Lab Objective
Configure MD5 authentication on an OSPF-enabled interface between two routers, verify the neighbor relationship forms successfully when keys match, then introduce a key mismatch and observe the resulting adjacency failure.
Lab Purpose
Without authentication, any device that can send properly formatted OSPF hello packets on a shared segment can potentially form an unauthorized neighbor relationship and inject false routing information. MD5 authentication ensures only routers sharing a common secret key can become neighbors.
Lab Topology
R1 ---- Gi0/0 ------------------ Gi0/0 ---- R2
192.168.110.1/24 192.168.110.2/24
OSPF process 1, area 0, already forming a
healthy adjacency between R1 and R2Task 1: Verify the Current Healthy Adjacency
Confirm R1 and R2 show a FULL neighbor relationship before adding authentication.
Task 2: Configure MD5 Authentication on R1
Enable OSPF MD5 authentication on R1's interface with a specific key.
Task 3: Configure Matching MD5 Authentication on R2
Enable the identical key on R2's corresponding interface.
Task 4: Verify the Adjacency Remains FULL
Confirm the neighbor relationship is unaffected, since both keys match.
Task 5: Introduce a Key Mismatch
Change R2's key to a different value and observe the resulting adjacency failure.
Task 6: Correct the Mismatch
Restore matching keys and confirm the adjacency recovers.
Solution and Verification
R1# show ip ospf neighbor
Neighbor ID Pri State Address
2.2.2.2 1 FULL/BDR 192.168.110.2R1(config)# interface gigabitethernet0/0
R1(config-if)# ip ospf message-digest-key 1 md5 OspfKey2026
R1(config-if)# ip ospf authentication message-digestR2(config)# interface gigabitethernet0/0
R2(config-if)# ip ospf message-digest-key 1 md5 OspfKey2026
R2(config-if)# ip ospf authentication message-digestR1# show ip ospf neighbor
Neighbor ID Pri State Address
2.2.2.2 1 FULL/BDR 192.168.110.2
-- Adjacency remains FULL, since both sides
-- now share the identical keyR2(config)# interface gigabitethernet0/0
R2(config-if)# ip ospf message-digest-key 1 md5 DifferentKey999R1# show ip ospf neighbor
-- (Neighbor entry eventually disappears
-- entirely once the dead timer expires)
R1# debug ip ospf adj
*OSPF: Rcv pkt from 192.168.110.2, Mismatch
Authentication Key - Message Digest Key ID 1R2(config)# interface gigabitethernet0/0
R2(config-if)# ip ospf message-digest-key 1 md5 OspfKey2026
R1# show ip ospf neighbor
Neighbor ID Pri State Address
2.2.2.2 1 FULL/BDR 192.168.110.2
-- Adjacency recovers once the keys match againKey Takeaway
An MD5 key mismatch produces a distinct debug message explicitly naming the authentication failure, unlike the generic "up, line protocol down" symptom seen with clocking or encapsulation mismatches discussed earlier in this series — this specific error message immediately points toward checking authentication configuration on both sides rather than the broader troubleshooting checklist a vaguer symptom would require.