Courseiva
OSPFInterface Config

ip ospf authentication message-digest

Enables MD5 authentication for OSPF on an interface to ensure routing updates are authenticated and secure.

Definition: ip ospf authentication message-digest is a Cisco IOS interface config command. Enables MD5 authentication for OSPF on an interface to ensure routing updates are authenticated and secure.

Overview

The `ip ospf authentication message-digest` command is used in Cisco IOS interface configuration mode to enable MD5 authentication for OSPF on a specific interface. OSPF authentication ensures that only trusted routers participate in routing updates, preventing spoofed routing information from being injected into the network. MD5 authentication uses a shared secret key and a cryptographic hash to verify the integrity and authenticity of OSPF packets.

This command is critical in securing OSPF deployments, especially in multi-access networks where rogue devices could otherwise disrupt routing. It is typically used in conjunction with `ip ospf message-digest-key` to define the key ID and password. Alternatives include null authentication (default) or plaintext authentication (`ip ospf authentication`), but MD5 is recommended for production networks due to its cryptographic strength.

When troubleshooting OSPF adjacency issues, authentication mismatches are a common cause; this command ensures that the interface is configured to expect MD5 authentication. The command takes effect immediately and is stored in the running configuration. It requires privilege level 15 (enable mode) to configure.

The command does not produce buffered output; it modifies the interface configuration directly. Understanding this command is essential for CCNA and CCNP candidates as OSPF authentication is a key topic in the exam blueprint and real-world network security.

Syntax·Interface Config
ip ospf authentication message-digest

When to Use This Command

  • Securing OSPF routing updates between routers in a corporate network to prevent unauthorized route injection.
  • Complying with security policies that require authentication for all routing protocols.
  • Preventing accidental or malicious OSPF neighbor formation from unauthorized routers.
  • Configuring OSPF authentication in a multi-vendor environment where MD5 is supported.

Command Examples

Enable MD5 authentication with a key ID

interface GigabitEthernet0/0 ip ospf authentication message-digest ip ospf message-digest-key 1 md5 MySecretKey
GigabitEthernet0/0 is up, line protocol is up
  Internet address is 192.168.1.1/30
  OSPF authentication is enabled (message-digest)
  OSPF message-digest key 1 is set

The first command enables MD5 authentication. The second sets the key ID (1) and the password (MySecretKey). The output confirms authentication is enabled and the key is configured.

Verify OSPF authentication on an interface

show ip ospf interface GigabitEthernet0/0
GigabitEthernet0/0 is up, line protocol is up
  Internet Address 192.168.1.1/30, Area 0
  Process ID 1, Router ID 1.1.1.1, Network Type BROADCAST, Cost: 1
  Transmit Delay is 1 sec, State DR, Priority 1
  Designated Router (ID) 1.1.1.1, Interface address 192.168.1.1
  Backup Designated router (ID) 2.2.2.2, Interface address 192.168.1.2
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    oob-resync timeout 40
    Hello due in 00:00:03
  Supports Link-local Signaling (LLS)
  Cisco NSF helper support enabled
  IETF NSF helper support enabled
  Index 1/1/1, flood queue length 0
  Next 0x0(0)/0x0(0)/0x0(0)
  Last flood scan length is 1, maximum is 1
  Last flood scan time is 0 msec, maximum is 0 msec
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 2.2.2.2  (Backup Designated Router)
  Suppress hello for 0 neighbor(s)
  Message digest authentication enabled
    Youngest key id is 1

The output shows OSPF interface details. The line 'Message digest authentication enabled' confirms MD5 authentication is active. 'Youngest key id is 1' indicates the key ID in use.

Understanding the Output

When you run 'show ip ospf interface', look for the line 'Message digest authentication enabled' to confirm MD5 authentication is active. The 'Youngest key id' shows the key ID being used for authentication. If authentication is misconfigured, the neighbor state may show 'DOWN' or 'INIT' instead of 'FULL'.

A missing or mismatched key will prevent OSPF adjacency from forming. In production, ensure all routers on the same link have identical key IDs and passwords.

Configuration Scenarios

Configure OSPF MD5 authentication between two directly connected routers

Two routers, R1 and R2, are connected via a point-to-point link. OSPF adjacencies are forming, but the network requires authentication to prevent unauthorized routing updates. The goal is to enable MD5 authentication on both interfaces using a shared key.

Topology

R1(Gi0/0)---10.0.12.0/30---(Gi0/0)R2

Steps

  1. 1.Step 1: Enter global configuration mode on R1: R1# configure terminal
  2. 2.Step 2: Enter interface configuration mode for Gi0/0: R1(config)# interface GigabitEthernet0/0
  3. 3.Step 3: Set the MD5 authentication key: R1(config-if)# ip ospf message-digest-key 1 md5 cisco123
  4. 4.Step 4: Enable MD5 authentication on the interface: R1(config-if)# ip ospf authentication message-digest
  5. 5.Step 5: Repeat steps 1-4 on R2 with the same key ID and password.
  6. 6.Step 6: Verify OSPF adjacency: R1# show ip ospf neighbor
Configuration
! R1 configuration
interface GigabitEthernet0/0
 ip address 10.0.12.1 255.255.255.252
 ip ospf message-digest-key 1 md5 cisco123
 ip ospf authentication message-digest
!
router ospf 1
 network 10.0.12.0 0.0.0.3 area 0
!
! R2 configuration
interface GigabitEthernet0/0
 ip address 10.0.12.2 255.255.255.252
 ip ospf message-digest-key 1 md5 cisco123
 ip ospf authentication message-digest
!
router ospf 1
 network 10.0.12.0 0.0.0.3 area 0

Verify: Use `show ip ospf neighbor` to verify adjacency state is FULL. Use `show ip ospf interface GigabitEthernet0/0` and look for 'Message digest authentication enabled' in the output.

Watch out: The key ID and password must match exactly on both sides. A common mistake is using different key IDs or passwords, which causes the adjacency to fail and OSPF to remain in INIT or EXSTART state.

Configure OSPF MD5 authentication on a broadcast multi-access network (Ethernet) with multiple routers

A LAN segment with three routers (R1, R2, R3) connected via a switch. OSPF is running in area 0. To secure the broadcast network, MD5 authentication must be configured on all routers' interfaces on that segment. The DR/BDR election process must also be considered.

Topology

R1(Gi0/0)---10.0.0.0/24---(Gi0/0)R2 | (Gi0/0)R3

Steps

  1. 1.Step 1: On each router, enter interface configuration mode for the interface connected to the LAN (e.g., GigabitEthernet0/0).
  2. 2.Step 2: Configure the MD5 key: R1(config-if)# ip ospf message-digest-key 1 md5 securekey
  3. 3.Step 3: Enable MD5 authentication: R1(config-if)# ip ospf authentication message-digest
  4. 4.Step 4: Repeat on R2 and R3 with the same key ID and password.
  5. 5.Step 5: Verify that all routers form FULL adjacencies with the DR/BDR.
Configuration
! R1 configuration
interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.0
 ip ospf message-digest-key 1 md5 securekey
 ip ospf authentication message-digest
!
router ospf 1
 network 10.0.0.0 0.0.0.255 area 0
!
! R2 configuration
interface GigabitEthernet0/0
 ip address 10.0.0.2 255.255.255.0
 ip ospf message-digest-key 1 md5 securekey
 ip ospf authentication message-digest
!
router ospf 1
 network 10.0.0.0 0.0.0.255 area 0
!
! R3 configuration
interface GigabitEthernet0/0
 ip address 10.0.0.3 255.255.255.0
 ip ospf message-digest-key 1 md5 securekey
 ip ospf authentication message-digest
!
router ospf 1
 network 10.0.0.0 0.0.0.255 area 0

Verify: Use `show ip ospf neighbor` on any router to see all neighbors in FULL state. Use `show ip ospf interface GigabitEthernet0/0` to confirm authentication is enabled and check the DR/BDR.

Watch out: On broadcast networks, authentication must be configured on all routers in the segment. If one router is missing authentication, it will not form an adjacency with any other router. Also, ensure that the key ID and password are identical across all routers.

Troubleshooting with This Command

When troubleshooting OSPF authentication issues, the `show ip ospf interface` command is your primary tool. Look for the line 'Message digest authentication enabled' to confirm that MD5 authentication is configured on the interface. If authentication is missing, the line will show 'No authentication' or 'Simple password authentication' if plaintext is used.

A common symptom of authentication mismatch is that the OSPF neighbor state remains stuck in INIT or EXSTART. Use `debug ip ospf adj` to see detailed adjacency events; look for 'Authentication mismatch' or 'Invalid authentication' messages. For example, if you see 'OSPF: Rcv pkt from 10.0.12.2, GigabitEthernet0/0 : Mismatch Authentication Key' it indicates that the key ID or password does not match.

Check the key ID with `show ip ospf interface` which displays the key ID in use. Also verify that the password is correctly configured using `show running-config interface` (the password is displayed as 'cisco123' if not encrypted, but typically it is shown as encrypted text). Another useful command is `show ip ospf neighbor detail` which shows the neighbor's authentication status.

If authentication is failing, OSPF packets are dropped silently; you may not see any error messages without debugging. To isolate the issue, first ensure that both sides have the same key ID and password. Then verify that the authentication mode matches (both should be message-digest).

If one side uses plaintext and the other MD5, adjacency will not form. Also check for mismatched area IDs or network types, as these can also prevent adjacency. A step-by-step diagnostic flow: 1) Check OSPF neighbor state with `show ip ospf neighbor`. 2) If state is not FULL, check interface authentication with `show ip ospf interface`. 3) Enable debug with `debug ip ospf adj` and observe the output. 4) Compare configurations on both sides. 5) Correct any mismatches and re-verify.

Correlate with `show ip ospf database` to ensure LSAs are being exchanged; if authentication fails, the database will be empty. Remember that authentication is configured per interface, so verify all interfaces in the OSPF process.

CCNA Exam Tips

1.

CCNA exam tip: Remember that 'ip ospf authentication message-digest' enables MD5 authentication, but you must also configure a key with 'ip ospf message-digest-key'.

2.

CCNA exam tip: The key ID must match on both routers; otherwise, authentication fails and neighbor adjacency will not form.

3.

CCNA exam tip: OSPF authentication is configured per interface, not globally. You must enter interface configuration mode.

4.

CCNA exam tip: The password is sent as an MD5 hash, not in plaintext, but it is stored in the running config as plaintext unless you enable service password-encryption.

Common Mistakes

Mistake 1: Forgetting to configure the message-digest-key after enabling authentication, causing OSPF to reject all packets and neighbor adjacency to fail.

Mistake 2: Using different key IDs or passwords on neighboring routers, leading to authentication mismatch and no OSPF adjacency.

Mistake 3: Applying authentication only on one side of the link; both sides must have matching authentication configuration.

ip ospf authentication message-digest vs ip ospf message-digest-key 1 md5 [key]

The ip ospf authentication message-digest and ip ospf message-digest-key commands are often confused because both are necessary for OSPF MD5 authentication to work, yet they play different roles: one activates the MD5 authentication method on the interface, while the other provides the actual key material. Configuring only one will not secure OSPF routing updates.

Aspectip ospf authentication message-digestip ospf message-digest-key 1 md5 [key]
PurposeEnables MD5 authentication on the interfaceDefines a key ID and password for MD5 authentication
DependencyRequires at least one message-digest-key to be configured to be effectiveRequires ip ospf authentication message-digest to be active for the key to be used
Key ManagementDoes not manage keys; only enables the authentication methodManages individual keys; multiple keys can be defined for rollover
Config OrderCan be configured before or after key definition; authentication will not work until both are presentCan be configured before or after enabling authentication; no effect until authentication is enabled
Verification ImpactSeen in show ip ospf interface as 'Message Digest Authentication'Seen in show running-config and show key chain; not directly in OSPF interface output

Use ip ospf authentication message-digest when you want to enable MD5 authentication on an interface after defining the necessary keys to start authenticating OSPF packets.

Use ip ospf message-digest-key 1 md5 [key] when you need to define or update the MD5 authentication key and key ID for an interface, typically during initial setup or key rollover.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 switches), the syntax is identical to classic IOS. The `ip ospf authentication message-digest` command works the same way. However, on some IOS-XE platforms, the key password may be displayed as encrypted by default in the running configuration.

In NX-OS (Cisco Nexus switches), the equivalent command is `ip ospf authentication message-digest` under interface mode, but the key is configured with `ip ospf message-digest-key <key-id> md5 <password>`. NX-OS also supports SHA authentication as an alternative. For ASA firewalls, OSPF authentication is configured under the OSPF process with `area <area-id> authentication message-digest` and then on the interface with `ospf message-digest-key <key-id> md5 <password>`.

The ASA does not use the `ip ospf authentication message-digest` command directly. In IOS-XR, the command is `ospf authentication message-digest` under the interface configuration, and the key is set with `message-digest-key <key-id> md5 <password>`. Note that IOS-XR uses a different configuration hierarchy.

Between IOS versions, the behavior is consistent from 12.x to 16.x. In older IOS versions (12.x), the key password could be displayed in plaintext in the running config if service password-encryption was not enabled. In newer versions, it is encrypted by default.

The command is available in all IOS versions that support OSPF.

Related Commands

ip ospf message-digest-key 1 md5 [key]

Configures OSPF MD5 authentication on an interface by defining a key ID and password to authenticate OSPF packets.

show ip ospf interface

Displays OSPF interface parameters and status, used to verify OSPF configuration and troubleshoot neighbor relationships.

show ip ospf neighbor

Displays OSPF neighbour table showing router IDs, adjacency state, dead timer, and the interface the neighbour is reachable through.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions