Configuring OSPFv3 Authentication Trailer

Open Shortest Path First version 3 (OSPFv3) supports packet authentication, enabling OSPFv3 devices to receive only the OSPFv3 packets that are authenticated. If packets fail to be authenticated, OSPFv3 neighbor relationships cannot be established. This section describes how to configure an authentication mode.

Usage Scenario

OSPFv3 authentication trailer supports HMAC-SHA256 authentication and HMAC-SM3 authentication.

By default, authentication is not configured for OSPFv3 areas, processes, or interfaces. Configuring authentication is recommended to ensure system security.

When configuring an authentication password, select the ciphertext mode because the password is saved in configuration files in simpletext if you select simpletext mode, which has a high risk. To ensure device security, change the password periodically.

Procedure

Configure area authentication.
1. Run system-view
  The system view is displayed.
2. Run ospfv3 [ process-id ]
  The OSPFv3 view is displayed.
3. Run area area-id
  The OSPFv3 area view is displayed.
4. Run authentication-mode { hmac-sha256 | hmac-sm3 } key-id KeyId { plain PlainText | [ cipher ] CipherText }
  An authentication mode is configured for the OSPFv3 area.
  
  If area authentication is used, authentication mode and password configurations on all routers in the same area must be the same.
5. Run commit
  The configuration is committed.
Configure process authentication.
1. Run system-view
  The system view is displayed.
2. Run ospfv3 [ process-id ]
  The OSPFv3 view is displayed.
3. Run authentication-mode { hmac-sha256 | hmac-sm3 } key-id KeyId { plain PlainText | [ cipher ] CipherText }
  An authentication mode is configured for the OSPFv3 process.
4. Run commit
  The configuration is committed.
Configure interface authentication.
1. Run system-view
  The system view is displayed.
2. Run interface interface-type interface-number
  The interface view is displayed.
3. Run ospfv3 authentication-mode { hmac-sha256 | hmac-sm3 } key-id KeyId { plain PlainText | [ cipher ] CipherText } [ instance instanceId ]
  An authentication mode is configured for the OSPFv3 interface.
  
  Interface authentication takes precedence over area authentication. For interfaces on the same subnet, the configured authentication mode and password must be identical. This requirement does not apply to the OSPFv3 interfaces on different subnets.
4. Run commit
  The configuration is committed.