Detections
Analytics

3.1.1.2 OSPF Neighbor Authentication

Information

Enable OSPF Neighbor Authentication

The purpose of configuring OSPF neighbor authentication is to secure communication between OSPF routers and protect the integrity of routing information exchanged. By default, OSPF uses "null" authentication, meaning no authentication is applied, leaving OSPF control packets vulnerable to unauthorized access, tampering, or injection of malicious routing information. Introducing cryptographic authentication methods, such as HMAC-SHA-512, ensures that OSPF neighbors exchange routing information securely, preventing unauthorized devices from becoming OSPF neighbors and mitigating risks such as routing table poisoning or network disruptions caused by malicious actors.

Solution

AOS-CX keychain feature can be used to specify a system-level cryptographicauthentication key which can be used by multiple OSPF interfaces -

To configure the keychain with HMAC-SHA-512 cryptographic algorithm and keystring (Keystring can be entered as plaintext or as a hashed ciphertext string)-

switch(config)# keychain <keychain-name>
switch(config-keychain)# key <ID>
switch(config-keychain-key)# cryptographic-algorithm hmac-sha-512
switch(config-keychain-key)# key-string plaintext <plaintext-key-string>

To associate the keychain in the OSPF enabled interface -

switch(config-keychain-key)# interface <interface-ID>
switch(config-if)# ip ospf authentication keychain
switch(config-if)# ip ospf keychain <keychain-name>

Impact:

HMAC-SHA-512 is a robust cryptographic hashing algorithm that offers strong protection against brute force and collision attacks. Configuring SHA-512 ensures a higher level of security for OSPF communications compared to plaintext passwords or weaker hashing algorithms. Requiring both devices to use the same authentication method and key ensures consistency and interoperability between OSPF neighbors, which is critical for maintaining stable OSPF adjacencies

See Also

https://workbench.cisecurity.org/benchmarks/24202

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1), CSCv7|14.4

Plugin: ArubaOS

Control ID: c8968661f940ab72eb0a5c83312c0792af062237ba12e77ea5c57deacc505e59