4.3.1 Ensure OSPF authentication is set to MD5


OSPF Neighbors should be authenticated.


Where it is deployed, OSPF routing is vital for normal operation of an organization's network infrastructure. Correct route information is required for routers to correctly direct traffic through the network. An attacker posing as one of the target routers OSPF neighbors may inject incorrect information into the route table resulting in DoS attack or loss of confidential data through a Man in the Middle attack.

On Juniper routers (as well as routers from other manufacturers such as Cisco or Brocade) it is possible to authenticate neighbors using an MD5 digest of elements in the update combined with a sequence number to protect against Replay attacks.

Authentication is configured on a per Interface basis when an interfaces is assigned to an OSPF area.


To configure MD5 based authentication, first configure the authentication type at the [edit protocols ospf area <area number>] hierarchy (this step is not required on all versions of JUNOS):

[edit protocols ospf area <area number>]
user@host#set authentication-type md5

The key must then be configured for any interfaces in the area

[edit protocols ospf area <area number>]
user@host#set interface <interface number> authentication md5 <key number> <key>

The parameter needs to be the same across all routers in the area and is there to provide a method for transitioning from old to new keys.

Default Value:

No OSPF routing is configured by default.

See Also


Item Details


References: 800-53|IA-5, 800-53|IA-5(1), CSCv7|16.4

Plugin: Juniper

Control ID: 8d415f0540728daaf99b08799f0784b66f4b845266a07c831a88896b293edf06