OSPF: Authentication over a Virtual Link

In OSPF, we can have an area that is not directly connected to the backbone area by using the virtual link feature. If somehow, OSPF authentication is enabled in area 0. Routers that is connected through a virtual link must have the authentication configured too. This is because the router believe that it is directly connected to the area 0, and since routers in area 0 authenticate themselves for communicating, the virtual-linked router would no longer able to communicate with the routers in area 0.

The command to configure authentication on a virtual-link is:

area NUMBER virtual-link A.B.C.D message-digest-key NUMBER2 md5 WORD

NUMBER: the area number where both virtual-linked routers reside.

A.B.C.D: the router-id of the peer router.
NUMBER2: the id number of the digest key.
WORD: the authentication password used.

So, let's say that we have this topology

We have an md5 authentication configured in area 0 with password of "cisco". To configure this authentication for area 0, go to all router in area 0, which in this case are R1 and R2 and type the following command (assume that you are from the global configuration level and the OSPF process id is 1):

router ospf 1
area 0 authentication message-digest
interface fastethernet1/0
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 cisco

Now, since authentication is in place for area 0, in order for area 2 to have connectivity with the rest of OSPF network, the authentication should be configured on the virtual-linked routers too, which in this case are R2 and R3. We first go to R2 and go to its OSPF process 1 configuration level and enter the following command

area 1 virtual-link 3.3.3.3 message-digest-key 1 md5 cisco

Next we go to R3, go to the OSPF process 1 configuration level and enter the command:

area 1 virtual-link 2.2.2.2 message-digest-key 1 md5 cisco
area 0 authentication message-digest

We need to configure the command "area 0 authentication message-digest" on R3 to avoid authentication type mismatch error (Type 0 - Null authentication on R3, and Type 2 - Message Digest authentication on R2). This is because a virtual-link is a tunnel that makes as if R3 is directly connected to area 0, and since area 0 is configured with message-digest authentication, therefore R3 should be configured to use message-digest authentication too on area 0.

OSPF: Configuring NBMA Network Type

There are 5 network tpyes in OSPF. They are: NBMA (Non-Broadcast MultiAccess), Point-to-Multipoint which are RFC standard and Broadcast, Point-to-Point, Point-to-Multipoint (static) which are Cisco proprietary. The default network type for interfaces in OSPF for multipoint network or when you are configuring Frame-Relay on physical interfaces is NBMA.

The characteristics of NBMA network type are there will be DR/BDR elections, what has to be noted here is that DR and BDR should have direct connectivity with the rest OSPF router in the network. In NBMA network there will be no broadcast, so that we have to define our OSPF neighbor statically. We only have to specify the neighbors statically at one router (one-way), and the peer router will respond and the neighborship will be formed. Usually, the static neighbor configuration is done at the hub-router.

We will try to configure OSPF in NBMA network type based on this topology

First, configure the serial1/0 interface, give an ip address, set the encapsulation to frame-relay and perform no shutdown

ip address 10.10.10.1 255.255.255.0
encapsulation frame-relay
no shutdown
ip ospf priority 255

Remember that in an NBMA network, there is a DR/BDR election. DR/BDR routers should have direct connectivity with the rest of the routers in the segment. So here, we want to make sure that R1 becomes the DR router. Therefore we set the OSPF priority of the interface to 255. You can go to R2 and R3 and configure the same configuration at the serial1/0 interface

R2:

ip address 10.10.10.2 255.255.255.0
encapsulation frame-relay
no shutdown
ip ospf priority 0

R3:

ip address 10.10.10.3 255.255.255.0
encapsulation frame-relay
no shutdown
ip ospf priority 0

R2 and R3 have no direct connectivity, therefore both of them couldn't be the BDR. We specify the OSPF interface priority of R2 and R3 serial1/0 to 0, making them inelligible for DR/BDR election.

I also configure a loopback0 interface on R1 for OSPF connectivity purpose, so if later after OSPF has been configured, we can see at least a route learned from OSPF on R2 and R3 in its routing table. On R1:

interface loopback0
ip address 10.10.10.3 255.255.255.0

Then we can start configuring OSPF. We will use OSPF with process id of 1.

R1:

router ospf 1
router-id 1.1.1.1
network 10.10.10.1 0.0.0.0 area 0
network 192.168.1.0 0.0.0.255 area 0

R2:

router ospf 1
router-id 2.2.2.2
network 10.10.10.2 0.0.0.0 area 0

R3:

router ospf 1
router-id 3.3.3.3
network 10.10.10.3 0.0.0.0 area 0

You can do the "show ip ospf interface" command to see the network type of serial1/0 interface. Here's the partial output of the command.

It should list the network type as NON_BROADCAST. If not, you can change the OSPF network type with the command "ip ospf network non-broadcast" at the interface configuration command level. At this point, you will not have any OSPF neighbor, since in non-broadcast network, neighbors should be specified manually. Remember that we only have to type the neighbor command one-way, only on one router and it is a good idea to configure it at the hub-router, which is R1. So, we go to R1 and type in the following command at the global configuration level:

router ospf 1
neighbor 10.10.10.2
neighbor 10.10.10.3

After entering the command, you can type the "show ip ospf neighbor" command to see that R1 is ATTEMPT-ing to become neighbor with R2 and R3. You might want to wait before the neighbor status becomes FULL. When it comes to FULL, we can verify that the network of R1 loopback0 interface is advertised to R2 and R3 and is listed in their routing table. From the picture bellow, for you who might be wondering why does 192.168.1.1 as advertised as a host route with /32 subnet mask when you expect it to be /24. This is because loopback interfaces are advertised with /24 subnet. To get a /24 network in the routing table, the OSPF network type of the loopback interface could be change to point-point with the command "ip ospf network point-to-point".

But, there is still a problem. If you try to ping R3 from R2 and vice-versa, the ping will fail. This is because both R2 and R3 think that they have direct connectivity because both of the reside in the same network. But actually, they have to send the packets to R1 first before reaching each other. To solve this, we add the manual frame-relay map command for them to reach each other using the DLCI used to reach R1. On R2 serial1/0 interface configuration level, type the following command:

frame-relay map ip 10.10.10.3 201 broadcast

On R3 serial1/0 interface configuration level, type the following command:

frame-relay map ip 10.10.10.2 301 broadcast

Now, if you try to ping R3 from R2 or vice-versa, the ping will succeed.

OSPF Virtual Link

Virtual links make it possible to have an area not directly connected to area 0. But, it’s recommended that you redesign your network as soon as possible to connect each non-backbone area to area 0.

Virtual links depend on router-id, that’s why it’s a good idea to set your router-id manually through the router-id command. Because this type of router-id doesn’t change except you change it to another value manually, difference from the active loopback or physical interface which may accidentally change the OSPF router id if you activate another interface which has a higher ip address than the existing one.

To configure a virtual link, go to the ABRs, R2 and R3 in the case above and go to the OSPF process configuration level and use the following command

area AREA-NUMBER virtual-link ROUTER-ID

AREA-NUMBER: the area number that both routers reside in. In the picture above, because both R2 and R3 reside in area 1, the AREA-NUMBER here should be 1..

ROUTER-ID: router-id of the other ABR that you want to associate a virtual link with.

That command should be used at both routers (both ABRs) that need to be associated with a virtual link, in this case a virtual link is needed between R2 and R3.

The virtual link makes R3 believe that it’s directly connected to area 0.

The virtual link command actually creates a tunnel between both routers, in a CCIE lab, you might be asked to create a virtual link without using the virtual-link command.

Let's try to configure virtual link based on the case above. At this point, I have configured the interfaces and OSPF at all three routers in the picture. R3 have loopback interfaces which reside on network 172.16.1.0/24, 172.16.2.0/24, 172.16.3.0/24 and all routers are running OSPF process number 10. R1 is configured with router id of 1.1.1.1, R2 is configured with router id of 2.2.2.2 and R3 is configured with router id of 3.3.3.3. But, I haven't configure a virtual link between R2 and R3. Here's the configuration of all 3 routers.

At this point, R1 doesn't have the routes to the 172.16.0.0/16 networks behind R3, However R3 have a route to network 192.168.0.0/24 which is the R1-R2 link.

Let's configure a virtual link between R2 and R3. As shown above, the configuration is simple. First we connect to R2, go to the OSPF process number 10 configuration level and enter the command "area 1 virtual-link 3.3.3.3" and at R3 go to the OSPF process number 10 configuration level and enter the command "area 1 virtual-link 2.2.2.2". Now, if we connect to R1 and do the "show ip route" command, we will see routes to 172.16.0.0/16 networks.

You can also do the "show ip ospf neighbor" command at R2 or R3 and see that they are connected through the OSPF_VL0 interface.

OSPF LSA Types

Link State Advertisements (LSAs) are the building blocks of OSPF. You need to know about OSPF LSA because there are many OSPF area types and certain area types block certain LSA type from entering the area. There are 11 types of OSPF LSAs, these are the 5 most common OSPF LSAs:

• Router LSA (Type 1)




The most common type of LSA. An advertisement about one network. Like hey, this is network 10.1.1.0/24 and here’s the cost to reach it.




• Network LSA (DR Generated) (Type 2)




Only advertised by DR. Advertise all routers that are attached to the same segment (same switch/LAN) including itself. This LSA is sent to all of the routers in the area (not only to the routers in the same segment as the DR).




• Summary LSA (ABR Summary route) (Type 3)




Advertisement about networks from another area. This route is marked as an IA (Inter-Area) route in the routing table.




• Summary LSA (ASBR Location) (Type 4)




Advertise the ip address of the ASBR in the network. This might be needed to know the next-hop ip address for external routes.




• External LSA (ASBR Summary route) (Type 5)



Advertised routes coming from an ASBR.




• NSSA External LSA (Type 7)



Generated by the ASBR in an NSSA (Not-So-Stubby Area). This LSA is converted back to type 5 once it reach the backbone area