Routing protocol authentication ensures only legitimate routers can exchange routing updates by protecting the protocol’s control traffic against spoofing and manipulation. It protects the control plane – not the data packets.

Why does it exist?

• Prevents fake routing updates, route injection, and man-in-the-middle attacks on the routing plane
• Stops unauthorized routers from joining routing, announcing better routes, and creating blackholes or loops

Methods per protocol

Protocol	Method	Applied	Comment
EIGRP	MD5/SHA (key chain)	Interface	Classic & named mode; AS, K-values and auth must match
OSPFv2	Plain / MD5	Interface or area	MD5 (type 2) is best practice
OSPFv3	IPsec (AH/ESP)	Link-local	No ip ospf authentication
BGP	TCP MD5	Neighbor session	Protects TCP 179; one shared secret, no key chain
RIPv2	MD5	Interface	Rarely used in practice

How it works

1. Router sends hello/update with a hash (hash = shared key + packet contents)
2. Receiver performs the same calculation
3. Hash matches → adjacency forms; mismatch → packets silently dropped

Key chains enable key rotation without downtime (graceful rollover). Clock drift can affect key-chain lifetimes.

Configuration

! EIGRP MD5
key chain EIGRP-KEYS
 key 1
  key-string Cisco123
interface GigabitEthernet0/0
 ip authentication mode eigrp 100 md5
 ip authentication key-chain eigrp 100 EIGRP-KEYS

! EIGRP named mode
router eigrp ENTERPRISE
 address-family ipv4 autonomous-system 100
  af-interface GigabitEthernet0/0
   authentication mode md5
   authentication key-chain EIGRP-KEYS

! OSPFv2 MD5
interface GigabitEthernet0/0
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 md5 Cisco123

! OSPFv3 (IPsec)
interface GigabitEthernet0/0
 ospfv3 ipv6 authentication ipsec spi 256 sha1 Cisco123

! BGP
router bgp 65001
 neighbor 192.0.2.2 password Cisco123

Typical faults (CCNP)

• Wrong key ID · different hash algorithm · key chain not bound to interface · authentication on only one side · OSPF area mismatch that looks like an auth problem · MTU mismatch (OSPF) · ACL/CoPP blocking auth packets

Passive interfaces (bonus – often paired)

A passive interface sends no routing hellos/updates but still advertises its subnet through other interfaces. Use on user LANs, management VLANs, loopbacks: no adjacencies can form, no rogue routers, less noise.

• OSPF: no DR/BDR participation; EIGRP still advertises the network
• Best practice: passive-interface default + no passive-interface <uplink>
• Typical “why no OSPF neighbor?” answer: passive interface 😄

router ospf 1
 passive-interface default
 no passive-interface GigabitEthernet0/0

router eigrp 100
 passive-interface GigabitEthernet0/1

Memory rule: passive interface = advertise, but don’t talk.

Combine with TTL-security (BGP), CoPP and infrastructure ACLs for layered control-plane security.