Cisco Certified ExpertConfiguring OSPF Authentication
OSPF Shared Key: auth593
Ciseo.com
Ciseo.com
OSPF Shared Key: auth593
router#(config-router)# area 0 authentication router#(config-if)# ip ospf authentication-key auth593
© 2DD2, Cisco Systems, Inc. All rights reserved.
Cisco CCIE Prep vt.D—Module 7-44
Plain Text Authentication
Plain text authentication allows a key (password) to be configured per area. All routers in the same area that want to participate in OSPF will have to be configured with the same key. Plain text authentication sends the authentication key itself in plain text over the wire. The drawback of this method is that it is vulnerable to eavesdropping attacks. Anybody with a protocol analyzer could easily get the plain text password off the wire.
Table 6-21
|
Command |
Description |
|||
|
area <area-id> authentication |
Enables plain text authentication for an OSPF area. When you configure authentication, you must configure all neighboring routers within the entire area for the same type of authentication. |
|||
|
ip ospf authentication-key key |
Interface configuration command that defines the plain text key used between OSPF neighbors for authentication. Command applied in Global Interface mode. |
|||
Message Digest Authentication
MD5 authentication is a cryptographic form of authentication. A key (password) and key-id are configured on each neighboring router within the area. The router uses an algorithm based on the OSPF packet, the key, and the key-id to generate a "message digest hash" that gets appended to the packet. Since both neighbors are using the same key and key-id, they will be able to decode each other's hash. Unlike plain text authentication, the key itself is never exchanged over the wire. A non-decreasing sequence number is also included in each OSPF packet to protect against replay attacks.
Table 6-22
|
Command |
Description |
|
area <area-id> authentication message-digest |
Enables MD5 authentication for an OSPF area. When you configure authentication, you must configure all neighboring routers within the entire area for the same type of authentication. |
|
ip ospf messagedigest-key keyid md5 key |
Interface configuration command that defines the key-id and key used to create the MD5 hash used between OSPF neighbors for authentication. |
Authentication Over a Virtual Link
• Since virtual links make discontiguous routers believe they are attached to Area 0, OSPF authentication should be configured for all attached areas AND Area 0
© 2002, Cisco Systems, Inc. All rights reserved. Cisco CCIE Prep v1.0—Module 7-63
Virtual links support both plain text and MD5 authentication. There is one trick, however, to get authentication across a virtual link to work. When a virtual link is configured, the ABR of the area that is not physically connected to Area 0 now believes that it is part of area 0. Therefore, in addition to configuring authentication for the areas the ABR is attached to, authentication must also be configured for area 0 on the ABR.
Table 6-23
|
Command |
Description |
|
area area-id virtual-link router-id authentication-key key |
Configures the plain text authentication key to be used across the virtual link |
|
area area-id virtual-link router-id message-digest-key key-id md5 key |
Configures the key-id and key used to create the MD5 hash used to authenticate ABRs across a virtual-link |
Was this article helpful?
Post a comment