Improving OSPFv3 Network Security
In OSPFv3 authentication, an authentication field is added to each OSPFv3 packet for encryption. When a local device receives an OSPFv3 packet from a remote device, the local device discards the packet if the authentication password carried in the packet is different from the local one, which protects the local device against potential attacks. Therefore, OSPFv3 authentication improves network security.
Procedure
- Configure OSPFv3 area authentication.
- Run authentication-mode hmac-sha256 key-id key-id { plain plain-text | [ cipher ] cipher-text }
OSPFv3 area authentication is configured.
If you use OSPFv3 area authentication, the authentication and password configurations on all switch in the same area must be the same.
- Run authentication-mode hmac-sha256 key-id key-id { plain plain-text | [ cipher ] cipher-text }
- Configure OSPFv3 process authentication.
- Configure OSPFv3 interface authentication.
- On an Ethernet interface, run undo portswitch
The interface is switched to Layer 3 mode.
By default, an Ethernet interface works in Layer 2 mode.
The mode switching function takes effect when the interface only has attribute configurations (for example, shutdown and description configurations). Alternatively, if configuration information supported by both Layer 2 and Layer 3 interfaces exists (for example, mode lacp and lacp system-id configurations), no configuration that is not supported after the working mode of the interface is switched can exist. If unsupported configurations exist on the interface, delete the configurations first and then run the undo portswitch command.
If many Ethernet interfaces need to be switched to Layer 3 mode, run the undo portswitch batch interface-type { interface-number1 [ to interface-number2 ] } &<1-10> command in the system view to switch these interfaces to Layer 3 mode in batches.
- Run ospfv3 authentication-mode hmac-sha256 key-id key-id { plain plain-text | [ cipher ] cipher-text } [ instance instance-id ]
OSPFv3 interface authentication is configured.
OSPFv3 interface authentication takes precedence over OSPFv3 area authentication.
If you use OSPFv3 interface authentication, the authentication and password configurations on all the interfaces on the same network segment must be the same.
- On an Ethernet interface, run undo portswitch
