Learn OSPF(Open Short Path First) routing to day

Editor's Notes

• #14: Step 1: Enable the OSPF process on the router using the router ospf command. The process-id is an internally used number to identify the OSPF routing process. The process ID does not need to match process IDs on other routers. Running multiple OSPF processes on the same router is not recommended because it creates multiple database instances that add extra overhead. However, if you are routing for multiple VPN routing and forwarding instances, the each VRF needs its own routing process. The vrf vpn-name option specifies the name of the VPN routing and forwarding (VRF) instance to associate with OSPF VRF processes. For more information on configuring VRF and OSPF refer to the following Cisco link: http://www.cisco.com/en/US/products/ps6350/products_configuration_guide_chapter09186a008045577b.html Step 2: Identify which interfaces on the router are part of the OSPF process, using the network command, as shown in the figure. We are all familiar with this command. The ip ospf process-id area area-id interface command is a completely new command starting with Cisco IOS Release 12.3(11)T. With this command, you can enable OSPF directly on an interface, which simplifies the configuration of unnumbered interfaces. Because the command is configured explicitly for the interface, it will take precedence over the network area command. The secondaries none option will prevent secondary IP addresses on the interface from being advertised.
• #21: We are already familiar with how to configure a basic virtual link. Simply use the area area-id virtual-link router-id router configuration command on each side of the link to define an OSPF virtual link. However, notice all the optional parameters that we can configure for the virtual link. If necessary for the virtual link, authentication and timing intervals must be configured here because the link is virtual. The equivalent ip ospf commands on the physical interface will not apply to traffic on the virtual link.
• #26: The figure shows the network used to illustrate the configuration, verification, and troubleshooting of simple password authentication in the next few slides. The configuration of the R1 router is shown in this figure as well. Simple password authentication is configured on interface serial 0/0/1 with the ip ospf authentication command. The interface is configured with an authentication key of plainpas.
• #27: Simple password authentication is configured on interface serial 0/0/1 with the ip ospf authentication command. The interface is configured with an authentication key of plainpas. Notice that the connecting interfaces on both R1 and R2 are configured for the same type of authentication with the same authentication key.
• #28: The figure shows the output of the show ip ospf neighbor and show ip route commands. The neighbor state is FULL, indicating that the two routers have successfully formed an OSPF adjacency. The routing table verifies that the 10.2.2.2 address has been learned via OSPF over the serial connection. The results of a ping to the R2 loopback interface address is also displayed to illustrate that the link is working.
• #29: MD5 authentication involved a 2-step process. To configure OSPF MD5 authentication, complete the following steps: Assign a key ID and key to be used with neighboring routers that are using the OSPF MD5 authentication, using the ip ospf message-digest-key command, as shown in the figure. The key and the key-id specified in this command are used to generate a message digest (also called a hash) of each OSPF packet; the message digest is appended to the packet. A separate password can be assigned to each network on a per-interface basis. The key-id allows for uninterrupted transitions between keys, which is helpful for administrators who wish to change the OSPF password without disrupting communication. The router will stop sending duplicate packets once it detects that all of its neighbors have adopted the new key. The process of changing keys is as follows. Suppose the current configuration is as follows: interface FastEthernet 0/0  ip ospf message-digest-key 100 md5 OLD Change the configuration to the following: interface FastEthernet 0/0  ip ospf message-digest-key 101 md5 NEW The system assumes its neighbors do not have the new key yet, so it begins a rollover process. Rollover allows neighboring routers to continue communication while the network administrator is updating them with the new key. Rollover stops once the local system finds that all its neighbors know the new key. The system detects that a neighbor has the new key when it receives packets from the neighbor authenticated by the new key. Cisco recommends that you not keep more than one key per interface. Every time you add a new key, you should remove the old key to prevent the local system from continuing to communicate with a hostile system that knows the old key. Specify the authentication type using the ip ospf authentication command as shown in the figure. The parameters for this command are as described in the previous topic. For MD5 authentication, use the ip ospf authentication command with the message-digest parameter. Before using this command, configure the message digest key for the interface with the ip ospf message-digest-key command. Recall that the ip ospf authentication command was introduced in Cisco IOS Software Release 12.0. As it is for simple password authentication, the MD5 authentication type for an area is still supported using the area area-id authentication message-digest router configuration command, for backward compatibility. NOTE: Limit to interfaces where attacks are possible