Implementing Cisco IP Routing (642-902 ROUTE) Tutorials
Advanced EIGRP / Lab 4 - EIGRP Authentication pt. 1
Visitors to VTC.com will be able to view all introductory videos for each training course.
Free Trial Members will gain access to first three chapters for each training course.
Full Access Members have full access to VTC.com�s entire library of video tutorials.
Learn More
Subtitles of the Movie (Implementing Cisco IP Routing (642-902 ROUTE) / Advanced EIGRP / Lab 4 - EIGRP Authentication pt. 1)
Welcome in to the EIGRP Authentication Configuration Lab. In this lab we're going to take a very simple Network Configuration and we're going to configure Authentication on that Network Topology and push out the Keyrings and the Authentication configuration to all of the various routers and we'll see what happens as we do this. Now we have a very simple lab set up here in GNS3 and this lab is available as part of the Work Files. One little thing to note on this lab is that Amestris is set up as an NTP Master, so my recommendation if you're playing along at home is to boot up the Amestris Router, set the date and time manually using the Clock Set Command in the IOS, wait a few seconds and then turn on the Drachma and the Xing Routers. Now obviously before you can set up EIGRP Authentication you have to have a functioning EIGRP environment. For the sake of time we won't go through how to configure that, but basically you look in your routing table, you look in your EIGRP Neighbors table and Topology table, make sure that you're seeing all of the routers, you're getting the routes how you expect them, you can ping back and forth, like I said, we've gone through all of that in the previous labs and so we won't rehash that here. So the first thing we'll do is we'll hit at the Asmestris Router and we'll dive right in, we'll configure the Key Chain and configure the keys within the key chain and then we'll copy that config out to the other two routers just so the config is exactly the same on all of them. Again that's one of the best practices or at least it's one of my best practices, so that way you don't have any confusion over when the keys expire, what the key, what the key string is and so on and so forth. So the first thing we do is, we Enable and we go into Config Mode and we're going to say Key Chain and we have to give it a name. In this case we'll name it Auth1. Now we're in Key Chain Config Mode, if we hit Question Mark you see there's not many things we can do, we can default some of the commands but there's no commands really to default until you go into Key Configuration Mode. So we'll do key one, I just can't type today and now we're in Key Configuration Mode and there are a couple of other commands now that we're in Key Configuration Mode. The first one you'll want to look at is the key string and that is anything from a single letter or a single number up to I think, its 250 characters is the upper limit for this. Obviously the longer and more complex this key string is, the harder it's going to be to guess. So you need to make it something fairly obscure, you don't need to make like Cisco one which is what we're going to set it to here in our lab, since it is a lab environment. So in this case we'll do key string, Cisco one and now we're going to set an Accept and a Send Lifetime on this particular key. Now you might be asking yourself, well why do we have a Send Lifetime and an Accept Lifetime? Why would I want to accept a key that I'm not actually sending out? And the short answer is time drift. Now let's say you have a key that you want to expire at 9 am on December 24th, if our networks going to break, it's going to break at the most inconvenient moment possible. So we're going to expire this key on December 24th, 2011 at 9 am. If you have routers out in the field who's clocks are off by a few minutes, then if you do not send that key and you do not accept that key after 9 am on December 24th, then you may have a little bit of a time where the routers at the remote sites will send their EIGRP updates using this key, because to them it hasn't hit nine o'clock here but here at the central sites, since it's after nine o'clock, we're not accepting it and so you'll have a bit of a time where your routing doesn't work properly. So generally I'll set an Accept Lifetime that's you know, an hour longer than the Send Lifetime just so you have a little bit overlap. You don't have any situation where routing updates won't take place in a timely manner. In this case, we will set the Send Lifetime. Now this is the first key in the key chain, I always set a time that is in the past, that way I know I don't have to wait for this Key Chain or this key material to take effect at some point in the future. In this case, I'm going to set it to 12:01 am on January 1st, 2000. Hopefully that's far enough in the past that none of your routers will, will have that set as their current time. So in this case, we'll do 00-01-00. It wants the day of the month to start so we'll do 1 January and you can't specify a year earlier than 1993 so we'll say 2000. Now it wants to know the time to stop. You can set that as a duration meaning you know five years or 20 days or whatever you want or you can specify an exact date and time to stop. In this case we've already decided on 9 am on December 24th, 2011. So we'll put in 09:00 :00 and we hit 24 Dec 2011 and that's it. So that is the Send Lifetime. We're going to set the Accept Lifetime to be pretty much the same except we're going to set it to be 10 am on December 24th. So we'll just hit up arrow, we'll go up here and change the send to accept, Accept Lifetime to the same thing, except we'll say 10. So now we've got our Key Chain configured, we've got one of our keys configured. So we'll exit all the way out of Config Mode and we'll go ahead and write this config just to be overly paranoid here and we'll continue with our Authentication configuration set up in the next video.
Tutorial Information
| Course: | Implementing Cisco IP Routing (642-902 ROUTE) |
| Author: | Greg Dickinson |
| SKU: | 34291 |
| ISBN: | 978-1-61866-028-2 |
| Release Date: | 2011-12-28 |
| Duration: | 10 hrs / 105 lessons |
| Work Files: |
Yes |
| Captions: | No |
| Compatibility: |
Vista/XP/2000, OS X, Linux QuickTime 7, Flash 8 |
VTC Sign up & Benefits
- Unlimited Access
- 81,350 Video Tutorials (14,200 free)
- Video Available as Flash or QuickTime
- Over 715 Courses
- $30 for One Month Access
- Multi-User Discounts Available
