If routing updates are unauthenticated, anyone on-path can inject a better route. Per-interface (IGP) or per-session (BGP) authentication fixes it — and a mismatch simply means no adjacency, which is also how you spot a partially-broken design.
! EIGRP
key chain AUTH
key 1
key-string cisco123
interface Gi0/0
ip authentication mode eigrp 100 md5
ip authentication key-chain eigrp 100 AUTH
! OSPF
interface Gi0/0
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 cisco123
! BGP
neighbor 10.1.1.2 password cisco123
! Passive: advertise, never speak
router ospf 1
passive-interface default
no passive-interface Gi0/0- Key chains enable rollover without downtime (two keys live during a change window).
- OSPFv3 authenticates with IPsec AH/ESP, not classic MD5.
passive-interfaceon LANs: networks still advertised, hellos never sent — cuts attack surface for free.
Control plane protection only — the payload of user traffic is untouched.