Methods of Authentication
There is both a key and a key number in the routing updates. (The key number is 0 if the routing protocol doesn’t allow more than one key.)
The key is sent to the other router, which checks it against its own.
It gets the update if the keys and key numbers match.
- Which routing protocols are capable of supporting authentication using plain text?
RIPv2, OSPFv2, IS-IS
- In the event of routing updates, how does hash authentication operate?
An algorithm for hashing is executed on a routing update by making use of the key that was configured. The outcome is incorporated into the final portion of the routing update.
The hash digest is produced as a result of the neighbor applying a hashing algorithm to the received update and its local key respectively.
In the event that the hash digest that was constructed is identical to the hash digest that was received, the router will accept the update.
- A key chain, what is it? What are the benefits of it?
It’s a group of keys, and each one has a unique key ID that goes with it.
It is possible to set up each key such that it is only used during a particular timewindow = time-based key chain.
- How is a time-based key chain configured?
key chain TESTKEYCHAIN
key 1
key-string Cisco1 // password of key 1
accept-lifetime 01:00:00 April 1 2024 01:00:00 May 23 2024
send-lifetime 01:00:00 April 1 2024 01:00:00 May 23 2024
key 2
key-string Juniper1
accept-lifetime 01:00:00 April 1 2024 infinite
send-lifetime 01:00:00 April 1 2024 infinite
Authentication with EIGRP
- When EIGRP authentication is turned on, what kinds of data are checked?
All EIGRP messages.
The routers all make use of the same preshared key (PSK), and according to the PSK, they construct an MD5 digest for each and every EIGRP message.
- What level of security is provided by EIGRP authentication?
DoS attacks are less likely to happen.
The EIGRP messages can be read by devices that are not neighbors.
Routers are unable to create a neighboring relationship without a successful EIGRP authentication.
What is the best way to set up EIGRP to authenticate IPv4 traffic?
key chain ROUTERKEYS
key 1
key-string DRIZZ
key 2
key-string GERALD
!
interface Fa0/0
ip authentication mode eigrp 1 md5
ip authentication key-chain eigrp 1 ROUTERKEYS
Below is the command syntax:-
ip authentication mode eigrp ASN md5
ip authentication key-chain eigrp ASN name-of-keychain
Key 2 will never be used in this example. It won’t check key 2 if key 1 doesn’t match. If you also set the lifetime, having more than one key is helpful.
- In order to configure EIGRP for IPv6 authentication, what are the steps?
key chain ROUTERKEYS
key 1
key-string DRIZZ
!
interface Fa0/0
ipv6 eigrp 1
ipv6 authentication mode eigrp 1 md5
ipv6 authentication key-chain eigrp 1 ROUTERKEYS
Below is the command syntax:-
Ipv6 authentication mode eigrp ASN md5
Ipv6 authentication key-chain eigrp ASN name-of-keychain
- How is named EIGRP authentication configured?
key chain ROUTERKEYS
key 1
key-string DRIZZ
!
router eigrp EIGRP-TEST
!
address-family ipv4 unicast autonomous-system 2
!
af-interface Fa0/0
authentication mode md5
authentication key-chain ROUTERKEYS
exit-af-interface
!
network 0.0.0.0
exit-address-family
The Authentication of OSPF
- With OSPF authentication enabled, which packets are checked for authenticity?
All OSPF messages are verified, much like EIGRP.
- What other kinds of authentications are available in OSPF?
Type 0 = no authentication
Type 1 = plain text authentication (OSPFv3 does not support it)
Type 2 = Hashing authentication
How do you set up plain text authentication and where is it located?
It can be configured via an OSPF area or an interface.
!R1
interface Fa0/0
ip address 10.1.1.1 255.255.255.0
ip ospf authentication-key ROUTERKEY
!
router ospf 1
area 0 authentication // enables authentication on an area
!R2
interface Fa0/0
ip address 10.1.1.2 255.255.255.0
ip ospf authentication // enable authentication on an individual interface
ip ospf authentication-key ROUTERKEY
- In OSPF, what’s the difference between plain text authentication and MD5 authentication?
With the key-string (which can be up to 16 characters long) and the key-id, an MD5 hash can be computed.
You have the option to use a different key for each interface.
- How is MD5 authentication configured?
!R1
interface Fa0/0
ip address 10.1.1.1 255.255.255.0
ip ospf message-digest-key 1 md5 ROUTERKEY
!
router ospf 1
area 0 authentication message-digest //enable MD5 auth for all area 0
network 0.0.0.0 255.255.255.255 area 0
!R2
interface Fa0/0
ip address 10.1.1.2 255.255.255.0
ip ospf authentication message-digest //enable MD5 auth for interface
ip ospf message-digest-key 1 md5 ROUTERKEY
!
router ospf 1
network 0.0.0.0 255.255.255.255 area 0
- How can you tell which authentication method is being utilized on the interface?
sho interface interface-id
- How does authentication for OSPFv3 operate?
When OSPFv3 is used with IPSEC for authentication and Encapsulating Security Payload (ESP) for encryption and authentication, the following happens:
ipv6 ospf authentication = only authentication
