Cisco EIGRP路由汇总与安全性配置

R1的loop1 ip和R3的loop1 ip这样设置是为了验证EIGRP协议支持不连续子网。
Ok，试验开始：
一．首先在器间EIGRP协议。
相信这个基本的步骤大家都熟记于心了。如有不会者请参看：CCNA配置试验之三 EIGRP协议的配置
二．验证EIGRP的自动功能;
在路由器间配置完EIGRP协议后，理应是全网全通的，可是如下所示：在R2上能ping通172.16.1.1却ping不通172.16.100.1
r2#ping 172.16.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/40/76 ms
r2#ping 172.16.100.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.100.1, timeout is 2 seconds:
U.U.U
Success rate is 0 percent (0/5)e
这是怎么回事呢？查看一下路由表，仔细一看，R2的路由表中没有172.16.100.0的信息。原因是EIGRP协议默认开启了自动汇总功能。172.16.1.1和172.16.100.1都汇总为172.16.0.0.路由器R2不知道该往那个方向传送数据包。
r2#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - , IA - inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

D 172.16.0.0/16 [90/2172416] via 192.168.2.2, 00:01:55, Serial0/1
[90/2172416] via 192.168.1.1, 00:01:55, Serial0/0
C 192.168.1.0/24 is directly connected, Serial0/0
C 192.168.2.0/24 is directly connected, Serial0/1
C 192.168.3.0/24 is directly connected, FastEthernet1/0ercent (0/5)
在所有路由器上关闭自动汇总功能，命令如下
r1(config-router)#no auto-summary
r2(config-router)#no auto-summary
r3(config-router)#no auto-summary

自动汇总关闭后让我们查看一下路由表，这次172.16.100.0的信息在路由表中显示出来了。
r2#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

172.16.0.0/24 is subnetted, 2 subnets
D 172.16.1.0 [90/2172416] via 192.168.1.1, 00:00:59, Serial0/0
D 172.16.100.0 [90/2172416] via 192.168.2.2, 00:00:27, Serial0/1
C 192.168.1.0/24 is directly connected, Serial0/0
C 192.168.2.0/24 is directly connected, Serial0/1
C 192.168.3.0/24 is directly connected, FastEthernet1/0

试着看能ping通172.16.1.1和172.16.100.1吗？哈哈，成功通讯……
r2#ping 172.16.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/48/116 ms
r2#ping 172.16.100.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/35/96 ms


路由协议配置完成了，相互之间也能正常通讯了，是不是已经万事大吉了呢？NO，如果有人在这个网络内新加进一台AS号相同的路由器就能和网络内的其他路由器相互交换信息，从而窃取一些重要信息，进而攻击我们的网络。
那我们能做些什么呢？答案是：在路由器间配置EIGRP认证。
三 使用EIGRP认证，使路由环境更安全;
首先我们在路由器R1的S0/1、路由器R2的S0/1和S0/2端口上配置EIGRP认证。密码都为cisco
注意，EIGRP认证要配置在路由器的出口上。而且所有的密码必须相同！
R1
r1(config)#key chain 11 定义密钥名称
r1(config-keychain)#key 1 定义密钥个数，此例我们使用一个密码
r1(config-keychain-key)#key-string cisco 定义密码为cisco
r1(config-keychain-key)#exit
r1(config-keychain)#exit
r1(config)#int s0/01在接口下启用认证，并定义要使用的钥匙链
r1(config-if)#ip authentication key-chain eigrp 100 11
r1(config-if)#ip authentication mode eigrp 100 md5 使用MD5加密

R2

r2(config)#key chain 22
r2(config-keychain)#key 1
r2(config-keychain-key)#key-string cisco
r2(config-keychain-key)#exi
r2(config-keychain)#exi
r2(config)#int s0/1
r2(config-if)#ip authentication key-chain eigrp 100 22
r2(config-if)#ip authentication mode eigrp 100 md5

r2(config)#key chain 33
r2(config-keychain)#key 1
r2(config-keychain-key)#key-string cisco
r2(config-keychain-key)#exit
r2(config-keychain)#exit
r2(config)#int s0/2
r2(config-if)#ip authentication key-chain eigrp 100 33
r2(config-if)#ip authentication mode eigrp 100 md5

完成EIGRP认证的配置后，查看路由器的路由表。
R1和R2的路由表中没有了172.16.100.0网段的信息。R3的路由表中也没有了R1和R2的信息。
R1
r1#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

172.16.0.0/24 is subnetted, 1 subnets
C 172.16.1.0 is directly connected, FastEthernet1/0
C 192.168.1.0/24 is directly connected, Serial0/0
D 192.168.2.0/24 [90/2681856] via 192.168.1.2, 00:02:33, Serial0/0
D 192.168.3.0/24 [90/2172416] via 192.168.1.2, 00:02:33, Serial0/0

R2

r2#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

172.16.0.0/24 is subnetted, 1 subnets
D 172.16.1.0 [90/2172416] via 192.168.1.1, 00:07:42, Serial0/0
C 192.168.1.0/24 is directly connected, Serial0/0
C 192.168.2.0/24 is directly connected, Serial0/1
C 192.168.3.0/24 is directly connected, FastEthernet1/0

R3

r3#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

172.16.0.0/24 is subnetted, 1 subnets
C 172.16.100.0 is directly connected, FastEthernet1/0
C 192.168.2.0/24 is directly connected, Serial0/1

这表明我们的试验已经快要成功了。因为我们只在R1和R2上配置了EIGRP认证。如果别的路由器想加入通信，必须也配置EIGRP认证，而且密码必须相同。
好了，我们让R3加入通信吧！在R3的出口配置EIGRP认证。方法如上。在次不再复述。
配置完EIGRP认证后，查看路由表。如下所示，在R3的路由表中出现了R1和R2的信息。
r3#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

172.16.0.0/24 is subnetted, 2 subnets
D 172.16.1.0 [90/2684416] via 192.168.2.1, 00:00:15, Serial0/1
C 172.16.100.0 is directly connected, FastEthernet1/0
D 192.168.1.0/24 [90/2681856] via 192.168.2.1, 00:00:15, Serial0/1
C 192.168.2.0/24 is directly connected, Serial0/1
D 192.168.3.0/24 [90/2172416] via 192.168.2.1, 00:00:15, Serial0/1

怎么样这个方法很实用很安全吧！

四．EIGRP的手动汇总功能：

EIGRP还支持手动汇总，汇总命令如下：（同样是在出口上配置）
（config-if）#ip summary-address eigrp AS号 汇总后的ip 汇总后的网络掩码
使用手动汇总可以自己配置汇总地址，这样一来，我们就能很轻松的记住汇总前的地址。很方便吧！

五．使用抑制传播的方法，减少网络带宽的使用率;

怎样能减少网络带宽使用率，提高使用效率呢？
抑制传播。路由器的内部一般接交换机、PC机，交换机和PC机没有必要接收接收路由宣告。因此我们抑制路由宣告向内网传播就能减少网络带宽的使用率！
具体配置如下：（在路由器的内网接口上配置）
(config-router)#passive-interface f1/0