USD ($)
$
United States Dollar
India Rupee

OSPF MD5 Authentication: Securing OSPF

Created by Deepak Sharma in Articles 11 Nov 2024
Share
«What is OSPF and How it Works?

As part of your Cisco Enterprise training, it's important to understand how to secure your Open Shortest Path First (OSPF) routing protocol using MD5 authentication. OSPF is a widely used Interior Gateway Protocol (IGP) that enables dynamic routing within an autonomous system.

Without proper authentication, OSPF routing updates can be vulnerable to unauthorized access and manipulation. MD5 authentication provides a robust method to ensure the integrity and authenticity of OSPF routing updates.

By configuring MD5 authentication on OSPF interfaces, you can prevent unauthorized routers from forming adjacencies and participating in the OSPF routing domain. In this article, we will explore the configuration steps required to enable OSPF MD5 authentication on Cisco routers.

Configure MD5 Authentication on OSPF Interface in Cisco Routers

Here, we will see the entire process of configuring OSPF MD5 authentication in Cisco routers. This lab practical will consist of the following tasks:

Tasks

● Configure OSPF on routers R1, R2, and R3.

● The link between R1 and R3 should be in OSPF area 0.

● The link between R2 and R3, and R3's link to the Test PC, should be in OSPF area 1.

● Advertise the routers' Loopback networks into OSPF.

● Authenticate the OSPF exchange between R1 and R3 using the clear-text string CLEARKEY.

● Authenticate the OSPF exchange between R2 and R3 using an MD5 hash of the string MD5HASH.

● R1 and R2 should enable authentication at the interface level, and R3 should enable authentication globally under the OSPF process.

● Ensure that R3 does not have authentication enabled on its VLAN11 interface.


CCNP Online TrainingJoin live CCNP training class.Explore course
custom banner static image

Initial Configurations:

Configure the devices R1, R2, R3, and SW as per the logical topology. In case you like to perform the same practical in your lab, you can download the initial configurations of these devices as follows.

Note: Enable password is "cisco" in the initial configurations. 

R1

R2

R3

SW1

OSPF Diagram

banner image

Configurations and Verifications

Before moving to the OSPF configuration, first, configure the Test PC IP address and hostname. TestPC IP address is being received by R3 as the DHCP server is configured on R3 for this segment to TestPC. In this case, 10.1.0.100/24 is the IP assigned by DHCP on TestPC.

banner image

Now check the IP connectivity (Layer 3) to R1, R2, and Test PC from R3.

banner image

R1:

!

interface Loopback0

 ip ospf 1 area 0

!

interface GigabitEthernet0/0

 ip ospf authentication

 ip ospf authentication-key CLEARKEY

 ip ospf 1 area 0

!

end

!

write

!

R2:

!

interface Loopback0

 ip ospf 1 area 1

!

interface GigabitEthernet0/0

 ip ospf authentication message-digest

 ip ospf message-digest-key 1 md5 MD5HASH

 ip ospf 1 area 1

!

end

!

write

!

R3:

!

interface Loopback0

 ip ospf 1 area 1

!

interface GigabitEthernet0/0.11

 ip ospf 1 area 1

 ip ospf authentication null

!

interface GigabitEthernet0/0.13

 ip ospf authentication-key CLEARKEY

 ip ospf 1 area 0

!

interface GigabitEthernet0/0.23

 ip ospf message-digest-key 1 md5 MD5HASH

 ip ospf 1 area 1

!

router ospf 1

 area 0 authentication

 area 1 authentication message-digest

!

end

!

write

!

At the packet level, the following are the OSPF authentication types

1. OSPF Type 0 or NULL or no Authentication

2. OSPF Type 1 Clear text Authentication

3. OSPF Type 3 MD5 Authentication

Similar to OSPF, BGP also supports MD5 authentication between its peers. 

OSPF authentication is configured in two distinct steps:

Step 1. Enable authentication (clear-text or MD5) at the interface level or global level.

Step 2. Configure the string used for authentication, as well as the key number only for MD5 authentication.

The common confusion with OSPF authentication comes from the fact that the first of these steps, enabling the authentication, can be done in two ways: at the interface level and under the global OSPF process. When OSPF authentication is enabled under the global process, it applies to all interfaces in that area.

In this particular example, R3 has the commands area 0 authentication and area 1 authentication message-digest configured under the OSPF process. This means that all interfaces in area 0 run clear-text authentication, and all interfaces in area 1 run MD5 authentication. 

When you enable OSPF authentication at the interface level, it tends to override the configuration of the global process, but only for that particular interface.

For example, while R3 has the command area 0 authentication configured under the global process, the command ip ospf authentication message-digest or ip ospf authentication null configured on an interface in area 0 would override the global clear-text authentication configuration.

Regardless of how OSPF authentication is enabled, either under the global process or at the interface level, the packet format for the authentication remains the same. This means that the difference in configuration is only cosmetic because both configurations have the same result.

The authentication key, however, is always configured at the interface level. For clear text authentication, this is the ip ospf authentication-key command, whereas for MD5 authentication, this is the ip ospf message-digest-key command.

Note that just like RIP and EIGRP, the MD5 key number must match between the neighbors, because it is a salt for the MD5 hash.

OSPF authentication, like EIGRP authentication, can be verified simply based on the fact that an adjacency has formed, as seen below:

banner image

The specific authentication configuration can be verified as seen below.

banner image

banner image

If authentication has been enabled at the global level, it can be determined by using the command show ip ospf :

banner image

Failures in OSPF authentication can be verified as a failure to establish adjacency. The below process-level debug (it's a troubleshooting step) shows a mismatch in authentication type, where R3 has MD5 authentication configured to R1, and R1 has clear-text authentication configured to R3. 

Please note while OSPF supports different authentication types, in BGP authentication methods it supports only the MD5 type. It is the safest method of all.  

banner image

Note: Apply on R3 and configure the simple ospf authentication to restore the neighborship between R1 and R3. Otherwise, you can just reload R3 because you have not yet saved this configuration. 

A mismatch in the password between two neighbors (or hash in the case of MD5) will result in a different output in this debug, as seen below on R2:

banner image

Note: Reload R2 to restore the ospf adjutancy because you have not yet saved the above configuration. 

Configure MD5 Authentication on OSPF - Summing up

Configuring MD5 authentication on OSPF enhances network security by ensuring that only authorized routers can exchange routing information. This process involves enabling MD5 authentication on the desired OSPF interfaces using the command "ip ospf authentication message-digest" and defining an MD5 key with "ip ospf message-digest-key md5 ".

It is crucial to ensure that all neighboring routers share the same key for successful authentication. By implementing this secure method, organizations can protect their OSPF routing domains from unauthorized access and potential attacks, thereby maintaining the integrity of their network infrastructure.

To learn more about such concepts, check out our IT infrastructure training courses.

OSPF LSA Types Explained»
Deepak Sharma

He is a senior solution network architect and currently working with one of the largest financial company. He has an impressive academic and training background. He has completed his B.Tech and MBA, which makes him both technically and managerial proficient. He has also completed more than 450 online and offline training courses, both in India and ...

More... | Author`s Bog | Book a Meeting

Related Articles

#Explore latest news and articles

OSPF ABR vs ASBR: Differences Insight 26 Oct 2024

OSPF ABR vs ASBR: Differences Insight

Explore the distinctions between ABR and ASBR in OSPF. Delve into OSPF ABR configuration details to understand their roles and functionalities.
OSPF States in Networking Explained 26 Nov 2024

OSPF States in Networking Explained

Do you know? OSPF states like neighbor & interface including exstart on cisco routers. Understand each adjacency phase in OSPF protocol. Read More!
Understanding OSPF LSA Type 4 16 Nov 2024

Understanding OSPF LSA Type 4

Overview of OSPF LSA Types and deep dive into OSPF LSA Type 4

FAQ

MD5 authentication in OSPF is a security mechanism that uses the MD5 hashing algorithm to verify the integrity and authenticity of OSPF routing updates, ensuring that only authorized routers can exchange routing information.
Yes, OSPF can be secured with MD5 authentication, which prevents unauthorized routers from forming adjacencies and ensures that routing updates are exchanged securely by using hashed keys rather than sending passwords in clear text.
The MD5 authentication key is a shared secret password used by OSPF routers to generate a hash value for each routing update. This key must match on all routers within the same OSPF area to authenticate communication successfully.
MD5 authentication is a cryptographic method that uses the MD5 algorithm to create a hash of data, ensuring message integrity and authenticity. It is commonly used in various networking protocols, including OSPF, to secure communications.
To make OSPF secure, implement MD5 authentication by configuring an MD5 key on all participating routers and ensuring they share the same key. Additionally, use access control lists (ACLs) to limit which devices can send or receive OSPF updates.

Comments (1)

Charlie yadhu Student
17 Oct 2023 | 10:55 pm

Nice piece of lab scenario. Is this process same for authenticating ospf ipv6?

Deepak Sharma User
30 Oct 2023 | 08:45 pm

The steps of implementing ospf authentication in ipv6 are different. I'll post this some other time.

Share

Share this post with others

Contact learning advisor

Captcha image
Join Cisco ACI Live Training – Starting 7th December! Enroll Now to Master ACI.
Join Cisco ACI Live Training – Starting 7th December! Enroll Now to Master ACI.
Expert-Led Cisco ACI Training with Lab Access.
Day
Hr
Min
Sec
Register Now