Configuring Dynamic Routing Protocol Authentication

Cisco routers support a couple of different approaches to authenticating route advertisements received from a neighboring router:

* Plain text authentication

* Hashing authentication

Both of these approaches require routers to have matching passwords (also referred to as keys ); however, Cisco recommends the use of hashing authentication. Plain text authentication, as the name suggests, simply sends a password from one router to another in clear text. This leads to the security concern of having a malicious user capture authentication traffic containing a password and then injecting her own router, which could use the compromised password to authenticate with one of the network’s production routers.

Hashing authentication is preferred over plain text authentication, because it never sends the password over the network. Instead, a mathematical algorithm is run on the password, and the result of that algorithm (called a hash digest ) is sent from one router to its neighbor. That neighboring router also runs the hashing algorithm on its configured password, and if its hash digest matches the hash digest it receives from the first router, it can conclude that the passwords match. The two hashing algorithms that you can select from (depending on the routing protocol) include Message Digest 5 (MD5) and Secure Hash Algorithm (SHA) . SHA is generally considered to be somewhat more secure than MD5; however, either algorithm is vastly superior to using plain text authentication.

Hashing authentication using MD5 can be configured for the following protocols within Cisco IOS:

* RIPv2

* EIGRP

* OSPFv2

* OSPFv3

* IS-IS

* BGP

SHA authentication is supported by the following protocols:

* RIP next generation (RIPng)

* Named EIGRP

* OSPFv2

R1#conf t

Enter configuration commands, one per line.  End with CNTL/Z.

R1(config)#interface loop 0

R1(config-if)#

*Jul 23 10:06:29.915: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to up

R1(config-if)#ip address 192.168.1.1 255.255.255.0

R1(config-if)#interface serial 2/0

R1(config-if)#ip address 10.1.1.1 255.255.255.252

R1(config-if)#no shut

R1(config-if)#

*Jul 23 10:06:54.739: %LINK-3-UPDOWN: Interface Serial2/0, changed state to up

R1(config-if)#

*Jul 23 10:06:55.747: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial2/0, changed state to up

R1(config-if)#end

R1#

*Jul 23 10:06:58.731: %SYS-5-CONFIG_I: Configured from console by console

R2#conf t

Enter configuration commands, one per line.  End with CNTL/Z.

R2(config)#interface serial 2/0

R2(config-if)#ip address 10.1.1.2 255.255.255.252

R2(config-if)#no shut

R2(config-if)#

*Jul 23 10:05:23.347: %LINK-3-UPDOWN: Interface Serial2/0, changed state to up

R2(config-if)#

*Jul 23 10:05:24.355: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial2/0, changed state to up

R2(config-if)#do ping 10.1.1.1 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 20/28/40 ms

R2(config-if)#

R2(config-if)#interface serial 2/1

R2(config-if)#ip address 10.2.2.1 255.255.255.252

R2(config-if)#no shut

R2(config-if)#

*Jul 23 10:06:14.075: %LINK-3-UPDOWN: Interface Serial2/1, changed state to up

R2(config-if)#

*Jul 23 10:06:15.083: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial2/1, changed state to up

R2(config-if)#end

R2#

R3#conf t

Enter configuration commands, one per line.  End with CNTL/Z.

R3(config)#interface loop 0

R3(config-if)#

*Jul 23 10:06:53.103: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to up

R3(config-if)#ip address 192.168.3.1 255.255.255.0

R3(config-if)#

R3(config-if)#interface serial 2/1

R3(config-if)#ip address 10.2.2.2 255.255.255.252

R3(config-if)#no shut

R3(config-if)#

*Jul 23 10:07:18.539: %LINK-3-UPDOWN: Interface Serial2/1, changed state to up

R3(config-if)#

*Jul 23 10:07:19.547: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial2/1, changed state to up

R3(config-if)#do ping 10.2.2.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.2.2.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 20/24/28 ms

R3(config-if)#end

R3#

R1#conf t

Enter configuration commands, one per line.  End with CNTL/Z.

R1(config)#router eigrp ?

  <1-65535>  Autonomous System

  WORD       EIGRP Virtual-Instance Name

R1(config)#router eigrp ROUTE      // CONFIGURE NAMED EIGRP

R1(config-router)#?

Router configuration commands:

  address-family  Enter Address Family command mode

  default         Set a command to its defaults

  exit            Exit from routing protocol configuration mode

  no              Negate a command or set its defaults

  service-family  Enter Service Family command mode

  shutdown        Shutdown this instance of EIGRP

R1(config-router)#address-family ?

  ipv4  Address family IPv4

  ipv6  Address family IPv6

R1(config-router)#address-family ipv4 ?

  autonomous-system  Specify Address-Family Autonomous System Number

  multicast          Address Family Multicast

  unicast            Address Family Unicast

  vrf                Specify a specific virtual routing/forwarding instance

R1(config-router)#address-family ipv4 autonomous-system ?

  <1-65535>  Autonomous System

R1(config-router)#address-family ipv4 autonomous-system 1

R1(config-router-af)#network 10.1.1.0 0.0.0.3

R1(config-router-af)#network 192.168.1.0 0.0.0.255

R1(config-router-af)#end

R1#

*Jul 23 10:14:08.843: %DUAL-5-NBRCHANGE: EIGRP-IPv4 1: Neighbor 10.1.1.2 (Serial2/0) is up: new adjacency

R2#conf t

Enter configuration commands, one per line.  End with CNTL/Z.

R2(config)#router eigrp ROUTE

R2(config-router)#address-family ipv4 autonomous-system 1

R2(config-router-af)#network 10.1.1.0 0.0.0.3

R2(config-router-af)#

*Jul 23 10:11:08.475: %DUAL-5-NBRCHANGE: EIGRP-IPv4 1: Neighbor 10.1.1.1 (Serial2/0) is up: new adjacency

R2(config-router-af)#network 10.2.2.0 0.0.0.3

R2(config-router-af)#end

R2#

*Jul 23 10:12:02.783: %DUAL-5-NBRCHANGE: EIGRP-IPv4 1: Neighbor 10.2.2.2 (Serial2/1) is up: new adjacency

R3#conf t

Enter configuration commands, one per line.  End with CNTL/Z.

R3(config)#router eigrp ROUTE

R3(config-router)#address-family ipv4 autonomous-system 1

R3(config-router-af)#network 10.2.2.2 0.0.0.3

R3(config-router-af)#

*Jul 23 10:12:12.347: %DUAL-5-NBRCHANGE: EIGRP-IPv4 1: Neighbor 10.2.2.1 (Serial2/1) is up: new adjacency

R3(config-router-af)#network 192.168.3.0 0.0.0.255

R3(config-router-af)#end

R3#

R1#show ip route eigrp      // VERIFY EIGRP ROUTES

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP

       + - replicated route, % - next hop override

Gateway of last resort is not set

      10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks

D        10.2.2.0/30 [90/23796062] via 10.1.1.2, 00:02:22, Serial2/0

D     192.168.3.0/24 [90/23796702] via 10.1.1.2, 00:01:28, Serial2/0

R1#

R1#tclsh        // VERIFY CONNECTIVTY

R1(tcl)#foreach address {

+>(tcl)#192.168.1.1

+>(tcl)#10.1.1.1

+>(tcl)#10.1.1.2

+>(tcl)#10.2.2.1

+>(tcl)#10.2.2.2

+>(tcl)#192.168.3.1

+>(tcl)#} { ping $address }

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/8 ms

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 36/40/44 ms

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.1.1.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 12/18/24 ms

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.2.2.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 8/16/20 ms

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.2.2.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 8/34/44 ms

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.3.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 8/34/72 ms

R1#conf t

Enter configuration commands, one per line.  End with CNTL/Z.

R1(config)#router eigrp ROUTE        // SECURE NAMED EIGRP PROCESS

R1(config-router)#address-family ipv4 autonomous-system 1

R1(config-router-af)#?

Address Family configuration commands:

  af-interface         Enter Address Family interface configuration

  default              Set a command to its defaults

  eigrp                EIGRP Address Family specific commands

  exit-address-family  Exit Address Family configuration mode

  help                 Description of the interactive help system

  maximum-prefix       Maximum number of prefixes acceptable in aggregate

  metric               Modify metrics and parameters for address advertisement

  neighbor             Specify an IPv4 neighbor router

  network              Enable routing on an IP network

  no                   Negate a command or set its defaults

  shutdown             Shutdown address family

  timers               Adjust peering based timers

  topology             Topology configuration mode

R1(config-router-af)#af-interface ?

  Async              Async interface

  Auto-Template      Auto-Template interface

  BVI                Bridge-Group Virtual Interface

  CDMA-Ix            CDMA Ix interface

  CTunnel            CTunnel interface

  Dialer             Dialer interface

  FastEthernet       FastEthernet IEEE 802.3

  GMPLS              MPLS interface

  Group-Async        Async Group interface

  LISP               Locator/ID Separation Protocol Virtual Interface

  LongReachEthernet  Long-Reach Ethernet interface

  Loopback           Loopback interface

  MFR                Multilink Frame Relay bundle interface

  Multilink          Multilink-group interface

  Port-channel       Ethernet Channel of interfaces

  Serial             Serial

  Tunnel             Tunnel interface

  Vif                PGM Multicast Host interface

  Virtual-PPP        Virtual PPP interface

  Virtual-Template   Virtual Template interface

  Virtual-TokenRing  Virtual TokenRing

  default            Address-family default interface configuration

  vmi                Virtual Multipoint Interface

R1(config-router-af)#af-interface serial 2/0

R1(config-router-af-interface)#?

Address Family Interfaces configuration commands:

  authentication      authentication subcommands

  bandwidth-percent   Set percentage of bandwidth percentage limit

  bfd                 Enable Bidirectional Forwarding Detection

  dampening-change    Percent interface metric must change to cause update

  dampening-interval  Time in seconds to check interface metrics

  default             Set a command to its defaults

  exit-af-interface   Exit from Address Family Interface configuration mode

  hello-interval      Configures hello interval

  hold-time           Configures hold time

  next-hop-self       Configures EIGRP next-hop-self

  no                  Negate a command or set its defaults

  passive-interface   Suppress address updates on an interface

  shutdown            Disable Address-Family on interface

  split-horizon       Perform split horizon

  summary-address     Perform address summarization

R1(config-router-af-interface)#authentication ?

  key-chain  key-chain

  mode       authentication mode

R1(config-router-af-interface)#authentication mode ?

  hmac-sha-256  HMAC-SHA-256 Authentication

  md5           Keyed message digest

R1(config-router-af-interface)#authentication mode hmac-sha-256 ?

  <0-7>  Encryption type (0 to disable encryption, 7 for proprietary)

  LINE   password

R1(config-router-af-interface)#authentication mode hmac-sha-256 cisco123       // ENABLE SHA 256

R1(config-router-af-interface)#

*Jul 23 10:19:57.471: %DUAL-5-NBRCHANGE: EIGRP-IPv4 1: Neighbor 10.1.1.2 (Serial2/0) is down: authentication HMAC-SHA-256 configured

R1(config-router-af-interface)#end

R1#

*Jul 23 10:25:41.283: %DUAL-5-NBRCHANGE: EIGRP-IPv4 1: Neighbor 10.1.1.2 (Serial2/0) is up: new adjacency

*Jul 23 10:16:57.079: %DUAL-5-NBRCHANGE: EIGRP-IPv4 1: Neighbor 10.1.1.1 (Serial2/0) is down: Auth failure

R2#

R2#conf t

Enter configuration commands, one per line.  End with CNTL/Z.

R2(config)#router eigrp ROUTE

R2(config-router)#address-family ipv4 autonomous-system 1

R2(config-router-af)#af-interface serial 2/0

R2(config-router-af-interface)#authentication mode hmac-sha-256 cisco123

R2(config-router-af-interface)#

*Jul 23 10:22:40.859: %DUAL-5-NBRCHANGE: EIGRP-IPv4 1: Neighbor 10.1.1.1 (Serial2/0) is up: new adjacency

R2(config-router-af-interface)#exit

R2(config-router-af)#af-interface serial 2/1

R2(config-router-af-interface)#authentication mode hmac-sha-256 cisco456

R2(config-router-af-interface)#

*Jul 23 10:23:57.835: %DUAL-5-NBRCHANGE: EIGRP-IPv4 1: Neighbor 10.2.2.2 (Serial2/1) is down: authentication HMAC-SHA-256 configured

R2(config-router-af-interface)#end

R2#

*Jul 23 10:26:31.195: %DUAL-5-NBRCHANGE: EIGRP-IPv4 1: Neighbor 10.2.2.2 (Serial2/1) is up: new adjacency

R3#conf t

Enter configuration commands, one per line.  End with CNTL/Z.

R3(config)#router eigrp ROUTE

R3(config-router)#address-family ipv4 autonomous-system 1

R3(config-router-af)#af-interface serial 2/1

R3(config-router-af-interface)#authentication mode hmac-sha-256 cisco456

R3(config-router-af-interface)#

*Jul 23 10:26:40.727: %DUAL-5-NBRCHANGE: EIGRP-IPv4 1: Neighbor 10.2.2.1 (Serial2/1) is up: new adjacency

R3(config-router-af-interface)#end

R3#

R1#show ip route eigrp

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP

       + - replicated route, % - next hop override

Gateway of last resort is not set

      10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks

D        10.2.2.0/30 [90/23796062] via 10.1.1.2, 00:05:35, Serial2/0

D     192.168.3.0/24 [90/23796702] via 10.1.1.2, 00:01:43, Serial2/0

R1#

R1#tclsh

R1(tcl)#foreach address {

+>(tcl)#192.168.1.1

+>(tcl)#10.1.1.1

+>(tcl)#10.1.1.2

+>(tcl)#10.2.2.1

+>(tcl)#10.2.2.2

+>(tcl)#192.168.3.1

+>(tcl)#} { ping $address }

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/8 ms

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 16/22/32 ms

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.1.1.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/10/20 ms

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.2.2.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 8/12/20 ms

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.2.2.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 20/26/32 ms

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.3.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 12/18/24 ms

R1#conf t

Enter configuration commands, one per line.  End with CNTL/Z.

R1(config)#no router eigrp ROUTE

R1(config)#

R1(config)#router ospf 1

R1(config-router)#network 192.168.1.0 0.0.0.255 area 0

R1(config-router)#network 10.1.1.0 0.0.0.3 area 0

R1(config-router)#end

R1#

*Jul 23 10:39:23.735: %OSPF-5-ADJCHG: Process 1, Nbr 10.2.2.1 on Serial2/0 from LOADING to FULL, Loading Done

*Jul 23 10:29:31.807: %DUAL-5-NBRCHANGE: EIGRP-IPv4 1: Neighbor 10.1.1.1 (Serial2/0) is down: Interface PEER-TERMINATION received

R2#

R2#conf t

Enter configuration commands, one per line.  End with CNTL/Z.

R2(config)#no router eigrp ROUTE       // REMOVE EIGRP ROUTING PROTOCOL

R2(config)#

R2(config)#router ospf 1     // CONFIGURE OSPF ROUTING PROTOCOL

R2(config-router)#network 10.1.1.0 0.0.0.3 area 0

R2(config-router)#

*Jul 23 10:36:23.351: %OSPF-5-ADJCHG: Process 1, Nbr 192.168.1.1 on Serial2/0 from LOADING to FULL, Loading Done

R2(config-router)#network 10.2.2.0 0.0.0.3 area 0

R2(config-router)#end

R2#

*Jul 23 10:37:56.143: %OSPF-5-ADJCHG: Process 1, Nbr 192.168.3.1 on Serial2/1 from LOADING to FULL, Loading Done

*Jul 23 10:29:56.123: %DUAL-5-NBRCHANGE: EIGRP-IPv4 1: Neighbor 10.2.2.1 (Serial2/1) is down: Interface PEER-TERMINATION received

R3#

R3#conf t

Enter configuration commands, one per line.  End with CNTL/Z.

R3(config)#no router eigrp ROUTE

R3(config)#

R3(config)#router ospf 1

R3(config-router)#network 192.168.3.0 0.0.0.255 area 0

R3(config-router)#network 10.2.2.0 0.0.0.3 area 0

R3(config-router)#

*Jul 23 10:38:05.703: %OSPF-5-ADJCHG: Process 1, Nbr 10.2.2.1 on Serial2/1 from LOADING to FULL, Loading Done

R3(config-router)#end

R3#

R1#tclsh

R1(tcl)#foreach address {

+>(tcl)#192.168.1.1

+>(tcl)#10.1.1.1

+>(tcl)#10.1.1.2

+>(tcl)#10.2.2.1

+>(tcl)#10.2.2.2

+>(tcl)#192.168.3.1

+>(tcl)#} { ping $address }

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/5/8 ms

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 36/42/48 ms

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.1.1.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 16/20/24 ms

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.2.2.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 12/18/24 ms

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.2.2.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 16/40/72 ms

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.3.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 16/36/64 ms

R1#conf t

R1(config)#interface serial 2/0

R1(config-if)#ip ospf ?

  <1-65535>            Process ID

  authentication       Enable authentication

  authentication-key   Authentication password (key)

  bfd                  Enable BFD on this interface

  cost                 Interface cost

  database-filter      Filter OSPF LSA during synchronization and flooding

  dead-interval        Interval after which a neighbor is declared dead

  demand-circuit       OSPF Demand Circuit

  flood-reduction      OSPF Flood Reduction

  hello-interval       Time between HELLO packets

  lls                  Link-local Signaling (LLS) support

  message-digest-key   Message digest authentication password (key)

  mtu-ignore           Ignores the MTU in DBD packets

  network              Network type

  prefix-suppression   OSPF prefix suppression

  priority             Router priority

  resync-timeout       Interval after which adjacency is reset if oob-resync is

                       not started

  retransmit-interval  Time between retransmitting lost link state

                       advertisements

  shutdown             Set OSPF protocol's state to disable under current

                       interface

  transmit-delay       Link state transmit delay

  ttl-security         TTL security check

R1(config-if)#ip ospf authentication ?

  message-digest  Use message-digest authentication

  null            Use no authentication

  <cr>

R1(config-if)#ip ospf authentication message-digest  // IOS 15.4(1)T OSPFv2 SUPPORTS SHA AUTHENTICATION

R1(config-if)#

*Jul 23 10:48:25.099: %OSPF-5-ADJCHG: Process 1, Nbr 10.2.2.1 on Serial2/0 from FULL to DOWN, Neighbor Down: Dead timer expired

R1(config-if)#ip ospf message-digest-key ?

  <1-255>  Key ID

R1(config-if)#ip ospf message-digest-key 1 ?

  md5  Use MD5 algorithm

R1(config-if)#ip ospf message-digest-key 1 md5 ?

  <0-7>  Encryption type (0 for not yet encrypted, 7 for proprietary)

  LINE   The OSPF password (key) (maximum 16 characters)

R1(config-if)#ip ospf message-digest-key 1 md5 cisco123

R1(config-if)#end

R1#

*Jul 23 10:51:02.715: %OSPF-5-ADJCHG: Process 1, Nbr 10.2.2.1 on Serial2/0 from LOADING to FULL, Loading Done

R2#conf t

Enter configuration commands, one per line.  End with CNTL/Z.

R2(config)#interface serial 2/0

R2(config-if)#ip ospf authentication message-digest

R2(config-if)#ip ospf message-digest-key 1 md5 cisco123

R2(config-if)#

*Jul 23 10:48:02.303: %OSPF-5-ADJCHG: Process 1, Nbr 192.168.1.1 on Serial2/0 from LOADING to FULL, Loading Done

R2(config)#interface serial 2/1

R2(config-if)#ip ospf authentication message-digest

R2(config-if)#ip ospf message-digest-key 1 md5 cisco456

R2(config-if)#

*Jul 23 10:49:40.915: %OSPF-5-ADJCHG: Process 1, Nbr 192.168.3.1 on Serial2/1 from FULL to DOWN, Neighbor Down: Dead timer expired

R2(config-if)#end

R2#

R3#conf t

Enter configuration commands, one per line.  End with CNTL/Z.

R3(config)#interface serial 2/1

R3(config-if)#

*Jul 23 10:49:57.731: %OSPF-5-ADJCHG: Process 1, Nbr 10.2.2.1 on Serial2/1 from FULL to DOWN, Neighbor Down: Dead timer expired

R3(config-if)#ip ospf authentication message-digest

R3(config-if)#ip ospf message-digest-key 1 md5 cisco456

R3(config-if)#

*Jul 23 10:50:25.515: %OSPF-5-ADJCHG: Process 1, Nbr 10.2.2.1 on Serial2/1 from LOADING to FULL, Loading Done

R3(config-if)#end

R3#

R1#show ip route ospf     // VERIFY OSPF ROUTING TABLE

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP

       + - replicated route, % - next hop override

Gateway of last resort is not set

      10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks

O        10.2.2.0/30 [110/128] via 10.1.1.2, 00:02:57, Serial2/0

      192.168.3.0/32 is subnetted, 1 subnets

O        192.168.3.1 [110/129] via 10.1.1.2, 00:00:33, Serial2/0

R1#show ip ospf interface serial 2/0      // VERIFY OSPF INTERFACE CONFIG

Serial2/0 is up, line protocol is up

  Internet Address 10.1.1.1/30, Area 0, Attached via Network Statement

  Process ID 1, Router ID 192.168.1.1, Network Type POINT_TO_POINT, Cost: 64

  Topology-MTID    Cost    Disabled    Shutdown      Topology Name

        0           64        no          no            Base

  Transmit Delay is 1 sec, State POINT_TO_POINT

  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5

    oob-resync timeout 40

    Hello due in 00:00:03

  Supports Link-local Signaling (LLS)

  Cisco NSF helper support enabled

  IETF NSF helper support enabled

  Index 2/2, flood queue length 0

  Next 0x0(0)/0x0(0)

  Last flood scan length is 1, maximum is 1

  Last flood scan time is 0 msec, maximum is 4 msec

  Neighbor Count is 1, Adjacent neighbor count is 1

    Adjacent with neighbor 10.2.2.1

  Suppress hello for 0 neighbor(s)

  Message digest authentication enabled

    Youngest key id is 1

R1#tclsh       // VERIFY FULL CONNECTIVITY

R1(tcl)#foreach address {

+>(tcl)#192.168.1.1

+>(tcl)#10.1.1.1

+>(tcl)#10.1.1.2

+>(tcl)#10.2.2.1

+>(tcl)#10.2.2.2

+>(tcl)#192.168.3.1

+>(tcl)#} { ping $address }

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 36/40/44 ms

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.1.1.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 12/17/24 ms

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.2.2.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 12/17/20 ms

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.2.2.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 12/35/48 ms

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.3.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 20/28/44 ms