OSPF Authentification

The basic principles of OSPF authentication are as follows:

If authentication is configured on the interface, use the authentication on the interface. If null is configured on the interface, no authentication is performed on the interface.

If no authentication is performed on the interface (Null does not mean that no authentication is configured), the authentication configured on the area is used. If no authentication is configured on the area, either, no authentication will be performed.

Authentication commands in the area view:

authentication-mode simple [ plain plain-text | [ cipher ] cipher-text ]
authentication-mode { md5 | hmac-md5 | hmac-sha256 } [ key-id { plain plain-text | [ cipher ] cipher-text } ]
authentication-mode keychain keychain-name

Authentication commands on a common OSPF interface:

ospf authentication-mode simple [ plain plain-text | [ cipher ] cipher-text ]
ospf authentication-mode { md5 | hmac-md5 | hmac-sha256 } [ key-id { plain plain-text | [ cipher ] cipher-text } ]
ospf authentication-mode null
ospf authentication-mode keychain keychain-name

Hi friend!

Basic principles of OSPF authentication

If authentication is configured on an interface, interface-based authentication is used. If the interface-based authentication is null, the interface-based authentication is not performed. If no authentication is configured on the interface (null indicates that no authentication is configured), the authentication configured in the area is used. If no authentication is configured in the area, no authentication is performed.

The difference between interface authentication and area authentication is as follows: OSPF authentication specifies only the authentication type, including 0, 1, 2, NULL, plain and cipher. The early OSPF implementation supports only area authentication. When area authentication is enabled, it means that all OSPF protocol messages sent and received by interfaces in this area need to contain authentication fields. Therefore, OSPF messages on all interfaces need to be authenticated. This is obviously not flexible. Many vendors have implemented interface-based authentication in the future. This greatly improves the flexibility of OSPF authentication. That is, OSPF authentication can be based on interfaces or areas.

Hope this helps!