OSPF

Basic

• OSPF supports adjacency authentication to protect control plane
  • E.g. prevent against routing injection attack
• Every OSPF packet header includes authentication information
  • I.e. Hello, LSU, LSR, etc.
• Authentication does not mean encryption
  • OSPFv2 payload is still clear text
  • OSPFv3 supports IPsec encryption

Types of authentication (3)

• Type 0 – Null
• Type 1 – Simple Password
• Type 2 – Cryptographic (MD5/SHA)

Configuration

Authentication with simple password

router ospf <process id>
area <area id> authentication
!
interface GigabitEthernet0/0
 ip ospf authentication-key [PASSWORD]

Authentication with md5

router ospf <process id>
area <area id> authentication [message-digest] 
!
interface <interface id> 
ip ospf message-digest-key <key id> md5 <key>

Authentication with SHA256

key chain OSPF-AUTH
 key 1
  key-string CISCO
  cryptographic-algorithm hmac-sha-256
!
interface GigabitEthernet0/0
 ip ospf authentication key-chain OSPF-AUTH

The password is always configured on the link

Verification

Simple password authentication

R8#sh ip ospf int gi0/0
GigabitEthernet0/0 is up, line protocol is up 
  Internet Address 155.1.58.8/24, Area 1, Attached via Interface Enable
...
...
  Simple password authentication enabled

Cryptographic password authentication (md5)

R1#sh ip ospf int gi0/2
GigabitEthernet0/2 is up, line protocol is up 
  Internet Address 155.1.146.1/24, Area 0, Attached via Interface Enable
..
..
  Cryptographic authentication enabled
    Youngest key id is 1

BGP

ToDo

EIGRP

Classic Mode

Define Key chain

key chain MD5_KEYS
 key 10
  key-string CISCO10
  accept-lifetime 00:00:00 Jan 1 1993 00:15:00 Jan 1 2030
  send-lifetime 00:00:00 Jan 1 1993 infinite
 key 20
  key-string CISCO20
  accept-lifetime 00:00:00 Jan 1 2030 infinite
  send-lifetime 00:00:00 Jan 1 2030 infinite

Apply to interface

interface GigabitEthernet0/0
 ip authentication mode eigrp 100 md5
 ip authentication key-chain eigrp 100 MD5_KEYS

Named Mode

Apply the authentication command to the desired interface or apply it to all interfaces by using the default keyword after the af-interface command.

router eigrp [NAME]
 address-family ipv4 unicast autonomous-system [AS-Number]
  af-interface default
   authentication mode hmac-sha-256 [PASSWORD]

Interconnecting classic and named mode

On the router running in named mode create the identical key ring as configured on the classic mode device(s).

key chain MD5_KEYS
 key 10
  key-string CISCO10
  accept-lifetime 00:00:00 Jan 1 1993 00:15:00 Jan 1 2030
  send-lifetime 00:00:00 Jan 1 1993 infinite
 key 20
  key-string CISCO20
  accept-lifetime 00:00:00 Jan 1 2030 infinite
  send-lifetime 00:00:00 Jan 1 2030 infinite

Now simply reference the the key ring under the interface connecting to the classic mode device(s). In this example interface gig0/0.

router eigrp [NAME]
 address-family ipv4 unicast autonomous-system [AS-Number]
  af-interface GigabitEthernet0/0
   authentication mode md5
   authentication key-chain MD5_KEYS

Verification

Verify that neighbors are up by looking at the neighbor output:

show ip eigrp neighbors

Check the log output is you see any issues:

R1#%DUAL-5-NBRCHANGE: EIGRP-IPv4 100: Neighbor x.x.x.x (GigabitEthernetx/x) is down: Auth failure

Verify the output of debug eigrp packets and see if have and authentication packets:

R1#debug eigrp packets 
EIGRP Packet debugging is on
R1#
EIGRP: received packet with HMAC-SHA-256 authentication
EIGRP: received packet with MD5 authentication, key id = 10
EIGRP: received packet with HMAC-SHA-256 authentication