Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd Logo
Upload

Welcome to Scribd!

  • 11 views

    OSPF HMAC-SHA Extended Authentication

    Uploaded by

    Marco Canales NAveda
    OSPF HMAC-SHA Extended Authentication

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    OSPF HMAC-SHA Extended Authentication

    Uploaded by

    Marco Canales NAveda
    11 views3 pages
    OSPF HMAC-SHA Extended Authentication

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    OSPF HMAC-SHA Extended Authentication

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    11 views3 pages

    OSPF HMAC-SHA Extended Authentication

    Uploaded by

    Marco Canales NAveda
    OSPF HMAC-SHA Extended Authentication

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 3

    OSPF HMAC-SHA Extended Authentication

    OSPF used to only support plain text and MD5 authentication but since IOS 15.4(1)T, OSPF also
    supports HMAC-SHA (Hash Message Authentication Code Secure Hash Algorithm). Besides the
    new algorithm, the way you configure authentication has also changed. OSPF now uses key chains
    like RIP and EIGRP.

    To demonstrate HMAC-SHA authentication, we will use these two routers:

    Configuration

    Let’s start by enabling OSPF on both routers:


    R1(config)#router ospf 1
    R1(config-router)#network 192.168.12.0 0.0.0.255 area 0
    R2(config)#router ospf 1
    R2(config-router)#network 192.168.12.0 0.0.0.255 area 0

    Now we can focus on authentication.

    R1
    First, we have to create a key chain. The name of the key chain is only locally significant so pick
    whatever you like. The key ID has to be the same on both routers. I’ll name it R1 and use key 1:
    R1(config)#key chain R1
    R1(config-keychain)#key 1

    In the key chain configuration, there are two things we have to do. First, we have to tell the router
    that we want to use a different cryptographic algorithm:
    R1(config-keychain-key)#cryptographic-algorithm ?
    hmac-sha-1 HMAC-SHA-1 authentication algorithm
    hmac-sha-256 HMAC-SHA-256 authentication algorithm
    hmac-sha-384 HMAC-SHA-384 authentication algorithm
    hmac-sha-512 HMAC-SHA-512 authentication algorithm
    md5 MD5 authentication algorithm
    As you can see above, we can choose one of the HMAC-SHA options. MD5 is also supported for
    this new key chain method. Let’s use the most secure HMAC-SHA options:
    R1(config-keychain-key)#cryptographic-algorithm hmac-sha-512

    The other thing we have to configure is the key string, the password that we want to use:
    R1(config-keychain-key)#key-string R1_R2_PASSWORD

    The only thing left to do now is to enable authentication. This can only be done on the interface,
    you can’t enable it for the entire area using this method:
    R1(config)#interface GigabitEthernet 0/1
    R1(config-if)#ip ospf authentication key-chain R1

    Let’s do the same thing on R2:

    R2
    R2(config)#key chain R2
    R2(config-keychain)#key 1
    R2(config-keychain-key)#cryptographic-algorithm hmac-sha-512
    R2(config-keychain-key)#key-string R1_R2_PASSWORD

    R2(config)#interface GigabitEthernet 0/1


    R2(config-if)#ip ospf authentication key-chain R2

    That’s all we have to configure.

    Verification
    Let’s verify our work. First, I’ll check if authentication is enabled or not:
    R1#show ip ospf interface GigabitEthernet 0/1 | begin auth
    Cryptographic authentication enabled
    Sending SA: Key 1, Algorithm HMAC-SHA-512 - key chain R1
    R2#show ip ospf interface GigabitEthernet 0/1 | begin auth
    Cryptographic authentication enabled
    Sending SA: Key 1, Algorithm HMAC-SHA-512 - key chain R2

    As you can see above, authentication is enabled using HMAC-SHA-512. Let’s make sure our two
    routers are neighbors:
    R1#show ip ospf neighbor

    Neighbor ID Pri State Dead Time Address Interface


    192.168.12.2 1 FULL/DR 00:00:31 192.168.12.2 GigabitEthernet0/1
    R2#show ip ospf neighbor

    Neighbor ID Pri State Dead Time Address Interface


    192.168.12.1 1 FULL/BDR 00:00:33 192.168.12.1 GigabitEthernet0/1

    Which seems to be the case. That’s all there is to it.

    Configurations
    R1
    R2

    Configurations

    Want to take a look for yourself? Here you will find the final configuration of each device.

    R1

    R2
    Conclusion
    You have now learned how to enable OSPF HMAC-SHA authentication:

    OSPF supports HMAC-SHA authentication since IOS 15.4(1)T.


    Authentication is configured using key chains, similar to RIP and EIGRP.
    Besides a key string, you have to configure which cryptographic algorithm you want to
    use on the key chain.

    Want to know more about OSPF HMAC-SHA authentication? RFC 5709RFC 5709 has all the
    details.

    You might also like