Cabletron Systems SmartSwitch 8-slot, Руководство пользователя

Страница: 80 / 150

Chapter 6: Routing Policy Configuration Guide
6 - 8 SSR User Reference Manual
A route may only contribute to an aggregate route that is more general than itself; it
must match the aggregate under its mask. Any given route may only contribute to one
aggregate route, which will be the most specific configured, but an aggregate route
may contribute to a more general aggregate.
An aggregate-route only comes into existence if at least one of its contributing routes
is active.
Authentication
Authentication guarantees that routing information is only imported from trusted
routers. Many protocols like RIP V2 and OSPF provide mechanisms for authenticating
protocol exchanges. A variety of authentication schemes can be used. Authentication
has two components – an Authentication Method and an Authentication Key. Many
protocols allow different authentication methods and keys to be used in different parts
of the network.
Authentication Methods
There are mainly two authentication methods:
Simple Password: In this method, an authentication key of up to 8 characters is
included in the packet. If this does not match what is expected, the packet is discarded.
This method provides little security, as it is possible to learn the authentication key by
watching the protocol packets.
MD5: This method uses the MD5 algorithm to create a crypto-checksum of the
protocol packet and an authentication key of up to 16 characters. The transmitted
packet does not contain the authentication key itself, instead it contains a crypto-
checksum, called the digest. The receiving router performs a calculation using the
correct authentication key and discard the packet if the digest does not match. In
addition, a sequence number is maintained to prevent the replay of older packets. This
method provides a much stronger assurance that routing data originated from a router
with a valid authentication key.
Many protocols allow the specification of two authentication keys per interface.
Packets are always sent using the primary keys, but received packets are checked with
both the primary and secondary keys before being discarded.
Authentication Keys and Key Management
An authentication key permits generation and verification of the authentication field in
protocol packets. In many situations, the same primary and secondary keys are used on
several interfaces of a router. For ease of management of keys, a concept of key-chain
is introduced. Each key-chain has an identifier and contains up to two keys. One of
keys is the primary key and other is the secondary key. Outgoing packets use the
primary authentication key, but incoming packets may match either the primary or