The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
The MPLS LDP MD5 Global Configuration feature provides enhancements to the Label Distribution Protocol (LDP) implementation of the Message Digest 5 (MD5) password. This feature allows you to enable LDP MD5 globally instead of on a per-peer basis. Using this feature you can set up password requirements for a set of LDP neighbors to help prevent unauthorized peers from establishing LDP sessions and to block spoofed TCP messages.
This document provides information about and configuration information for the global configuration of LDP MD5 protection.
Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Message Digest 5 (MD5) protection described in this document applies only to Label Distribution Protocol (LDP) sessions. All enhancements described in this document do not affect Tag Distribution Protocol (TDP) sessions.
The MPLS LDP MD5 Global Configuration feature provides the following enhancements to the Label Distribution Protocol (LDP) support of Message Digest 5 (MD5) passwords:
LDP session, advertisement, and notification messages are exchanged between two LDP peers over a TCP connection. You can configure the TCP MD5 option to protect LDP messages that are exchanged over a TCP connection. You can configure this protection for each potential LDP peer. As a result, an LDP ignores any LDP hello messages sent from a label switch router (LSR) for which you have not configured a password. (LDP tries to establish an LDP session with each neighbor from which a hello message is received.)
Before the introduction of the MPLS LDP MD5 Global Configuration feature, you needed to configure a separate password for each LDP peer for which you wanted MD5 protection. This was the case even when the same password was used for multiple LDP peers. Before this feature, LDP would tear down LDP sessions with a peer immediately if a password for that peer had changed.
Before the introduction of the MPLS LDP MD5 Global Configuration feature, the command used for configuring a password for a Label Distribution Protocol (LDP) neighbor was mpls ldp neighbor [vrf vrf-name] ip-address password [0 | 7] password. This command configures a password for one neighbor whose router ID is the IP address in the specified virtual routing and forwarding (VRF). A label switch router (LSR) can have zero or one such configuration for each LDP neighbor.
You can use the commands provided by the MPLS LDP MD5 Global Configuration feature to configure passwords for LDP neighbors.
You must understand how LDP determines the password for an LDP session between peers before you configure Message Digest 5 (MD5) password protection for your network. LDP determines the passwords for its sessions based on the commands that you enter.
You can enter an mpls ldp password vrf vrf-name required [for acl] command, either with an optional acl argument that permits the LDP router ID of the neighbor or without an acl argument. Make sure that you enter a command that configures a password. Otherwise, LDP might not establish a session with the neighbor in question.
For the commands in the following password-determining process, A.B.C.D:N represents the LDP neighbor in VRF vpn1 and the neighbor LDP ID:
To determine the password for an LDP session for the neighbor label space A.B.C.D:N, LDP looks at the password commands in the order indicated by the following statements:
The MPLS LDP MD5 Global Configuration feature introduces commands that can establish password protection for Label Distribution Protocol (LDP) sessions between LDP neighbors or peers. These commands can apply to routes in the global routing table or in a virtual routing and forwarding (VRF) instance.
By default, if the vrf keyword is not specified in the command, the command applies to the global routing table. The following sample commands apply to routes in the global routing table:
Device# mpls ldp password required Device# mpls ldp password option 15 for 99 pwd-acl Device# mpls ldp password fallback pwd-fbck
You can configure LDP Message Digest 5 (MD5) password protection for routes in a VRF only when the VRF is configured on the label switch router (LSR). If you specify a VRF name and a VRF with that name is not configured on the LSR, LDP prints out a warning and discards the command. If you remove a VRF, LDP deletes the password configuration for that VRF. The following sample commands apply to routes in a VRF, for example, VRF vpn1:
Device# mpls ldp vrf vpn1 password required Device# mpls ldp vrf vpn1 password option 15 for 99 pwd-acl Device# mpls ldp vrf vpn1 password fallback pwd-flbk
You might require password protection for a certain set of neighbors for security reasons (for example, to prevent Label Distribution Protocol (LDP) sessions being established with unauthorized peers, or to block spoofed TCP messages). To enforce this security, you can configure a password requirement for LDP sessions with those neighbors that must have Message Digest 5 (MD5) protection (TCP session uses a password).
If you configure a password requirement for a neighbor and you did not configure a password for the neighbor, LDP tears down the LDP sessions with the neighbor. LDP also tears down the LDP sessions with the neighbor if you configured a password requirement and a password, and the password is not used in the LDP sessions.
If a password is required for a neighbor and the LDP sessions with the neighbor are established to use a password, any configuration that removes the password for the neighbor causes the LDP sessions to be torn down.
To avoid unnecessary LDP session flapping, you should perform the task as described in the next section and use caution when you change LDP passwords.
Perform the following task to identify LDP neighbors for LDP MD5 password protection.
Before you start to configure passwords for Label Distribution Protocol (LDP) sessions, you must identify neighbors or groups of peers for which you want to provide Message Digest 5 (MD5) protection. For example:
1. Identify LDP neighbors or groups of peers for LDP MD5 password protection.
2. Decide what LDP MD5 protection is required for each neighbor or group of peers.
This section contains information about and instructions for configuring a Label Distribution Protocol (LDP) Message Digest 5 (MD5) password for LDP sessions. You configure an LDP MD5 password to protect your devices from unwanted LDP sessions and provide LDP session security. You can provide LDP session security for a specific neighbor, or for LDP peers from a specific virtual routing and forwarding (VRF) instance or from the global routing table, or for a specific set of LDP neighbors.
After you have identified the LDP neighbor, LDP neighbors, or LDP peers in your network for which you want LDP MD5 password protection, perform the following procedures, as you require, to configure an LDP MD5 password for LDP sessions:
LDP looks first for a password between the device and neighbor that is configured with the mpls ldp neighbor [vrf vrf-name] ip-address password pwd-string command. If a password is configured with this command, LDP uses that password before checking passwords configured by other commands.
You must add a configuration command for each neighbor or peer for which you want password protection.
Identify the Label Distribution Protocol (LDP) neighbor or peer for which you want Message Digest 5 (MD5) password protection.
1. enable
2. configure terminal
3. mpls ldp neighbor [vrf vrf-name] ip-address password [0 | 7] password-string
4. end
5. show mpls ldp neighbor [vrf vrf-name | all] [ip-address | [interface] [detail] [graceful-restart]
6. show mpls ldp neighbor [vrf vrf-name] [ip-address | interface] password [pending | current]
7. show mpls ldp discovery [vrf vrf-name | all] [detail]
This task provides you with Label Distribution Protocol (LDP) session protection with peers from a particular virtual routing and forwarding (VRF) instance or the global routing table. If you want a password requirement, you can use the mpls ldp password required command.
If only LDP sessions with a set of LDP neighbors need Message Digest 5 (MD5) protection, configure a standard IP access list that permits the desired set of LDP neighbors and denies the rest.
Identify LDP peers for which you want MD5 password protection.
1. enable
2. configure terminal
3. mpls ldp [vrf vrf-name] password fallback [0 | 7] password
4. mpls ldp [vrf vrf-name] password required [for acl]
5. end
6. show mpls ldp discovery [vrf vrf-name | all] [detail]
If only Label Distribution Protocol (LDP) sessions with a selected group of peers need Message Digest 5 (MD5) protection, configure a standard IP access list that permits sessions with the desired group of peers (identified by LDP router IDs) and denies session with the rest. Configuring a password and password requirement for these neighbors or peers provides security by preventing LDP sessions from being established with unauthorized peers.
Identify the groups of peers for which you want MD5 password protection and define an access list that permits LDP sessions with the group of peers you require.
1. enable
2. configure terminal
3. mpls ldp [vrf vrf-name] password option number for acl [0 | 7] password
4. mpls ldp [vrf vrf-name] password required [for acl]
5. end
6. show mpls ldp discovery [vrf vrf-name | all] [detail]
Perform the following task to verify that the Label Distribution Protocol (LDP) Message Digest 5 (MD5) secure sessions are as you configured for all LDP neighbors.
1. enable
2. show mpls ldp discovery detail
3. show mpls ldp neighbor detail
4. show mpls ldp neighbor password [pending | current]
5. exit
The following example shows how to configure a Label Distribution Protocol (LDP) Message Digest 5 (MD5) password for LDP sessions for a specified neighbor:
enable configure terminal mpls ldp vrf vpn1 10.1.1.1 password nbrscrtpwd end
This sets up nbrscrtpwd as the password to use for LDP sessions for the neighbor whose LDP router ID is 10.1.1.1. Communication with this neighbor is through VRF vpn1.
The following example shows how to configure a Label Distribution Protocol (LDP) Message Digest 5 (MD5) password for LDP sessions with peers from a specified virtual routing and forwarding (VRF) instance. The password vrfpwdvpn1 is configured for use with LDP peers that communicate using VRF vpn1. A password is required; otherwise, LDP tears down the session.
enable configure terminal mpls ldp vrf vpn1 password fallback vrfpwdvpn1 mpls ldp vrf vpn1 password required end
The following example shows how to configure a password that is used for sessions for peers that communicate using the global routing table:
enable configure terminal mpls ldp password fallback vrfpwdvppn1 end
The following example shows how to configure a Label Distribution Protocol (LDP) Message Digest 5 (MD5) password for LDP sessions with a selected group of peers. The required password aclpwdfor10 is configured for access list 10. Only those LDP router IDs permitted in access list 10 are required to use the password.
enable configure terminal mpls ldp password option 25 for 10 aclpwdfor10 mpls ldp password required for 10 end
Access list 10 might look something like this:
enable configure terminal access-list 10 permit 10.1.1.1 access-list 10 permit 10.3.3.3 access-list 10 permit 10.4.4.4 access-list 10 permit 10.1.1.1 access-list 10 permit 10.2.2.2 end
Related Topic |
Document Title |
---|---|
Cisco IOS commands |
|
MPLS commands |
Description |
Link |
---|---|
The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password. |
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Feature Name |
Releases |
Feature Information |
---|---|---|
MPLS LDP MD5 Global Configuration |
12.0(32)SY 12.2(28)SB 12.2(33)SRB 12.4(20)T Cisco IOS XE Release 2.1 |
The MPLS LDP MD5 Global Configuration feature provides enhancements to the Label Distribution Protocol (LDP) implementation of the Message Digest 5 (MD5) password. This feature allows you to enable LDP MD5 globally instead of on a per-peer basis. With this feature, you can set up password requirements for a set of LDP neighbors to help prevent unauthorized peers from establishing LDP sessions and to block spoofed TCP messages. In 12.2(28)SB, this feature was introduced. In 12.0(32)SY, this feature was integrated into Cisco IOS Release 12.0(32)SY. This feature was integrated into Cisco IOS Release 12.2(33)SRB. This feature was integrated into Cisco IOS Release 12.4(20)T. In Cisco IOS XE Release 2.1, support was added for the Cisco ASR 1000 Series Routers. |
|
|
The following commands were modified by this feature: mpls ldp password fallback, mpls ldp password option, mpls ldp password required, show mpls ldp discovery, show mpls ldp neighbor, show mpls ldp neighbor password. |
BGP—Border Gateway Protocol. An interdomain routing protocol that replaces External Gateway Protocol (EGP). BGP systems exchange reachability information with other BGP systems. BGP is defined by RFC 1163.
EGP—Exterior Gateway Protocol. An internet protocol for exchanging routing information between autonomous systems. EGP is documented in RFC 904. EGP is not to be confused with the general term exterior gateway protocol. EGP is an obsolete protocol that was replaced by Border Gateway Protocol (BGP).
CE device—customer edge device. A device that is part of a customer network and that interfaces to a provider edge (PE) device.
CSC—Carrier Supporting Carrier. A situation where one service provider allows another service provider to use a segment of its backbone network. The service provider that provides the segment of the backbone network to the other provider is called the backbone carrier. The service provider that uses the segment of the backbone network is called the customer carrier.
LDP—Label Distribution Protocol. A standard protocol between Multiprotocol Label Switching (MPLS)-enabled devices that is uses in the negotiation of the labels used to forward packets. The Cisco proprietary version of this protocol is the Tag Distribution Protocol (TDP).
LDP peer—A label switch router (LSR) that is the receiver of label space information from another LSR. If an LSR has a label space to advertise to another LSR, or to multiple LSRs, one Label Distribution Protocol (LDP) session exists for each LSR (LDP peer) receiving the label space information.
MD5—Message Digest 5. A one-way hashing algorithm that produces a 128-bit hash. Both MD5 and Secure Hash Algorithm (SHA) are variations on MD4 and are designed to strengthen the security of the MD4 hashing algorithm. Cisco uses hashes for authentication within the IPSec framework. SNMP v2 uses MD5 for message authentication, to verify the integrity of the communication, to authenticate the message origin, and to check its timeliness.
MPLS—Multiprotocol Label Switching. A switching method that forwards IP traffic through use of labels. Each label instructs the devices and the switches in the network where to forward a packet based on preestablished IP routing information.
PE device—provider edge device. A device that is part of a service provider’s network connected to a customer edge (CE) device. All Multiprotocol Label Switching (MPLS) Virtual Private Network (VPN) processing occurs in the PE device.
VPN—Virtual Private Network. Enables IP traffic to travel securely over a public TCP/IP network by encrypting all traffic forwarded from one network to another. A VPN uses tunneling to encrypt all information at the IP level.
VRF—A VPN routing and forwarding instance. A VRF consists of an IP routing table, a derived forwarding table, a set of interfaces that use the forwarding table, and a set of rules and routing protocols that determine what goes into the forwarding table. In general, a VRF includes the routing information that defines a customer VPN site that is attached to a PE device.