A router link that runs through a shared building
R2 Gi0/1, 10.0.23.1/30, connects to R3 Gi0/0, 10.0.23.2/30, through a switch. R2 and R3 need to exchange OSPF routing information, so this link cannot be passive. Another device with access to the same VLAN could try to join that conversation. Without authentication, compatible OSPF settings and access to the link may let it form a neighbour relationship.
On small screens, swipe sideways or focus the diagram and use the arrow keys.
OSPF authentication adds a receiver check before OSPF accepts a packet. With cryptographic authentication, both routers hold a shared key, a secret value configured locally. The sender calculates a digest, a check value derived from the packet and key. The receiver calculates the expected value and compares it.
Null, plain text and cryptographic authentication
OSPFv2 offers three authentication types, chosen per interface (or per area):
On small screens, swipe sideways or focus the diagram and use the arrow keys.
On small screens, swipe sideways or focus the diagram and use the arrow keys.
The authentication type and key are part of the hello check, like the area and timers. If they don't match for a key the receiver accepts, neighbour formation fails. Authentication also applies to later OSPF packets, not only Hellos.
- Auth type 2, key ID 1, sequence 1739, hash of (packet + Lab-Key-23).Hello from R2 to R3.Hello
- R3 checksLook up key ID 1, verify the digest with the local key and apply the sequence-number checks. Accept only if the required checks pass.
- HelloAuth type 2, key ID 1, sequence 902, hash of (packet + Lab-Key-23).Hello from R3 to R2.
- NeighboursBoth checks pass and the adjacency forms as normal. Every later DBD, LSR, LSU and LSAck carries a hash too.
- HelloFrom a laptop: no authentication, or a guessed key.Hello from R3 to R2.
- DroppedType or hash doesn't match: R2 ignores the packet. The laptop never becomes a neighbour.
Device key: R2, R3 (router)
The top line is the shared network link; port labels name its interfaces. Read message rows from top to bottom and follow each arrow from sender to receiver. Rows show protocol order, not additional cables or timing to scale.
Reading the addresses
IP labels identify interfaces or destinations. Subnet labels identify networks; /n is the prefix length. A router ID (RID) identifies a routing process and need not be a reachable interface.
An IP address alone is not a URL. A web URL includes a scheme such as https://; an address on a router or printer does not imply a website.
- R2: key 1 = Lab-Key-23 · 10.0.23.1
- R3: key 1 = Lab-Key-23 · 10.0.23.2
What the digest and sequence number actually check
The digest lets the receiver detect packet changes and reject packets without valid shared-key proof. The key is not carried as a plain-text field in cryptographic authentication. Routing records remain visible, and weak keys still need protection. The sequence number helps identify old packets replayed by a device that recorded an earlier exchange. It is not a blanket guarantee against every replay attack: RFC 7474 adds protections for weaknesses in older manually keyed OSPFv2 mechanisms.
On small screens, swipe sideways or focus the diagram and use the arrow keys.
This is the trade-off of shared-key authentication: it avoids a separate login exchange for every routing packet, but distributing and replacing the same secret on several devices takes care. It proves possession of a key, not a unique device identity. The older MD5 method remains below so you can understand existing configurations; the key-chain example shows a supported HMAC-SHA-256 alternative.
Turning on authentication on Cisco IOS
Use an isolated Cisco IOS or IOS XE lab with OSPFv2 already working in area 0 on this /30 link. R2 and R3 use point-to-point network type and unique router IDs, 2.2.2.2 and 3.3.3.3. Commands start in global configuration mode unless stated otherwise. Treat MD5, key-chain and plain-text blocks as alternatives, not steps to paste together. All displayed keys are public teaching examples; do not reuse them as real secrets.
On small screens, swipe sideways or focus the diagram and use the arrow keys.
MD5 on one interface
interface GigabitEthernet0/1
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 Lab-Key-23On R2 (and the same on R3's Gi0/0). The first line turns MD5 on for this interface; the second sets key ID 1. Both the key ID and the key must match the neighbour's.
MD5 for a whole area
router ospf 1
area 0 authentication message-digest
!
interface GigabitEthernet0/0
ip ospf message-digest-key 1 md5 Lab-Key-12
interface GigabitEthernet0/1
ip ospf message-digest-key 1 md5 Lab-Key-23area 0 authentication turns MD5 on for every interface in area 0. The keys are still set per interface, so each link can have its own. An interface-level ip ospf authentication command overrides the area setting.
HMAC-SHA with a key chain
key chain OSPF-KEYS
key 1
key-string Lab-Key-23-Long-Secret
cryptographic-algorithm hmac-sha-256
!
interface GigabitEthernet0/1
ip ospf authentication key-chain OSPF-KEYSR2 example for a release that supports OSPFv2 HMAC-SHA-256. On R3, define the matching key/algorithm and apply the chain to Gi0/0. Local chain names can differ; the on-wire key ID, algorithm and accepted key must agree. Check valid send and accept lifetimes on both routers.
A key chain stores keys and their validity periods. The send lifetime controls which key can sign outgoing packets; the accept lifetime controls which received keys can be verified. These periods let you prepare a replacement before removing the old key. Check the platform's selection rules and clock before a timed rollover. On the documented IOS XE implementation, applying an OSPF key chain causes previously configured interface MD5 keys to be ignored.
Plain text (for recognition only)
interface GigabitEthernet0/1
ip ospf authentication
ip ospf authentication-key Secret12Type 1. The key is sent in clear text; avoid it outside labs.
Note: service password-encryption can obfuscate supported password fields as type 7. Type 7 is easily reversed. It is not encryption for OSPF packets or a safe way to publish a configuration file.
Confirming which authentication is active
On small screens, swipe sideways or focus the diagram and use the arrow keys.
R2#show ip ospf interface GigabitEthernet0/1 GigabitEthernet0/1 is up, line protocol is up Internet Address 10.0.23.1/30, Area 0, Attached via Network Statement Process ID 1, Router ID 2.2.2.2, Network Type POINT_TO_POINT, Cost: 10 ... Neighbor Count is 1, Adjacent neighbor count is 1 Adjacent with neighbor 3.3.3.3 Suppress hello for 0 neighbor(s) Cryptographic authentication enabled Youngest key id is 1
R2#show ip ospf | include BACKBONE|authentication Area BACKBONE(0) Area has message digest authentication
show ip ospf.Reading an authentication mismatch
First compare interface authentication type, active key ID, algorithm and lifetimes on both ends. Check logs before enabling debug. The following is a short lab-only diagnostic example; output and CPU load vary. Finish with undebug all, and do not publish output that contains real keys.
On small screens, swipe sideways or focus the diagram and use the arrow keys.
R2#debug ip ospf adj OSPF-1 ADJ Gi0/1: Rcv pkt from 10.0.23.2 : Mismatched Authentication Key - Message Digest Key 1
- Type mismatch: authentication on one end only, or MD5 on one end and plain text on the other.
- Key ID mismatch: key 1 on one router, key 2 on the other.
- Key mismatch: a typo, or trailing spaces copied into the key.
- Area setting missed on one router:
area 0 authentication message-digestconfigured on some routers only.
Change keys carefully: adding authentication to one end of a live link drops the adjacency until the other end matches. MD5 lets you configure a second key ID on both routers first, then remove the old one.
If the key ID is correct but digest verification fails, use the approved secret source to restore the intended value on both ends. Do not compare keys by posting running configurations into tickets. Type 7 obfuscation is reversible, and different stored strings alone do not reliably explain the active authentication state.
Half-configured authentication and other slips
On small screens, swipe sideways or focus the diagram and use the arrow keys.
- Setting the key but not turning authentication on (or the reverse).
- Expecting area-level authentication to set the keys too. Keys are set per interface (or on the virtual-link command).
- Using plain text outside a lab.
- Thinking authentication encrypts the LSAs.
Authentication rules to remember
- Cryptographic authentication rejects packets that cannot pass the configured shared-key checks.
- Types: 0 none, 1 plain text (avoid), 2 cryptographic (MD5 or HMAC-SHA).
- Enable per interface (
ip ospf authentication message-digest) or per area (area 0 authentication message-digest); keys are per interface. - The receiver needs an accepted key ID, matching secret and compatible method; check lifetimes during a rollover.
Short lab: prove the check before trusting the result
Start with the healthy R2–R3 lab. Record the Full adjacency and the route to LAN 3, 192.168.3.0/24, on R2. Configure the matching MD5 example on both lab interfaces. A one-sided change can interrupt the adjacency, so do not use this exercise on a live network.
show ip ospf interface GigabitEthernet0/1
show ip ospf neighbor
show ip route 192.168.3.0R2, privileged EXEC: confirm authentication and key ID, then Full with router ID 3.3.3.3, then the learned LAN route. On R3 inspect Gi0/0 instead.
Change only R3's lab key text while keeping key ID 1. Observe the mismatch and loss of adjacency. Restore Lab-Key-23 on R3, wait for Full, and recheck the route and a PC-to-server test. Explain why a link can remain up while routing fails. Do not disable authentication as the repair.
References: Cisco OSPFv2 key-chain configuration, RFC 5709 HMAC-SHA and RFC 7474 replay-protection extensions. Commands and outputs are documentation-based examples, not captures from a tested router image.
Test yourself on OSPF authentication
R2 uses MD5 key 1 on Gi0/1. R3 has no authentication on Gi0/0. What happens?
With MD5 authentication, what crosses the link?
R2 has ip ospf message-digest-key 1 md5 Lab-Key-23; R3 has ip ospf message-digest-key 2 md5 Lab-Key-23. Both have MD5 enabled. Result?