| 8.4 |  | Routing and Multicast Configuration |
| 8.4.2 |  | Dynamic routes |

| Another way to build the PIX Security Appliance routing table is by enabling the Routing Information Protocol (RIP) with the rip command. Administrators can configure the PIX Security Appliance to learn routes dynamically from RIP version 1 or RIP version 2 broadcasts. Although the PIX Security Appliance uses the dynamically learned routes to forward traffic to the appropriate destinations, it does not broadcast learned routes to other devices. The PIX Security Appliance cannot pass RIP updates between interfaces. It can, however, advertise one of its interfaces as a default route.

Figure shows the PIX Security Appliance learning routes from a router on its outside interface and broadcasting a default route on its inside interface. MD5 authentication is used on the outside interface to enable the PIX Security Appliance to accept the encrypted RIP updates. Both the PIX Security Appliance and Router A are configured with the encryption key HKEY and its key id of 2.

Use the rip command, shown in Figure , to configure the PIX Firewall to learn routes dynamically from RIP version 1 or RIP version 2 broadcasts. When RIP version 2 is configured in passive mode, the PIX Security Appliance accepts RIP version 2 multicast updates with an IP destination of 224.0.0.9. For the RIP version 2 default mode, the PIX Firewall transmits default route updates using an IP destination of 224.0.0.9. Configuring RIP version 2 registers the multicast address 224.0.0.9 on the interface specified in the command, so that the PIX Firewall can accept multicast RIP version 2 updates. When the RIP version 2 commands for an interface are removed, the multicast address is unregistered from the interface card.

If RIP version 2 is specified, RIP updates can also be encrypted using MD5 encryption. Ensure that the key and key_id values are the same as those used in any device in the network that makes RIP version 2 updates.

IP routing table updates are enabled by default. Use the no rip command to disable the PIX Firewall IP routing table updates. The clear rip command removes all the rip commands from the configuration.

The example in Figure combines RIP version 1 and 2 commands that enable the following:

- Version 2 passive RIP using MD5 authentication on the outside interface to encrypt the key used by the PIX Security Appliance and other RIP peers, such as routers.
- Broadcasting a default route on the outside interface using MD5 authentication
- Version 1 passive RIP listening on the inside interface
- Version 2 passive RIP listening on the DMZ interface
- The syntax reference table for the rip command is as follows :

> rip if_name default | passive [version [1 | 2]] [authentication [text | md5 key key_id]]