In this section, we are going to be learning about the different types of authentication supported by OSPF. Unlike EIGRP, OSPF supports plain text and MD5 authentication. The authentication method used by OSPF is specified in the OSPF packet header in the 16-bit Auth Type field. This field may contain one of three codes. These three codes are:
- Code 0 – Used to indicate that there is Null or no authentication
- Code 1 – Used to indicate that the plain text authentication
- Code 2 – Used to indicate Message Digest 5 (MD5) authentication
By default, an OSPF-enabled router uses Null authentication (Code 0) which means that routing exchanges over a network are not authenticated and are therefore prone to security attacks.
In Cisco IOS software, OSPF authentication can be configured for the entire OSPF area or on a per-interface basis. Both methods are described in detail in the following sections.
Configuring Area Authentication
The area [area ID] authentication [message-digest] command is used to enable plain text or MD5 authentication for the specified OSPF area. This command must be accompanied by the ip ospf authentication-key [password] or the ip ospf message-digest-key [key ID] md5 [password] interface configuration commands on all interfaces within the specified OSPF area to enable either plain text authentication or MD5 authentication respectively.
When configuring MD5 authentication, the key ID on both interfaces must match. The interfaces use the password configured in the lowest key ID when exchanging messages. Additionally, when configuring plain text authentication the password can be configured using any continuous string of characters that can be entered from the keyboard and can be up to 8 bytes in length. However, when configuring MD5 authentication, the password must be an alphanumeric password of up to 16 bytes in length.
When plain text authentication is enabled, the specified password is used as a key which is then inserted into the OSPF header when the router originates OSPF packets. A separate password can be assigned to each network on a per-interface basis. In other words, different subnets within the area can use different passwords. However, all neighboring routers on the same subnet must have the same password in order to be able to exchange OSPF routing information.
NOTE: By default, the configuration password will be shown in plain text in the router configuration unless theservice password-encryption global command is issued.
Figure 3-30 illustrates a basic multi-area OSPF network. R3 is connected to the backbone area in addition to area 2. Both R4 and R6 reside in area 2. Based on this topology, MD5 authentication will be enabled for area 2.
Fig. 3-30. OSPF Area Authentication
NOTE: It should be assumed that OSPF routing has been correctly enabled and the routers have established adjacencies with each other.
The first requirement when configuring area authentication is to enable the authentication type for the desired area. This is performed using the area [area ID] authentication [message-digest] router configuration command. This command must be enabled on all routers within the same area. This configuration is performed as follows:
| R3(config)#router ospf 3 R3(config-router)#area 2 authentication message-digest R3(config-router)#exit |
| R4(config)#router ospf 4 R4(config-router)#area 2 authentication message-digest R4(config-router)#exit |
| R6(config)#router ospf 6 R6(config-router)#area 2 authentication message-digest R6(config-router)#exit |
The next required step is to configure authentication on all interfaces within area 2 using the ip ospf message-digest-key [key ID] md5 [password] interface configuration command. The key ID configured on the routers must match, otherwise authentication will fail and the adjacency will not be established. To highlight the fact that the passwords can be different on different subnets, R3 and R4 will be configured to use the password ospf-md5-1 for MD5 authentication between the two routers. This is performed as follows:
| R3(config)#interface serial 0/0 R3(config-if)#ip ospf message-digest-key 1 md5 ospf-md5-1 R3(config-if)#exit |
| R4(config)#interface serial 0/0 R4(config-if)#ip ospf message-digest-key 1 md5 ospf-md5-1 R4(config-if)#exit |
Following this configuration, OSPF authentication can be verified using the show ip ospf and the show ip ospf interface [name] commands. The show ip ospf command simply indicates the type of authentication configured for the OSPF area as illustrated below:
| R4#show ip ospf | begin Area 2 Area 2 Number of interfaces in this area is 3 (2 loopback) Area has message digest authentication SPF algorithm last executed 00:08:50.465 ago SPF algorithm executed 16 times Area ranges are Number of LSA 10. Checksum Sum 0x0532CC Number of opaque link LSA 0. Checksum Sum 0x000000 Number of DCbitless LSA 0 Number of indication LSA 0 Number of DoNotAge LSA 0 Flood list length 0 |
The show ip ospf and the show ip ospf interface [name] command, on the other hand, indicates the type of authentication configured, and also shows the key ID (MD5) used for authentication on the interface as illustrated in the following output:
| R4#show ip ospf interface serial 0/0 Serial0/0 is up, line protocol is up Internet Address 10.0.2.4/24, Area 2 Process ID 4, Router ID 4.4.4.4, Network Type POINT_TO_POINT, Cost: 64 Enabled by interface config, including secondary ip addresses Transmit Delay is 1 sec, State POINT_TO_POINT Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 oob-resync timeout 40 Hello due in 00:00:04 Supports Link-local Signaling (LLS) Index 3/3, flood queue length 0 Next 0x0(0)/0x0(0) Last flood scan length is 1, maximum is 1 Last flood scan time is 0 msec, maximum is 0 msec Neighbor Count is 1, Adjacent neighbor count is 1 Adjacent with neighbor 3.3.3.3 Suppress hello for 0 neighbor(s) Message digest authentication enabled Youngest key id is 1 |
And finally, as previously stated, it is important to remember that the passwords are displayed in plain text in the router configuration unless the service password-encryption command is enabled. This is illustrated in the following output:
| R4#show running-config interface serial 0/0 Building configuration…Current configuration : 159 bytes ! interface Serial0/0 ip address 10.0.2.4 255.255.255.0 ip ospf message-digest-key 1 md5 ospf-md5-1 ip ospf 4 area 2 end |
Continuing with the area authentication configuration example, R4 and R6 will be configured to use the password ospf-md5-2 for MD5 authentication between the two routers. These routers will also use a key ID of. 2 This is performed as follows:
| R4(config)#interface fastethernet 0/0 R4(config-if)#ip ospf message-digest-key 2 md5 ospf-md5-2 R4(config-if)#exit |
| R6(config)#interface ethernet 0/0 R6(config-if)#ip ospf message-digest-key 2 md5 ospf-md5-2 R6(config-if)#exit |
Again, OSPF authentication configuration can be verified using the show ip ospf and the show ip ospf interface [name] commands. Following is the output of the show ip ospf interface command on R6:
| R6#show ip ospf interface ethernet 0/0 Ethernet0/0 is up, line protocol is up Internet Address 172.16.4.6/24, Area 2 Process ID 6, Router ID 6.6.6.6, Network Type BROADCAST, Cost: 10 Transmit Delay is 1 sec, State DR, Priority 1 Designated Router (ID) 6.6.6.6, Interface address 172.16.4.6 Backup Designated router (ID) 4.4.4.4, Interface address 172.16.4.4 Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 oob-resync timeout 40 Hello due in 00:00:08 Index 1/1, flood queue length 0 Next 0x0(0)/0x0(0) Last flood scan length is 0, maximum is 1 Last flood scan time is 0 msec, maximum is 0 msec Neighbor Count is 1, Adjacent neighbor count is 1 Adjacent with neighbor 4.4.4.4 (Backup Designated Router) Suppress hello for 0 neighbor(s) Message digest authentication enabled Youngest key id is 2 |
NOTE: When configuring MD5 authentication and a key ID is specified, you cannot simply change the password by entering the ip ospf message-digest-key [key ID] md5 [password] interface configuration command with the desired new password. Instead, you must negate the original configuration and re-enter this command with the desired new password. If this is attempted, the router will print an error message similar to the following:
| R4(config)#interface fastethernet 0/0 R4(config-if)#ip ospf message-digest-key 2 md5 my-new-password OSPF: Key 2 already exists |
NOTE: If an additional key is configured on an interface which is already configured for MD5 authentication, the router begins the rollover process and sends multiple copies of the same packet, each authenticated by the different configured keys. For example, assume that key 5 was configured on the Serial0/0 interface of R4 in addition to key 1 which is currently being used for authentication with R3. Based on this configuration, the show ip ospf interface [name] command shows the following for the Serial0/0 interface of R4:
| R4#show ip ospf interface serial 0/0 Serial0/0 is up, line protocol is up Internet Address 10.0.2.4/24, Area 2 Process ID 4, Router ID 4.4.4.4, Network Type POINT_TO_POINT, Cost: 64 Enabled by interface config, including secondary ip addresses Transmit Delay is 1 sec, State POINT_TO_POINT Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 oob-resync timeout 40 Hello due in 00:00:05 Supports Link-local Signaling (LLS) Index 3/3, flood queue length 0 Next 0x0(0)/0x0(0) Last flood scan length is 1, maximum is 1 Last flood scan time is 0 msec, maximum is 0 msec Neighbor Count is 1, Adjacent neighbor count is 1 Adjacent with neighbor 3.3.3.3 Suppress hello for 0 neighbor(s) Message digest authentication enabled Youngest key id is 5 Rollover in progress, 1 neighbor(s) using the old key(s): key id 1 |
Using the debug ip ospf events command we can validate that R4 is indeed sending multiple copies of the same packets to R3, each using a different key as shown below:
| R4#debug ip ospf events OSPF events debugging is on R4# *Mar 1 20:12:13.250: OSPF: Send with key 1 *Mar 1 20:12:13.250: OSPF: Send hello to 224.0.0.5 area 2 on Serial0/0 from 10.0.2.4 *Mar 1 20:12:13.250: OSPF: Send with key 5 *Mar 1 20:12:13.250: OSPF: Send hello to 224.0.0.5 area 2 on Serial0/0 from 10.0.2.4 |
R4 will continue to send multiple copies of the same OSPF packets with any many keys as are configured on the interface until R3 is configured with the new key (5). At this point, the old key ceases being used and both routers use the new key. Following is the output of the debug ip ospf events command after R5 has also been configured with the new key:
| R4#debug ip ospf events OSPF events debugging is on R4# *Mar 1 20:22:33.275: OSPF: Send with youngest Key 5 *Mar 1 20:22:33.275: OSPF: Send hello to 224.0.0.5 area 2 on Serial0/0 from 10.0.2.4[Truncated Output]*Mar 1 20:22:43.275: OSPF: Send with youngest Key 5 *Mar 1 20:22:43.275: OSPF: Send hello to 224.0.0.5 area 2 on Serial0/0 from 10.0.2.4 |
The old key is retained in the configuration until it is negated. However, the output of the show ip ospf interfacecommand shows only that the new key is being used:
| R4#show ip ospf interface serial 0/0 Serial0/0 is up, line protocol is up Internet Address 10.0.2.4/24, Area 2 Process ID 4, Router ID 4.4.4.4, Network Type POINT_TO_POINT, Cost: 64 Enabled by interface config, including secondary ip addresses Transmit Delay is 1 sec, State POINT_TO_POINT Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 oob-resync timeout 40 Hello due in 00:00:09 Supports Link-local Signaling (LLS) Index 3/3, flood queue length 0 Next 0x0(0)/0x0(0) Last flood scan length is 1, maximum is 1 Last flood scan time is 0 msec, maximum is 0 msec Neighbor Count is 1, Adjacent neighbor count is 1 Adjacent with neighbor 3.3.3.3 Suppress hello for 0 neighbor(s) Message digest authentication enabled Youngest key id is 5 |
Configuring Interface Authentication
Interface authentication is enabled first by using the ip ospf authentication [message-digest|null] interface configuration command. Used without additional keywords, this command enables plain text authentication for the configured interface. The message-digest keyword configures the interface to useMD5 authentication. Thenull keyword is used to specify that no authentication will be used for this interface. This is the default.
Interface-based authentication provides flexibility in that authentication can be configured on some subnets and not others for routers residing in the same OSPF area. When area authentication is configured, all routers must be configured for authentication. Interface-based authentication negates the need to configure all routers in the area for authentication. For example, if the LAN link between R4 and R6 was secure, perhaps due to a firewall on the LAN, however, the WAN link between R3 and R4 was not secure, interface-based authentication could be configured on that link only, securing routing protocol packets between R3 and R4.
After specifying the interface authentication type, the next step when configuring interface-based authentication is to use the ip ospf authentication-key [password] or the ip ospf message-digest-key [key ID] md5 [password] interface configuration commands must be used to configure the password depending on the type of authentication enabled at the interface level. Referencing the topology illustrated in Figure 3-30, plain text interface-based authentication will be configured for the connection between R3 and R4. This configuration is implemented as follows:
| R3(config)#interface serial 0/0 R3(config-if)#ip ospf authentication-key secure R3(config-if)#exit |
| R4(config)#interface serial 0/0 R4(config-if)#ip ospf authentication R4(config-if)#ip ospf authentication-key secure R4(config-if)#exit |
NOTE: If the plain text password is longer than 8 bytes (8 characters) the following warning message will be printed on the console:
| R3(config)#interface serial 0/0 R3(config-if)#ip ospf authentication-key howtonetwork %OSPF: Warning: The password/key will be truncated to 8 characters |
When interface-based authentication is configured, the show ip ospf command correctly reflects that authentication for the area is not configured as illustrated below:
| R4#show ip ospf | begin Area 2 Area 2 Number of interfaces in this area is 3 (2 loopback) Area has no authentication SPF algorithm last executed 00:01:27.548 ago SPF algorithm executed 19 times Area ranges are Number of LSA 10. Checksum Sum 0x0541DD Number of opaque link LSA 0. Checksum Sum 0x000000 Number of DCbitless LSA 0 Number of indication LSA 0 Number of DoNotAge LSA 0 Flood list length 0 |
However, the show ip ospf interface [name] command can be used to validate the configured authentication type for the specified interface as illustrated below:
| R4#show ip ospf interface serial 0/0 Serial0/0 is up, line protocol is up Internet Address 10.0.2.4/24, Area 2 Process ID 4, Router ID 4.4.4.4, Network Type POINT_TO_POINT, Cost: 64 Enabled by interface config, including secondary ip addresses Transmit Delay is 1 sec, State POINT_TO_POINT Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 oob-resync timeout 40 Hello due in 00:00:01 Supports Link-local Signaling (LLS) Index 3/3, flood queue length 0 Next 0x0(0)/0x0(0) Last flood scan length is 1, maximum is 1 Last flood scan time is 0 msec, maximum is 4 msec Neighbor Count is 1, Adjacent neighbor count is 1 Adjacent with neighbor 3.3.3.3 Suppress hello for 0 neighbor(s) Simple password authentication enabled |
NOTE: Plain text authentication cannot be validated using the debug ip ospf events command as is the case for MD5 authentication.