Authentication
Authentication is now available on most routing protocols. You can configure routing devices with a predefined shared secret key that is used to validate each routing update. Most routing protocols support two types of neighbor authentication: plaintext and MD5. With plaintext authentication, a secret key is included inside each routing update message. This does not provide much security because an attacker can easily read keys. MD5 authentication works by processing each routing update with an MD5 hash function and by including the resulting signature (digest) as part of the routing update message. When you are using MD5, the shared secret key is never sent over the network only the hashing information or digest.
Figure 2-2 illustrates a topology in which four Cisco IOS routers and a Cisco ASA are configured with OSPF and with MD5 authentication.
Figure 2-2 OSPF Authentication
Figure 2-2 OSPF Authentication
All routers and the Cisco ASA belong to the OSPF area 0. The following example shows the configuration of OSPF MD5 neighbor authentication on the router labeled Router 1.
network 172.18.124.0 0.0.0.255 area 0 network 10.10.10.0 0.0.0.255 area 0 area 0 authentication message-digest interface Ethernet1
ip address 10.10.10.2 255.255.255.0 ip ospf authentication message-digest ip ospf message-digest-key 10 md5 1qaz@WSX
The first highlighted line shows how MD5 authentication is enabled for area 0. The second and third highlighted lines show how OSPF MD5 authentication is enabled on Ethernet 1. The shared key on this example is 1qaz@WSX.
The following example shows the configuration of the Cisco ASA. The commands are almost identical to the Cisco IOS router.
router ospf 5
network 10.10.10.0 0.0.0.255 area 0 area 0 authentication message-digest
interface GigabitEthernet0/1
ip address 10.10.10.1 255.255.255.0 ospf authentication message-digest ospf message-digest-key 10 md5 1qaz@WSX
Notice that the Cisco ASA OSPF authentication configuration is similar to the Cisco IOS router. The actual code was ported from IOS. One of the differences is that OSPF interface subcommands are not preceded by the word "ip."
NOTE For more information about neighbor authentication in Cisco IOS, refer to
http://www.cisco.com/univercd/cc/td/doc/product/software/ios124/124cg/hsec_c/part25/ schroutr.htm.
For more about routing authentication in Cisco ASA, refer to http://www.cisco.com/ univercd/cc/td/doc/product/multisec/asa_sw/v_7_2/conf_gd/general/ip.htm.
Continue reading here: Timeto Live TTL Security Check
Was this article helpful?