Supported Platforms
Related Documentation
- ACX, EX, J, M, MX, PTX, T Series, QFabric System, QFX Series standalone switches
- show bfd session
- EX, M, MX, PTX, T Series, QFX Series standalone switches
- Configuring BFD for PIM
- EX, M, MX, T Series, QFabric System, QFX Series standalone switches
- authentication-key-chains
- EX, M, MX, PTX, SRX, T Series, QFX Series standalone switches
- bfd-liveness-detection
- M, MX, T Series, QFabric System, QFX Series standalone switches
- Understanding Bidirectional Forwarding Detection Authentication for PIM
Configuring BFD Authentication for PIM
Beginning with Junos OS Release 9.6, you can configure authentication for Bidirectional Forwarding Detection (BFD) sessions running over Protocol Independent Multicast (PIM). Routing instances are also supported. The following steps are needed to configure authentication on a BFD session:
- Specify the BFD authentication algorithm for the PIM protocol.
- Associate the authentication keychain with the PIM protocol.
- Configure the related security authentication keychain.
The following sections provide instructions for configuring and viewing BFD authentication on PIM:
Configuring BFD Authentication Parameters
BFD authentication is only supported in the Canada and United States version of the Junos OS image and is not available in the export version.
To configure BFD authentication:
- Specify the algorithm (keyed-md5, keyed-sha-1, meticulous-keyed-md5, meticulous-keyed-sha-1,
or simple-password) to use for BFD authentication on a PIM
route or routing instance.[edit protocols pim]user@host# set interface ge-0/1/5 family inet bfd-liveness-detection authentication algorithm keyed-sha-1
Note: Nonstop active routing (NSR) is not supported with the meticulous-keyed-md5 and meticulous-keyed-sha-1 authentication algorithms. BFD sessions using these algorithms might go down after a switchover.
- Specify the keychain to
be used to associate BFD sessions on the specified PIM route or routing
instance with the unique security authentication keychain attributes.
The keychain you specify must match the keychain name configured at the [edit security authentication key-chains] hierarchy level.
[edit protocols pim]user@host# set interface ge-0/1/5 family inet bfd-liveness-detection authentication keychain bfd-pimNote: The algorithm and keychain must be configured on both ends of the BFD session, and they must match. Any mismatch in configuration prevents the BFD session from being created.
- Specify the unique security authentication information
for BFD sessions:
- The matching keychain name as specified in Step 2.
- At least one key, a unique integer between 0 and 63. Creating multiple keys allows multiple clients to use the BFD session.
- The secret data used to allow access to the session.
- The time at which the authentication key becomes active, in the format yyyy-mm-dd.hh:mm:ss.
[edit security]user@host# set authentication-key-chains key-chain bfd-pim key 53 secret $9$ggaJDmPQ6/tJgF/AtREVsyPsnCtUHm start-time 2009-06-14.10:00:00 - (Optional) Specify loose authentication checking if you
are transitioning from nonauthenticated sessions to authenticated
sessions.[edit protocols pim]user@host# set interface ge-0/1/5 family inet bfd-liveness-detection authentication loose-check
- (Optional) View your configuration by using the show bfd session detail or show bfd session extensive command.
- Repeat these steps to configure the other end of the BFD session.
Viewing Authentication Information for BFD Sessions
You can view the existing BFD authentication configuration by using the show bfd session detail and show bfd session extensive commands.
The following example shows BFD authentication configured for the ge-0/1/5 interface. It specifies the keyed SHA-1 authentication algorithm and a keychain name of bfd-pim. The authentication keychain is configured with two keys. Key 1 contains the secret data “$9$ggaJDmPQ6/tJgF/AtREVsyPsnCtUHm” and a start time of June 1, 2009, at 9:46:02 AM PST. Key 2 contains the secret data “$9$a5jiKW9l.reP38ny.TszF2/9” and a start time of June 1, 2009, at 3:29:20 PM PST.
If you commit these updates to your configuration, you see output similar to the following example. In the output for the show bfd session detail command, Authenticate is displayed to indicate that BFD authentication is configured. For more information about the configuration, use the show bfd session extensive command. The output for this command provides the keychain name, the authentication algorithm and mode for each client in the session, and the overall BFD authentication configuration status, keychain name, and authentication algorithm and mode.
show bfd session detail
user@host# show bfd session detail Detect Transmit Address State Interface Time Interval Multiplier 50.0.0.2 Up ge-0/1/5.0 0.900 0.300 3 Client PIM, TX interval 0.300, RX interval 0.300, Authenticate Session up time 3d 00:34 Local diagnostic None, remote diagnostic NbrSignal Remote state Up, version 1 Replicated
show bfd session extensive
user@host# show bfd session extensive Detect Transmit Address State Interface Time Interval Multiplier 50.0.0.2 Up ge-0/1/5.0 0.900 0.300 3 Client PIM, TX interval 0.300, RX interval 0.300, Authenticate keychain bfd-pim, algo keyed-sha-1, mode strict Session up time 00:04:42 Local diagnostic None, remote diagnostic NbrSignal Remote state Up, version 1 Replicated Min async interval 0.300, min slow interval 1.000 Adaptive async TX interval 0.300, RX interval 0.300 Local min TX interval 0.300, minimum RX interval 0.300, multiplier 3 Remote min TX interval 0.300, min RX interval 0.300, multiplier 3 Local discriminator 2, remote discriminator 2 Echo mode disabled/inactive Authentication enabled/active, keychain bfd-pim, algo keyed-sha-1, mode strict
Related Documentation
- ACX, EX, J, M, MX, PTX, T Series, QFabric System, QFX Series standalone switches
- show bfd session
- EX, M, MX, PTX, T Series, QFX Series standalone switches
- Configuring BFD for PIM
- EX, M, MX, T Series, QFabric System, QFX Series standalone switches
- authentication-key-chains
- EX, M, MX, PTX, SRX, T Series, QFX Series standalone switches
- bfd-liveness-detection
- M, MX, T Series, QFabric System, QFX Series standalone switches
- Understanding Bidirectional Forwarding Detection Authentication for PIM
Modified: 2015-07-31
Supported Platforms
Related Documentation
- ACX, EX, J, M, MX, PTX, T Series, QFabric System, QFX Series standalone switches
- show bfd session
- EX, M, MX, PTX, T Series, QFX Series standalone switches
- Configuring BFD for PIM
- EX, M, MX, T Series, QFabric System, QFX Series standalone switches
- authentication-key-chains
- EX, M, MX, PTX, SRX, T Series, QFX Series standalone switches
- bfd-liveness-detection
- M, MX, T Series, QFabric System, QFX Series standalone switches
- Understanding Bidirectional Forwarding Detection Authentication for PIM