Edge-Core AS5700-54X, Справочное руководство CLI, Страница: 850 / 1116

Chapter 29
| IP Routing Commands
Open Shortest Path First (OSPFv2)
– 850 –
Area Configuration
area authentication
This command enables authentication for an OSPF area. Use the no form to remove
authentication for an area.
Syntax
[ no ] area area-id authentication [ message-digest ]
area-id - Identifies an area for which authentication is to be configured.
The area ID can be in the form of an IPv4 address or as a four octet unsigned
integer ranging from 0-4294967295.
message-digest - Specifies message-digest (MD5) authentication.
Command Mode
Router Configuration
Default Setting
No authentication
Command Usage
◆
Use authentication to prevent routers from inadvertently joining an
unauthorized area. Configure routers in the same area with the same password
or key. All neighboring routers on the same network with the same password
will exchange routing data.
◆
Specifying authentication for an area without the message-digest keyword
sets authentication to Type 1 (simple password). Before specifying plain-text
password authentication for an area, configure a password with the
ip ospf
authentication-key interface command. This password is inserted into the
OSPF header when routing protocol packets are originated by this device.
Assign a separate password to each area for different interfaces.
◆
When using simple password authentication, a password is included in the
packet. If it does not match the password configured on the receiving router,
the packet is discarded. This method provides very little security as it is possible
to learn the authentication key by snooping on routing protocol packets.
◆
When using Message-Digest 5 (MD5) authentication, the router uses the MD5
algorithm to verify data integrity by creating a 128-bit message digest from the
authentication key. Without the proper key and key-id, it is nearly impossible to
produce any message that matches the pre-specified target message digest.
◆
Before specifying MD5 authentication for an area, configure the message-
digest key-id and key with the
ip ospf message-digest-key interface command.
◆
The plain-text authentication-key, or the MD5 key-id and key , must be used
consistently throughout the autonomous system.