Hello everybody,

I try to get ospfv3 authentication between MK and a cisco device to work.
Cisco has this this thing. And I can't figure out how to make it on the MK.

Anyone has such thing running? Thanks for any hints.

Mycket

Hello everybody,

I try to get ospfv3 authentication between MK and a cisco device to work.
Cisco has this this

Code: Select all

area 1 authentication ipsec spi 256 md5 1234

thing. And I can't figure out how to make it on the MK.

Anyone has such thing running? Thanks for any hints.

Mycket

I think you can configure OSPF authetication as below

/routing ospf interface
add authentication=md5 authentication-key=1234 authentication-key-id=1 cost=\
10 dead-interval=40s disabled=no hello-interval=10s instance-id=0 \
interface=all network-type=default passive=no priority=1 \
retransmit-interval=5s transmit-delay=1s use-bfd=no

I think you can configure OSPF authetication as below

/routing ospf interface
add authentication=md5 authentication-key=1234 authentication-key-id=1 cost=\
10 dead-interval=40s disabled=no hello-interval=10s instance-id=0 \
interface=all network-type=default passive=no priority=1 \
retransmit-interval=5s transmit-delay=1s use-bfd=no[/quote]

Isn't that for just OSPF (v2?). He's talking about OSPFv3, ie, IPv6 OSPF. Which from what I've read uses IPsec for athentication?

If you look in the WebUi for a router with the IPv6 plugin, the OSPFv3 page does not show stuff for MD5 athentication where the Plain (IPv4) does.

Currently ospfv3 authentication is not implemented.

The OSPFv3 authentication uses IPsec. If there will be in the IPsec configuraiton option for the manul keying, then can be OSPFv3 secured. It is pity that "/ip ipsec manual-sa" was removed from the RouterOS. But one configuration option under OSPFv3 which create all requisited SPD and SA entries is more comfortable - in this way works the Cisco command "area X authentication ipsec ...".
Or Juniper way is to define the maual SA entry (like was in the ROS: /ip ipsec manual-sa add name=XXX ..." and then under OSPFv3 interface is only something like "set ipsec-sa XXX".
We had too problem with this that was required OSPFv3 authetication in some installations - so was used Juniper boxes and not RBs.