182
Usage guidelines
As defined in RFC 2328, all non-backbone areas must maintain connectivity to the backbone. You can
use the vlink-peer command to configure a virtual link to connect an area to the backbone.
When you configure this command, follow these guidelines:
• The smaller the hello interval is, the faster the network converges, and the more network resources
are consumed.
• A retransmission interval that is too small can cause unnecessary retransmissions. A large value is
appropriate for a low speed link.
• Specify an appropriate transmission delay with the trans-delay keyword.
For security purposes, all keys, including keys configured in plain text, are saved in cipher text.
You can specify either MD5/HMAC-MD5 authentication or simple authentication for a virtual link. For
MD5/HMAC-MD5 authentication, you can configure multiple keys by executing this command multiple
times, and each command must have a unique key ID and key string.
To modify the key of a virtual link, perform the following key rollover configurations:
1. Configure a new MD5/HMAC-MD5 authentication key for the virtual link on the local device. If
the new key is not configured on the neighbor device, MD5/HMAC-MD5 authentication key
rollover is triggered. During key rollover, OSPF sends multiple packets that contain both the new
and old MD5/HMAC-MD5 authentication keys to ensure that the neighbor device can pass the
authentication.
2. Configure the new MD5/HMAC-MD5 authentication key on the neighbor device. When the local
device receives packets with the new key from the neighbor device, it exits MD5 key rollover.
3. Delete the old MD5/HMAC-MD5 authentication key from the local device and the neighbor. This
step helps prevent attacks from devices that use the old key for communication and reduces system
resources and bandwidth consumption caused by key rollover.
Examples
# C on f i gu r e a vi r t u a l l i n k t o th e n e i g h b o r w i t h r o ut e r I D 1.1.1.1.
<Sysname> system-view
[Sysname] ospf 100
[Sysname-ospf-100] area 2
[Sysname-ospf-100-area-0.0.0.2] vlink-peer 1.1.1.1
Related commands
• authentication-mode
• display ospf vlink
To Next Page
Loading...
Need help?
General
