[AUDIO LOGO]
In this video, let's jump in and talk about OSPF authentication.
Now, OSPF authentication is one of those topics
that, well, a lot of environments
don't implement authentication.
And really, they should.
It can add a little bit more difficulty
to the troubleshooting process.
But overall, the risk is if somebody
were to compromise your network and your routing protocol
is not authenticated, not only could they
potentially learn all of your routes
and therefore learn where things are on your network and maybe
a little more information about how your network is constructed
than we want them to know, but possibly even more importantly,
they could inject routes into your OSPF process
and therefore create a man in the middle attack.
And maybe just have your routers go places
they're not supposed to go or just black hole traffic.
There's a lot of different attacks
that could be done if we allow somebody to inject routes
into our routing protocol.
So this really is something that should be protected.
So let's jump in here and take a look at the different methods
we have to authenticate OSPF.
We have a couple of different choices.
And then we'll jump into the command line
and we'll get this configured so we can
see how authentication works.
And in fact, we'll look at a couple of different ways
to configure it as well.
So let's jump in by looking at our different options
for OSPF authentication.
Our first thing here is just a reminder that authentication
should be used.
And of course, it's to ensure that unauthorized routers
cannot form a neighbor relationship with legitimate
routers.
Of course, if we would allow that to happen,
that means that they could either steal our routing table,
again, getting information we don't really want them to have,
or possibly worse yet, they could
inject routes that are not valid to either do
man in the middle attacks or black hole routing,
that sort of thing.
Anything to disrupt the traffic flow.
These are things, of course, we don't want to allow.
Now, keep in mind, very important concept here,
that authentication itself does not
involve any form of encryption.
This is simply authentication.
It's making sure that our neighbors are valid,
but it's not encrypting the OSPF traffic itself.
That said, somebody with a packet sniffer
could still get the packets off the wire,
decode them, and get OSPF information.
So there is still a potential for compromise here.
This can be encrypted using other methods that are
beyond the scope of this video.
OSPF version 2 itself does not offer any method
to do encryption.
As we jump into our configuration,
we'll find that this can be enabled either at the area
level or at the link level.
So we can turn on authentication area wide meaning
that everything in the area should be authenticated,
or if we just have a particular link that we want to protect,
maybe it's going through a higher risk network,
then we could authenticate just that one link if we wanted to.
And then we have our three authentication types.
These are type 0, which is none or authentication off.
So yes, not doing authentication is still
a type of authentication.
We have one which is, of course, plain text.
This should not, of course, be used in most environments.
Just like a packet sniffer could pull the OSPF traffic itself
off the wire, it could pull the authentication password
off the wire as well.
In which case, authentication is doing no good.
So the best choice on this screen is the MD5 hash.
Now, MD5 hashes are, of course, much better than plain text.
However, MD5 has been compromised.
So even though it's a seeded hash,
it's still not necessarily the best.
But it's the best that we have with OSPF version 2 depending
on your equipment.
Now, what do we mean by that?
Well, like we said, it is recommended
to use md5 authentication, but it does depend
on what equipment you're using.
Newer equipment supports RFC 5709, which as we can see here
is using HMAC-SHA to do our authentication.
So this is an add on this is something that came along
a little bit later, so we need this in our newer iOS code.
But if your equipment supports it, using RFC 5709
is an even better option than MD5.
The reason we still say recommended
using MD5 is because it does, of course,
depend on your equipment if you can do 5709.
MD5 authentication has been around a lot longer.
Therefore, it will be much more compatible.
So I would change this recommendation
if all of your equipment supports RFC 5709.
Then I would definitely go for that.
So now that we've talked a little bit
about the different authentication options that
are available, let's jump onto the command line
and implement these different options.
Let's start by looking at our topology
so we know what we're working with.
So for this skill, we're going to be working
with OSPF topology three.
And as you can see here looking at this topology,
it is a little bit of a mess.
We have three different Area 0s.
We'll, of course, be dealing with this when we get
to our virtual link section.
We also have an area 1000 up here that's
not connected to area 0 at all.
Therefore, it's currently isolated.
So we have a lot of issues in this topology
that we're going to need to fix.
But for now, we're just going to be turning on authentication
in different ways in different areas on different routers.
So let's just jump in and get started.
Just keep this topology handy for your reference as we go.
So let's begin here on router 1, which is running iOS XR.
Now, we're only going to be configuring MD5 authentication
to start with.
We're not going to bother looking at plain text.
You could do it.
It's pretty much the same configuration.
So we'll just go into router ospf 1.
We'll turn this on for area 0.
So the first thing we do is we can
figure authentication message digest that
tells it which type we're using, and then we put in our key.
So this is going to be message digest key.
We have to give it a number.
So we'll give it a key ID of one.
We tell it that it is in fact MD5,
we can see that this is the only choice here,
and then we put in the actual password itself.
We're just going to put it in clear text.
We'll just make it Cisco_PASS.
Let's commit those changes, and exit configuration.
Now, if we're going to do area 0 authentication,
that means we're going to have to go do router 3 as well.
This is going to be the same configuration.
So we'll enable message digest.
And as we can see as we're going through our commands here,
notice our neighbor ships are already going down.
This is, of course, because router 1 is already
requiring authentication and nobody else
is configured for that yet.
So we would expect these neighbor ships to go down.
This actually proves that the authentication is already
working on router 1 because the neighbor ships are already
failing.
It should, of course, come up as soon as we fix this.
So we'll put our key in, and we see
that neighbor ship with router 1 has already come back up.
Since router 4 is part of area 0,
we'll have to do it over there as well.
Since this is the exact same configuration,
we'll simply copy and paste it in.
So that takes care of configuring router 4.
Next up would be router 5.
Now, 5 five is running iOS XE.
So that configuration is going to be just a little bit
different let's go over there.
So of course, the first thing we're going to do
is go to configuration mode for router ospf 1,
and we'll turn on area 0 authentication.
Of course, we see that neighbor with router 4 going down now
since it's already been configured for authentication
and router 5 isn't.
Once again, we enable it for message digest.
Now, one thing a little bit different on iOS XE
is notice it's saying we have no valid authentication.
The key in iOS XE goes under the interface.
So here, we have to go to interface gigabit 2
and say ip ospf message-digest-key.
Now, this is the same format.
We still give it a key ID.
So it'll be key ID 1 it's still going to be MD5, and then,
of course, we're going to put in an unencrypted password
Cisco_PASS.
And we can see that neighbor ship has come back up.
One quick thing to note about copying and pasting
configuration though for authentication,
be very careful when you're copying the password that you
don't accidentally catch a space at the end of the password.
A lot of text editors won't show that really easy,
so be very careful to ensure you're not
catching any extra spaces or else the passwords won't match.
Next, we'll configure router 6.
Since router 6 is the same except
for the interface as gigabit 1, we'll
go ahead and copy and paste that one as well.
So here in router 6, we'll simply
paste our configuration in.
Again, being careful not to catch an extra space.
Now, as we can see here, we do not
have any extra space on the end of Cisco_PASS.
We see that our neighbor ship with router 7 has gone down.
This, of course, is because router 7 is not yet configured.
So let's go ahead and configure router 7 next.
We'll do router 7 just a little bit differently.
Since we've done most of these the same so far,
let's use a key chain on router 7.
So for this, we're going to configuration mode.
We'll make key-chain.
Let's just call it OSPF_KEY.
We'll create key number 1.
We'll configure our key-string.
This is the actual password.
This would be Cisco_PASS, and then we
have to tell it what type of cryptography we're using.
Now, in this case for area 0, we're only using MD5.
But you can see we have other choices here.
This is where we can enable that SHA authentication.
And you can see that we can use either SHA-1, SHA-256, 384,
or 512.
We'll do those in just a moment.
But here in area 0, we had said on the other routers MD5,
so we have to stick with that here.
So we'll say MD5, and the next step
is to configure its interfaces.
So on router 7, we do have a couple.
So it's interface, gigabit 1, and we
say ip ospf authentication.
But this time, we're going to say key-chain and call
our key-chain.
So this is OSPF underscore KEY.
Now, we do have to do this for interface gigabit 2 and 3.
We can see our neighbors coming up already.
So there is router 6, 1, and 3.
Just all came back up as they should.
And we should actually see router 8
go down now because we haven't yet configured router 8.
So we can jump over there and configure it
before it even goes down.
We may not be able to get it done that quickly,
but we can at least start configuring it.
We'll do a key-chain here as well.
Again, we'll just call it OSPF_KEY.
Key 1.
We'll set our cryptography to MD5,
and our key-string to Cisco_PASS.
And we almost got it done in time for the neighbor ship
not to go down, but we didn't quite make it.
We see the neighbor ship went down just before we
put in the key-string.
Plus, we set up to configure the interface.
So this would be interface gigabit 1 on router 8.
So we'll assign our key-chain.
Now we should see router 7 come back up.
There it is.
So that takes care of all of our area 0 authentication.
Now, just to look at one of our SHA options,
let's go ahead and do authentication in area 200
as well.
Just between router 6 and 10.
Let's just start our configuration on router 6.
This is actually going to be similar to some
of the configuration we've already done.
We're just, again, going to make a key-chain.
We'll keep it the same name, OSPF_KEY.
Key 1.
We'll set our key-string.
We'll just make it the same one, it doesn't matter.
Cisco underscore PASS.
But, of course, what we're going to change
is that cryptographic algorithm.
Remember, we have four choices for SHA.
So since we're going to run it anyway,
we might as well just run the 512.
So we'll just say, hmm, tab that out.
And, of course, it's going to take us
to the next choice, which would be 512, and we'll hit enter.
Now, we have to assign this on our gigabit 2
interface, which is the interface going up
towards router 10.
And for this, it's simply ip ospf authentication.
Once again, it's to the key-chain, OSPF_KEY,
and we do the same thing on router 10.
Of course, we have to use the same algorithm on both sides.
This one is going to be interface gigabit 1.
We should see our neighbor ship with router 6 come back up
using that new algorithm now.
If we do a show ip ospf, we see here
that both area 0 and area 200 are not
configured for authentication.
That's because we didn't enable area authentication.
However, if we were to say look at interface gigabit 1,
we see here that cryptographic authentication is enabled.
That it is sending the essay of key 1,
the algorithm is SHA-512, and it's
using our key-chain OSPF_KEY.
Now, one last thing we should do while we're here on router 10,
since it does have an area zero interface even though it's just
a loopback, we should go ahead enable that while we're here.
So what we're going to do is enable area authentication.
So area 0, authentication, message digest.
We don't have any neighbors at our loopback interface,
so we don't need to set a key on the loopback interface.
In this video, we jumped in and we
looked at OSPF authentication.
We looked at the different types of authentication that
are available both traditionally and on our newer platforms,
and then we jumped into the command line
and we looked at a couple of different ways
to implement authentication.
We saw how to do it at the area level,
we saw how you have to configure the key on the interface in iOS
XE, and then we also looked at how
to configure it using a key-chain
as well as using SHA authentication rather than just
MD5.
I hope this has been informative for you,
and I'd like to thank you for viewing.