ospf part 4: ospf authentication

Hi there mate! This will be the last discussion on OSPF configuration. The rest of the OSPF topics will discuss how OSPF works and the content of Hello packet. The last topic that we had was configuring passive interfaces for security reasons. This time, we will configure OSPF with authentication using encrypted passwords. The need for configuring authentication is very simple, it is to provide security to active interfaces.  I mean active interface are those interfaces that receives and sends hello or OSPF updates. They cannot be a passive interface so authentication will be the best process to secure those interfaces.

Just come to imagine the scenario below wherein12a1

Instead that the interface serial 1/0 of router 1 is connected to router2. It was connected to hacking router so it will lead to security breach.

So let us get back to our original topology.

12a2.PNG

Authentication SYNTAX:

en 
conf t
router ospf {process#} <— process # 
area {area#} authentication message digest < — we set authentication on the entire area on specific router
exit
int serial x/x
ip ospf message-digest-key 1 md5 {password} <— the authentication used is MD5 , you can further check on google how it works 

Note: 1.) We set password on each interface since the security breach may happen on each                     interface

2.) We can set multiple passwords on each interface: the syntax will follow:

 

int serial x/x
ip ospf message-digest-key 1 md5 {password}
ip ospf message-digest-key 2 md5 {password}

Very easy configuration right? So let us try to check the configuration on each router.
en
conf t
router ospf 100
area 0 authentication message-digest
exit
int se 1/0
ip ospf message-digest-key 1 md5 cisco

12a3

As we can see, opsf neighbor adjacency went down. It is for the reason that the neighbor router is not also configured with authentication and so they will not established neighbor relationship. Another way to verify: show ip ospf neighbor

12a4

So no neighbor relationship established. We can now continue with R2 authentication configuration:

@r2

en
conf t
router ospf 100
area 0 authentication message-digest
exit

12a5

As I go on, I can see that neighbor adjacency went down even without configuring the interfaces. It is for the reason that authentication was configured globally so it affects all the interfaces involved. We need to go by interfaces so that it would be more secured and to specify the password. How we will enter a locked door without a key? There should be a key. We need to specify the password / key-string. Below shows that no neighbor adjacency was established.

12a6

Let us continue the configuration:

int se 1/0
ip ospf message-digest-key 1 md5 cisco
int se 1/1
ip ospf message-digest-key 1 md5 cisco
exit

Below is what happened when I configured authentication on R2. We can see that serial 1/0 went up since it is connected to R1 and R1 has already md5 configuration. We can see on neighbor table that only R1 exists since R3 doesnt have md5 configuration.

12a7.png

Below is the neighbor table of R1, it shows that he can now see R2

12a8

Lastly, let us configure R3:
en
conf t
router ospf 100
area 0 authentication message-digest
exit
int se 1/1
ip ospf message-digest-key 1 md5 cisco
exit

12a9.png

Nothing much special with R3 configuration. We already discussed that serial 1/1 is possible to turn up since all routers has already md5 authentication and also router 2 appears on neighbor table. One thing that I can add to is that you alway see that term “from loading to FULL”. Those are stages of neighbor adjacency which we will discuss on the next topics.

I guess right now, you wonder how ospf works? We will discuss that on the next topic.

Advertisements

OSPF part 2: Router-ID

Hi mate, good morning!  We will be dealing back with our network topology that we configured before.o7a

You wonder what is router-id right? Router-id is the identifier of router on the perception of another router. I am sorry if it is a little bit confusing. Here’s how it goes, R1 would identify R2 by R2’s router-id and R2 would identify R1 by R1’s router ID.

I hope that your GNS3 is now ready. Kindly input ” show ip protocols”

12a.PNG

Router-ID is an important concept in each routing protocols specially with OSPF and EIGRP. When R1 would like to connect to R2, of course R1 should introduce himself and R1 will introduce his router-id as his name. On the figure above, you would see ROUTING INFORMATION SOURCES and the ip address written on the gateway column is the router-id. So how would we know the router-id which should be listed? There are hierarchy to know the router-id and these are the following from the top priority to the least priority.

1.) Hard-coded router-id – this is the router-id that we manually configure.

2.) Highest loopback address- very self-explanatory, the loopback address which has highest numerical value

3.)Highest ip address-   very self-explanatory, the ip address which has highest numerical value

If ever you wonder why there are two router-ids on the “show ip protocols” command, it was because there are two neighbor routers.

12b

Before we proceed with manually configuring the IP address, let us try to remove the loopback addresses, to know if removing the loopback address would lead us that the highest IP address will be the last resort if there are no loopback address and no hard-coded router-id. Since it is very obvious on the figure above that highest loopback address was used instead of hard coded router-id and highest IP address.

Let us try to implement:

on R2

conf t

int lo 0
ip address 192.168.91.1 255.255.255.0
shut
int lo 1
ip address 192.168.92.1 255.255.255.0
shut
int lo 2
ip address 192.168.93.1 255.255.255.0
shut
exit
do sh ip int br

 

on R3

en
conf t

int lo 0
ip address 10.0.0.1 255.255.255.0
shut
int lo 1
ip address 20.0.0.1 255.255.255.0
shut
exit
do sh ip int br

 

As you observed, the router-ids are not changed. Why is it happening? because R1 already knows R2 as 192.168.93.1 and R1 already knows R3 as 20.0.0.1 and so in the event there are changes with R2 and R3, R1 would still identify R2 and R3 as their original router-ids unless R2 and R3 reintroduce themselves to R1.  In order that R2 and R3 will reintroduce themselves to R1, we need to restart the routers.

12c

 

Alright, the routers just got restarted, and let us check sh ip protocols command,

12d

You would see that 201.52.30.2 which is not a loopback nor hard-coded router-id on the routing information sources. Due to incorrect configuration, only one router-is is known by R1 and  R3’s router-id is not known by R1. Also, you will see above the the router-id of R1 still remain as 172.16.17.1 since we did not touch that.So let us retrieve the loopback addresses.

12e.PNG

***********************************************************************Configuration of Router-IDs

Mate, it is very clear that the reason why we consider hard-coded router-ids as top of the hierarchy is because it is something stable or meaning to say it will not vary. What I mean is that in the event that the interface with highest ip address went down or the loopback address was accidentally went to administratively down, it may cause misconfiguration which will lead to network disruption.So it is advisable in the industry, to configure router-id. So let us take note that router-id doesnt necessarily mean that it is an ip address though it looks like ip address.

Let us designate the router-ids of routers:

R1 1.1.1.1

R2 2.2.2.2

R3 3.3.3.3

SYNTAX:

en
conf t
router ospf  {process#}
router-id x.x.x.x
do clear ip ospf process  —> it will appear and it is your discretion whether to restart router or clear the router-ids, then type  YES
do wr
exit
do sh ip protocols

@R1

en
conf t
router ospf 100
router-id 1.1.1.1
do clear ip ospf process  ; type YES
do wr
exit
do sh ip protocols

 

@r2

en
conf t
router ospf 100
router-id 2.2.2.2
do clear ip ospf process; type YES
do wr
exit

 

@R3

en
conf t
router ospf 100
router-id 3.3.3.3
do clear ip ospf process; type YES
do wr
exit

 

And there you go, we will check the router-id of R1, please take note that old router-ids may take time to be removed on the sh ip protocols table

12f

Let’s check R2

12g

 

Let’s check R3

12h

And there dyou go! We are able to at least configure router id on OSPF protocol. Next ospf process that we will configure is passive inteface and security features of OSPF. After that, we will explain how OSPF works. Stay tuned!