To guarantee this trust, routers in a specific area can be configured to authenticate each other.

Each OSPF interface can present an authentication key for use by routers sending OSPF information to other routers on the segment. The authentication key, known as a password, is a shared secret between the routers. This key is used to generate the authentication data in the OSPF packet header. The password can be up to eight characters. Use the following command syntax to configure OSPF authentication:

Router(config-if)#ip ospf authentication-key password

After the password is configured, authentication must be enabled:

Router(config-router)#area area-number authentication

With simple authentication, the password is sent as plain text. This means that it can be easily decoded if a packet sniffer captures an OSPF packet.

It is recommended that authentication information be encrypted. To send encrypted authentication information and to ensure greater security, the message-digest keyword is used. The MD5 keyword specifies the type of message-digest hashing algorithm to use, and the encryption type field refers to the type of encryption, where 0 means none and 7 means proprietary.

Use the interface configuration command mode syntax:

Router(config-if)#ip ospf message-digest-key key-id md5 encryption-type key

The key-id is an identifier and takes the value in the range of 1 through 255. The key is an alphanumeric password up to sixteen characters. Neighbor routers must use the same key identifier with the same key value.

The following is configured in router configuration mode:

Router(config-router)#area area-id authentication message-digest

MD5 authentication creates a message digest. A message digest is scrambled data that is based on the password and the packet contents. The receiving router uses the shared password and the packet to re-calculate the digest. If the digests match, the router believes that the source and contents of the packet have not been tampered with. The authentication type identifies which authentication, if any, is being used. In the case of message-digest authentication, the authentication data field contains the key-id and the length of the message digest that is appended to the packet. The message digest is like a watermark that cannot be counterfeited.

Lab Activity Lab Exercise: Configuring OSPF Authentication This lab is to setup an IP addressing scheme for Open Shortest Path First (OSPF) area.

   

Lab Activity e-Lab Activity: Configuring OSPF Authentication In this lab, the student will setup an IP addressing scheme for OSPF area, configure and verify OSPF routing, and introduce OSPF authentication in to the area.

   

Web Links area authentication http://www.cisco.com/en/US/products/sw/ iosswrel/ps1835/products_command_ reference_chapter09186a00800917e6. html#1017391