In which configuration mode is ip ospf message-digest-key 1 md5 [key] used?

The ip ospf message-digest-key 1 md5 [key] command is entered in Interface Config mode on Cisco IOS devices.

OSPFInterface Config

ip ospf message-digest-key 1 md5 [key]

Configures OSPF MD5 authentication on an interface by defining a key ID and password to authenticate OSPF packets.

Definition: ip ospf message-digest-key 1 md5 [key] is a Cisco IOS interface config command. Configures OSPF MD5 authentication on an interface by defining a key ID and password to authenticate OSPF packets.

Overview

The `ip ospf message-digest-key 1 md5 [key]` command is used to configure OSPF MD5 authentication on a per-interface basis. OSPF authentication ensures that only trusted routers participate in routing updates, preventing spoofed routing information from being injected into the network. MD5 authentication uses a shared secret key and a key ID to generate a cryptographic hash that is appended to OSPF packets.

The receiving router verifies the hash using the same key and key ID. This command is typically used in environments where OSPF adjacency security is required, such as between enterprise branch routers or in service provider networks. It is an alternative to plaintext authentication (which is insecure) and null authentication (which provides no security).

The command is applied in interface configuration mode and affects only that interface. The key ID (1 in this example) must match on both sides of the link. The password (key) can be up to 16 characters.

After configuration, OSPF packets sent on that interface will include the MD5 digest. The command does not affect the running configuration until the interface is brought up or OSPF is restarted. It is important to note that the key is stored in the running configuration in encrypted form if the `service password-encryption` command is enabled.

The command requires privilege level 15 (enable mode) to configure. When troubleshooting, mismatched keys or key IDs will prevent OSPF adjacency from forming, and the `debug ip ospf adj` command will show authentication failures. This command is part of the broader OSPF security configuration workflow, which may also include area authentication or virtual-link authentication.

It is commonly used in conjunction with `area authentication message-digest` to enable authentication for an entire area. However, the interface-level command overrides the area-level setting. The command is supported in IOS 12.x and later, including IOS-XE and IOS-XR (with slight syntax differences).

In NX-OS, the equivalent command is `ip ospf authentication message-digest` and `ip ospf message-digest-key <key-id> md5 <key>`. The command is critical for CCNA and CCNP candidates as it tests understanding of OSPF security and the importance of consistent configuration across neighboring routers.

Syntax·Interface Config

ip ospf message-digest-key 1 md5 [key]

When to Use This Command

Securing OSPF routing updates between two directly connected routers to prevent route injection attacks.
Enabling OSPF authentication in a multi-access network (e.g., Ethernet) where multiple neighbors must share the same key.
Migrating from plain-text authentication to MD5 authentication without disrupting OSPF adjacency by adding a new key before removing the old one.
Complying with security policies that require authentication for all routing protocol exchanges.

Parameters

Parameter	Syntax	Required	Description
key-id	<1-255>	Required	The key identifier for the MD5 key. It must match on both OSPF neighbors. Valid values are from 1 to 255. A common mistake is using the same key ID but different passwords, which will cause authentication failure.
key	string (up to 16 characters)	Required	The password used for MD5 authentication. It can be up to 16 characters. The password must be identical on both sides of the link. It is stored in the running configuration and can be encrypted with `service password-encryption`.

Command Examples

Basic MD5 Authentication Configuration

ip ospf message-digest-key 1 md5 cisco123

Router(config-if)# ip ospf message-digest-key 1 md5 cisco123
Router(config-if)#

The command sets key ID 1 with password 'cisco123' for OSPF MD5 authentication on the interface. No output is shown if successful; the prompt returns without error.

Verifying MD5 Authentication with show ip ospf interface

show ip ospf interface gigabitethernet 0/0

GigabitEthernet0/0 is up, line protocol is up
  Internet Address 192.168.1.1/24, Area 0
  Process ID 1, Router ID 1.1.1.1, Network Type BROADCAST, Cost: 1
  Transmit Delay is 1 sec, State DR, Priority 1
  Designated Router (ID) 1.1.1.1, Interface address 192.168.1.1
  Backup Designated router (ID) 2.2.2.2, Interface address 192.168.1.2
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    oob-resync timeout 40
    Hello due in 00:00:03
  Supports Link-local Signaling (LLS)
  Cisco NSF helper support enabled
  IETF NSF helper support enabled
  Can be protected by per-packet TTL-1 hop security
  Index 1/1/1, flood queue length 0
  Next 0x0(0)/0x0(0)/0x0(0)
  Last flood scan length is 0, maximum is 0
  Last flood scan time is 0 msec, maximum is 0 msec
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 2.2.2.2  (Backup Designated Router)
  Suppress hello for 0 neighbor(s)
  Message digest authentication enabled
    Youngest key id is 1

The output shows OSPF interface details. Key line: 'Message digest authentication enabled' confirms MD5 is active. 'Youngest key id is 1' indicates the key ID currently used for sending.

Understanding the Output

The command itself produces no output on success. To verify, use 'show ip ospf interface [interface]'. Look for 'Message digest authentication enabled' to confirm MD5 is active.

The 'Youngest key id' field shows the key ID used for sending; all neighbors must have the same key ID and password. If authentication fails, the neighbor state will not progress beyond INIT or EXSTART, and 'show ip ospf neighbor' will show the neighbor as stuck in INIT or EXSTART/EXCHANGE. Use 'debug ip ospf adj' to see authentication failures.

Configuration Scenarios

Configure OSPF MD5 authentication between two branch routers

Two branch routers, R1 and R2, are connected via a serial link. OSPF is already configured, but the network requires authentication to prevent unauthorized routing updates.

Topology

R1(Se0/0/0)---10.0.12.0/30---(Se0/0/0)R2

Steps

1.Step 1: Enter privileged EXEC mode on R1: enable
2.Step 2: Enter global configuration mode: configure terminal
3.Step 3: Enter interface configuration mode for Serial0/0/0: interface Serial0/0/0
4.Step 4: Configure MD5 authentication with key ID 1 and password 'cisco123': ip ospf message-digest-key 1 md5 cisco123
5.Step 5: Exit interface configuration: exit
6.Step 6: Repeat steps 1-5 on R2 with the same key ID and password.
7.Step 7: Verify OSPF adjacency: show ip ospf neighbor

Configuration

! R1 configuration
interface Serial0/0/0
 ip ospf message-digest-key 1 md5 cisco123
!
! R2 configuration
interface Serial0/0/0
 ip ospf message-digest-key 1 md5 cisco123

Verify: Use `show ip ospf interface serial0/0/0` to verify authentication is enabled. Look for 'Message digest authentication enabled' in the output. Also use `show ip ospf neighbor` to confirm adjacency state is FULL.

Watch out: If the key ID or password does not match on both sides, the adjacency will not form. Use `debug ip ospf adj` to see authentication failures.

Change OSPF MD5 key without disrupting adjacency

A network administrator needs to change the OSPF authentication key on a link between two routers without causing an adjacency flap. This is done by adding a new key while keeping the old key active.

Topology

R1(Gi0/0)---192.168.1.0/30---(Gi0/0)R2

Steps

1.Step 1: On R1, add a new key with a higher key ID (e.g., key ID 2) and new password: interface GigabitEthernet0/0, then ip ospf message-digest-key 2 md5 newpass
2.Step 2: On R2, add the same new key: interface GigabitEthernet0/0, then ip ospf message-digest-key 2 md5 newpass
3.Step 3: Wait for OSPF to use the new key (the router will send packets with the highest key ID). Verify with show ip ospf interface.
4.Step 4: Remove the old key from both routers: no ip ospf message-digest-key 1 md5
5.Step 5: Verify adjacency remains FULL: show ip ospf neighbor

Configuration

! R1 configuration
interface GigabitEthernet0/0
 ip ospf message-digest-key 1 md5 oldpass
 ip ospf message-digest-key 2 md5 newpass
!
! R2 configuration
interface GigabitEthernet0/0
 ip ospf message-digest-key 1 md5 oldpass
 ip ospf message-digest-key 2 md5 newpass

Verify: Use `show ip ospf interface gigabitethernet0/0` to see both keys. The output will show 'Message digest authentication enabled' and list the key IDs. Use `debug ip ospf packet` to see which key is being used.

Watch out: If you remove the old key before adding the new one, the adjacency will drop. Always add the new key first, then remove the old one.

Troubleshooting with This Command

When troubleshooting OSPF MD5 authentication, the first step is to verify that the key ID and password match on both sides. Use `show ip ospf interface` to check if authentication is enabled and to see the configured key IDs. The output should include 'Message digest authentication enabled' and list the key IDs.

If the adjacency is not forming, use `debug ip ospf adj` to see authentication errors. A typical error message is 'OSPF: Mismatched authentication key from [source IP]'. This indicates that the key ID or password does not match.

Also check that the OSPF process is running and that the interface is not passive. Use `show ip ospf neighbor` to see the state of the neighbor. If the state is stuck in INIT or EXSTART, authentication is likely the issue.

Another useful command is `debug ip ospf packet` to see the authentication type in the packets. Healthy output shows 'OSPF: rcv. v:2 t:1 l:48 rid:2.2.2.2 aid:0.0.0.0 chk:0 aut:2 keyid:1 seq:0x1 from 10.0.12.2'. The 'aut:2' indicates MD5 authentication.

If you see 'aut:0' (null) or 'aut:1' (plaintext), the authentication type is mismatched. Also verify that the key is not expired or that the key ID is not out of range. If using multiple keys, ensure the highest key ID is used for sending.

The router will send packets with the highest key ID configured. If the receiving router does not have that key, it will drop the packet. To correlate with other commands, use `show running-config interface` to see the configured keys.

Also check the OSPF process with `show ip ospf` to ensure the router ID and area are correct. In complex scenarios, use `show ip ospf database` to verify that LSAs are being exchanged. If authentication is failing, the database will be empty.

Finally, remember that the `ip ospf message-digest-key` command is interface-specific, so ensure it is applied to the correct interface. If the interface is a VLAN interface, the authentication must match on all routers in that VLAN.

CCNA Exam Tips

CCNA exam tip: MD5 authentication is configured per interface, not per OSPF process. Remember to apply it on both sides with matching key ID and password.

CCNA exam tip: The key ID is a number from 1 to 255. The password can be up to 16 characters. The exam may test that the key ID must match on both routers.

CCNA exam tip: To change the password without disrupting adjacency, configure a new key with a higher ID, then remove the old key. The router uses the youngest key (highest ID) for sending.

CCNA exam tip: 'ip ospf message-digest-key' is used for MD5; for plain-text authentication, use 'ip ospf authentication-key'. The exam may ask which command enables MD5.

Common Mistakes

Mistake 1: Configuring the key on only one side of the link. Consequence: OSPF adjacency fails to form or drops.

Mistake 2: Using different passwords or key IDs on neighboring routers. Consequence: Authentication mismatch, adjacency stuck in INIT.

Mistake 3: Forgetting to enable authentication with 'ip ospf authentication message-digest' after setting the key. Consequence: Key is configured but not used; OSPF packets are sent without authentication.

ip ospf message-digest-key 1 md5 [key] vs show ip ospf interface

The ip ospf message-digest-key command configures MD5 authentication on an OSPF interface, while show ip ospf interface displays operational state and configuration details. They are commonly paired because after configuring authentication, engineers use the show command to verify that OSPF neighbors are established correctly.

Aspect	ip ospf message-digest-key 1 md5 [key]	show ip ospf interface
Scope	Interface-specific authentication key	All interfaces or specified interface OSPF status
Configuration mode	Interface configuration mode	Privileged EXEC mode (show command)
Persistence	Written to running-config, persists after reload	Displays current state, no persistence
Precedence	Only used if matched with neighbor's key ID and password	Passive; displays both configured and learned values
Typical use	Enable OSPF authentication on an interface	Verify OSPF adjacency status and interface parameters

Use ip ospf message-digest-key 1 md5 [key] when you need to enable MD5 authentication on a specific OSPF interface to secure OSPF routing updates.

Use show ip ospf interface when you need to verify OSPF interface state, check that authentication is active, or troubleshoot neighbor relationship issues.

Platform Notes

In IOS-XE, the command syntax is identical to classic IOS. However, the output of `show ip ospf interface` may include additional fields like 'Cryptographic authentication' and 'Message digest authentication'. In NX-OS, the equivalent command is `ip ospf authentication message-digest` to enable MD5 authentication on the interface, and `ip ospf message-digest-key <key-id> md5 <key>` to configure the key.

Note that in NX-OS, the key ID range is also 1-255, but the password can be up to 16 characters. In IOS-XR, the command is `ospf authentication message-digest` under the interface configuration, and the key is configured with `message-digest-key <key-id> md5 <key>`. The syntax is similar but the command hierarchy differs.

In ASA, OSPF authentication is configured under the OSPF process with `area <area-id> authentication message-digest` and then on the interface with `ospf message-digest-key <key-id> md5 <key>`. The ASA does not support the `ip ospf message-digest-key` command directly; instead, it uses `ospf` under interface configuration. For IOS versions prior to 12.4, the command is the same, but the output of `show ip ospf interface` may not show the key IDs.

In IOS 15.x and later, the output is more detailed. There are no significant differences between 12.x and 15.x for this command. In all platforms, the key is stored in the running configuration and can be encrypted with `service password-encryption`.

The command is available in all IOS images that support OSPF, including IP Base and Advanced IP Services.

Related Commands

debug ip ospf adj

Use this command to debug OSPF adjacency events in real-time, helping to troubleshoot why OSPF neighbors are not forming or are flapping.

show ip ospf interface

Displays OSPF interface parameters and status, used to verify OSPF configuration and troubleshoot neighbor relationships.

show ip ospf neighbor

Displays OSPF neighbour table showing router IDs, adjacency state, dead timer, and the interface the neighbour is reachable through.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions