Courseiva
OSPFRouter Config

area [id] authentication message-digest

Enables OSPF MD5 authentication on a specific area to ensure that only trusted routers participate in OSPF routing updates within that area.

Definition: area [id] authentication message-digest is a Cisco IOS router config command. Enables OSPF MD5 authentication on a specific area to ensure that only trusted routers participate in OSPF routing updates within that area.

Overview

The `area [id] authentication message-digest` command is a critical OSPF security feature that enables MD5 authentication on a per-area basis. In OSPF, routers exchange routing information via Link State Advertisements (LSAs). Without authentication, any device can inject false routing information, potentially causing routing loops, black holes, or denial of service.

MD5 authentication ensures that only routers with a matching password (key) can participate in OSPF exchanges within that area. This command is typically used in multi-access networks (e.g., Ethernet) or point-to-point links where security is a concern. It is an alternative to simple password authentication (which sends the password in clear text) and is preferred because MD5 creates a hash of the password and the packet contents, preventing eavesdropping and replay attacks.

The command is applied in router configuration mode and affects all interfaces in the specified area. It is important to note that authentication must be configured consistently on all routers in the area; otherwise, OSPF neighbor relationships will fail to form. The command does not require a reload and takes effect immediately.

It is often used in conjunction with `ip ospf message-digest-key` on individual interfaces to define the actual key. In a broader workflow, you would first plan your OSPF areas and authentication keys, then configure the area authentication globally, and finally set the per-interface keys. This command is part of the OSPF security toolkit and is commonly tested in CCNA and CCNP exams, as well as encountered in enterprise networks.

Syntax·Router Config
area [id] authentication message-digest

When to Use This Command

  • Securing OSPF routing in a corporate network to prevent unauthorized routers from injecting false routes.
  • Configuring OSPF authentication in a multi-tenant environment where different areas are managed by different teams.
  • Meeting compliance requirements that mandate authentication for all routing protocols.
  • Troubleshooting OSPF neighbor issues caused by authentication mismatch between routers.

Parameters

ParameterSyntaxDescription
idA.B.C.D or <0-4294967295>The OSPF area ID. This can be specified as a decimal number (e.g., 0, 1, 2) or in dotted-decimal format (e.g., 0.0.0.0, 0.0.0.1). The area ID must match on all routers in that area. A common mistake is using the wrong area ID, which prevents authentication from being applied to the intended interfaces.

Command Examples

Enable MD5 authentication on area 0

area 0 authentication message-digest
Router(config-router)# area 0 authentication message-digest
Router(config-router)#

The command is entered without any output; it simply enables MD5 authentication for area 0. After this, each interface in area 0 must have an 'ip ospf message-digest-key' command configured.

Verify OSPF authentication configuration

show ip ospf interface gigabitethernet0/0
GigabitEthernet0/0 is up, line protocol is up
  Internet Address 192.168.1.1/24, Area 0
  Process ID 1, Router ID 1.1.1.1, Network Type BROADCAST, Cost: 1
  Transmit Delay is 1 sec, State DR, Priority 1
  Designated Router (ID) 1.1.1.1, Interface address 192.168.1.1
  Backup Designated router (ID) 2.2.2.2, Interface address 192.168.1.2
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    oob-resync timeout 40
    Hello due in 00:00:03
  Supports Link-local Signaling (LLS)
  Cisco NSF helper support enabled
  IETF NSF helper support enabled
  Can be protected by per-prefix Loop-Free Fast Reroute
  Index 1/1/1, flood queue length 0
  Next 0x0(0)/0x0(0)/0x0(0)
  Last flood scan length is 1, maximum is 1
  Last flood scan time is 0 msec, maximum is 0 msec
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 2.2.2.2  (Backup Designated Router)
  Suppress hello for 0 neighbor(s)
  Message digest authentication enabled
    Youngest key id is 1

The output shows OSPF interface details. The line 'Message digest authentication enabled' confirms that MD5 authentication is active. 'Youngest key id is 1' indicates the key ID being used. If authentication is not configured, this line would be absent or show 'No authentication'.

Understanding the Output

The 'show ip ospf interface' command is used to verify OSPF authentication. Look for the line 'Message digest authentication enabled' to confirm that MD5 authentication is active on the interface. If authentication is missing, the line will not appear or will state 'No authentication'.

The 'Youngest key id' field shows the key ID currently in use; all routers in the same area must have matching key IDs and passwords. A mismatch will prevent OSPF neighbor adjacency from forming. In a real network, you should also check that all interfaces in the area have the same authentication configuration to avoid partial connectivity.

Configuration Scenarios

Configure OSPF MD5 authentication on a single area between two routers

Two routers, R1 and R2, are connected via a point-to-point link in OSPF area 0. The network engineer wants to secure OSPF updates using MD5 authentication to prevent unauthorized routers from forming adjacencies.

Topology

R1(Gi0/0)---10.0.12.0/30---(Gi0/0)R2

Steps

  1. 1.Step 1: Enter global configuration mode on R1: configure terminal
  2. 2.Step 2: Enable OSPF process: router ospf 1
  3. 3.Step 3: Enable MD5 authentication for area 0: area 0 authentication message-digest
  4. 4.Step 4: Exit to interface configuration: interface gigabitethernet 0/0
  5. 5.Step 5: Set the MD5 key: ip ospf message-digest-key 1 md5 cisco123
  6. 6.Step 6: Repeat steps 1-5 on R2 with the same key and area.
Configuration
! R1 configuration
router ospf 1
 area 0 authentication message-digest
!
interface GigabitEthernet0/0
 ip address 10.0.12.1 255.255.255.252
 ip ospf message-digest-key 1 md5 cisco123
!
! R2 configuration
router ospf 1
 area 0 authentication message-digest
!
interface GigabitEthernet0/0
 ip address 10.0.12.2 255.255.255.252
 ip ospf message-digest-key 1 md5 cisco123

Verify: Use 'show ip ospf neighbor' to verify adjacency state is FULL. Use 'show ip ospf interface gigabitethernet 0/0' to confirm authentication is enabled (look for 'Message digest authentication enabled').

Watch out: The key ID (1 in this example) must match on both routers; otherwise, authentication fails and neighbors will not form.

Configure OSPF MD5 authentication in a multi-area scenario with multiple keys

A network has three routers in area 0 and area 1. The engineer needs to enable MD5 authentication on area 0 only, while area 1 remains unauthenticated. Additionally, they want to use a different key for each interface for added security.

Topology

R1(Gi0/0)---10.0.12.0/30---(Gi0/0)R2(Gi0/1)---10.0.23.0/30---(Gi0/0)R3 R1 and R2 in area 0, R2 and R3 in area 1

Steps

  1. 1.Step 1: On R1, configure OSPF and enable MD5 authentication for area 0: router ospf 1, area 0 authentication message-digest
  2. 2.Step 2: On R1, configure the key on the interface: interface gi0/0, ip ospf message-digest-key 1 md5 key1
  3. 3.Step 3: On R2, enable MD5 authentication for area 0: router ospf 1, area 0 authentication message-digest
  4. 4.Step 4: On R2, configure key on the interface facing R1: interface gi0/0, ip ospf message-digest-key 1 md5 key1
  5. 5.Step 5: On R2, configure a different key on the interface facing R3 (area 1 does not require authentication, but the interface can still have a key if needed; however, since area 1 has no authentication, the key is ignored): interface gi0/1, ip ospf message-digest-key 2 md5 key2
  6. 6.Step 6: On R3, no authentication is configured for area 1, so no area authentication command is needed. However, if you want to authenticate area 1 later, you would add it.
Configuration
! R1
router ospf 1
 area 0 authentication message-digest
!
interface GigabitEthernet0/0
 ip address 10.0.12.1 255.255.255.252
 ip ospf message-digest-key 1 md5 key1
!
! R2
router ospf 1
 area 0 authentication message-digest
!
interface GigabitEthernet0/0
 ip address 10.0.12.2 255.255.255.252
 ip ospf message-digest-key 1 md5 key1
!
interface GigabitEthernet0/1
 ip address 10.0.23.2 255.255.255.252
 ip ospf message-digest-key 2 md5 key2
!
! R3
router ospf 1
!
interface GigabitEthernet0/0
 ip address 10.0.23.3 255.255.255.252
 ip ospf message-digest-key 2 md5 key2

Verify: On R1 and R2, use 'show ip ospf neighbor' to confirm adjacency is FULL. On R2, use 'show ip ospf interface gi0/1' to see that authentication is not enabled (since area 1 has no authentication).

Watch out: If you configure the area authentication command on R2 for area 0 but forget to set the key on the interface, the neighbor will not form. Also, ensure that the key ID and password match exactly on both ends.

Troubleshooting with This Command

When troubleshooting OSPF MD5 authentication, the first step is to verify that the neighbor adjacency is not forming. Use 'show ip ospf neighbor' to see if the neighbor state is stuck in INIT or EXSTART/EXCHANGE. If the neighbor is not appearing, check the interface with 'show ip ospf interface [interface]'.

Look for the line 'Message digest authentication enabled' to confirm authentication is active. If it says 'No authentication', then the area authentication command may not be applied correctly. Next, verify the key configuration with 'show ip ospf interface [interface]' which displays the key ID and the authentication type.

Common issues include mismatched key IDs, mismatched passwords, or one side having authentication enabled while the other does not. Use 'debug ip ospf packet' to see authentication errors; look for 'Authentication mismatch' or 'Invalid authentication' messages. Also, ensure that the area ID in the 'area authentication' command matches the area configured on the interface.

If you have multiple keys, OSPF will use the most recent key (highest key ID) for sending, but will accept any valid key for receiving. A common mistake is forgetting to configure the key on the interface after enabling area authentication. Another is using the wrong key ID on one side.

If you change a key, you can add a new key with a higher ID and then remove the old one after the neighbor re-establishes. Always verify with 'show ip ospf neighbor detail' to see the authentication status. In a multi-area scenario, ensure that authentication is applied only to the intended areas; if you accidentally enable authentication on an area where not all routers have it, those routers will lose connectivity.

CCNA Exam Tips

1.

CCNA exam tip: Remember that 'area [id] authentication message-digest' is configured in router config mode, not interface mode.

2.

CCNA exam tip: After enabling area authentication, you must configure 'ip ospf message-digest-key [key-id] md5 [password]' on each interface in that area.

3.

CCNA exam tip: The key ID must match between neighbors; otherwise, authentication fails and OSPF adjacency does not form.

4.

CCNA exam tip: Use 'show ip ospf interface' to verify authentication status; look for 'Message digest authentication enabled'.

Common Mistakes

Mistake 1: Forgetting to configure the 'ip ospf message-digest-key' on interfaces after enabling area authentication, causing OSPF neighbors to fail to form.

Mistake 2: Using different key IDs or passwords on routers in the same area, leading to authentication mismatches and neighbor flapping.

Mistake 3: Applying the 'area authentication' command to the wrong area ID, which can cause authentication to be enabled on unintended areas.

area [id] authentication message-digest vs ip ospf message-digest-key 1 md5 [key]

These two commands are commonly confused because both are required to implement OSPF MD5 authentication; the area-level command enables authentication for the entire area, while the interface-level command defines the actual authentication key.

Aspectarea [id] authentication message-digestip ospf message-digest-key 1 md5 [key]
ScopeArea-wideInterface-specific
Configuration modeRouter configurationInterface configuration
Effect on OSPF packetsEnables authentication requirementProvides cryptographic key for verification
Required for operationMust be present on all routers in areaMust match on neighboring interfaces
Key managementNo key definedDefines key ID and password

Use area [id] authentication message-digest when you need to enable OSPF authentication across an entire area, ensuring all OSPF packets in that area are authenticated.

Use ip ospf message-digest-key 1 md5 [key] when you need to configure the actual authentication key on a per-interface basis, required for authentication to function.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 switches), the command syntax is identical to classic IOS. However, the output of 'show ip ospf interface' may include additional fields like 'Cryptographic authentication enabled' instead of 'Message digest authentication enabled'. In NX-OS (e.g., Nexus switches), the equivalent command is 'area [id] authentication message-digest' under 'router ospf', but the key configuration is done under the interface using 'ip ospf authentication-key [key]' or 'ip ospf message-digest-key [id] md5 [key]'.

NX-OS also supports 'area [id] authentication' without 'message-digest' for simple authentication. On ASA firewalls, OSPF authentication is configured under 'router ospf' with 'area [id] authentication [message-digest | null]' and keys are set per interface with 'ospf message-digest-key [id] md5 [key]'. In IOS-XR, the command is 'area [id] authentication message-digest' under 'router ospf', but the key is configured using 'crypto key' or 'authentication-key' under the interface.

There are no significant differences between IOS 12.x, 15.x, and 16.x for this command; however, in older IOS versions (12.x), the 'message-digest' keyword was required, while in newer versions, 'area authentication' defaults to simple authentication if not specified. Always specify 'message-digest' for MD5.

Related Commands

ip ospf message-digest-key 1 md5 [key]

Configures OSPF MD5 authentication on an interface by defining a key ID and password to authenticate OSPF packets.

show ip ospf interface

Displays OSPF interface parameters and status, used to verify OSPF configuration and troubleshoot neighbor relationships.

show ip ospf neighbor

Displays OSPF neighbour table showing router IDs, adjacency state, dead timer, and the interface the neighbour is reachable through.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions