How do you secure OSPF adjacencies, and what options exist in OSPFv2?
Show the answer
Say this first
OSPFv2 has null (type 0), plain text (type 1) and cryptographic (type 2). Type 2 was originally keyed MD5.
RFC 5709 added HMAC-SHA, which IOS-XE configures with a key chain and ip ospf authentication key-chain.
Both sides must match type, key ID and key. I use HMAC-SHA-256 and never plain text.
Go deeper
HMAC-SHA-256 on IOS-XE (preferred)
key chain OSPF-KEYS
key 1
key-string Str0ngOspfKey
cryptographic-algorithm hmac-sha-256
!
interface GigabitEthernet0/0/0
ip ospf authentication key-chain OSPF-KEYSMD5 (legacy, still common)
interface GigabitEthernet0/0/0
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 Str0ngOspfKeyMD5 can also be enabled for a whole area with area 0 authentication message-digest, with the key still
set per interface. The interface command overrides the area setting.
Key rotation
With MD5 you can add key 2 on both sides. IOS sends with both keys until it sees every neighbor using the
newest key. With key chains, use send-lifetime and accept-lifetime so the change rolls over without a flap.
Symptoms of a mismatch
The neighbor disappears after the dead interval and debug ip ospf adj reports a mismatched
authentication type or key. Virtual links follow area 0's authentication.
OSPFv3
OSPFv3 removed the authentication fields. It uses IPsec AH or ESP (ipv6 ospf authentication ipsec),
or the RFC 7166 authentication trailer on newer releases.
They will ask next
Does authentication encrypt OSPF?
No. It adds a keyed hash so the receiver can check the packet came from a router that knows the key and was not changed. LSAs are still readable in a capture. OSPFv3 with IPsec ESP can encrypt.
What is the cryptographic sequence number for?
Replay protection. Each packet carries a non-decreasing sequence number, and receivers drop packets with an older one from the same neighbor.
Traps
- Calling MD5 "encryption".
- Enabling area-wide authentication and forgetting the virtual link, which then fails.