Detections
Analytics

3.1.1 OSPF Interface Authentication

Information

OSPF authentication secures routing updates by verifying the identity of neighboring routers, preventing malicious devices from injecting false routing information.

The OSPFv2 Secure Hash Algorithms (SHA) Authentication support as defined in RFC 5709 supports the configuration of SHA1, SHA256, SHA384 and SHA512 Message-Digest authentication as an alternative to the MD5 Message-Digest authentication.

Because a routing protocol contains information that need not be kept
secret, privacy is not a requirement. However, authentication of the
messages within the protocol is of interest in order to reduce the
risk of an adversary compromising the routing system by deliberately
injecting false information into the routing system.

SHA256 or higher should be used due to concerns about the overall strength of the MD5 and SHA1 algorithm.

Solution

Configure OSPF authentication on interfaces connected to OSPF neighbors

interface {interface-name}
 ip ospf authentication message-digest
 ip ospf authentication message-digest-key {number} sha256 {key text}

See Also

https://workbench.cisecurity.org/benchmarks/25683

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-3(1)

Plugin: Arista

Control ID: bc12efd3eff834259ad035f40b7d1df4f12f02ab5f55fb60feb392ec6dd67681