ospf authentication...

every now and then i just have to force myself to do this again and again... can't make mistakes with stupid shit like this during pucker time... this'll kill you on the clock... it's gotta be automatic everywhere you can make it automatic... take no prisoners...

R4#debug ip ospf adj
OSPF adjacency debugging is on
R4#
Feb  3 12:42:38.416: OSPF-1 ADJ   Se1/0.34: Send with youngest Key 1
R4#debug
Feb  3 12:42:47.548: OSPF-1 ADJ   Se1/0.34: Send with youngest Key 1
R4#debug ip ospf pack
OSPF packet debugging is on
R4#
Feb  3 12:42:57.440: OSPF-1 ADJ   Se1/0.34: Send with youngest Key 1
R4#
Feb  3 12:42:58.688: OSPF-1 PAK  : rcv. v:2 t:1 l:48 rid:3.3.3.3 aid:0.0.0.34 chk:0 aut:2 keyid:1 seq:0x510E5419 from Serial1/0.34
R4#
Feb  3 12:43:07.004: OSPF-1 ADJ   Se1/0.34: Send with youngest Key 1
R4#
Feb  3 12:43:08.044: OSPF-1 PAK  : rcv. v:2 t:1 l:48 rid:3.3.3.3 aid:0.0.0.34 chk:0 aut:2 keyid:1 seq:0x510E5422 from Serial1/0.34
R4#un all
All possible debugging has been turned off

version:ospfv2 t:1 hello l:48 length rid: router id aid: area id chk: checksum aut: authentication type keyid: md5 key seq: sequence number

http://www.cisco.com/en/US/docs/ios/12_3/debug/command/reference/dbg_i2g.html#wp1055528

R4#sh ip ospf int s1/0.34
Serial1/0.34 is up, line protocol is up
  Internet Address 10.1.1.10/30, Area 34, Attached via Network Statement
  Process ID 1, Router ID 10.1.4.9, Network Type POINT_TO_POINT, Cost: 64
  Topology-MTID    Cost    Disabled    Shutdown      Topology Name
        0           64        no          no            Base
  Transmit Delay is 1 sec, State POINT_TO_POINT
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    oob-resync timeout 40
    Hello due in 00:00:01
  Supports Link-local Signaling (LLS)
  Cisco NSF helper support enabled
  IETF NSF helper support enabled
  Index 1/1, flood queue length 0
  Next 0x0(0)/0x0(0)
  Last flood scan length is 5, maximum is 5
  Last flood scan time is 0 msec, maximum is 4 msec
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 3.3.3.3
  Suppress hello for 0 neighbor(s)
  Message digest authentication enabled
    Youngest key id is 1
R4#config t
Enter configuration commands, one per line.  End with CNTL/Z.
R4(config)#int s1/0.34
R4(config-subif)#no ip ospf authenti mess
R4(config-subif)#no ip ospf message-digest-key 1 md5 cisco
R4(config-subif)#
Feb  3 12:56:56.259: %OSPF-5-ADJCHG: Process 1, Nbr 3.3.3.3 on Serial1/0.34 from FULL to DOWN, Neighbor Down: Dead timer expired
R4(config-subif)#do sh ip ospf int s1/0.34
Serial1/0.34 is up, line protocol is up
  Internet Address 10.1.1.10/30, Area 34, Attached via Network Statement
  Process ID 1, Router ID 10.1.4.9, Network Type POINT_TO_POINT, Cost: 64
  Topology-MTID    Cost    Disabled    Shutdown      Topology Name
        0           64        no          no            Base
  Transmit Delay is 1 sec, State POINT_TO_POINT
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    oob-resync timeout 40
    Hello due in 00:00:01
  Supports Link-local Signaling (LLS)
  Cisco NSF helper support enabled
  IETF NSF helper support enabled
  Index 1/1, flood queue length 0
  Next 0x0(0)/0x0(0)
  Last flood scan length is 5, maximum is 5
  Last flood scan time is 0 msec, maximum is 4 msec
  Neighbor Count is 0, Adjacent neighbor count is 0
  Suppress hello for 0 neighbor(s)
  (no messass digest crap here where it's supposed to be)

R4(config-subif)#ip ospf authen mess
R4(config-subif)#ip ospf message-digest-key 1 md5 cisco
R4(config-subif)#end
Feb  3 12:57:42.875: %OSPF-5-ADJCHG: Process 1, Nbr 3.3.3.3 on Serial1/0.34 from LOADING to FULL, Loading Done
R4(config-subif)#end
R4#
Feb  3 12:57:45.391: %SYS-5-CONFIG_I: Configured from console by console
R4#sh ip ospf int s1/0.34
Serial1/0.34 is up, line protocol is up
  Internet Address 10.1.1.10/30, Area 34, Attached via Network Statement
  Process ID 1, Router ID 10.1.4.9, Network Type POINT_TO_POINT, Cost: 64
  Topology-MTID    Cost    Disabled    Shutdown      Topology Name
        0           64        no          no            Base
  Transmit Delay is 1 sec, State POINT_TO_POINT
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    oob-resync timeout 40
    Hello due in 00:00:04
  Supports Link-local Signaling (LLS)
  Cisco NSF helper support enabled
  IETF NSF helper support enabled
  Index 1/1, flood queue length 0
  Next 0x0(0)/0x0(0)
  Last flood scan length is 1, maximum is 5
  Last flood scan time is 0 msec, maximum is 4 msec
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 3.3.3.3
  Suppress hello for 0 neighbor(s)
  Message digest authentication enabled
    Youngest key id is 1

quote of the day... ospf auth...

you have been warned...

NOTE 
OSPF authentication is a good place for tricky CCIE lab questions—ones that can be solved in a few minutes if you know all the intricacies.

of course...  authentication can create havoc with routing protocols... and yes, the configuration for eigrp, ospf and bgp are unique to each routing protocol...

so what's the plan... you hate it so much that you love it... like frame relay, dtp, vtp, or whatever your particular hateful protocol might be...

bring the hate and you will find the love...

the devil's in the details, baby...

you will authenticate everything...

it's one of those things you just have to suck up...  authenticate everything...

you can't fight it... can't afford to take a hit on something like that in time pressure...

the above video is a work of art...

md5 is the only authentication type available for eigrp... but don't trust me... put your faith in the doccd...

but arteq, why on earth then does md5 need to be specified in the configuration command...

right.........................................................................................................................

authentication...

i hate authentication... no wait, i LOVE authentication...

the books say you can either set up authentication per area, or per interface with ospf... i beg to differ... perhaps it's older code, not sure, either way it's a pain in the ass...

r1#debug ip ospf packet
OSPF packet debugging is on
r1#
*Nov  5 17:15:51.342: OSPF-1 PAK  : rcv. v:2 t:1 l:48 rid:10.1.40.1 aid:0.0.0.0 chk:3542 aut:0 auk: from FastEthernet0/0

debugging the packets is a good way to check if the authentication is working, note above our authorization code is 0 (aut:0)

place authentication on the neighbors using plain text...

r1(config)#int f0/0
r1(config-if)#ip ospf authentication-key cisco

r2(config-if)#ip ospf authentication-key cisco
r2(config-if)#

no help with that shit...

r1#
*Nov  5 17:21:42.042: OSPF-1 PAK  : rcv. v:2 t:1 l:48 rid:10.1.40.1 aid:0.0.0.0 chk:3542 aut:0 auk: from FastEthernet0/0

now turn it on for the area on each router...

r2(config-if)#router ospf 1
r2(config-router)#area 0 authentication

r1#
*Nov  5 17:26:20.030: OSPF-1 PAK  : rcv. v:2 t:1 l:48 rid:10.1.40.1 aid:0.0.0.0 chk:3541 aut:1 auk: from FastEthernet0/0

now it works... same for  md5... arghh...

r1#sh ip ospf int f0/0
FastEthernet0/0 is up, line protocol is up
  Internet Address 192.168.1.1/24, Area 0, Attached via Network Statement
  Process ID 1, Router ID 1.1.1.1, Network Type BROADCAST, Cost: 1
  Topology-MTID    Cost    Disabled    Shutdown      Topology Name
        0           1         no          no            Base
  Transmit Delay is 1 sec, State BDR, Priority 1
  Designated Router (ID) 10.1.40.1, Interface address 192.168.1.2
  Backup Designated router (ID) 1.1.1.1, Interface address 192.168.1.1
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    oob-resync timeout 40
    Hello due in 00:00:02
  Supports Link-local Signaling (LLS)
  Cisco NSF helper support enabled
  IETF NSF helper support enabled
  Index 1/1, flood queue length 0
  Next 0x0(0)/0x0(0)
  Last flood scan length is 1, maximum is 1
  Last flood scan time is 0 msec, maximum is 0 msec
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 10.1.40.1  (Designated Router)
  Suppress hello for 0 neighbor(s)
  Simple password authentication enabled


turn area authentication back off...

r1#sh ip ospf inte f0/0
FastEthernet0/0 is up, line protocol is up
  Internet Address 192.168.1.1/24, Area 0, Attached via Network Statement
  Process ID 1, Router ID 1.1.1.1, Network Type BROADCAST, Cost: 1
  Topology-MTID    Cost    Disabled    Shutdown      Topology Name
        0           1         no          no            Base
  Transmit Delay is 1 sec, State BDR, Priority 1
  Designated Router (ID) 10.1.40.1, Interface address 192.168.1.2
  Backup Designated router (ID) 1.1.1.1, Interface address 192.168.1.1
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    oob-resync timeout 40
    Hello due in 00:00:01
  Supports Link-local Signaling (LLS)
  Cisco NSF helper support enabled
  IETF NSF helper support enabled
  Index 1/1, flood queue length 0
  Next 0x0(0)/0x0(0)
  Last flood scan length is 1, maximum is 1
  Last flood scan time is 0 msec, maximum is 0 msec
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 10.1.40.1  (Designated Router)
  Suppress hello for 0 neighbor(s)

all gone, but look at f0/0...

r1#sh run int f0/0
Building configuration...

Current configuration : 151 bytes
!
interface FastEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip ospf authentication-key cisco
 speed auto
 duplex auto
end

whoops...  i love expected behaviors that are unexpected...

rip authentication...

same same... except change to ver 2...

on r5 and r6 add

key chain suck-key
key 1
key-string suck- key

and on the applicable interfaces

ip rip authentication key-chain suck-key

r6#sh key chain
Key-chain suck-key:
    key 1 -- text "suck- key"
        accept lifetime (always valid) - (always valid) [valid now]
        send lifetime (always valid) - (always valid) [valid now]

*Sep  3 16:50:46: RIP: received packet with text authentication suck- key
*Sep  3 16:50:46: RIP: received v2 update from 172.16.2.2 on FastEthernet0/1
*Sep  3 16:50:46:      1.0.0.0/8 via 0.0.0.0 in 1 hops
*Sep  3 16:50:46:      10.0.0.0/8 via 0.0.0.0 in 1 hops
*Sep  3 16:50:46:      192.168.1.0/24 via 0.0.0.0 in 1 hops
*Sep  3 16:50:46:      192.168.2.0/24 via 0.0.0.0 in 1 hops

set both sides to md5 authentication...

ip rip authenti mode md5

r6#
*Sep  3 16:54:58: RIP: received packet with MD5 authentication

that was very refreshing...

radius...

why?

radius = remote authentication dial in user service...

the first question one should ask is, do user's actually dial in anymore?

at any rate...

enable aaa new-model as you would for tacacs

aaa new-model

then the radius server
radius-server  host (hostname) (key)

define the 802.1x authentication method

aaa authentication dot1x default group radius

enable 802.1x on the switch

  dot1x system-auth-control

configure each switchport for usage

(config-if)# dot1x port-control {force-authorized | forceunauthorized
| auto}

then sit back and try to figure out why you'd ever use this garbage...