zNetLaB › Guided labs › Enterprise
OSPF authentication — MD5 on the link, and the neighbour it breaks
Enterprise Advanced 2 devices 4 checked tasks 100 points Plan lab
An OSPF adjacency anyone can join is an adjacency anyone can poison. Turn on MD5 authentication for area 0 on both routers with the same key — and notice that the neighbour goes down the moment only one side has it, which is the troubleshooting symptom to recognise. You build it in a browser, type real commands at each device, and every task below is
checked against the running configuration — so you find out it is wrong before anybody else does.
Open this lab in the simulator
The simulator runs in your browser with nothing to install. This lab is part of the full simulator: open it free for 7 days with a new account, then with a plan. It needs an account, which keeps your progress.
The scenario
An OSPF adjacency anyone can join is an adjacency anyone can poison. Turn on MD5 authentication for area 0 on both routers with the same key — and notice that the neighbour goes down the moment only one side has it, which is the troubleshooting symptom to recognise.
Your role: a network engineer on the enterprise team. Level: Advanced Done when: all 4 goals show as passed (100 points).
Network status
Devices: 2 routers, cabled as drawn. No Layer 1 or Layer 2 faults: every link is connected and up. R1 starts with addresses (G0/1 10.0.12.1/30, L0 1.1.1.1/32) and OSPF 1 already configured. R2 starts with addresses (G0/1 10.0.12.2/30, L0 2.2.2.2/32) and OSPF 1 already configured. Known problems
The network worked and now does not: the scenario above says what users report. The cause is a configuration fault, not a cable. Find it with show commands (interfaces, routes, neighbours, running-config) before you change anything; fix only what is wrong. Goals
Area 0 uses MD5 authentication on R1 (25 pts) R1’s link has an MD5 key (20 pts) R2 is configured the same way (20 pts) The adjacency is up with authentication on (35 pts) The activity, in order
Area 0 uses MD5 authentication on R1 Why: This is the task that checks your configuration directly: the line must really be there, not just look right. Verify with: show running-config R1’s link has an MD5 key Why: This is the task that checks your configuration directly: the line must really be there, not just look right. Verify with: show running-config R2 is configured the same way Why: This is the task that checks your configuration directly: the line must really be there, not just look right. Verify with: show running-config The adjacency is up with authentication on Why: OSPF routes only flow over a FULL adjacency. If a neighbour is stuck in INIT or EXSTART, compare the two ends’ settings. Verify with: show ip ospf neighbor Tips
Work in the order given: later goals depend on the earlier ones. After every change, run the verify command before moving on; do not guess. Stuck? Read the verify output first. It names the interface, neighbour or route that is wrong. Common mistake: Different key IDs on the two ends Common mistake: Authentication on one side only Common mistake: A key typed with a trailing space Why this matters
An OSPF adjacency anyone can join is one anyone can poison. MD5 authentication makes routers prove they know a shared key — and a one-sided configuration drops the neighbour, which is the symptom to recognise.
What you will be able to do
Enable MD5 authentication on the interface or for the area
Configure matching key IDs and keys on both ends
Recognise the neighbour loss when only one side has it
The network
ISR 2911 — 2 devices in all, already cabled.
Gi0/1 10.0.12.1/30 Gi0/1 10.0.12.2/30 R1 R2 Drawn from this lab: devices, cables, ports and the addresses already set. Device Model Address already set
R1 ISR 2911 configure it R2 ISR 2911 configure it
Cabling
R1 Gi0/1 ↔ R2 Gi0/1
What is configured at the start
These are already configured when the lab opens — including, where this is a troubleshooting lab, the fault itself:
R1 interface g0/1
ip address 10.0.12.1 255.255.255.252
no shutdown
exit
interface lo0
ip address 1.1.1.1 255.255.255.255
no shutdown
exit
router ospf 1
router-id 1.1.1.1
network 10.0.12.0 0.0.0.3 area 0
network 1.1.1.1 0.0.0.0 area 0 R2 interface g0/1
ip address 10.0.12.2 255.255.255.252
no shutdown
exit
interface lo0
ip address 2.2.2.2 255.255.255.255
no shutdown
exit
router ospf 1
router-id 2.2.2.2
network 10.0.12.0 0.0.0.3 area 0
network 2.2.2.2 0.0.0.0 area 0 Tasks, and how each one is checked
Every task is decided by reading the live network — a neighbour in FULL, a ping that succeeds, a line in the running configuration — not by looking for a keyword you typed. The same command shows you what the lab sees.
# Task Pts How to verify it yourself
1 Area 0 uses MD5 authentication on R1 25 On R1: show running-config contains the line(s) matching area 0 authentication message-digest|ip ospf authentication message-digest. 2 R1’s link has an MD5 key 20 On R1: show running-config contains the line(s) matching ip ospf message-digest-key 1 md5. 3 R2 is configured the same way 20 On R2: show running-config contains the line(s) matching ip ospf message-digest-key 1 md5. 4 The adjacency is up with authentication on 35 On R1: show ip ospf neighbor shows at least 1 neighbour(s) in FULL.
Stuck? Ask the coach
Tell the coach what you see or what you tried. It gives you a hint, not the answer, the way a senior engineer would. Included with a free trial or any plan.
Ask the coach
Common mistakes
Different key IDs on the two ends
Authentication on one side only
A key typed with a trailing space
Reference solution
Try it yourself first — the lab checks your work either way. This is one configuration that makes every task pass, device by device:
R1 interface g0/1
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 0SPF-K3y
exit R2 interface g0/1
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 0SPF-K3y
exit Where this is examined
CCNP ENCOR/ENARSI (OSPF security), CCIE EI (routing protocol security).
This lab practises these topics in the zNetLaB certification courses:
Related labs
Where to start
The lessons all guided labs plans
CCNA®, CCNP® and Cisco® are trademarks of Cisco Systems, Inc. zNetLaB is not affiliated with or endorsed by Cisco.