Configuring RSVP Authentication

Problem

You want to verify that all RSVP traffic that the router accepts comes from trusted routers to ensure the security of the LSP and the data it carries.

Solution

Configure MD5 authentication for each interface running RSVP:

	[edit protocols rsvp]
	aviva@R1# set interface so-0/0/2 authentication-key 1991$poPPi
	aviva@R1# show
	interface so-0/0/2.0 {
	 authentication-key "$9$GoDqm5QF/ApTQSrKMXxqmPfn/"; ## SECRET-DATA
	}

Discussion

It is a good security measure to authenticate RSVP exchanges to ensure that only trusted routers participate in the LSP. This recipe shows how to configure RSVP authentication. You configure a key for each interface on the router that is running RSVP. MD5 creates an encoded checksum that is included in all transmitted RSVP packets. The receiving router verifies this checksum before accepting the packet.

Use the following command to check that RSVP authentication is configured:

	aviva@R1>  
show rsvp interface detail
	RSVP interface: 1 active
	so-0/0/2.0 Index 69, State Ena/Up
	  
Authentication, NoAggregate, NoReliable, NoLinkProtection
	 HelloInterval 9(second)
	 Address 10.1.13.1, 10.0.0.1
	 ActiveResv 1, PreemptionCnt 0, Update threshold 10%
	 Subscription 100%, StaticBW 155.52Mbps, AvailableBW 155.52Mbps
	 ReservedBW [0] 0bps[1] 0bps[2] 0bps[3] 0bps[4] 0bps[5] 0bps[6] 0bps[7] 0bps
	 PacketType Total Last 5 seconds
	 Sent Received Sent Received
	Path 1588 35 0 0
	PathErr 0 0 0 0
	PathTear 3 1 0 0
	Resv 34 1586 0 0
	ResvErr 0 0 0 0
	ResvTear 0 0 0 0
	Hello 8526 8527 1 1
	Ack 0 0 0 0
	Srefresh 0 0 0 0
	EndtoEnd RSVP 0 0 0 0

Configure the same authentication key on all interfaces participating in the LSP. If you do not configure the same password, the LSP cannot be established and is marked as Dn (down) in the show mpls lsp command output:

	aviva@R1> show mpls lsp
	Ingress LSP: 1 sessions
	To From State Rt ActivePath P LSPname
	10.0.0.6 10.0.0.1 Dn 0 - R1-to-R6
	Total 1 displayed, Up 0, Down 1

This LSP is not operating because authentication is not configured on R6, the egress router:

	aviva@R6> show rsvp interface detail
	RSVP interface: 1 active
	so-0/0/3.0 Index 66, State Ena/Up
	 NoAuthentication, NoAggregate, NoReliable, NoLinkProtection
	 HelloInterval 9(second)
	 Address 10.1.36.2, 10.0.0.6
	 ActiveResv 0, PreemptionCnt 0, Update threshold 10%
	 Subscription 100%, StaticBW 155.52Mbps, AvailableBW 155.52Mbps
	 ReservedBW [0] 0bps[1] 0bps[2] 0bps[3] 0bps[4] 0bps[5] 0bps[6] 0bps[7] 0bps