Ospf Authentication Message Digest Management; Gtsm Ttl Security Mechanism For Ospf; Path Computation Element For Ospfv2 - Cisco ASR 9000 Series Routing Configuration Manual

OSPF Authentication Message Digest Management

be used on a large number of interfaces (for example, when LDP is used for transport in the core) and on
multiple OSPF instances simultaneously.
This feature supports the IPv4 unicast address family for the default VPN routing and forwarding (VRF)
instance.
LDP IGP auto-configuration can also be explicitly disabled on an individual interface basis under LDP using
the igp auto-config disable command. This allows LDP to receive all OSPF interfaces minus the ones explicitly
disabled.
See Cisco ASR 9000 Series Aggregation Services Router MPLS Configuration Guide for information on
configuring LDP IGP auto-configuration.
OSPF Authentication Message Digest Management
All OSPF routing protocol exchanges are authenticated and the method used can vary depending on how
authentication is configured. When using cryptographic authentication, the OSPF routing protocol uses the
Message Digest 5 (MD5) authentication algorithm to authenticate packets transmitted between neighbors in
the network. For each OSPF protocol packet, a key is used to generate and verify a message digest that is
appended to the end of the OSPF packet. The message digest is a one-way function of the OSPF protocol
packet and the secret key. Each key is identified by the combination of interface used and the key identification.
An interface may have multiple keys active at any time.
To manage the rollover of keys and enhance MD5 authentication for OSPF, you can configure a container of
keys called a keychain with each key comprising the following attributes: generate/accept time, key
identification, and authentication algorithm.

GTSM TTL Security Mechanism for OSPF

OSPF is a link state protocol that requires networking devices to detect topological changes in the network,
flood Link State Advertisement (LSA) updates to neighbors, and quickly converge on a new view of the
topology. However, during the act of receiving LSAs from neighbors, network attacks can occur, because
there are no checks that unicastor multicast packets are originating from a neighbor that is one hop away or
multiple hops away over virtual links.
For virtual links, OSPF packets travel multiple hops across the network; hence, the TTL value can be
decremented several times. For these type of links, a minimum TTL value must be allowed and accepted for
multiple-hop packets.
To filter network attacks originating from invalid sources traveling over multiple hops, the Generalized TTL
Security Mechanism (GTSM), RFC 3682, is used to prevent the attacks. GTSM filters link-local addresses
and allows for only one-hop neighbor adjacencies through the configuration of TTL value 255. The TTL value
in the IP header is set to 255 when OSPF packets are originated, and checked on the received OSPF packets
against the default GTSM TTL value 255 or the user configured GTSM TTL value, blocking unauthorized
OSPF packets originated from TTL hops away.

Path Computation Element for OSPFv2

A PCE is an entity (component, application, or network node) that is capable of computing a network path
or route based on a network graph and applying computational constraints.
Cisco ASR 9000 Series Aggregation Services Router Routing Configuration Guide, Release 5.3.x
432
Implementing OSPF