cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1884
Views
12
Helpful
21
Replies

area 0 authentication message-digest

krahulbgp
Level 1
Level 1

when to use command"area 0 authentication message-digest"

21 Replies 21

R1 not form OSPF adj with R2 
I config R1 with auth 

Screenshot (330).png

after I add auth under the R2 interface the OSPF is change to Full
so it work if one side auth using area and other side using auth under ospf 

 

Screenshot (332).png

Fantastic!  (That's what Dave expected, I believe.) Mucho thanks!

Classically, often you'll see:

OSPF Adjacency Requirements,

From the perspective of OSPF, there are a couple of things that must match for a OSPF neighborship to establish; these include:

The devices must be in the same area
The devices must have the same authentication configuration
The devices must be on the same subnet
The devices hello and dead intervals must match
The devices must have matching stub flags

What Dave had described, and what MHM confirmed, is you can match authentication via area settings and/or interface settings.

Years ago, when (on Cisco devices) authentication could only be defined in the OSPF router section, and implicitly impacted all interfaces for the authenticated area, it was and all-or-nothing situation.

The only possible limitation I now see, if you configure authentication, in the OSPF router section, for all the area interfaces, you might not have a way to disable it for an interface to not use authentication, on an interface, to establish adjacency with another router not using it at all.

E.g.:

R1

interface e0
ip address 192.168.1.1 255.255.255.0
!command to disable authenication on just this interface to R2?
!i.e. not "no ip ospf authentication"
!but something like "ip no ospf authentication"

router ospf 10
area 1 authentication
network 192.168.1.0 0.0.0.255 area 1

R2

interface e0
ip address 192.168.1.2 255.255.255.0

router ospf 10
network 192.168.1.0 0.0.0.255 area 1

Sure you can! ip ospf authentication null. It disables authentication requirements at the interface level. It was one of the configs I used on my lab in PT I attached. I don't trust PT as much as you but in this case it works just as its supposed to...at least with newer IOSs as you have pointed out.

To be fair I've only ever known this. I didn't realize you had to configure the same for all devices for it to work in previous IOS versions.

@MHM Cisco World 

Yes. That was my initial assessment. You can have Area and interface authentication. As long as the link matches it will form an adjacency.

-David

I buy PC with 2500 $ to run advance lab.
PT is limit so limit and have many bug. 
I suggest use other. 

@Joseph W. Doherty  @David Ruess so so welcome 

Joseph W. Doherty
Hall of Fame
Hall of Fame

@krahulbgp did you get the answer you needed?

In not, please let us know!

Hope we didn't lose you on all the back and forth on ways to configure OSPF authentication.

Review Cisco Networking for a $25 gift card