INTRODUCTION :
The Authentication Process For RIP v2 Announcements Uses The First Route Entry In The RIP Message To Store Authentication Information. The First Route Entry Must Be Used, Leaving A Maximum Of 24 Routes In A RIP V2 Authenticated Announcement.
RIP-2 Provides For Unauthenticated Service (As In Classical RIP), Or Password Authentication. Both Are Vulnerable To Passive Attacks Currently Widespread In The Internet. Well-Understood Security Issues Exist In Routing Protocols. Clear Text Passwords, Currently Specified For Use With RIP-2, Are No Longer Considered Sufficient.
If Authentication Is Disabled, Then Only Simple Misconfigurations Are Detected. Simple Passwords Transmitted In The Clear Will Further Protect Against The Honest Neighbor, But Are Useless In The General Case. By Simply Capturing Information On The Wire - Straightforward Even In A Remote Environment - A Hostile Process Can Learn The Password And Overcome The Network.
We Propose That RIP-2 Use An Authentication Algorithm, As Was Originally Proposed For SNMP Version 2, Augmented By A Sequence Number. Keyed MD5 Is Proposed As The Standard Authentication Algorithm For RIP-2, But The Mechanism Is Intended To Be Algorithm- Independent.
RIP AUTHENTICATION :
RIP v2 Supports the Use of Authentication Mechanisms to Verify the Origin of Incoming RIP Announcements. Simple Password Authentication Was Defined In RFC 1723, But Newer Authentication Mechanisms Such As Message Digest 5 (MD5) Are Available.
NOTE :RIP Version 1 Does Not Support Authentication. If You Are Sending And Receiving RIP Version 2 Packets, You Can Enable RIP Authentication On An Interface.
The Key Chain Determines The Set Of Keys That Can Be Used On The Interface. If A Key Chain Is Not Configured, No Authentication Is Performed On That Interface, Not Even The Default Authentication.
Therefore, You Must Also Perform The Tasks In The Section "Manage Authentication Keys" In The "Configuring IP Routing Protocol-Independent Features" Chapter.
Two Modes Of Authentication On An Interface For Which Rip Authentication Is Enabled:
The Default Authentication In Every RIP Version 2 Packet Is Plain Text Authentication.
CONFIGURATIONS STEPS AS FOLLOW IN RIP v2 :
1. Define A Key Chain With A Name.
Note: The Key Chain Determines The Set Of Keys That Can Be Used On The Interface. If A Key Chain Is Not Configured, No Authentication Is Performed On That Interface.
2. Define The Key Or Keys On The Key Chain.
3. Specify The Password Or Key-String To Be Used In The Key.
This Is The Authentication String That Must Be Sent And Received In The Packets Using The Routing Protocol Being Authenticated. (In The Example Given Below, The Value Of The String Is 234.)
4. Enable Authentication On An Interface And Specify The Key Chain To Be Used.
Since Authentication Is Enabled On A Per Interface Basis, A Router Running Ripv2 Can Be Configured For Authentication On Certain Interfaces And Can Operate Without Any Authentication On Other Interfaces.
5. Specify Whether The Interface Will Use Plain Text Or MD5 Authentication.
The Default Authentication Used In Ripv2 Is Plain Text Authentication, When Authentication Is Enabled In The Previous Step. So, If Using Plain Text Authentication, This Step Is Not Required.
6. Configure Key Management (This Step Is Optional).
CONFIGURATION EXAMPLE :
STEP 1:
IP RIP Authentication Key-Chain Name-Of-Chain - > Enable Rip Authentication.
STEP 2:
IP RIP Authentication Mode {Text | MD5} - > Configure The Interface To Use Md5 Digest Authentication (Or Let It Default To Plain Text Authentication).
RIP AUTHENTICATION (Interface Command) :
# IP RIP AUTHENTICATION MODE MD5
# NO IP RIP AUTHENTICATION MODE MD5
SET THE INTERFACE WITH RIPV2 MD5 AUTHENTICATION.
#IP RIP AUTHENTICATION MODE TEXT
#NO IP RIP AUTHENTICATION MODE TEXT
SET THE INTERFACE WITH RIPV2 SIMPLE PASSWORD AUTHENTICATION.
#IP RIP AUTHENTICATION STRING STRING
#NO IP RIP AUTHENTICATION STRING STRING
RIP VERSION 2 HAS SIMPLE TEXT AUTHENTICATION. THIS COMMAND SETS AUTHENTICATION STRING. THE STRING MUST BE SHORTER THAN 16 CHARACTERS.
#IP RIP AUTHENTICATION KEY-CHAIN KEY-CHAIN
#NO IP RIP AUTHENTICATION KEY-CHAIN KEY-CHAIN
DISABLE ROUTE SUMMARIZATION:
By Default RIP Version 2 Supports Automatic Route Summarization. The Software Summarizes Subprefixes To The Classful Network Boundary When Crossing Classful Network Boundaries.
If You Have Disconnected Subnets, Disable Automatic Route Summarization To Advertise The Subnets. When Route Summarization Is Disabled, The Software Transmits Subnet And Host Routing Information Across Classful Network Boundaries. To Disable Automatic Summarization.
No Auto-Summary - > Disable Automatic Summarization.
DISABLE THE VALIDATION OF SOURCE IP ADDRESSES
By Default, The Software Validates The Source IP Address Of Incoming RIP Routing Updates. If That Source Address Is Not Valid, The Software Discards The Routing Update.
You Might Want To Disable This Feature If You Have A Router That Is "Off Network" And You Want To Receive Its Updates. However, Disabling This Feature Is Not Recommended Under Normal Circumstances.
No Validate-Update-Source
Disable The Validation Of The Source IP Address Of Incoming RIP Routing Updates.
CONFIGURE:
CONFIGURING PLAIN TEXT AUTHENTICATION :
One Of The Two Ways In Which RIP Updates Can Be Authenticated Is Using Plain Text Authentication. This Can Be Configured As Shown In The Tables Below.CLEAR TEXT - ON ROUTER 1 :
Key Chain Kal
!--- Name A Key Chain. A Key Chain May Contain More Than One Key For Added Security.
!--- It Need Not Be Identical On The Remote Router.
Key 1
!--- This Is The Identification Number Of An Authentication Key On A Key Chain.
!--- It Need Not Be Identical On The Remote Router.
Key-String 234
!--- The Actual Password Or Key-String.
!--- It Needs To Be Identical To The Key-String On The Remote Router.
!
Interface Loopback0
Ip Address 70.70.70.70 255.255.255.255
!
Interface Serial0
Ip Address 141.108.0.10 255.255.255.252
Ip Rip Authentication Key-Chain Kal
!--- Enables Authentication On The Interface And Configures
!--- The Key Chain That Will Be Used.
!
Router Rip
Version 2
Network 141.108.0.0
Network 70.0.0.0
CLEAR TEXT - ON ROUTER 2:
Key Chain Kal
Key 1
Key-String 234
!
Interface Loopback0
Ip Address 80.80.80.1 255.255.255.0
!
Interface Serial0
Ip Address 141.108.0.9 255.255.255.252
Ip Rip Authentication Key-Chain Kal
Clockrate 64000
!
Router Rip
Version 2
Network 141.108.0.0
Network 80.0.0.0
CONFIGURING MD5 AUTHENTICATION :
MD5 Authentication Is An Optional Authentication Mode Added By Cisco To The Original RFC 1723-Defined Plain Text Authentication. The Configuration Is Identical To That For Plain Text Authentication, Except For The Use Of The Additional Command IP RIP Authentication Mode MD5 .
Users Must Configure Router Interfaces On Both Sides Of The Link For The MD5 Authentication Method, Making Sure The Key Number And Key String Match On Both Sides.
MD5 - ON ROUTER A:
Key Chain Kal
!--- Need Not Be Identical On The Remote Router.
Key 1
!--- Needs To Be Identical On Remote Router.
Key-String 234
!--- Needs To Be Identical To The Key-String On The Remote Router.
!
Interface Loopback0
Ip Address 70.70.70.70 255.255.255.255
!
Interface Serial0
Ip Address 141.108.0.10 255.255.255.252
Ip Rip Authentication Mode Md5
!--- Specifies The Type Of Authentication Used
!--- In Ripv2 Packets.
!--- Needs To Be Identical On Remote Router.
!-- To Restore Clear Text Authentication, Use The No Form Of This Command.
Ip Rip Authentication Key-Chain Kal
!
Router Rip
Version 2
Network 141.108.0.0
Network 70.0.0.0
MD5 - ON ROUTER B:
Key Chain Kal
Key 1
Key-String 234
!
Interface Loopback0
Ip Address 80.80.80.1 255.255.255.0
!
Interface Serial0
Ip Address 141.108.0.9 255.255.255.252
Ip Rip Authentication Mode Md5
Ip Rip Authentication Key-Chain Kal
Clockrate 64000
!
Router Rip
Version 2
Network 141.108.0.0
Network 80.0.0.0
VERIFY:
Verifying Plain Text Authentication
This Section Provides Information To Confirm Your Configuration Is Working Properly.
By Configuring The Routers As Shown Above, All Routing Update Exchanges Will Be Authenticated Before Being Accepted. This Can Be Verified By Observing The Output Obtained From The DEBUG IP RIP And SHOW IP ROUTE Commands.
NOTE: Before Issuing Debug Commands, Refer To Important Information On Debug Commands.
RB#Debug Ip Rip
RIP Protocol Debugging Is On
*Mar 3 02:11:39.207: RIP: Received Packet With Text Authentication 234
*Mar 3 02:11:39.211: RIP: Received V2 Update From 141.108.0.10 On Serial0
*Mar 3 02:11:39.211: RIP: 70.0.0.0/8 Via 0.0.0.0 In 1 Hops
RB#Show Ip Route
R 70.0.0.0/8 [120/1] Via 141.108.0.10, 00:00:25, Serial0
80.0.0.0/24 Is Subnetted, 1 Subnets
C 80.80.80.0 Is Directly Connected, Loopback0
141.108.0.0/30 Is Subnetted, 1 Subnets
C 141.108.0.8 Is Directly Connected, Serial0
Using Plain Text Authentication Improves The Network Design By Preventing The Addition Of Routing Updates Originated By Routers Not Meant To Take Part In The Local Routing Exchange Process. However, This Type Of Authentication Is Not Secure.
The Password (234 In This Example) Is Exchanged In Plain Text. It Can Be Captured Easily And Thus Exploited. As Mentioned Before, MD5 Authentication Must Be Preferred Over Plain Text Authentication When Security Is An Issue.
VERIFYING MD5 AUTHENTICATION:
By Configuring The RA And RB Routers As Shown Above, All Routing Update Exchanges Will Be Authenticated Before Being Accepted. This Can Be Verified By Observing The Output Obtained From The DEBUG IP RIP And SHOW IP ROUTE Commands.
RB#Debug Ip Rip
RIP Protocol Debugging Is On
*Mar 3 20:48:37.046: RIP: Received Packet With MD5 Authentication
*Mar 3 20:48:37.046: RIP: Received V2 Update From 141.108.0.10 On Serial0
*Mar 3 20:48:37.050: 70.0.0.0/8 Via 0.0.0.0 In 1 Hops
RB#Show Ip Route
R 70.0.0.0/8 [120/1] Via 141.108.0.10, 00:00:03, Serial0
80.0.0.0/24 Is Subnetted, 1 Subnets
C 80.80.80.0 Is Directly Connected, Loopback0
141.108.0.0/30 Is Subnetted, 1 Subnets
C 141.108.0.8 Is Directly Connected, Serial0
MD5 Authentication Uses The One-Way, MD5 Hash Algorithm, Acknowledged To Be A Strong Hashing Algorithm. In This Mode Of Authentication, The Routing Update Does Not Carry The Password For The Purpose Of Authentication. Rather, A 128-Bit Message, Generated By Running The MD5 Algorithm On The Password, And The Message Are Sent Along For Authentication. Thus, It Is Recommended To Use MD5 Authentication Over Plain Text Authentication Since It Is More Secure.
THE FOLLOWING SET OF COMMANDS ENABLES PLAIN-TEXT RIP AUTHENTICATION :
Router 1 ----------------- Router 2
Router1#Configure Terminal
Enter Configuration Commands, One Per Line. End With Cntl/Z.
Router1(Config)#Key Chain Prem
Router1(Config-Keychain)#Key 1
Router1(Config-Keychain-Key)#Key-String CCNP
Router1(Config-Keychain-Key)#Exit
Router1(Config)#Interface Fastethernet0/0.1
Router1(Config-Subif)#Ip Rip Authentication Key-Chain Prem
Router1(Config-Subif)#Ip Rip Authentication Mode Text
Router1(Config-Subif)#Exit
Router1(Config)#End
Router1#
For Greater Security, Cisco Routers Can Also Use MD5-Based Authentication :
Router1#Configure Terminal
Enter Configuration Commands, One Per Line. End With Cntl/Z.
Router1(Config)#Key Chain Prem
Router1(Config-Keychain)#Key 1
Router1(Config-Keychain-Key)#Key-String CCNP
Router1(Config-Keychain-Key)#Exit
Router1(Config)#Interface Fastethernet0/0.1
Router1(Config-Subif)#Ip Rip Authentication Key-Chain Prem
Router1(Config-Subif)#Ip Rip Authentication Mode Md5
Router1(Config-Subif)#End
Router1#
DISCUSSION:
Rip Authentication Is One Of The Protocol Enhancements That Appeared In Version 2. It Is Not Available For Version 1.
The First Configuration Example In This Recipe Uses Plain-Text Authentication. In General, We Recommend Using The Md5 Authentication Because The Plain-Text Version Is Far Too Easy To Break.
If You Want To Set Up Authentication To Ensure That You Only Receive Updates From The Appropriate Devices, You Should Use The Safer MD5 Version. The Only Reason To Consider The Less Secure Plain-Text Version Is If Some Of The Rip Devices Cannot Support MD5.
Because The RFC For Rip Version 2 Only Describes Plain Text Authentication, Some Non-Cisco Devices Do Not Support MD5 Authentication.
Both Forms Of Rip Authentication Help To Ensure That Only Legitimate Network Equipment Is Allowed To Take Part In Rip Updates.
This Is Particularly Important If You Have Network Segments That Contain Foreign Devices That May Corrupt The Routing Tables. This Could Happen Because Of Malice, But It's Also Relatively Easy For A Misconfigured Unix Workstation Running The Routed Program To Cause Serious Routing Problems.
When You Enable Plain Text Authentication, The First Route Field In Each Update Packet Contains The Authentication String Instead Of A Route.
NOTE: That This Implies That Each Update Packet Can Then Hold A Maximum Of 24 Route Entries. Because The MD5 Authentication Scheme Carries More Information, It Uses The First And Last Route Fields In Each Update Packet. So This Leaves A Maximum Of 23 Route Entries Per Update Packet.
In The Example: You Can See That The Key Is Applied To An Interface. This Allows You To Specify A Different Key For Each Network Segment. However, There Is Nothing To Stop You From Using The Same Key On More Than One Interface, Or Even A Single Key Throughout The Network.
The Following Debug Traces Were Taken With Authentication Enabled. The First Trace Shows Plain-Text Authentication, And Includes The Password:
Router1#Debug Ip Rip
Rip Protocol Debugging Is On
Aug 12 02:08:03.386: Rip: Received Packet With Text Authentication Oreilly
Aug 12 02:08:03.390: Rip: Received V2 Update From 172.25.1.7 On Fastethernet0/0.1
CONCLUSION:
The Goal Of This Article Is To Give An Easy Way To Understand The “CISCO - BASIC RIP AUTHENTICATION.”Hope This Article Will Help Every Beginners Who Are Going To Start Cisco Lab Practice Without Any Doubts. Thank You And Best Of Luck.
This Article Written Author By: Premakumar Thevathasan. CCNA, CCNP, CCIP, MCSE, MCSA, MCSA - MSG, CIW Security Analyst, CompTIA Certified A+.
DISCLAIMER:
This Document Carries No Explicit Or Implied Warranty. Nor Is There Any Guarantee That The Information Contained In This Document Is Accurate. Every Effort Has Been Made To Make All Articles As Complete And As Accurate As Possible.
It Is Offered In The Hopes Of Helping Others, But You Use It At Your Own Risk. The Author Will Not Be Liable For Any Special, Incidental, Consequential Or Indirect Any Damages Due To Loss Of Data Or Any Other Reason That Occur As A Result Of Using This Document. But No Warranty Or Fitness Is Implied. The Information Provided Is On An "As Is" Basic. All Use Is Completely At Your Own Risk.
The School Of Cisco Networking (SCN)
No comments:
Post a Comment