Authentication

Understand

OSPF authentication checks control-packet authenticity and integrity; it does not encrypt routing information or user traffic. Legacy simple-password authentication exposes the password. MD5 is still encountered; this lab uses HMAC-SHA-256 on an IOS XE image supporting OSPFv2 cryptographic key-chain authentication. Confirm support for the actual router/version.

Both ends need compatible authentication mode, key ID, algorithm and secret, and overlapping valid send/accept lifetimes. Key-chain names are local labels and need not match. The readable lab secret below is disposable; use unique managed secrets in deployment.

For rollover, install the new key with acceptance on both ends, switch sending with old-key acceptance overlapping, verify stable neighbors, then retire the old key. Time-based lifetimes require synchronized clocks. Verify the selected image’s rollover behavior.

Lab setup

Use a fresh lab for this lesson; changes from other lessons are not cumulative. All outputs are illustrative excerpts, not recorded router tests. Transit cost is explicitly 10 and Loopback0 cost is 1. Interface names may vary by image.

Loopback0 is 10.255.0.<router number>/32; area assignments: R1: area 0, R2: area 0.

configure terminal
hostname R1
router ospf 1
 router-id 10.255.0.1
 passive-interface Loopback0
 exit
interface Loopback0
 ip address 10.255.0.1 255.255.255.255
 ip ospf 1 area 0
 ip ospf cost 1
 exit
interface GigabitEthernet1
 ip address 192.0.2.1 255.255.255.252
 ip ospf network point-to-point
 ip ospf cost 10
 ip ospf 1 area 0
 no shutdown
 exit
end

configure terminal
hostname R2
router ospf 1
 router-id 10.255.0.2
 passive-interface Loopback0
 exit
interface Loopback0
 ip address 10.255.0.2 255.255.255.255
 ip ospf 1 area 0
 ip ospf cost 1
 exit
interface GigabitEthernet1
 ip address 192.0.2.2 255.255.255.252
 ip ospf network point-to-point
 ip ospf cost 10
 ip ospf 1 area 0
 no shutdown
 exit
end

Apply

Begin with the pair baseline. This single-key lab uses default lifetime behavior with no explicit time window. Apply the same material and algorithm on both endpoints; a one-sided activation can disrupt adjacency.

R1 and R2 · independently

configure terminal
key chain OSPF-LAB
 key 1
  key-string PacketLabLabOnly42
  cryptographic-algorithm hmac-sha-256
  exit
 exit
interface GigabitEthernet1
 ip ospf authentication key-chain OSPF-LAB
end

Verify and interpret

R1# show ip ospf interface GigabitEthernet1
  Cryptographic authentication enabled
  Sending SA: Key 1, Algorithm HMAC-SHA-256 - key chain OSPF-LAB
R1# show ip ospf neighbor
Neighbor ID     Pri State   Dead Time Address     Interface
10.255.0.2        0 FULL/-  00:00:36  192.0.2.2  GigabitEthernet1

Check the active key ID and algorithm as well as Full state. Wording varies by image.

Inject a secret mismatch only on R2, wait for expiry and inspect neighbor state. Restore the expected secret instead of disabling authentication.

R2 · mismatch

configure terminal
key chain OSPF-LAB
 key 1
  key-string WrongLabSecret
end

R1# show ip ospf neighbor
[No entries; explanatory annotation]

No valid adjacency remains after expiry. Compare mode, key ID, algorithm, secret and lifetimes.

R2 · restore

configure terminal
key chain OSPF-LAB
 key 1
  key-string PacketLabLabOnly42
end

R1# show ip ospf neighbor
Neighbor ID     Pri State   Dead Time Address     Interface
10.255.0.2        0 FULL/-  00:00:38  192.0.2.2  GigabitEthernet1

Full state returns with authentication still enabled. Production key rollover has not been tested by this lab.

Technical references

OSPFv2 standard · Router configuration guide · OSPFv2 cryptographic authentication