Rate and give feedback:  Feedback Received. Thank You!

Rate and give feedback: 

X

This document helped resolve my issue

Yes No

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:  

E-mail: 

Enter a valid Email ID

Need product assistance? Contact Juniper Support

Submit

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.

English  

English

Example: Configuring a Transition of MD5 Keys on an OSPFv2 Interface

Requirements

Before you begin:

• Configure the device interfaces. See the Router Interfaces or the Junos OS Interfaces Configuration Guide for Security Devices.
• Configure the router identifiers for the devices in your OSPF network. See Example: Configuring an OSPF Router Identifier.
• Control OSPF designated router election. See Example: Controlling OSPF Designated Router Election
• Configure a single-area OSPF network. See Example: Configuring a Single-Area OSPF Network.
• Configure a multiarea OSPF network. See Example: Configuring a Multiarea OSPF Network.

Overview

MD5 authentication uses an encoded MD5 checksum that is included in the transmitted packet. For MD5 authentication to work, both the receiving and transmitting routing devices must have the same MD5 key.

You define an MD5 key for each interface. If MD5 is enabled on an interface, that interface accepts routing updates only if MD5 authentication succeeds. Otherwise, updates are rejected. The routing device only accepts OSPFv2 packets sent using the same key identifier (ID) that is defined for that interface.

For increased security, you can configure multiple MD5 keys, each with a unique key ID, and set the date and time to switch to a new key. The receiver of the OSPF packet uses the ID to determine which key to use for authentication.

• md5—Specifies the MD5 authentication key ID. The key ID can be set to any value between 0 and 255, with a default value of 0. The routing device only accepts OSPFv2 packets sent using the same key ID that is defined for that interface.
• key—Specifies the MD5 key. Each key can be a value from 1 through 16 characters long. Characters can include ASCII strings. If you include spaces, enclose all characters in quotation marks (“ “).
• start-time—Specifies the time to start using the MD5 key. This option enables you to configure a smooth transition mechanism for multiple keys. The start time is relevant for transmission but not for receiving OSPF packets.

Note: You must set the same passwords and transition dates and times on all devices in the area so that OSPFv2 adjacencies remain active.

Configuration

CLI Quick Configuration

To quickly configure multiple MD5 keys on an OSPFv2 interface, copy the following commands, remove any line breaks, and then paste the commands into the CLI.

Step-by-Step Procedure

1. Create an OSPF area.
   [edit]user@host# edit protocols ospf area 0.0.0.0
2. Specify the interface.
   [edit protocols ospf area 0.0.0.0]user@host# edit interface fe-0/1/0
3. Configure MD5 authentication and set an authentication password and key ID.
   [edit protocols ospf area 0.0.0.0 interface fe-0/1/0.0]user@host# set authentication md5 1 key $2010HaL
4. Configure a new key to take effect at 12:01 AM on the first day of February, March, and April.

   You configure a new authentication password and key ID for each month.

   1. For the month of February, enter the following:
      [edit protocols ospf area 0.0.0.0 interface fe-0/1/0.0]user@host# set authentication md5 2 key NeWpsswdFEB start-time 2011-02-01.00:01
   2. For the month of March, enter the following:
      [edit protocols ospf area 0.0.0.0 interface fe-0/1/0.0]user@host# set authentication md5 3 key NeWpsswdMAR start-time 2011-03-01.00:01
   3. For the month of April, enter the following:
      [edit protocols ospf area 0.0.0.0 interface fe-0/1/0.0]user@host# set authentication md5 4 key NeWpsswdAPR start-time 2011-04-01.00:01
5. If you are done configuring the device, commit the configuration.
   [edit protocols ospf area 0.0.0.0 interface fe-0/1/0.0]user@host# commit

   Note: Repeat this entire configuration on all peer OSPFv2 routing devices.

Results

Confirm your configuration by entering the show protocols ospf command. If the output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

Note: After you configure the password, you do not see the password itself. The output displays the encrypted form of the password you configured.

Verification

Confirm that the configuration is working properly.

Verifying the Configured Authentication Method

Purpose

Verify that the authentication method for sending and receiving OSPF protocol packets is configured. When configured for MD5 authentication with a transition of keys, the Auth type field displays MD5, the Active key ID field displays the unique number you entered that identifies the MD5 key, and the Start time field displays the time at which the routing device starts using an MD5 key to authenticate OSPF packets transmitted on the interface you configured.

Action

From operational mode, enter the show ospf interface and the show ospf overview commands.