Discussion

Solution
You configure MD5 authentication for OSPF:
[edit protocols ospf area 0.0.0.0]
aviva@RouterG# set authentication-type md5
aviva@RouterG# set interface fe-0/0/1 authentication md5 1 key $1991poPPi
aviva@RouterG# set interface fe-1/0/1 authentication md5 1 key $1991poPPi
aviva@RouterG# show
authentication-type md5;
interface fe-0/0/1.0 {
authentication {
md5 1 key "$9$dEbgoZUjqP5GUApO1hcgoaJHq"; ## SECRET-DATA
}
}
interface fe-1/0/1.0 {
authentication {
md5 1 key "$9$dEbgoZUjqP5GUApO1hcgoaJHq"; ## SECRET-DATA
}
}
Discussion
It is a good security measure to authenticate OSPF protocol packet exchanges to
ensure that only trusted routers participate in the OSPF network and in the exchange
of Hello and LSA packets.
This recipe shows how to configure OSFP to use MD5 authentication. First, configure
MD5 authentication for the entire area, then set the key, or password, for each
interface. Each key has an identifier; here, it is 1. MD5 creates an encoded checksum
that is included in all transmitted OSPF packets. The receiving router verifies this
checksum before accepting the packet.
When you display the router’s configuration after you have typed the password, you
do not see the password itself, only the encrypted form of the password. Someone
casually glancing through the configuration would not see the actual password.
You can also configure a simple password for OSPF authentication, which includes a
plain-text password in the transmitted OSPF packets. Plain-text passwords are easy
to break by devices that sniff network traffic, so you should never use them when
your goal is network security.
For authentication to work across the entire OSPF domain, you need to configure
MD5 authentication with the same key identifier and the same password on all OSPF
interfaces, as shown in this recipe. Once you have the encrypted version of the password,
you can use it in the authentication-key statement instead of the password
itself. This is one way to minimize the number of people who see the actual password.
aviva@RouterG# set interface fe-1/0/1 authentication 1 key
"$9$dEbgoZUjqP5GUApO1hcgoaJHq"
Enabling OSPF Authentication | 403
This is the Title of the Book, eMatter Edition
Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.