OSPF MD5 Authentication: Backbone Integrity and Area Mismatch

Bundle lab

Deploy OSPFv2 with MD5 authentication on backbone links, deliberately trigger and diagnose an area mismatch adjacency failure, then fix it and restore end-to-end reachability between two branch hosts in a compact three-router topology.

Learning objectives

• Deploy OSPFv2 across a multi-router backbone with MD5 authentication on all backbone transit links.
• Identify and fix OSPF adjacency failures caused by an interface area mismatch.
• Use neighbor and LSDB verification to ensure full route propagation.
• Harden the OSPF backbone by enforcing consistent MD5 authentication (key ID 1 and a matching key string) on every transit link so only authorized routers can form adjacencies.
• Validate end-to-end network reachability from host endpoints after control-plane repair.

Troubleshooting focus

• show ip ospf neighbor shows the transit adjacency stuck Down/Init: the OSPF area differs on the two ends. Backbone links must be area 0 on both routers.
• The adjacency flaps or will not form after the area is fixed: MD5 must be present and identical at both ends — same key-id 1 and key-string. Mismatched keys cause AUTH_FAIL and Down.
• No inter-area routes appear: verify the LAN networks are advertised in area 10 and area 20 and the transits in area 0. Confirm every interface is passive by default, with non-passive exceptions on the transits only.
• HOST-A reaches 10.10.10.1 but not 10.20.20.10: check the routers first — neighbour state FULL and routes present. Then confirm host default gateways and no duplicate LAN IPs.