Back to OSPF Guide OSPF security

OSPF Authentication: Plain Text, MD5 and Verification

OSPF authentication helps two neighboring routers trust each other. In this lesson, you will build a working OSPF neighbor relationship, protect it with a shared key, and verify that both routers use the same settings.

Plain Text MD5 Area 0 Key ID Debug

OSPF Authentication at a Glance

Without authentication, a router accepts OSPF packets from any device that meets the normal neighbor requirements. Authentication adds a shared secret. Both routers must use the same method and key before they can exchange trusted OSPF information.

No authentication aut:0
Plain text aut:1
MD5 aut:2
Main command show ip ospf interface

What You Will Learn

  1. Lab Topology
  2. Base OSPF Configuration
  3. Plain Text Authentication
  4. MD5 Authentication
  5. Verification and Debug
  6. Troubleshooting Authentication Mismatches
  7. Choose an Authentication Method
  8. Guided Practice Lab
  9. Best Practices
  10. Frequently Asked Questions

1. Lab Topology

R1 and R2 connect to the same Ethernet switch. Their FastEthernet0/0 interfaces are in the 192.168.12.0/24 subnet and OSPF Area 0. The switch only carries the Ethernet frames; the OSPF neighbor relationship forms directly between R1 and R2.

Two-router authentication labRead the diagram from left to right: R1 → shared Ethernet segment → R2.
OSPF Area 0
Authentication applies to the R1–R2 OSPF adjacency. The method, key ID, and secret must match on both router interfaces.
SW1 does not run OSPF in this lab. It provides the shared Ethernet connection between the two routers.

What Authentication Does

With message-digest authentication, each router uses its locally configured secret to create a digest for the OSPF packet. The secret itself is not placed in the packet. The receiving router performs the same check.

How an authenticated OSPF packet is checkedThe shared secret stays on the routers.
Packet flow
1R1 builds a packetR1 prepares an OSPF Hello or LSA packet.
2R1 creates a digestR1 uses the configured secret and key ID. It adds the result to the packet.
3R2 checks the packetR2 uses its own copy of the same secret and key ID.
4R2 decidesR2 accepts a valid packet and rejects a packet that fails the check.
✓ Settings matchThe packet is accepted and the adjacency can stay Full.
× Settings do not matchThe packet is rejected and the adjacency may fail or reset.
Both routers need the same authentication settings. Configure both sides during the same maintenance change.
Remember: Area number, timers, subnet settings, and authentication must all agree. Authentication does not fix other OSPF neighbor problems.

2. Base OSPF Configuration

First, build a normal OSPF neighbor relationship without authentication. This gives you a known working starting point.

Configure R1

R1(config)#interface FastEthernet0/0
R1(config-if)#ip address 192.168.12.1 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#exit
R1(config)#router ospf 1
R1(config-router)#network 192.168.12.0 0.0.0.255 area 0

Configure R2

R2(config)#interface FastEthernet0/0
R2(config-if)#ip address 192.168.12.2 255.255.255.0
R2(config-if)#no shutdown
R2(config-if)#exit
R2(config)#router ospf 1
R2(config-router)#network 192.168.12.0 0.0.0.255 area 0

The wildcard mask 0.0.0.255 selects every address in the 192.168.12.0/24 subnet. The command places the matching interface in Area 0.

Check the Starting Point

Wait a few seconds, then run this command on both routers. The neighbor state should be FULL.

R1#show ip ospf neighbor

Neighbor ID     Pri   State    Dead Time   Address          Interface
192.168.12.2      1   FULL/-   00:00:36    192.168.12.2     FastEthernet0/0
Useful fact: OSPF process ID 1 is local to each router. The process IDs do not need to match. The area number and authentication settings do need to match.

3. Plain Text Authentication

Plain text authentication is useful for learning and for some old devices. It sends the shared password inside the OSPF packet without strong protection. Do not use it on an untrusted production network.

Enable plain text on R1

R1(config)#interface FastEthernet0/0
R1(config-if)#ip ospf authentication
R1(config-if)#ip ospf authentication-key MYPASS

Enable plain text on R2

R2(config)#interface FastEthernet0/0
R2(config-if)#ip ospf authentication
R2(config-if)#ip ospf authentication-key MYPASS
  • Enable the method: ip ospf authentication tells the interface to use plain text authentication.
  • Set the secret: ip ospf authentication-key MYPASS stores the shared password on the interface.
  • Configure both sides: Use the same password on R1 and R2. The adjacency can drop while only one side is configured.

Area-Wide Plain Text Authentication

You can enable the authentication method for every interface in an area. You must still configure a password on each interface.

R1(config)#router ospf 1
R1(config-router)#area 0 authentication

Repeat the area command on R2. Keep the interface-level ip ospf authentication-key command on both routers.

4. MD5 Authentication

MD5 authentication does not send the shared secret as readable text. Instead, the router uses the secret to calculate a digest for each OSPF packet. MD5 is stronger than plain text, but it is an old algorithm. Use a stronger supported method, such as HMAC-SHA, in new production designs.

Enable MD5 on R1

R1(config)#interface FastEthernet0/0
R1(config-if)#ip ospf message-digest-key 1 md5 MYPASS
R1(config-if)#ip ospf authentication message-digest

Enable MD5 on R2

R2(config)#interface FastEthernet0/0
R2(config-if)#ip ospf message-digest-key 1 md5 MYPASS
R2(config-if)#ip ospf authentication message-digest
  • Key ID: The number 1 identifies the key. Use the same key ID on both ends of this link.
  • Shared secret: MYPASS is the lab secret. It is case-sensitive and must match exactly.
  • Enable the method: ip ospf authentication message-digest turns on message-digest authentication for the interface.

Area-Wide MD5 Authentication

This command enables message-digest authentication on every OSPF interface in Area 0. Each interface still needs its own message-digest key.

R1(config)#router ospf 1
R1(config-router)#area 0 authentication message-digest

Apply the same area-wide method on R2. Then verify that each participating interface has the correct key ID and secret.

5. Verification and Debug

Always verify the result after a configuration change. Start with normal show commands. Use debugging only when the show commands do not explain the problem.

Step 1: Check the Neighbor

The neighbor should return to the FULL state after both routers have matching settings.

R1#show ip ospf neighbor

Neighbor ID     Pri   State    Dead Time   Address          Interface
192.168.12.2      1   FULL/-   00:00:35    192.168.12.2     FastEthernet0/0

Step 2: Check Plain Text Authentication

For plain text authentication, look for the final line in this output.

R1#show ip ospf interface FastEthernet0/0
FastEthernet0/0 is up, line protocol is up
  Internet Address 192.168.12.1/24, Area 0
  Neighbor Count is 1, Adjacent neighbor count is 1
  Simple password authentication enabled

Step 3: Check MD5 Authentication

For MD5, confirm that message-digest authentication is enabled and that the expected key ID is active.

R1#show ip ospf interface FastEthernet0/0
FastEthernet0/0 is up, line protocol is up
  Internet Address 192.168.12.1/24, Area 0
  Neighbor Count is 1, Adjacent neighbor count is 1
  Message digest authentication enabled
    Youngest key id is 1

Step 4: Understand Debug Authentication Codes

Some OSPF packet debug output uses a short authentication code. Use this table as a quick reference.

Debug Code Meaning Example
aut:0 No authentication Default OSPF packet behavior
aut:1 Plain text authentication aid:0.0.0.0 chk:B9F0 aut:1
aut:2 MD5 authentication chk:0 aut:2 keyid:1 seq:0x3C7EC653

6. Troubleshooting Authentication Mismatches

If the neighbor does not reach FULL, compare R1 and R2 one setting at a time. Do not change several values at once.

  • Method: Make sure both sides use no authentication, plain text, or message-digest. The methods cannot be mixed.
  • Key ID: For MD5, confirm that both sides use the same key ID on this link.
  • Secret: Enter the secret again on both routers. Check uppercase and lowercase letters.
  • Scope: Check whether authentication is enabled on the interface or for the whole area.
  • Other OSPF settings: Also compare the area number, subnet mask, timers, network type, and interface MTU.

Compare the Running Configuration

Run these commands on both routers. Place the outputs side by side and compare them.

R1#show running-config interface FastEthernet0/0
R1#show ip ospf interface FastEthernet0/0
R1#show ip ospf neighbor

Use Debugging Only When Needed

This targeted debug can show an authentication mismatch. Debugging may increase router CPU use, so enable it for a short time and disable it when you finish.

R1#debug ip ospf adj
OSPF adjacency events debugging is on

OSPF: Rcv pkt from 192.168.12.2, FastEthernet0/0:
Mismatch Authentication Key - Message Digest Key 1

R1#undebug all
All possible debugging has been turned off
Avoid unnecessary resets: Do not use clear ip ospf process as your first troubleshooting step. It tears down OSPF adjacencies and recalculates routes.

7. Choose an Authentication Method

The best method depends on what the router supports and where it is used. This table gives you a practical starting point.

MethodWhat It DoesRecommended Use
No authenticationDoes not check a shared secret.Temporary isolated labs only.
Plain textChecks a password, but the password can be read in a packet capture.Learning or old-device compatibility only.
MD5 message digestUses a shared secret to calculate a digest. The secret is not sent as readable text.Existing environments where stronger methods are unavailable.
HMAC-SHAUses a modern keyed hash when supported by the platform and software release.Preferred for new production designs that support it.
Check platform support: Authentication commands and available algorithms can differ by router model and software release. Confirm the vendor documentation before a production change.

8. Guided Practice Lab

Use these exercises to turn the commands into a troubleshooting skill. Complete one task at a time and record what changes.

Task 1: Build a Healthy Neighbor Relationship

  1. Configure the two interface addresses shown in the topology.
  2. Enable OSPF process 1 and place both interfaces in Area 0.
  3. Run show ip ospf neighbor on both routers.

Expected result: Each router shows one neighbor in the FULL state.

Task 2: Add MD5 Authentication

  1. Configure key ID 1 and the same lab secret on R1 and R2.
  2. Enable message-digest authentication on both FastEthernet0/0 interfaces.
  3. Verify the interface authentication mode and neighbor state.

Expected result: The interface output reports message-digest authentication, key ID 1 is active, and the neighbor returns to FULL.

Task 3: Create and Find a Safe Fault

  1. In an isolated lab, change the secret on R2 only.
  2. Watch the neighbor relationship fail.
  3. Compare the interface configuration on both routers.
  4. Restore the correct secret and confirm that the adjacency returns.

Expected result: You can explain that the key ID matched but the shared secret did not. You can prove the fix with show commands.

Lab safety: Introduce faults only in a test environment. Changing authentication on a production link can remove routes and interrupt traffic.

9. Best Practices

  • Use plain text only in a lab: It does not protect the password from packet capture.
  • Choose the strongest supported method: Prefer HMAC-SHA or another modern option when your router platform supports it.
  • Do not show real secrets in documentation: Replace MYPASS with a strong secret stored in an approved password system.
  • Plan key changes: Update both ends during a controlled maintenance window to avoid losing the adjacency.
  • Record the design: Document the method, key ID, interface, area, and planned rotation date.
  • Verify every change: Check the neighbor state and the interface authentication status before ending the maintenance window.

10. Frequently Asked Questions

What must match between two authenticated OSPF neighbors?

The authentication method and shared secret must match. For message-digest authentication, the active key ID must also match. Normal OSPF settings such as area, timers, subnet, and network type must still be compatible.

Does the OSPF process ID need to match?

No. The process ID is locally significant. R1 can use process 1 while R2 uses process 20. The routers can still become neighbors if the interface-level OSPF settings match.

Why is plain text authentication unsafe?

The password is carried without strong protection. Someone who can capture the OSPF packet may be able to read it.

What should you check first when the neighbor drops after enabling authentication?

Compare the method, key ID, and secret on both interfaces. Then check the area, timers, subnet mask, network type, and MTU.

What proves that the repair worked?

show ip ospf neighbor should show the neighbor in the FULL state. show ip ospf interface should show the intended authentication method and key information.