02-28-2023 06:38 AM
when to use command"area 0 authentication message-digest"
02-28-2023 03:36 PM - edited 02-28-2023 03:38 PM
R1 not form OSPF adj with R2
I config R1 with auth
02-28-2023 03:41 PM
after I add auth under the R2 interface the OSPF is change to Full
so it work if one side auth using area and other side using auth under ospf
02-28-2023 03:57 PM
Fantastic! (That's what Dave expected, I believe.) Mucho thanks!
Classically, often you'll see:
OSPF Adjacency Requirements,
From the perspective of OSPF, there are a couple of things that must match for a OSPF neighborship to establish; these include:
The devices must be in the same area
The devices must have the same authentication configuration
The devices must be on the same subnet
The devices hello and dead intervals must match
The devices must have matching stub flags
What Dave had described, and what MHM confirmed, is you can match authentication via area settings and/or interface settings.
Years ago, when (on Cisco devices) authentication could only be defined in the OSPF router section, and implicitly impacted all interfaces for the authenticated area, it was and all-or-nothing situation.
The only possible limitation I now see, if you configure authentication, in the OSPF router section, for all the area interfaces, you might not have a way to disable it for an interface to not use authentication, on an interface, to establish adjacency with another router not using it at all.
E.g.:
R1
interface e0
ip address 192.168.1.1 255.255.255.0
!command to disable authenication on just this interface to R2?
!i.e. not "no ip ospf authentication"
!but something like "ip no ospf authentication"
router ospf 10
area 1 authentication
network 192.168.1.0 0.0.0.255 area 1
R2
interface e0
ip address 192.168.1.2 255.255.255.0
router ospf 10
network 192.168.1.0 0.0.0.255 area 1
02-28-2023 04:01 PM - edited 02-28-2023 04:08 PM
Sure you can! ip ospf authentication null. It disables authentication requirements at the interface level. It was one of the configs I used on my lab in PT I attached. I don't trust PT as much as you but in this case it works just as its supposed to...at least with newer IOSs as you have pointed out.
To be fair I've only ever known this. I didn't realize you had to configure the same for all devices for it to work in previous IOS versions.
Yes. That was my initial assessment. You can have Area and interface authentication. As long as the link matches it will form an adjacency.
-David
02-28-2023 04:03 PM
I buy PC with 2500 $ to run advance lab.
PT is limit so limit and have many bug.
I suggest use other.
02-28-2023 04:01 PM
@Joseph W. Doherty @David Ruess so so welcome
02-28-2023 04:07 PM
@krahulbgp did you get the answer you needed?
In not, please let us know!
Hope we didn't lose you on all the back and forth on ways to configure OSPF authentication.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide