Cisco APIC Layer 3 Networking Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Layer 3 Networking Configuration Guide, Release 6.2(x)

Create an OSPF interface profile

Updated: April 17, 2026

Want to summarize with AI?

Log in

Creates an OSPF interface profile for an L3Out interface and configures an interface policy, OSPFv2 authentication, or an OSPFv3 IPsec policy.

An OSPF interface profile enables OSPF on an L3Out interface. You can associate the profile with an OSPF interface policy to control additional interface properties.

The following configuration errors generate faults and bring down the OSPF session:

  • The key-chain policy does not contain a preshared key.

  • The key-chain policy does not contain a key string.

  • The key-chain policy specifies an unsupported encryption algorithm, such as 3DES or AES.

If the send or accept lifetime expires and no key is active, the OSPF session goes down without generating a fault. The key-chain state under the OSPF interface changes to not-ready.

Before you begin

  • Install the Cisco ACI fabric. Ensure that the Cisco APIC controllers are online and that the cluster is formed and healthy.

  • Obtain a Cisco APIC fabric-administrator account that can create the required fabric infrastructure configuration.

  • Register the target leaf switches in the Cisco ACI fabric, and verify that they are available.

  • If the L3Out interfaces use port channels, configure the port channels.

Procedure

  1. From the menu bar, choose Tenants > All Tenants .

  2. In the Work pane, double-click the tenant name.

  3. In the Navigation pane, expand tenant_name > Networking > L3Outs > L3Out_name > Logical Node Profiles > node_profile_name > Logical Interface Profiles > OSPF Interface Profile .

  4. In the Name field, enter a profile name that contains 1 through 64 alphanumeric characters.

    Note

    You cannot change the name after you save the profile.

  5. In the Description field, enter a description that contains up to 128 alphanumeric characters.

  6. In the Target Interface Policy Name field, enter a policy name that contains 1 through 64 alphanumeric characters.

    Note

    You cannot change the policy name after you save the profile.

  7. To use simple or MD5 authentication for OSPFv2, configure the authentication fields:

    1. In the OSPFv2 Authentication Key field, enter an authentication key of up to eight characters.

      The key must match on every router that connects to the interface.

      Note

      To use simple authentication, configure the OSPF authentication type for the entire area as Simple. The default is None.

    2. In the Confirm OSPFv2 Authentication Key field, reenter the authentication key.
    3. In the OSPFv2 Authentication Key ID field, enter the authentication key ID.
    4. From the OSPFv2 Authentication Type field, select an authentication type.

      • None: Does not authenticate OSPF neighbors. This value is the default.

      • Simple: Uses the value in the OSPFv2 Authentication Key field. Configure the same authentication type and key on every router in the OSPF area.

      • MD5: Uses the MD5 message-digest algorithm so that the password does not traverse the network. Configure MD5 authentication throughout the OSPF area.

  8. To use key-chain authentication for OSPFv2, select a policy from the OSPFv2 KeyChain Policy field.

    An OSPFv2 key-chain policy supports HMAC-SHA, simple, and MD5 authentication and can contain multiple keys. To rotate keys, configure a lifetime for each key. When a key lifetime expires, OSPF uses the next active key.

    If you do not specify an algorithm, OSPF uses MD5 as the default cryptographic authentication algorithm.

    Note

    A new key is preferred over existing keys.

    An OSPFv2 key-chain policy overrides the value in the OSPFv2 Authentication Type field.

  9. For OSPFv3, select an IPsec policy from the OSPFv3 IPsec Policy field. To create a policy, see Create an OSPF IPsec policy .

  10. Click Submit.

The OSPF interface profile is created and associated with the selected authentication or IPsec policy.

What to do next

To configure rotating keys for the OSPFv2 key-chain policy, see Create a key policy .

Create a key policy

Before you begin

Create the OSPFv2 interface profile. For instructions, see Create an OSPF interface profile .

Procedure

  1. From the menu bar, choose Tenants > All Tenants .

  2. In the Work pane, double-click the tenant name.

  3. In the Navigation pane, choose Policies > Protocol > KeyChains .

  4. Right-click KeyChains, choose Create Key Policy, and configure the key:

    1. In the Name field, enter a policy name.
    2. Optional: In the Description field, enter a description.
    3. In the Key ID field, enter a valid key ID.
    4. In the Pre-Shared Key field, enter the preshared key.
    5. From the Cryptographic Algorithm field, select an algorithm.

      If you do not select an algorithm, OSPF uses MD5.

    6. In the Start Time field, enter the send-lifetime start time in YYYY-MM-DD HH:MM:SS format.
    7. In the End Time field, enter the send-lifetime end time in YYYY-MM-DD HH:MM:SS format.
    8. In the Key Accept Lifetime Start Time field, enter the accept-lifetime start time in YYYY-MM-DD HH:MM:SS format.

      When a key lifetime expires, OSPF rotates to the next active key.

      This field does not apply to an OSPFv3 IPsec policy.

      Note

      A new key is preferred over existing keys.

    9. In the Key Accept Lifetime End Time field, enter the accept-lifetime end time in YYYY-MM-DD HH:MM:SS format.

      This field does not apply to an OSPFv3 IPsec policy.

  5. Click Submit.

The key policy is created with the configured authentication and lifetime settings.

Create an OSPFv3 IPsec policy

Cisco APIC release 6.1(2) and later supports authentication and encryption for OSPFv3 sessions.

OSPFv3 and OSPFv3 IPsec policies are supported only in user tenants, not in the infrastructure tenant.

Before you begin

Create a key-chain policy.

Procedure

  1. From the menu bar, choose Tenants > tenant_name .

  2. In the Navigation pane, choose Policies > Protocol > OSPF > OSPF IPSec .

  3. In the Create IPSec Authentication Policy dialog box, configure the policy:

    1. In the Name field, enter a policy name.
    2. Optional: In the Description field, enter a policy description.
    3. From the IP Security Protocol field, select Authentication Header (AH) or Encapsulating Security Payload (ESP).

      • Authentication Header (AH): Provides authentication only. The supported key-chain algorithms are MD5, which is the default, and HMAC-SHA1.

      • Encapsulating Security Payload (ESP): Provides authentication, encryption, or both. HMAC-SHA1 provides authentication. 3DES, which is the default, and AES provide encryption.

      Note

      If you do not select an algorithm or select an unsupported algorithm, the policy uses the applicable default algorithm.

    4. From the Security Parameter Index field, select a unique value from 256 through 4294967295.
    5. From the OSPFv3 Authentication Keychain field, select an authentication key-chain policy.

      This field is required when IP Security Protocol is Authentication Header (AH). If you leave the field blank, Cisco APIC generates a fault.

      To view the fault, open the OSPF interface profile and click the Faults tab.

    6. From the OSPFv3 Encryption Keychain field, select an encryption key-chain policy, if required.

      This field does not apply when IP Security Protocol is Authentication Header (AH).

      When IP Security Protocol is Encapsulating Security Payload (ESP), select a value for OSPFv3 Authentication Keychain, OSPFv3 Encryption Keychain, or both.

  4. Click Submit.

    To verify the IPsec policy on the switch through an SSH or console session, use the show ipv6 ospfv3 interface interface_id command.

The OSPFv3 IPsec policy is created in the user tenant.

What to do next

Associate the OSPFv3 IPsec policy with an L3Out interface. For instructions, see Create an OSPF interface profile .