33. BGP Neighbor Authentication

1、掌握其于MD5的BGP对等体认证配置。

网络图：

配置各路由器IP地址等基本信息，测试互连可达。

配置正确的BGP。

查看R1和R2的路由表：

R1>show ip route
Gateway of last resort is not set

     172.16.0.0/24 is subnetted, 1 subnets
C       172.16.1.0 is directly connected, Loopback0
     10.0.0.0/30 is subnetted, 1 subnets
C       10.1.255.0 is directly connected, Serial0/0
B    192.168.1.0/24 [20/0] via 10.1.255.2, 00:05:44

R2>show ip route
Gateway of last resort is not set

     172.16.0.0/24 is subnetted, 1 subnets
B       172.16.1.0 [20/0] via 10.1.255.1, 00:06:42
     10.0.0.0/30 is subnetted, 1 subnets
C       10.1.255.0 is directly connected, Serial0/0
C    192.168.1.0/24 is directly connected, Loopback0

在R1上配置BGP认证：

R1(config)#router bgp 64512
R1(config-router)#neighbor 10.1.255.2 password xiaoyang ---->指定邻居指定密码
R1(config-router)#exit

配置完后R1立即提示下列信息：

*Mar 1 00:10:16.159: %TCP-6-BADAUTH: No MD5 digest from 10.1.255.2(179) to 10.1.255.1(16715)
*Mar 1 00:10:16.391: %TCP-6-BADAUTH: No MD5 digest from 10.1.255.2(179) to 10.1.255.1(16715)
*Mar 1 00:10:16.851: %TCP-6-BADAUTH: No MD5 digest from 10.1.255.2(179) to 10.1.255.1(16715)
*Mar 1 00:10:16.903: %TCP-6-BADAUTH: No MD5 digest from 10.1.255.2(179) to 10.1.255.1(16715)

R2使用其TCP的179端口与本地的16715端口建立BGP会话，没有携带MD5密钥认证不通过。

查看R1和R2的路由表和BGP的数据库：

R1#show ip route
Gateway of last resort is not set

     172.16.0.0/24 is subnetted, 1 subnets
C       172.16.1.0 is directly connected, Loopback0
     10.0.0.0/30 is subnetted, 1 subnets
C       10.1.255.0 is directly connected, Serial0/0
R1#show ip bgp
BGP table version is 4, local router ID is 172.16.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path
*> 172.16.1.0/24 0.0.0.0 0 32768 i

R2#show ip route
Gateway of last resort is not set

     10.0.0.0/30 is subnetted, 1 subnets
C       10.1.255.0 is directly connected, Serial0/0
C    192.168.1.0/24 is directly connected, Loopback0
R2#show ip bgp
BGP table version is 4, local router ID is 192.168.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path
*> 192.168.1.0 0.0.0.0 0 32768 i

--->此时R1和R2的BGP协议已经释放了之前学习到的BGP路由。

查看R2的汇总信息：

R2#show ip bgp summary
BGP router identifier 192.168.1.1, local AS number 64513
BGP table version is 4, main routing table version 4
1 network entries using 117 bytes of memory
1 path entries using 52 bytes of memory
2/1 BGP path/bestpath attribute entries using 248 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 417 total bytes of memory
BGP activity 2/1 prefixes, 2/1 paths, scan interval 60 secs

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd
10.1.255.1 4 64512 16 16 0 0 0 00:11:11 Active

---->认证不过，BGP邻居不能建立

在R2上也配置认证:

R2(config)#router bgp 64513
R2(config-router)#neighbor 10.1.255.1 password xiaoyang
R2(config-router)#end

*Mar 1 00:25:53.307: %BGP-5-ADJCHANGE: neighbor 10.1.255.1 Up

最后的日志信息说明邻居已经正常建立。

此时所有的邻居和路由等信息又会恢复正常。