Configuring an Authentication Mode
Context
OSPFv3 supports keychain and HMAC-SHA256 authentications. The following procedure uses keychain authentication as an example.
Before you configure keychain authentication, run the keychain command to configure a keychain, the key-id command to configure a key ID, the key-string command to configure a password, and the algorithm command to configure an algorithm. If these commands are not run, OSPFv3 authentication fails.
If plain is selected during the configuration of the authentication mode, the password is saved in the configuration file in plain text. This brings security risks. It is recommended that you select cipher to save the password in cipher text.
Procedure
- Configure OSPFv3 area authentication.
- Run authentication-mode { hmac-sha256 key-id key-id { plain plain-text | [ cipher ] cipher-text } | keychain keychain-name }
OSPFv3 area authentication is configured.
If you use OSPFv3 area authentication, the authentication and password configurations on all router in the same area must be the same.
- Run authentication-mode { hmac-sha256 key-id key-id { plain plain-text | [ cipher ] cipher-text } | keychain keychain-name }
- Configure OSPFv3 process authentication.
- Configure OSPFv3 interface authentication.
- Run ospfv3 authentication-mode { hmac-sha256 key-id key-id { plain plain-text | [ cipher ] cipher-text } | keychain keychain-name } [ instance instance-id ]
OSPFv3 interface authentication is configured.
OSPFv3 interface authentication takes precedence over OSPFv3 area authentication.
If you use HMAC-SHA256 authentication, the authentication and password configurations on all the interfaces on the same network segment must be the same.
- Run ospfv3 authentication-mode { hmac-sha256 key-id key-id { plain plain-text | [ cipher ] cipher-text } | keychain keychain-name } [ instance instance-id ]
