ccna实验手册互联神州认证配置

1、Eigrp MD5 认证配置:第一步:先配;R1(config)#key chain ?WORDKey-chain nameR1(config)#key chain hlsz*首先定义一个 key chain “链”,名字随便起,本地有意义.R1(config-keychain)#key ?Key identifierR1(config-keychain)#key 1 *定义”串”上的第一个,R1(config-keychain-key)#key-string cisco *这个”的名字,cisco”第二步:开启认证开关R1(config)#s 1R1(config-if)#ip authen

2、tication mode eigrp 100 md5 *开启认证开关R1(config-if)#ip authentication key-chain eigrp 100 hlsz *说白了就是拿哪串去R1#clear ip eigrp neighbors *清除掉邻居关系 R1#sh ip eigrp neighborsIP-EIGRP neighbors for pro对方的提示信息: R2#s 100 *查看邻居关系已经起不来了00:17:03: %DUAL-5-NBRCHANGE: IP-EIGRP 100: Neighbor 12.1.1.1 (Serial1)down: Auth

3、 failureis同样,R2 上也作相应的配置R2(config)#key chain ccna R2(config-keychain)#key 1R2(config-keychain-key)#key-string cisco R2(config-if)#ip authentication mode eigrp 100 md5R2(config-if)#ip authentication key-chain eigrp 100 ccna R2#00:24:22: %DUAL-5-NBRCHANGE: IP-EIGRP 100: Neighbor 12.1.1.1 (Serial1) is

4、up:new adjacency *刚打上这条命令,即提示邻居建立完成当邻居建立不成功时的基本排错方法先 show run,因为以前邻居是起来的,现在起不来,肯定不是接口,看配置文件从这里可以看出,两边,第一个cisco 后面多了一个空格,在运算的时候,会把这个”空格”也当拿去哈希,所以造成不一致,认证失败.这个在CRT中还可以很容易看出来,如果用超级终端,一选择就整个变蓝了.看不出来.但还可以用另外一种办法:R1#sh key chain Key-chain hlsz:key 1 - text ciscoaccept lifetime (always valid) - (always val

5、id) valid now send lifetime (always valid) - (always valid) valid nowR2#sh key chain Key-chain ccna:key 1 - text cisco accept lifetime (always valid) - (always valid) valid now send lifetime (always valid) - (always valid) valid now这里就很明显看到多了一个字符,经常有一不就多输入一个空格,一定要.R2#00:54:53: EIGRP: SendingO on Loa

6、ck000:54:53:AS 100, Flags 0 x0, Seq 0/0 idbQ 0/0 iidbQ un/rely 0/000:54:53: EIGRP: ReceivedO on Loack0 nbr 2.2.2.200:54:53:AS 100, Flags 0 x0, Seq 0/0 idbQ 0/000:54:53: EIGRP: Packet from ourselves ignored00:54:54: EIGRP: SendingO on Serial100:54:54:R2#AS 100, Flags 0 x0, Seq 0/0 idbQ 0/0 iidbQ un/r

7、ely 0/000:54:55: EIGRP: pkt key id = 1, authentication mismatch00:54:55: EIGRP: Serial1: ignored packet from 12.1.1.1, opcode authentication)= 5 (invalid不同时间用不时的 key-stringR2(config-keychain-key)#key-string cisco R2(config-keychain-key)#accept-lifetime修改后的配置以前正确运行时的配置key 1key-stringkeyaccept-lifetime 04:00:00 Jan 1 2006 infinitesend-lifetime 04:00:00 Jan 1 2006 04:01:00 Jan 1 2006key 2key-string secondkeyaccept-lifetime 05:00:00 Jan 1 2006 infinites