I currently have an existing OSPF area that has neighborships and is exchanging routes, but has no authentication mechanism. Is there a way to transition it to an MD5 authenticated area without tearing down the existing relationships?

I'm hoping there is some process that is similar to transitioning to OSPF with TTL security check by setting the hop count to 254.

1 Answer 1


I now think the only way transition to MD5 auth, without tearing down existing adjacencies, is to simply beat the HELLO and DEAD timers when configuring the authentication key on all the routers participating in the process. I had to put the MD5 key on the interfaces before their DEAD timers expire, with enough time to transmit another HELLO.

But if you already have authentication enables, then it trivial to change keys: It seems that MD5 Auth uses a non-destructive 'rollover' process.

From cisco:

The system assumes its neighbors do not have the new key yet, so it begins a rollover process. It sends multiple copies of the same packet, each authenticated by different keys. In this example, the system sends out two copies of the same packet--the first one authenticated by key 100 and the second one authenticated by key 101.

Rollover allows neighboring routers to continue communication while the network administrator is updating them with the new key. Rollover stops once the local system finds that all its neighbors know the new key. The system detects that a neighbor has the new key when it receives packets from the neighbor authenticated by the new key.

After all neighbors have been updated with the new key, the old key should be removed. In this example, you would enter the following:

interface ethernet 1
no ip ospf message-digest-key 100

  • 1
    Changing the hello timers on one router will have the same effect as enabling authentication— it will drop the neighbor relationship. In many high speed networks, there are sub-second hello timers. What will you do then?
    – Ron Trunk
    Feb 23, 2019 at 12:34
  • I did find that out through trial and error.
    – Shōgun8
    Feb 25, 2019 at 17:03
  • The only way I found to transition to MD5 auth without tearing down existing adjacencies, was to just add the keys to each interface before the DEAD timers expired on any single interface. I guess it's just a matter of having nimble fingers
    – Shōgun8
    Feb 25, 2019 at 17:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.