OSPF Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

OSPF Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

Configure OSPF authentication

Updated: June 26, 2026

Want to summarize with AI?

Log in

Configure OSPF authentication using MD5 or plain text methods.

OSPF authentication helps prevent unauthorized routers from injecting incorrect routing information. Interface-level configuration takes precedence over area or process-level settings. If authentication is not set on the interface, it inherits the configuration from the area or process.

Enforce secure OSPF routing protocol operations by implementing authentication at the process, area, and interface levels to prevent unauthorized routing updates.

Before you begin

  • Determine whether to apply authentication globally, per OSPF area, or on specific interfaces.

  • Decide on the OSPF authentication method: MD5 (preferred) or plain text.

  • Ensure a valid OSPF keychain is configured if using MD5 authentication.

Follow these steps to configure and verify OSPF areas and neighbours:

Procedure

  1. Configure MD5 message digest authentication for the OSPF process and apply it to the required area or interface.

    Example:

    Router(config)# router ospf 1
Router(config-ospf)# router-id 192.168.4.3
Router(config-ospf)# area 1
Router(config-ospf-ar)# interface GigabitEthernet0/4/0/1
Router(config-ospf-ar-if)# authentication message-digest keychain ospf_intf_1

  2. Define the OSPF keychain with multiple keys and send-lifetime values.

    Example:

    key chain ospf_intf_1
key 1
send-lifetime 11:30:30 May 1 2007 duration 600
cryptographic-algorithm MD5
key-string clear ospf_intf_1
key 2
send-lifetime 11:40:30 May 1 2007 duration 600
cryptographic-algorithm MD5
key-string clear ospf_intf_1
key 3
send-lifetime 11:50:30 May 1 2007 duration 600
cryptographic-algorithm MD5
key-string clear ospf_intf_1
key 4
send-lifetime 12:00:30 May 1 2007 duration 600
cryptographic-algorithm MD5
key-string clear ospf_intf_1
key 5
send-lifetime 12:10:30 May 1 2007 duration 600
cryptographic-algorithm MD5
key-string clear ospf_intf_1

  3. Verify that keychain authentication is enabled on the interface.

    Example:

    
Router# show ospf 1 interface GigabitEthernet0/4/0/1

Keychain-based authentication enabled
Key id used is 3

  4. Verify that the configured OSPF keys are valid and active.

    Example:

    
Router# show key chain ospf_intf_1
Key-chain: ospf_intf_1/ -
Key 1 -- ...
Key 2 -- ...
Key 3 -- ... [Valid now]
...

  5. (Optional) Configure additional OSPF security features as needed, such as router ID, adjacency logging, NSF, throttle timers, or TTL hops.

    Example:

    
Router(config)# router ospf 1
Router(config-ospf)# router-id 10.10.10.100
Router(config-ospf-ar-if)# log adjacency changes detail
Router(config-ospf)# nsf ietf
Router(config-ospf)# timers throttle spf 500 500 10000
Router(config-ospf-ar)# interface GigabitEthernet0/5/0/0
Router(config-ospf-ar-if)# security ttl hops 2
Router# show ospf 1 interface GigabitEthernet0/5/0/0

  6. (Optional) Configure plain text or null authentication at the area or interface level, if needed.

    Example:

    
Router(config)# router ospf 1
Router(config-ospf)# authentication message-digest
Router(config-ospf)# router-id 192.168.4.3
Router(config-ospf)# message-digest-key 4 md5 yourkey
Router(config-ospf)# area 0
Router(config-ospf-ar)# interface GigabitEthernet0/1/0/3
Router(config-ospf-ar)# exit
Router(config-ospf-ar)# interface GigabitEthernet0/3/0/0
Router(config-ospf-ar-if)# authentication null

  7. Verify that the GTSM security TTL value is configured on an OSPF interface.

    Example:

    
show ospf 1 interface GigabitEthernet0/5/0/0

TTL security enabled, hop count 2

OSPF authentication is enabled and verified. The router securely exchanges OSPF routing information, ensuring only devices with the correct authentication settings can participate.