Key chains

Key chains help you rotate authentication keys for IGP peers to enhance data security, prevent unauthorized users from guessing routing protocol authentication keys, and maintain uninterrupted, secure communication by allowing overlapping key lifetimes.

Key chain authentication and key management

Use rotating keys in key chains, with a duration of 180 days or less, to protect your devices and data. Rotating keys apply only to the OSPFv2 protocol.

Note

Only the MD5 cryptographic algorithm is used for authentication.

Each key in a key chain has two lifetimes:

  • Accept lifetime: The time interval within which the device accepts the key during key exchange with another device.

  • Send lifetime: The time interval within which the device sends the key during key exchange with another device.

During a key's send lifetime, the device sends routing update packets using that key. If the key is not within the accept lifetime, the device does not accept communication from other devices.

If lifetimes are not configured, the system treats the configuration as using an MD5 authentication key without defined timelines.

When configuring authentication for routing protocols that provide key chains, configure the keys in your key chain with overlapping lifetimes to prevent losing secure communication if no active key is available.

Key selection in a key chain is determined as follows:

  • When a key chain has more than one valid key, OSPF selects the key with the longest lifetime.

  • The system prefers a key with an infinite lifetime.

  • If keys have the same lifetime, then key with the higher key ID is preferred.