Scribd Logo
Upload

Welcome to Scribd!

  • 22 views

    LDP md5

    Uploaded by

    kyi lwin
    1. The document discusses enabling authentication between two LDP peers using MD5 to verify the integrity of communications and authenticate message origins. 2. MD5 authentication uses a shared password between peers, and sessions will only be established if the same password is configured on both sides. 3. The show mpls ldp neighbor command can confirm if a session was successfully established based on whether MD5 is listed as being used.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    LDP md5

    Uploaded by

    kyi lwin
    22 views4 pages
    1. The document discusses enabling authentication between two LDP peers using MD5 to verify the integrity of communications and authenticate message origins. 2. MD5 authentication uses a shared password between peers, and sessions will only be established if the same password is configured on both sides. 3. The show mpls ldp neighbor command can confirm if a session was successfully established based on whether MD5 is listed as being used.

    Original Title

    ldp md5

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    1. The document discusses enabling authentication between two LDP peers using MD5 to verify the integrity of communications and authenticate message origins. 2. MD5 authentication uses a shared password between peers, and sessions will only be established if the same password is configured on both sides. 3. The show mpls ldp neighbor command can confirm if a session was successfully established based on whether MD5 is listed as being used.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    22 views4 pages

    LDP md5

    Uploaded by

    kyi lwin
    1. The document discusses enabling authentication between two LDP peers using MD5 to verify the integrity of communications and authenticate message origins. 2. MD5 authentication uses a shared password between peers, and sessions will only be established if the same password is configured on both sides. 3. The show mpls ldp neighbor command can confirm if a session was successfully established based on whether MD5 is listed as being used.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 4

    Protecting Data Between LDP Peers with MD5 Authentication

    You can enable authentication between two LDP peers, which verifies each segment sent on the TCP
    connection between the peers. You must configure authentication on both LDP peers using the same
    password; otherwise, the peer session is not established.
    Authentication uses the Message Digest 5 (MD5) algorithm to verify the integrity of the communication
    and authenticate the origin of the message.
    To enable authentication, issue the mpls ldp neighbor command with the password keyword. This
    causes the router to generate an MD5 digest for every segment sent on the TCP connection and check
    the MD5 digest for every segment received from the TCP connection.
    When you configure a password for an LDP neighbor, the router tears down existing LDP sessions and
    establishes new sessions with the neighbor.
    If a router has a password configured for a neighbor, but the neighboring router does not have a password
    configured, a message such as the following appears on the console who has a password configured
    while the two routers attempt to establish an LDP session. The LDP session is not established.
    %TCP-6-BADAUTH: No MD5 digest from [peer's IP address](11003) to [local router's IP
    address](646)
    Similarly, if the two routers have different passwords configured, a message such as the following
    appears on the console. The LDP session is not established.
    %TCP-6-BADAUTH: Invalid MD5 digest from [peer's IP address](11004) to [local router's IP
    address](646)

    SUMMARY STEPS

    1. enable
    2. configure terminal
    3. mpls ip
    4. mpls label protocol {ldp | tdp | both}
    5. mpls ldp neighbor [vrf vpn-name] ip-address [password [0-7] password-string]
    6. show mpls ldp neighbor [[vrf vpn-name] [address | interface] [detail] | [all]]

    DETAILED STEPS

    Command or Action Purpose


    Step 1 enable Enables privileged EXEC mode.
    • Enter your password if prompted.
    Example:
    Router> enable
    Step 2 configure terminal Enters global configuration mode.

    Example:
    Router# configure terminal

    Cisco IOS Release 12.4(5)


    1
    Command or Action Purpose
    Step 3 mpls ip Configures MPLS hop-by-hop forwarding globally.
    • The mpls ip command is enabled by default; you do not
    Example: have to specify this command.
    Router(config)# mpls ip
    • Globally enabling MPLS forwarding does not enable it
    on the router interfaces. You must enable MPLS
    forwarding on the interfaces as well as for the router.
    Step 4 mpls label protocol {ldp | tdp | both} Configures the use of LDP on all interfaces. LDP is the
    default.
    Example: • If you set all interfaces globally to LDP, you can
    Router(config)# mpls label protocol ldp override specific interfaces with either the tdp or both
    keyword by specifying the command in interface
    configuration mode.
    Step 5 mpls ldp neighbor [vrf vpn-name] ip-address Specifies authentication between two LDP peers.
    [password [0-7] password-string]

    Example:
    Router(config)# mpls ldp neighbor 172.27.0.15
    password onethirty9
    Step 6 exit Exits global configuration mode and enters privileged
    EXEC mode.
    Example:
    Router(config)# exit
    Step 7 show mpls ldp neighbor [[vrf vpn-name] [address Displays the status of LDP sessions.
    | interface] [detail] | [all]]
    If the passwords have been set on both LDP peers and the
    passwords match, the show mpls ldp neighbor command
    Example: displays that the LDP session was successfully established.
    Router# show mpls ldp neighbor detail

    Examples
    The following example configures a router with the password cisco:
    Router> enable
    Router# configure terminal
    Router(config)# mpls ip
    Router(config)# mpls label protocol ldp
    Router(config)# mpls ldp neighbor 10.1.1.1 password cisco
    Router(config)# exit

    The following example shows that the LDP session between routers was successfully established:
    Router# show mpls ldp neighbor

    Peer LDP Ident: 10.1.1.2:0; Local LDP Ident 10.1.1.1:0


    TCP connection: 10.1.1.2.11118 - 10.1.1.1.646
    State: Oper; Msgs sent/rcvd: 12/11; Downstream
    Up time: 00:00:10
    LDP discovery sources:
    FastEthernet1/0, Src IP addr: 10.20.10.2
    Addresses bound to peer LDP Ident:
    10.1.1.2 10.20.20.1 10.20.10.2

    Cisco IOS Release 12.4(5)


    2
    The following show mpls ldp neighbor detail command shows that MD5 (shown in bold) is used for
    the LDP session.
    Router# show mpls ldp neighbor 10.0.0.21 detail

    Peer LDP Ident: 10.0.0.21:0; Local LDP Ident 10.0.0.22:0


    TCP connection: 10.0.0.21.646 - 10.0.0.22.14709; MD5 on
    State: Oper; Msgs sent/rcvd: 1020/1019; Downstream; Last TIB rev sent 2034
    Up time: 00:00:39; UID: 3; Peer Id 1;
    LDP discovery sources:
    FastEthernet1/1; Src IP addr: 172.16.1.1
    holdtime: 15000 ms, hello interval: 5000 ms
    Addresses bound to peer LDP Ident:
    10.0.0.21 10.0.38.28 10.88.88.2 172.16.0.1
    172.16.1.1
    Peer holdtime: 180000 ms; KA interval: 60000 ms; Peer state: estab

    CCSP, CCVP, the Cisco Square Bridge logo, Follow Me Browsing, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work,
    Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP,
    CCIE, CCIP, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital,
    the Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, FormShare, GigaDrive, GigaStack, HomeLink,
    Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, Linksys, MeetingPlace, MGX, the Networkers logo,
    Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, ProConnect, RateMUX, ScriptShare, SlideCast, SMARTnet,
    The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the
    United States and certain other countries.

    All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a
    partnership relationship between Cisco and any other company. (0601R)

    © 2005 Cisco Systems, Inc. All rights reserved.

    Cisco IOS Release 12.4(5)


    3
    Cisco IOS Release 12.4(5)
    4

    You might also like