OSPF Authentication
OSPF neighbor authentication (also called neighbor router authentication or route authentication) can be configured such that routers can participate in routing based on predefined passwords.
When you configure neighbor authentication on a router, the router authenticates the source of each routing update packet that it receives. This authentication is accomplished by the exchange of an authenticating key (sometimes referred to as a password) that is known to both the sending and receiving router.
Types of Authentication
By default, OSPF uses null authentication (Type 0), which means that routing exchanges over a network are not authenticated. OSPF supports two other authentication methods:
■ Plaintext (or simple) password authentication (Type 1)
■ MD5 authentication (Type 2)
OSPF MD5 authentication includes an increasing sequence number in each OSPF packet to protect against replay attacks.
Configuring Plaintext Password Authentication
To configure OSPF plaintext password authentication, complete the following steps:
Step 1 Use the interface level ip ospf authentication-key password command to assign a password to use with neighboring routers that use the OSPF simple password authentication. The password can be any continuous string of characters that can be entered from the keyboard, up to eight characters in length.
NOTE In Cisco IOS Release 12.4, the router gives a warning message if you try to configure a password longer than eight characters; only the first eight characters are used. Some earlier Cisco IOS Software releases did not provide this warning.
The password that is created by this command is used as a "key" that is inserted directly into the OSPF header when Cisco IOS Software originates routing protocol packets. A separate password can be assigned to each network on a per-interface basis. All neighboring routers on the same network must have the same password to be able to exchange OSPF information.
NOTE If you do not use the service password-encryption command when configuring OSPF authentication, the key is stored as plaintext in the router configuration. If you configure the global service password-encryption command, the key is stored and displayed in an encrypted form; when it is displayed, an encryption type of 7 is specified before the encrypted key.
Step 2 Specify the authentication type using the interface level ip ospf authentication command. Table 4-6 explains the parameters for this command.
Table 4-6 ip ospf authentication Command Parameters
|
Parameter |
Description |
|
message-digest |
(Optional) Specifies that MD5 authentication will be used. |
|
null |
(Optional) No authentication is used. This option is useful for overriding password or MD5 authentication if configured for an area. |
For plaintext password authentication, use the ip ospf authentication command with no parameters. Before using this command, configure a password for the interface using the ip ospf authentication-key command.
The ip ospf authentication command was introduced in Cisco IOS Release 12.0. For backward compatibility, the authentication type for an area is still supported. If the authentication type is not specified for an interface, the authentication type for the area is used. (The area default is null authentication.) To enable authentication for an OSPF area, use the area area-id authentication [message-digest] router configuration command. Table 4-7 explains the parameters for this command.
|
Parameter |
Description |
|
area-id |
Identifier of the area for which authentication is to be enabled. The identifier can be specified as either a decimal value or an IP address. |
|
message-digest |
(Optional) Enables MD5 authentication on the area specified by the area-id argument. |
Example: Plaintext Password Authentication Configuration
Figure 4-7 shows the network that is used to illustrate the configuration, verification, and troubleshooting of plaintext password authentication.
Figure 4-7 Plaintext Password Authentication
Loopback 0 Area 0 Loopback 0
Loopback 0 Area 0 Loopback 0
Plaintext password authentication is configured on interface serial 0/0/1 with the ip ospf authentication command. The interface is configured with an authentication key of "plainpas."
Notice that the connecting interfaces on both Router 1 and Router 2 are configured for the same type of authentication with the same authentication key.
Verifying Plaintext Password Authentication
Example 4-10 shows output from the show ip ospf neighbor and show ip route commands for a router that was configured with authentication.
|
RouterX#show ip ospf neighbor |
|
|
Neighbor ID Pri State Dead Time Address |
Interface |
|
10.2.2.2 0 FULL/ 00:00:32 192.168 |
1.102 Serial0/0/1 |
|
RouterX#show ip route |
|
|
<output omitted> |
|
|
Gateway of last resort is not set |
|
|
10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks |
|
|
O 10.2.2.2/32 [110/782] via 192.168.1.102, 00:01:17 |
Serial0/0/1 |
|
C 10.1.1.0/24 is directly connected, Loopback0 |
|
|
192.168.1.0/27 is subnetted, 1 subnets |
|
|
C 192.168.1.96 is directly connected, Serial0/0/1 |
Notice that the neighbor state is FULL, indicating that the two routers have successfully formed an OSPF adjacency. The routing table verifies that the 10.2.2.2 address has been learned via OSPF over the serial connection.
The results of a ping to the Router Y loopback interface address are also displayed to illustrate that the link is working, as shown in Example 4-11.
Example 4-11 Using ping Output to Verify Link Operation
RouterX#ping 10.2.2.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.2.2.2, timeout is 2 seconds: !!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 28/29/32 ms
Continue reading here: Troubleshooting OSPF Neighbor Adjacencies
Was this article helpful?