RIPv2 Configuration

RIPv2 Configuration


  • Configure, verify, and troubleshoot RIPv2

The configuration for RIPv2 is practically identical to RIPv1. In other words, you still must enter the RIP routing process with the router rip command and still must advertise the directly connected classful networks. To enable RIPv2, you have to enter the command version 2 in the routing process:

By default, RIPv2 is classful. To configure this enhanced routing protocol to support classless routing updates, the only entry you need to configure is the no auto-summary command in the routing process:

After you configure this command, the RIP version 2 updates being multicast to are no longer be considered classful, because the subnet mask is advertised in the updates along with the network.

By default, RIP is configured to send version 1 and accept version 1 and 2 received updates. This means that routers that have not been changed to version 2 will still accept version 2 updates but will process them as version 1 (ignoring any subnet mask or authentication). Be sure to keep this in mind if you decide to revert your RIP configuration to version 1 by using the version 1 command. This command instructs the router to receive only version 1 updates, which causes version 2 updates to be treated as an illegal version and be ignored. To revert to the default RIP configuration, a better command to use is default version in the RIP routing process.

If a router is explicitly configured to run as version 1, RIP version 2 updates are considered an illegal version and are ignored.

RIPv2 Update Authentication

As previously mentioned, RIPv2 provides update authentication to help protect from rogue devices or attackers injecting false routing information into your routing table by authenticating the routing updates. This authentication is achieved by defining a key and attaching a key string (password) to it. This key string must match on both routers, or the updates will be rejected. To define the authentication key, use the key chain command followed by a name for the key chain in global configuration mode. After you enter that command, you are put into configkeychain subconfiguration mode:

Here you can configure several keys if you want, with different key string passwords. To create a key, use the key keyword and a number identifier for that key. You are put into another subconfiguration mode for that specific key, as shown by the config-keychain-key prompt:

Now we finally get to define our password, using the key-string command followed by the password that will match on each side:

With our key chain defined, we have to apply it to interfaces that connect to neighboring RIPv2 routers with matching authentication configurations. The command to assign the key chain to the interface is ip rip authentication key-chain followed by the key chain you defined a moment ago:

This key chain is sent over the link in clear text by default. This defeats the point of securing links, because the key chain can be seen if the link is being eavesdropped. To secure the key using an MD5 hash of the password, use the following command:
RouterA(config-if)#ip rip authentication mode md5

Configuring RIP with SDM

RIP configurations using SDM are relatively similar and just as easy as configuring default and static routes. Select Configuration, Routing. Focus on the bottom of the screen for our dynamic routing protocols. When you click the Edit button, you see the pop-up window shown in

Figure 11.11, in which you can specify your routing protocol parameters. You can enable RIP by checking the checkbox and specifying which version you want to run. Below that, you add the networks you want to advertise. Be sure that you specify each network that is directly attached to the router. This ensures that they are included in the routing updates and that the updates are sent and received on the interfaces associated with those networks. Finally, in the bottom of the window, you can check the check boxes for the interfaces that you want to make into passive interfaces to save bandwidth or control which routers will have updates sent to them.

RIP Verification


  • Verify router hardware and software operation using SHOW & DEBUG commands

To verify RIP, you can use an assortment of show commands, each equally contributing to a wealth of information about the RIP routing protocol you configured. For instance, show running-config is an easy pick to show your configuration for RIP and the networks that you have configured. It is also a useful starting point if you are troubleshooting an existing implementation of RIP and you suspect missing or misconfigured network statements.

To ensure that RIP updates are being received from neighbors, show ip route proves the network configuration is functioning, because you will see RIP entries appear in the routing table:

The RIP entries are identified in the routing table with the letter R followed by the administrative distance and the hop count in brackets. The IP is the next-hop address to reach those networks out of Serial 0/0/0. Finally, to see detailed information about all the IP routing protocols configured on a routing device, use show ip protocols to see a plethora of information:

Sending updates every 30 seconds, next due in 24 seconds Invalid after 180 seconds, hold down 180, flushed after 240
Outgoing update filter list for all interfaces is not set Incoming update filter list for all interfaces is not set

In this output, you can see the timers involved with the routing protocol, including the update interval of 30 seconds and the invalid and hold-down timers. The show ip protocols output also lists the interfaces participating in RIP and the version that they are configured to send and receive (in this case, version 2). On our serial 0/0/0 interface, you can also see that we have
configured RIP authentication and that the key chain luckyrabbitsfoot is assigned to this interface. In addition, you can see which networks you are routing using RIP. This is useful for

administrators who do not have access to privileged EXEC mode (and who therefore cannot use the show running-config command) to verify which networks are being advertised.

Troubleshooting RIP


  • Troubleshoot routing issues

Troubleshooting routing protocols always begins with verification of the routing configuration and status by using the show commands discussed in the last section. You can also test whether you have IP connectivity by pinging or you can test the route packets will take by using the traceroute command. However, if you need to get into the trenches, so to speak, and verify the updates as they are being sent and received, you need to use real-time troubleshooting tools entailing the debug command.

If you forget which debug processes you have running, you can issue the show debug command to list all the processes you are currently debugging. To actively see real-time updates as they are being sent and received for RIP, use the privileged

EXEC command debug ip rip, as demonstrated here:

In this section of the debug output, the router receives an update from a neighbor with the IP address This update is a version 2 update and has been authenticated using MD5. If any new subnets are learned from this update, they ultimately are placed in the routing table, using as the next-hop address and Serial 0/0/0 as the exiting interface, because that is where this information was learned. Notice in this section that subnet masks are received in the update, solidifying the fact that you are running a classless routing protocol, RIPv2. The next bit of output that follows is the local router sending its v2 multicast ( update out its Fast Ethernet 0/0 interface. Most important, notice how the router increments the hop count by 1 before sending it to any neighbors on its LAN:

Also, take note of the entry that is being advertised out this Fast Ethernet 0/0 interface. Because the interface has an IP address of, which is not in the same major network, this router automatically summarized its subnetted entries to Therefore, we can surmise by this debug output that we have not configured the no auto-summary on
Router A. If this were the case, the entry would remain classless and look more like this:
*Aug 6 22:33:23.598: via, metric 1, tag 0
The final output that follows is proof that split horizon is enabled and working on this router. This is evident because the router does not send any entries that it received on serial 0/0/0 from the first output explanation. Recall that split horizon keeps a router from advertising networks back out the interface from which it received that information. Because the,,, and networks were received in the router’s Serial 0/0/0 interface, they cannot be sent back out that interface.

Be sure you can decipher the output of a debug ip rip command.

Given the following design in Figure 11.12, configure RIP on Router A to be able to communicate with the remainder of the preconfigured network.

  1. Remember to remove any existing static routes. Why?
  2. Enter the configuration process for RIP.
  3. dvertise Router A’s networks.
    What will Router B do with the update from Router A?
    What will the networks look like when Router B sends them on to Router C?
  4. Configure Router A to run RIP version 2.
  5. Configure Router A to be classless.
    What will the update from Router A look like now?
  6. Configure RIP authentication using an MD5 hash of the password on Routers A and B.

Challenge Answer
You must first remove any static routes because they have a lower administrative distance than RIP. The configuration in steps 2 and 3 would look like the following:

Despite having subnetted the major networks in our topology, you must advertise the directly connected classful networks. When Router B receives that update, it adds the entry into its routing table (because is already directly connected) with a metric of 1 and uses Router A’s serial interface as the next hop. The entry is not because Router A auto-summarizes that network when exiting its WAN interface because that is on a different major network. When Router B sends that entry to Router C, it is sent as with a metric (hop count of 2). To configure Router A for RIPv2 and make it classless, you must add the following configurations:

With this configuration, Router A does not automatically summarize the network and it sends the subnet mask along to Router B. If B is running RIPv2 also, it keeps the network in its subnetted form of To assign RIP update authentication, we have to create matching keys on each router and apply them to the serial interfaces of each router:

Notice that the names of the key chains do not have to match, but the actual key strings inside the key chains do.

About the author


Leave a Comment