Is there any way of using key chains for authentication with OSPF like you can do for EIGRP? I want to be able to age and introduce new passwords for one of my OSPF areas and without key chains I dont think I will be able to do it. Any help would be appreciated. Thanks.
"Usually, one key per interface is used to generate authentication information when sending packets and to authenticate incoming packets. The same key identifier on the neighbor router must have the same key value.
The process of changing keys is as follows. Suppose the current configuration is as follows:
interface ethernet 1
ip ospf message-digest-key 100 md5 OLD
You change the configuration to the following:
interface ethernet 1
ip ospf message-digest-key 101 md5 NEW
The system assumes its neighbors do not have the new key yet, so it begins a rollover process. It sends multiple copies of the same packet, each authenticated by different keys. In this example, the system sends out two copies of the same packet?the first one authenticated by key 100 and the second one authenticated by key 101.
Rollover allows neighboring routers to continue communication while the network administrator is updating them with the new key. Rollover stops once the local system finds that all its neighbors know the new key. The system detects that a neighbor has the new key when it receives packets from the neighbor authenticated by the new key.
After all neighbors have been updated with the new key, the old key should be removed."
"We recommend that you not keep more than one key per interface. Every time you add a new key, you should remove the old key to prevent the local system from continuing to communicate with a hostile system that knows the old key. Removing the old key also reduces overhead during rollover."
Is key rollover supposed to work like this on NX-OS as well? We have observed only 1 key at a time being used in transmitted packets when multiple "ip ospf message-digest-key" commands are configured on an interface.
Hi everyone, I would like to thank you in advance for any help you can provide a newcomer like myself!
Im studying the 100-105 book by Odom and am currently on the topic of Port security. I purchased a used 2960 and I'm trying to follow a...
While deploying a number of 18xx/2802/3802 model access points (APs), which run AP-COS as their operating platform. It can be observed on some occasions that while many of their access points were able to join the fabric WLC withou...
I am going to design and build an LAN network under a tunnel underground with long distance between the switches.
I will have 2 Catalyst switches and 8 Industrial IE3000, and they will be connected with fiber.
For now I am planning on use Layer-2 s...