1
00:00:00,000 --> 00:00:02,862
[AUDIO LOGO]

2
00:00:02,862 --> 00:00:07,160

3
00:00:07,160 --> 00:00:12,620
In this video, let's jump in and
talk about OSPF authentication.

4
00:00:12,620 --> 00:00:15,770
Now, OSPF authentication
is one of those topics

5
00:00:15,770 --> 00:00:18,020
that, well, a lot
of environments

6
00:00:18,020 --> 00:00:19,970
don't implement authentication.

7
00:00:19,970 --> 00:00:21,890
And really, they should.

8
00:00:21,890 --> 00:00:24,740
It can add a little
bit more difficulty

9
00:00:24,740 --> 00:00:26,690
to the troubleshooting process.

10
00:00:26,690 --> 00:00:30,290
But overall, the
risk is if somebody

11
00:00:30,290 --> 00:00:33,665
were to compromise your network
and your routing protocol

12
00:00:33,665 --> 00:00:36,860
is not authenticated,
not only could they

13
00:00:36,860 --> 00:00:38,810
potentially learn
all of your routes

14
00:00:38,810 --> 00:00:42,170
and therefore learn where things
are on your network and maybe

15
00:00:42,170 --> 00:00:44,870
a little more information about
how your network is constructed

16
00:00:44,870 --> 00:00:48,860
than we want them to know, but
possibly even more importantly,

17
00:00:48,860 --> 00:00:52,670
they could inject routes
into your OSPF process

18
00:00:52,670 --> 00:00:56,180
and therefore create a
man in the middle attack.

19
00:00:56,180 --> 00:00:58,700
And maybe just have
your routers go places

20
00:00:58,700 --> 00:01:02,090
they're not supposed to go
or just black hole traffic.

21
00:01:02,090 --> 00:01:03,920
There's a lot of
different attacks

22
00:01:03,920 --> 00:01:07,760
that could be done if we allow
somebody to inject routes

23
00:01:07,760 --> 00:01:09,680
into our routing protocol.

24
00:01:09,680 --> 00:01:13,190
So this really is something
that should be protected.

25
00:01:13,190 --> 00:01:16,340
So let's jump in here and take
a look at the different methods

26
00:01:16,340 --> 00:01:19,250
we have to authenticate OSPF.

27
00:01:19,250 --> 00:01:21,080
We have a couple of
different choices.

28
00:01:21,080 --> 00:01:23,150
And then we'll jump
into the command line

29
00:01:23,150 --> 00:01:25,400
and we'll get this
configured so we can

30
00:01:25,400 --> 00:01:27,110
see how authentication works.

31
00:01:27,110 --> 00:01:29,330
And in fact, we'll look at
a couple of different ways

32
00:01:29,330 --> 00:01:30,890
to configure it as well.

33
00:01:30,890 --> 00:01:33,890
So let's jump in by looking
at our different options

34
00:01:33,890 --> 00:01:37,790
for OSPF authentication.

35
00:01:37,790 --> 00:01:41,750
Our first thing here is just
a reminder that authentication

36
00:01:41,750 --> 00:01:43,790
should be used.

37
00:01:43,790 --> 00:01:48,230
And of course, it's to ensure
that unauthorized routers

38
00:01:48,230 --> 00:01:51,920
cannot form a neighbor
relationship with legitimate

39
00:01:51,920 --> 00:01:52,940
routers.

40
00:01:52,940 --> 00:01:55,310
Of course, if we would
allow that to happen,

41
00:01:55,310 --> 00:01:58,580
that means that they could
either steal our routing table,

42
00:01:58,580 --> 00:02:01,520
again, getting information we
don't really want them to have,

43
00:02:01,520 --> 00:02:04,580
or possibly worse
yet, they could

44
00:02:04,580 --> 00:02:08,180
inject routes that are
not valid to either do

45
00:02:08,180 --> 00:02:11,000
man in the middle attacks
or black hole routing,

46
00:02:11,000 --> 00:02:12,080
that sort of thing.

47
00:02:12,080 --> 00:02:14,360
Anything to disrupt
the traffic flow.

48
00:02:14,360 --> 00:02:17,030
These are things, of course,
we don't want to allow.

49
00:02:17,030 --> 00:02:19,520
Now, keep in mind, very
important concept here,

50
00:02:19,520 --> 00:02:22,790
that authentication
itself does not

51
00:02:22,790 --> 00:02:25,910
involve any form of encryption.

52
00:02:25,910 --> 00:02:28,850
This is simply authentication.

53
00:02:28,850 --> 00:02:31,490
It's making sure that
our neighbors are valid,

54
00:02:31,490 --> 00:02:35,120
but it's not encrypting
the OSPF traffic itself.

55
00:02:35,120 --> 00:02:38,390
That said, somebody
with a packet sniffer

56
00:02:38,390 --> 00:02:41,120
could still get the
packets off the wire,

57
00:02:41,120 --> 00:02:44,870
decode them, and get
OSPF information.

58
00:02:44,870 --> 00:02:47,960
So there is still a potential
for compromise here.

59
00:02:47,960 --> 00:02:51,320
This can be encrypted using
other methods that are

60
00:02:51,320 --> 00:02:53,570
beyond the scope of this video.

61
00:02:53,570 --> 00:02:57,710
OSPF version 2 itself
does not offer any method

62
00:02:57,710 --> 00:02:59,720
to do encryption.

63
00:02:59,720 --> 00:03:02,090
As we jump into
our configuration,

64
00:03:02,090 --> 00:03:05,780
we'll find that this can be
enabled either at the area

65
00:03:05,780 --> 00:03:08,810
level or at the link level.

66
00:03:08,810 --> 00:03:11,900
So we can turn on
authentication area wide meaning

67
00:03:11,900 --> 00:03:14,390
that everything in the area
should be authenticated,

68
00:03:14,390 --> 00:03:18,380
or if we just have a particular
link that we want to protect,

69
00:03:18,380 --> 00:03:21,290
maybe it's going through
a higher risk network,

70
00:03:21,290 --> 00:03:24,680
then we could authenticate just
that one link if we wanted to.

71
00:03:24,680 --> 00:03:28,430
And then we have our three
authentication types.

72
00:03:28,430 --> 00:03:34,160
These are type 0, which is
none or authentication off.

73
00:03:34,160 --> 00:03:37,790
So yes, not doing
authentication is still

74
00:03:37,790 --> 00:03:39,440
a type of authentication.

75
00:03:39,440 --> 00:03:42,650
We have one which is,
of course, plain text.

76
00:03:42,650 --> 00:03:46,520
This should not, of course,
be used in most environments.

77
00:03:46,520 --> 00:03:51,170
Just like a packet sniffer could
pull the OSPF traffic itself

78
00:03:51,170 --> 00:03:55,310
off the wire, it could pull
the authentication password

79
00:03:55,310 --> 00:03:57,110
off the wire as well.

80
00:03:57,110 --> 00:04:00,170
In which case, authentication
is doing no good.

81
00:04:00,170 --> 00:04:05,840
So the best choice on this
screen is the MD5 hash.

82
00:04:05,840 --> 00:04:10,640
Now, MD5 hashes are, of course,
much better than plain text.

83
00:04:10,640 --> 00:04:14,900
However, MD5 has
been compromised.

84
00:04:14,900 --> 00:04:17,660
So even though
it's a seeded hash,

85
00:04:17,660 --> 00:04:20,480
it's still not
necessarily the best.

86
00:04:20,480 --> 00:04:26,720
But it's the best that we have
with OSPF version 2 depending

87
00:04:26,720 --> 00:04:28,130
on your equipment.

88
00:04:28,130 --> 00:04:29,780
Now, what do we mean by that?

89
00:04:29,780 --> 00:04:32,810
Well, like we said,
it is recommended

90
00:04:32,810 --> 00:04:38,240
to use md5 authentication,
but it does depend

91
00:04:38,240 --> 00:04:40,400
on what equipment you're using.

92
00:04:40,400 --> 00:04:47,720
Newer equipment supports RFC
5709, which as we can see here

93
00:04:47,720 --> 00:04:52,760
is using HMAC-SHA to
do our authentication.

94
00:04:52,760 --> 00:04:56,480
So this is an add on this
is something that came along

95
00:04:56,480 --> 00:05:00,140
a little bit later, so we need
this in our newer iOS code.

96
00:05:00,140 --> 00:05:04,880
But if your equipment
supports it, using RFC 5709

97
00:05:04,880 --> 00:05:07,910
is an even better
option than MD5.

98
00:05:07,910 --> 00:05:09,530
The reason we still
say recommended

99
00:05:09,530 --> 00:05:12,590
using MD5 is because
it does, of course,

100
00:05:12,590 --> 00:05:17,210
depend on your equipment
if you can do 5709.

101
00:05:17,210 --> 00:05:20,180
MD5 authentication has
been around a lot longer.

102
00:05:20,180 --> 00:05:22,730
Therefore, it will be
much more compatible.

103
00:05:22,730 --> 00:05:25,520
So I would change
this recommendation

104
00:05:25,520 --> 00:05:29,990
if all of your equipment
supports RFC 5709.

105
00:05:29,990 --> 00:05:32,810
Then I would
definitely go for that.

106
00:05:32,810 --> 00:05:34,400
So now that we've
talked a little bit

107
00:05:34,400 --> 00:05:36,740
about the different
authentication options that

108
00:05:36,740 --> 00:05:40,010
are available, let's jump
onto the command line

109
00:05:40,010 --> 00:05:42,320
and implement these
different options.

110
00:05:42,320 --> 00:05:44,450
Let's start by looking
at our topology

111
00:05:44,450 --> 00:05:47,060
so we know what
we're working with.

112
00:05:47,060 --> 00:05:49,700
So for this skill, we're
going to be working

113
00:05:49,700 --> 00:05:52,700
with OSPF topology three.

114
00:05:52,700 --> 00:05:55,850
And as you can see here
looking at this topology,

115
00:05:55,850 --> 00:05:58,730
it is a little bit of a mess.

116
00:05:58,730 --> 00:06:02,600
We have three different Area 0s.

117
00:06:02,600 --> 00:06:05,150
We'll, of course, be dealing
with this when we get

118
00:06:05,150 --> 00:06:07,010
to our virtual link section.

119
00:06:07,010 --> 00:06:10,580
We also have an area
1000 up here that's

120
00:06:10,580 --> 00:06:12,770
not connected to area 0 at all.

121
00:06:12,770 --> 00:06:15,380
Therefore, it's
currently isolated.

122
00:06:15,380 --> 00:06:18,650
So we have a lot of
issues in this topology

123
00:06:18,650 --> 00:06:20,780
that we're going to need to fix.

124
00:06:20,780 --> 00:06:24,440
But for now, we're just going
to be turning on authentication

125
00:06:24,440 --> 00:06:28,130
in different ways in different
areas on different routers.

126
00:06:28,130 --> 00:06:30,380
So let's just jump
in and get started.

127
00:06:30,380 --> 00:06:35,590
Just keep this topology handy
for your reference as we go.

128
00:06:35,590 --> 00:06:40,360
So let's begin here on router
1, which is running iOS XR.

129
00:06:40,360 --> 00:06:44,230
Now, we're only going to be
configuring MD5 authentication

130
00:06:44,230 --> 00:06:45,250
to start with.

131
00:06:45,250 --> 00:06:47,500
We're not going to bother
looking at plain text.

132
00:06:47,500 --> 00:06:48,280
You could do it.

133
00:06:48,280 --> 00:06:50,470
It's pretty much the
same configuration.

134
00:06:50,470 --> 00:06:52,840
So we'll just go
into router ospf 1.

135
00:06:52,840 --> 00:06:55,450
We'll turn this on for area 0.

136
00:06:55,450 --> 00:06:57,010
So the first thing
we do is we can

137
00:06:57,010 --> 00:06:59,440
figure authentication
message digest that

138
00:06:59,440 --> 00:07:03,130
tells it which type we're using,
and then we put in our key.

139
00:07:03,130 --> 00:07:05,410
So this is going to
be message digest key.

140
00:07:05,410 --> 00:07:06,850
We have to give it a number.

141
00:07:06,850 --> 00:07:09,250
So we'll give it
a key ID of one.

142
00:07:09,250 --> 00:07:11,710
We tell it that
it is in fact MD5,

143
00:07:11,710 --> 00:07:13,780
we can see that this is
the only choice here,

144
00:07:13,780 --> 00:07:16,570
and then we put in the
actual password itself.

145
00:07:16,570 --> 00:07:19,210
We're just going to
put it in clear text.

146
00:07:19,210 --> 00:07:21,040
We'll just make it Cisco_PASS.

147
00:07:21,040 --> 00:07:24,640
Let's commit those changes,
and exit configuration.

148
00:07:24,640 --> 00:07:26,640
Now, if we're going to
do area 0 authentication,

149
00:07:26,640 --> 00:07:29,015
that means we're going to have
to go do router 3 as well.

150
00:07:29,015 --> 00:07:30,970
This is going to be
the same configuration.

151
00:07:30,970 --> 00:07:32,980
So we'll enable message digest.

152
00:07:32,980 --> 00:07:35,650
And as we can see as we're
going through our commands here,

153
00:07:35,650 --> 00:07:38,890
notice our neighbor ships
are already going down.

154
00:07:38,890 --> 00:07:42,460
This is, of course,
because router 1 is already

155
00:07:42,460 --> 00:07:45,100
requiring authentication
and nobody else

156
00:07:45,100 --> 00:07:46,510
is configured for that yet.

157
00:07:46,510 --> 00:07:49,090
So we would expect these
neighbor ships to go down.

158
00:07:49,090 --> 00:07:51,610
This actually proves that
the authentication is already

159
00:07:51,610 --> 00:07:54,760
working on router 1 because
the neighbor ships are already

160
00:07:54,760 --> 00:07:56,320
failing.

161
00:07:56,320 --> 00:07:59,230
It should, of course, come
up as soon as we fix this.

162
00:07:59,230 --> 00:08:02,160
So we'll put our
key in, and we see

163
00:08:02,160 --> 00:08:05,520
that neighbor ship with router
1 has already come back up.

164
00:08:05,520 --> 00:08:07,590
Since router 4 is
part of area 0,

165
00:08:07,590 --> 00:08:09,420
we'll have to do it
over there as well.

166
00:08:09,420 --> 00:08:11,730
Since this is the exact
same configuration,

167
00:08:11,730 --> 00:08:13,620
we'll simply copy
and paste it in.

168
00:08:13,620 --> 00:08:17,590

169
00:08:17,590 --> 00:08:19,750
So that takes care of
configuring router 4.

170
00:08:19,750 --> 00:08:22,060
Next up would be router 5.

171
00:08:22,060 --> 00:08:24,790
Now, 5 five is running iOS XE.

172
00:08:24,790 --> 00:08:27,070
So that configuration is
going to be just a little bit

173
00:08:27,070 --> 00:08:29,012
different let's go over there.

174
00:08:29,012 --> 00:08:30,970
So of course, the first
thing we're going to do

175
00:08:30,970 --> 00:08:34,750
is go to configuration
mode for router ospf 1,

176
00:08:34,750 --> 00:08:38,230
and we'll turn on
area 0 authentication.

177
00:08:38,230 --> 00:08:41,020
Of course, we see that neighbor
with router 4 going down now

178
00:08:41,020 --> 00:08:43,659
since it's already been
configured for authentication

179
00:08:43,659 --> 00:08:45,400
and router 5 isn't.

180
00:08:45,400 --> 00:08:48,100
Once again, we enable
it for message digest.

181
00:08:48,100 --> 00:08:51,070
Now, one thing a little
bit different on iOS XE

182
00:08:51,070 --> 00:08:55,570
is notice it's saying we
have no valid authentication.

183
00:08:55,570 --> 00:08:59,650
The key in iOS XE goes
under the interface.

184
00:08:59,650 --> 00:09:02,980
So here, we have to go
to interface gigabit 2

185
00:09:02,980 --> 00:09:06,280
and say ip ospf
message-digest-key.

186
00:09:06,280 --> 00:09:07,930
Now, this is the same format.

187
00:09:07,930 --> 00:09:09,400
We still give it a key ID.

188
00:09:09,400 --> 00:09:12,820
So it'll be key ID 1 it's still
going to be MD5, and then,

189
00:09:12,820 --> 00:09:16,300
of course, we're going to put
in an unencrypted password

190
00:09:16,300 --> 00:09:17,650
Cisco_PASS.

191
00:09:17,650 --> 00:09:20,470
And we can see that neighbor
ship has come back up.

192
00:09:20,470 --> 00:09:23,560
One quick thing to note
about copying and pasting

193
00:09:23,560 --> 00:09:26,200
configuration though
for authentication,

194
00:09:26,200 --> 00:09:30,130
be very careful when you're
copying the password that you

195
00:09:30,130 --> 00:09:34,810
don't accidentally catch a space
at the end of the password.

196
00:09:34,810 --> 00:09:38,020
A lot of text editors won't
show that really easy,

197
00:09:38,020 --> 00:09:40,750
so be very careful
to ensure you're not

198
00:09:40,750 --> 00:09:44,950
catching any extra spaces or
else the passwords won't match.

199
00:09:44,950 --> 00:09:46,990
Next, we'll configure router 6.

200
00:09:46,990 --> 00:09:49,330
Since router 6 is
the same except

201
00:09:49,330 --> 00:09:51,970
for the interface
as gigabit 1, we'll

202
00:09:51,970 --> 00:09:54,340
go ahead and copy and
paste that one as well.

203
00:09:54,340 --> 00:09:55,990
So here in router
6, we'll simply

204
00:09:55,990 --> 00:09:57,880
paste our configuration in.

205
00:09:57,880 --> 00:10:01,240
Again, being careful not
to catch an extra space.

206
00:10:01,240 --> 00:10:03,730
Now, as we can see
here, we do not

207
00:10:03,730 --> 00:10:06,790
have any extra space on
the end of Cisco_PASS.

208
00:10:06,790 --> 00:10:09,880
We see that our neighbor ship
with router 7 has gone down.

209
00:10:09,880 --> 00:10:12,640
This, of course, is because
router 7 is not yet configured.

210
00:10:12,640 --> 00:10:15,370
So let's go ahead and
configure router 7 next.

211
00:10:15,370 --> 00:10:17,710
We'll do router 7 just a
little bit differently.

212
00:10:17,710 --> 00:10:20,230
Since we've done most of
these the same so far,

213
00:10:20,230 --> 00:10:23,890
let's use a key
chain on router 7.

214
00:10:23,890 --> 00:10:27,770
So for this, we're going
to configuration mode.

215
00:10:27,770 --> 00:10:29,270
We'll make key-chain.

216
00:10:29,270 --> 00:10:32,900
Let's just call it OSPF_KEY.

217
00:10:32,900 --> 00:10:34,850
We'll create key number 1.

218
00:10:34,850 --> 00:10:36,290
We'll configure our key-string.

219
00:10:36,290 --> 00:10:38,150
This is the actual password.

220
00:10:38,150 --> 00:10:40,370
This would be
Cisco_PASS, and then we

221
00:10:40,370 --> 00:10:44,060
have to tell it what type
of cryptography we're using.

222
00:10:44,060 --> 00:10:48,890
Now, in this case for area
0, we're only using MD5.

223
00:10:48,890 --> 00:10:51,200
But you can see we have
other choices here.

224
00:10:51,200 --> 00:10:55,430
This is where we can enable
that SHA authentication.

225
00:10:55,430 --> 00:11:00,830
And you can see that we can
use either SHA-1, SHA-256, 384,

226
00:11:00,830 --> 00:11:02,450
or 512.

227
00:11:02,450 --> 00:11:04,130
We'll do those in just a moment.

228
00:11:04,130 --> 00:11:09,260
But here in area 0, we had
said on the other routers MD5,

229
00:11:09,260 --> 00:11:11,090
so we have to stick
with that here.

230
00:11:11,090 --> 00:11:13,700
So we'll say MD5,
and the next step

231
00:11:13,700 --> 00:11:15,740
is to configure its interfaces.

232
00:11:15,740 --> 00:11:17,690
So on router 7, we
do have a couple.

233
00:11:17,690 --> 00:11:19,460
So it's interface,
gigabit 1, and we

234
00:11:19,460 --> 00:11:22,700
say ip ospf authentication.

235
00:11:22,700 --> 00:11:26,030
But this time, we're going
to say key-chain and call

236
00:11:26,030 --> 00:11:26,840
our key-chain.

237
00:11:26,840 --> 00:11:29,180
So this is OSPF underscore KEY.

238
00:11:29,180 --> 00:11:33,740
Now, we do have to do this
for interface gigabit 2 and 3.

239
00:11:33,740 --> 00:11:36,050
We can see our neighbors
coming up already.

240
00:11:36,050 --> 00:11:38,810
So there is router 6, 1, and 3.

241
00:11:38,810 --> 00:11:41,300
Just all came back
up as they should.

242
00:11:41,300 --> 00:11:43,280
And we should
actually see router 8

243
00:11:43,280 --> 00:11:46,850
go down now because we haven't
yet configured router 8.

244
00:11:46,850 --> 00:11:49,220
So we can jump over
there and configure it

245
00:11:49,220 --> 00:11:50,660
before it even goes down.

246
00:11:50,660 --> 00:11:52,910
We may not be able to
get it done that quickly,

247
00:11:52,910 --> 00:11:54,890
but we can at least
start configuring it.

248
00:11:54,890 --> 00:11:57,140
We'll do a key-chain
here as well.

249
00:11:57,140 --> 00:12:00,080
Again, we'll just
call it OSPF_KEY.

250
00:12:00,080 --> 00:12:01,610
Key 1.

251
00:12:01,610 --> 00:12:05,030
We'll set our
cryptography to MD5,

252
00:12:05,030 --> 00:12:09,160
and our key-string
to Cisco_PASS.

253
00:12:09,160 --> 00:12:12,250
And we almost got it done in
time for the neighbor ship

254
00:12:12,250 --> 00:12:14,380
not to go down, but we
didn't quite make it.

255
00:12:14,380 --> 00:12:17,170
We see the neighbor ship
went down just before we

256
00:12:17,170 --> 00:12:18,310
put in the key-string.

257
00:12:18,310 --> 00:12:20,860
Plus, we set up to
configure the interface.

258
00:12:20,860 --> 00:12:24,910
So this would be interface
gigabit 1 on router 8.

259
00:12:24,910 --> 00:12:26,470
So we'll assign our key-chain.

260
00:12:26,470 --> 00:12:29,320
Now we should see
router 7 come back up.

261
00:12:29,320 --> 00:12:30,310
There it is.

262
00:12:30,310 --> 00:12:34,360
So that takes care of all of
our area 0 authentication.

263
00:12:34,360 --> 00:12:37,060
Now, just to look at
one of our SHA options,

264
00:12:37,060 --> 00:12:40,150
let's go ahead and do
authentication in area 200

265
00:12:40,150 --> 00:12:40,870
as well.

266
00:12:40,870 --> 00:12:43,420
Just between router 6 and 10.

267
00:12:43,420 --> 00:12:45,757
Let's just start our
configuration on router 6.

268
00:12:45,757 --> 00:12:47,590
This is actually going
to be similar to some

269
00:12:47,590 --> 00:12:49,330
of the configuration
we've already done.

270
00:12:49,330 --> 00:12:51,670
We're just, again, going
to make a key-chain.

271
00:12:51,670 --> 00:12:55,550
We'll keep it the
same name, OSPF_KEY.

272
00:12:55,550 --> 00:12:57,080
Key 1.

273
00:12:57,080 --> 00:12:58,310
We'll set our key-string.

274
00:12:58,310 --> 00:13:00,435
We'll just make it the same
one, it doesn't matter.

275
00:13:00,435 --> 00:13:02,180
Cisco underscore PASS.

276
00:13:02,180 --> 00:13:04,220
But, of course, what
we're going to change

277
00:13:04,220 --> 00:13:07,220
is that cryptographic algorithm.

278
00:13:07,220 --> 00:13:10,010
Remember, we have
four choices for SHA.

279
00:13:10,010 --> 00:13:12,620
So since we're going
to run it anyway,

280
00:13:12,620 --> 00:13:15,500
we might as well
just run the 512.

281
00:13:15,500 --> 00:13:18,638
So we'll just say,
hmm, tab that out.

282
00:13:18,638 --> 00:13:20,180
And, of course, it's
going to take us

283
00:13:20,180 --> 00:13:23,660
to the next choice, which would
be 512, and we'll hit enter.

284
00:13:23,660 --> 00:13:25,640
Now, we have to assign
this on our gigabit 2

285
00:13:25,640 --> 00:13:27,650
interface, which is
the interface going up

286
00:13:27,650 --> 00:13:29,450
towards router 10.

287
00:13:29,450 --> 00:13:32,570
And for this, it's simply
ip ospf authentication.

288
00:13:32,570 --> 00:13:36,080
Once again, it's to the
key-chain, OSPF_KEY,

289
00:13:36,080 --> 00:13:38,480
and we do the same
thing on router 10.

290
00:13:38,480 --> 00:13:41,380

291
00:13:41,380 --> 00:13:44,590
Of course, we have to use the
same algorithm on both sides.

292
00:13:44,590 --> 00:13:49,240
This one is going to
be interface gigabit 1.

293
00:13:49,240 --> 00:13:51,940
We should see our neighbor
ship with router 6 come back up

294
00:13:51,940 --> 00:13:54,670
using that new algorithm now.

295
00:13:54,670 --> 00:13:57,730
If we do a show ip
ospf, we see here

296
00:13:57,730 --> 00:14:01,450
that both area 0
and area 200 are not

297
00:14:01,450 --> 00:14:03,280
configured for authentication.

298
00:14:03,280 --> 00:14:06,220
That's because we didn't
enable area authentication.

299
00:14:06,220 --> 00:14:10,600
However, if we were to say
look at interface gigabit 1,

300
00:14:10,600 --> 00:14:13,900
we see here that cryptographic
authentication is enabled.

301
00:14:13,900 --> 00:14:17,050
That it is sending
the essay of key 1,

302
00:14:17,050 --> 00:14:20,020
the algorithm is
SHA-512, and it's

303
00:14:20,020 --> 00:14:22,270
using our key-chain OSPF_KEY.

304
00:14:22,270 --> 00:14:25,150
Now, one last thing we should do
while we're here on router 10,

305
00:14:25,150 --> 00:14:28,420
since it does have an area zero
interface even though it's just

306
00:14:28,420 --> 00:14:32,080
a loopback, we should go ahead
enable that while we're here.

307
00:14:32,080 --> 00:14:34,780
So what we're going to do is
enable area authentication.

308
00:14:34,780 --> 00:14:38,740
So area 0, authentication,
message digest.

309
00:14:38,740 --> 00:14:41,080
We don't have any neighbors
at our loopback interface,

310
00:14:41,080 --> 00:14:46,660
so we don't need to set a key
on the loopback interface.

311
00:14:46,660 --> 00:14:49,540
In this video, we
jumped in and we

312
00:14:49,540 --> 00:14:52,390
looked at OSPF authentication.

313
00:14:52,390 --> 00:14:54,760
We looked at the different
types of authentication that

314
00:14:54,760 --> 00:14:59,320
are available both traditionally
and on our newer platforms,

315
00:14:59,320 --> 00:15:01,660
and then we jumped
into the command line

316
00:15:01,660 --> 00:15:03,610
and we looked at a
couple of different ways

317
00:15:03,610 --> 00:15:06,160
to implement authentication.

318
00:15:06,160 --> 00:15:08,770
We saw how to do it
at the area level,

319
00:15:08,770 --> 00:15:13,000
we saw how you have to configure
the key on the interface in iOS

320
00:15:13,000 --> 00:15:15,580
XE, and then we
also looked at how

321
00:15:15,580 --> 00:15:17,950
to configure it
using a key-chain

322
00:15:17,950 --> 00:15:21,850
as well as using SHA
authentication rather than just

323
00:15:21,850 --> 00:15:23,590
MD5.

324
00:15:23,590 --> 00:15:25,690
I hope this has been
informative for you,

325
00:15:25,690 --> 00:15:28,770
and I'd like to thank
you for viewing.

326
00:15:28,770 --> 00:15:32,000