CCNA online course

Configure OSPF MD5 Authentication

Learn how to configure, verify, and troubleshoot OSPFv2 MD5 message-digest authentication between Cisco IOS routers.

OSPFv2 is the IPv4 version of Open Shortest Path First. This lesson shows how to protect OSPF control-plane exchanges with MD5 message-digest authentication on Cisco IOS routers.

You should already understand IPv4 addressing, Cisco IOS configuration modes, OSPF areas and neighbors, and basic OSPF configuration.

Why OSPF Authentication Matters

OSPF routers exchange control-plane packets to discover neighbors, synchronize link-state databases, and calculate routes. An OSPF adjacency is the neighbor relationship used to exchange this link-state information.

Authentication validates that OSPF packets come from a peer with the expected credentials. The goal is to prevent a router without the correct authentication settings from forming or maintaining an adjacency.

OSPF authentication is not encryption. MD5 authentication helps validate the sender and detect changes to the authenticated packet, but it does not hide OSPF packet contents or encrypt routing information. Anyone who can observe the traffic may still see the routing protocol data.

OSPF Authentication Methods

Traditional Cisco IOS OSPFv2 configurations provide three general authentication choices:

With MD5 message-digest authentication, a shared secret is configured on both ends of the OSPF link. The sender calculates a digest from the packet data and secret. The receiver independently calculates the expected digest and accepts the packet only when validation succeeds.

The password is not sent as readable OSPF clear-text authentication data. Successful communication requires the same authentication type, key ID, and secret on both peers.

Configuration Scopes

There are two related configuration scopes:

• Interface-level authentication: Configured directly under each participating routed interface. The interface receives the MD5 key and is told to use message-digest authentication.
• Area-level authentication: Configured under router ospf. This selects the authentication policy for OSPF interfaces in an area.

The area-level command selects the authentication type; it does not supply the interface password. Interfaces still need their own MD5 key details.

Lab Topology: Two Routers in Area 0

R1 and R2 are directly connected through one IPv4 transit network. Both interfaces run OSPFv2 in area 0.

• R1: 192.0.2.1/30
• R2: 192.0.2.2/30
• OSPF area: 0
• MD5 key ID: 1
• Shared secret: secret

The key ID and secret shown here are suitable for a lab only. Use an appropriate credential-management process and stronger operational secrets in real networks.

Step 1: Configure the Interfaces and OSPF

First assign IPv4 addresses, enable the interfaces, and activate OSPFv2. The exact OSPF network statement can vary according to the lab design.

R1# configure terminal
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip address 192.0.2.1 255.255.255.252
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# router ospf 1
R1(config-router)# network 192.0.2.0 0.0.0.3 area 0
R1(config-router)# end

R2# configure terminal
R2(config)# interface GigabitEthernet0/0
R2(config-if)# ip address 192.0.2.2 255.255.255.252
R2(config-if)# no shutdown
R2(config-if)# exit
R2(config)# router ospf 1
R2(config-router)# network 192.0.2.0 0.0.0.3 area 0
R2(config-router)# end

Confirm basic connectivity before adding authentication. For example, the routers should be able to reach each other's transit addresses.

Step 2: Configure an MD5 Key on Each Interface

The ip ospf message-digest-key command is entered in interface configuration mode. The syntax is:

ip ospf message-digest-key key-id md5 shared-secret

Configure the same key ID and secret on the two interfaces:

R1# configure terminal
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip ospf message-digest-key 1 md5 secret
R1(config-if)# exit
R1(config)# end

R2# configure terminal
R2(config)# interface GigabitEthernet0/0
R2(config-if)# ip ospf message-digest-key 1 md5 secret
R2(config-if)# exit
R2(config)# end

Replace 1 with the selected numeric key ID and replace secret with the agreed shared secret. The key ID and secret must match the neighboring router.

Step 3: Enable MD5 Authentication on Each Interface

Still in interface configuration mode, enable message-digest authentication:

R1# configure terminal
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip ospf authentication message-digest
R1(config-if)# end

R2# configure terminal
R2(config)# interface GigabitEthernet0/0
R2(config-if)# ip ospf authentication message-digest
R2(config-if)# end

The key command supplies the interface credential. The authentication command selects MD5 for OSPF packets sent and received on that interface. Both routers on the shared network segment need compatible settings.

Area-Level MD5 Authentication

Instead of selecting MD5 separately on every interface, an OSPF process can require message-digest authentication for all OSPF interfaces in an area. This command is entered in OSPF router configuration mode, not interface configuration mode.

R1# configure terminal
R1(config)# router ospf 1
R1(config-router)# area 0 authentication message-digest
R1(config-router)# end

Apply the equivalent policy on R2:

R2# configure terminal
R2(config)# router ospf 1
R2(config-router)# area 0 authentication message-digest
R2(config-router)# end

Interfaces in the area still require MD5 message-digest keys:

interface GigabitEthernet0/0
 ip ospf message-digest-key 1 md5 secret

The area command chooses MD5 as the area authentication type. It does not create a key or copy a password to the interfaces.

Important Difference: MD5 Versus Simple Password

These commands select different authentication modes:

router ospf 1
 area 0 authentication message-digest

router ospf 1
 area 0 authentication

The first command selects MD5 message-digest authentication. Omitting message-digest selects simple password authentication instead. Do not use the second command when the objective is OSPF MD5 authentication.

Verify the Configuration

Check the OSPF Interface

Use interface-focused OSPF output to inspect the active authentication type and message-digest key information:

R1# show ip ospf interface GigabitEthernet0/0

Review the output for message-digest authentication and the configured key information. Run the command on both routers and compare the results.

Check the Neighbor State

Use the OSPF neighbor command:

R1# show ip ospf neighbor

A correctly configured eligible peer should normally reach the FULL state. FULL means the neighbors have completed synchronization and have the expected completed OSPF relationship.

When authentication is correct and the rest of the OSPF configuration is valid, the adjacency remains established and OSPF routes can be exchanged.

Inspect the Running Configuration

Inspect the OSPF process configuration:

R1# show running-config | section router ospf

Because the MD5 key is configured under an interface, also inspect the relevant interface configuration:

R1# show running-config interface GigabitEthernet0/0

Do not rely only on the router ospf section; the key command is not stored there.

Troubleshoot Authentication Mismatches

An authentication mismatch prevents adjacency formation or causes an existing adjacency to fail. Check both peers systematically rather than changing several settings at once.

Recommended Troubleshooting Sequence

1. Confirm the physical and data-link interfaces are up and the transit IP addresses are correct.
2. Run show ip ospf neighbor to determine whether the peer is absent, stuck in a partial state, or has reached FULL.
3. Run show ip ospf interface <interface> on both routers and confirm message-digest authentication is active.
4. Compare the key ID and secret on both interfaces. Check spelling and case carefully.
5. Confirm both interfaces belong to the same OSPF area and that area-level and interface-level authentication settings are compatible.
6. Review relevant OSPF log or debug output carefully if the mismatch is not visible in the configuration. Use debugging selectively because it can consume CPU and produce substantial output.

Authentication Is Not Encryption

MD5 authentication does not encrypt OSPF link-state advertisements, neighbor information, or route data. It provides a digest-based check using a shared secret so that a receiver can reject packets that do not validate.

For newer deployments, consult current Cisco platform capabilities and security guidance instead of assuming that MD5 is the preferred modern algorithm. MD5 remains important when maintaining legacy Cisco IOS configurations and when studying traditional CCNA OSPFv2 authentication commands.

Quick Reference

! Interface-level MD5 configuration
interface GigabitEthernet0/0
 ip ospf message-digest-key 1 md5 secret
 ip ospf authentication message-digest

! Area-level MD5 policy
router ospf 1
 area 0 authentication message-digest

! Verification
show ip ospf interface GigabitEthernet0/0
show ip ospf neighbor
show running-config | section router ospf

Key Terms

• OSPFv2: The IPv4 version of Open Shortest Path First.
• Authentication: Validation that OSPF packets come from a peer with the expected credentials.
• Clear-text authentication: A basic OSPF mode using a simple password instead of a message digest.
• MD5 message-digest authentication: An OSPF mode that validates packets with an MD5-based digest and a shared secret.
• Shared secret: The password configured consistently on OSPF peers.
• Key ID: The numeric identifier associated with an OSPF MD5 key.
• Interface-level authentication: Authentication configured directly under an individual routed interface.
• Area-level authentication: An OSPF area policy that selects the authentication type for OSPF-enabled interfaces in that area.
• FULL state: The normal completed OSPF neighbor state for routers that should fully synchronize.