I85PREP
⌘ K
Nokia 4A0-113 OSPF study materials
Nokia 4A0-113 OSPF study resources

Nokia 4A0-113 OSPF: OSPF Security, Authentication, and Troubleshooting

Nokia 4A0-113 OSPF · Work through your exam, one topic at a time.

All guide sections

OSPF Security, Authentication, and Troubleshooting

Domain 7 - OSPF Security, Authentication, and Troubleshooting

This domain tests how to protect adjacencies and how to isolate faults quickly.

Authentication

OSPF supports null, simple password, and cryptographic (MD5) authentication. On SR OS, set auth-type and message-digest-key under the area or interface:

configure router ospf area 0 interface "to-r2"
    authentication-type message-digest
    message-digest-key 1 hash2 <key>

Keys must match on both sides, including key ID. MD5 protects the packet but not against replay; change keys on a schedule. Authentication must match before any adjacency forms, so a mismatch shows as a stuck Init or Down state.

Hardening

Use passive interfaces on all links that do not need adjacencies, restrict OSPF to trusted interfaces, and keep the router ID stable. BFD can speed failure detection but must be enabled on both ends.

Troubleshooting sequence

  1. show router ospf neighbor - state and dead timer.
  2. Check area ID, hello/dead, network type, MTU, and authentication.
  3. show router ospf interface - passive flag, timers, DR/BDR.
  4. show router ospf database - missing LSAs point to filtering or area type.
  5. show router ospf routes - SPF result; check preference and metric.

Worked example

Two routers stay in ExStart. Hello and area match, authentication matches, but MTU differs (9000 vs 1500). DBD packets are dropped, so the state never advances. Setting both interfaces to the same MTU brings the adjacency to Full. If they stayed in Init, the likely cause would be a one-way path or authentication mismatch.

Traps

Assuming authentication failure always shows as Down - it can also appear as Init. Forgetting the key ID. Blaming SPF when the LSDB is simply filtered by a stub area. Changing timers on one side only.