OSPF Plaintext Authentication

So far, your OSPF routers have trusted every Hello packet they received.
In this lesson, you will see why that is a security risk, and how to protect your neighbor relationships with a shared key.

The Rogue Router

OSPF authentication secures your neighbor relationships.
It prevents an unknown router from joining your network and declaring itself a neighbor.

Figure 1 - Two trusted neighbors exchange Hellos

By default, nothing stops an untrusted device.
Any router connected to the segment that receives your Hellos can become an OSPF neighbor and start advertising networks.

Figure 2 - A rogue router joins the OSPF domain

Someone plugs a router into your switch.
It hears your Hellos, replies with its own, and moments later forms a FULL adjacency with your core routers.

What an Attacker Can Do

Once inside your OSPF domain, a rogue router can launch several attacks:

• Route Injection: Advertises fake routes with a better cost, causing your traffic to be misrouted.

• Man-In-The-Middle (MITM): Declares itself as the optimal path, causing corporate traffic to flow through it to be captured.

• Denial of Service (DoS): Floods the area with LSAs, overwhelming every router in the network.

Figure 3 - Man-in-the-middle attack

What Authentication Protects

With authentication enabled, only routers that know the shared key can become neighbors.
Rogue routers without the key have their packets ignored.

Figure 4 - The rogue router does not have the key

Security Note: OSPF authentication protects control-plane routing exchanges, not data-plane user traffic.
The actual user data crossing your network is not encrypted by OSPF authentication.

How does OSPF authentication actually work?
The mechanism is simple, and it lives inside every single OSPF packet.

The Auth Type Field

Every OSPF packet carries an Auth Type field in its header. This value tells the receiver which authentication method the packet uses:

• Type 0 (None): No authentication at all (the default behavior).

• Type 1 (Plaintext): Simple password. The key travels inside the packet, readable by anyone.

• Type 2 (Cryptographic): MD5 or HMAC hash. A hash travels instead of the key itself.

Look at the image below: every router embeds an Auth Type in the Hello packets it sends, announcing its authentication level.

Figure 5 - Auth Type 1 in action, the type 0 Hello is ignored

R1 and R2 send Auth Type 1. The hacker sends Auth Type 0 (no authentication at all). Looking inside the Auth Data field, the key itself travels directly inside the Hello packet.

The Matching Rule

For two routers to become neighbors, both sides of the link must share the exact same authentication type and key.

Figure 6 - Same type and same key on both sides

The check happens on every Hello packet received:

• If either the type or the key does not match, the packet is simply ignored.

• The very first non-matching Hello is dropped upon reception.

• The adjacency never leaves the DOWN state, and the neighbor never appears in the OSPF neighbor table.

Plaintext is the first and simplest method: as its name says, the key travels in clear text inside every OSPF packet.