You can prevent your router from receiving fraudulent route updates by configuring neighbor router authentication. When configured,
neighbor authentication occurs whenever routing updates are exchanged between neighbor routers. This authentication ensures
that a router receives reliable routing information from a trusted source.
Without neighbor authentication, unauthorized or deliberately malicious routing updates could compromise the security of
your network traffic. A security compromise could occur if an unfriendly party diverts or analyzes your network traffic. For
example, an unauthorized router could send a fictitious routing update to convince your router to send traffic to an incorrect
destination. This diverted traffic could be analyzed to learn confidential information about your organization or merely used
to disrupt your organization’s ability to effectively communicate using the network. Neighbor authentication prevents any
such fraudulent route updates from being received by your router.
When neighbor authentication has been configured on a router, the router authenticates the source of each routing update
packet that it receives. This is accomplished by the exchange of an authenticating key (sometimes referred to as a password)
that is known to both the sending and the receiving router.
There are two types of neighbor authentication used: plain text authentication and Message Digest Algorithm Version 5 (MD5)
authentication. Both forms work in the same way, with the exception that MD5 sends a "message digest" instead of the authenticating
key itself. The message digest is created using the key and a message, but the key itself is not sent, preventing it from
being read while it is being transmitted. Plain text authentication sends the authenticating key itself over the wire.
Note |
Note that plain text authentication is not recommended for use as part of your security strategy. Its primary use is to avoid
accidental changes to the routing infrastructure. Using MD5 authentication, however, is a recommended security practice.
|
In plain text authentication, each participating neighbor router must share an authenticating key. This key is specified at
each router during configuration. Multiple keys can be specified with some protocols; each key must then be identified by
a key number.
In general, when a routing update is sent, the following authentication sequence occurs:
-
A router sends a routing update with a key and the corresponding key number to the neighbor router. In protocols that can
have only one key, the key number is always zero. The receiving (neighbor) router checks the received key against the same
key stored in its own memory.
-
If the two keys match, the receiving router accepts the routing update packet. If the two keys do not match, the routing update
packet is rejected.
MD5 authentication works similarly to plain text authentication, except that the key is never sent over the wire. Instead,
the router uses the MD5 algorithm to produce a "message digest" of the key (also called a "hash"). The message digest is then
sent instead of the key itself. This ensures that nobody can eavesdrop on the line and learn keys during transmission.
Another form of neighbor router authentication is to configure key management using key chains. When you configure a key
chain, you specify a series of keys with lifetimes, and the Cisco IOS software rotates through each of these keys. This decreases
the likelihood that keys will be compromised. To find complete configuration information for key chains, refer to the "Managing
Authentication Keys" section in the Configuring IP Routing Protocol-Independent Features module of the Cisco IOS IP Routing:
Protocol-Independent Configuration Guide.
Feedback