158
cipher-string
: Specifies a ciphertext key. This argument is case sensitive. If
simple
is specified, the key must
be a string of 33 to 41 characters. If
md5
or
hmac-md5
is specified, the key must be a string of 33 to 53
characters.
plain
: Sets a plaintext key.
plain-string
: Specifies a plaintext key. This argument is case sensitive. If
simple
is specified, the key must
be a string of 1 to 8 characters. If
md5
or
hmac-md5
is specified, the key must be a string of 1 to 16
characters.
Usage guidelines
For security purposes, all keys, including keys configured in plain text, are saved in cipher text.
The interfaces attached to the same network segment must have the same key. You can specify either
MD5/HMAC-MD5 authentication or simple authentication for an OSPF interface. For
MD5/HMAC-MD5 authentication, you can configure multiple keys by executing this command multiple
times, and each command must have a unique key ID and key string.
To modify the key of an OSPF interface, perform the following key rollover configurations:
1.
Configure a new MD5/HMAC-MD5 authentication key for the interface. If the new key is not
configured on neighbor devices, MD5/HMAC-MD5 authentication key rollover is triggered.
During key rollover, OSPF sends multiple packets that contain both the new and old
MD5/HMAC-MD5 authentication keys to ensure that all neighbor devices can pass the
authentication.
2.
Configure the new MD5/HMAC-MD5 authentication key on all neighbor devices. When the local
device receives packets with the new key from all neighbor devices, it exits MD5 key rollover.
3.
Delete the old MD5/HMAC-MD5 authentication key from the local device and all its neighbors.
This operation helps prevent attacks from devices that use the old key for communication and
reduce system resources and bandwidth consumption caused by key rollover.
Examples
# On VLAN-interface 10, enable MD5 authentication, and set the interface key ID to 15 and plaintext
key to
123456
.
<Sysname> system-view
[Sysname] interface vlan-interface 10
[Sysname-Vlan-interface10] ospf authentication-mode md5 15 plain 123456
# On VLAN-interface 10, enable simple authentication, and set the plaintext key to
123456
.
<Sysname> system-view
[Sysname] interface vlan-interface 10
[Sysname-Vlan-interface10] ospf authentication-mode simple plain 123456
Related commands
authentication-mode
ospf bfd enable
Use
ospf bfd enable
to enable BFD on an OSPF interface.
Use
undo
ospf
bfd enable
to disable BFD on an OSPF interface.
Syntax
ospf bfd enable
[
echo
]
Содержание 5900
Страница 554: ...541 Sysname Vlan interface100 isis ipv6 enable 1 ...