Nokia 7705 SAR-W Series Manual page 225

MPLS Guide
authentication-key
Syntax authentication-key {authentication-key | hash-key} [hash | hash2]
no authentication-key
Context config>router>rsvp>interface
Description This command specifies the authentication key to be used between RSVP-TE neighbors to
authenticate RSVP-TE messages. Authentication uses the MD5 message-based digest.
When enabled on an RSVP-TE interface, authentication of RSVP-TE messages operates in
both directions of the interface.
A 7705 SAR node maintains a security association using one authentication key for each
interface to a neighbor. The following items are stored in the context of this security
association:
A 7705 SAR RSVP-TE sender transmits an authenticating digest of the RSVP-TE message,
computed using the shared authentication key and a keyed hash algorithm. The message
digest is included in an integrity object that also contains a flags field, a key identifier field,
and a sequence number field. The 7705 SAR RSVP-TE sender complies with the procedures
for RSVP-TE message generation in RFC 2747, RSVP Cryptographic Authentication.
A 7705 SAR RSVP-TE receiver uses the key together with the authentication algorithm to
process received RSVP-TE messages.
When a PLR node switches the path of the LSP to a bypass LSP, it does not send the integrity
object in the RSVP-TE messages sent over the bypass tunnel. If the PLR receives an
RSVP-TE message with an integrity object, it will perform the digest verification for the key of
the interface over which the packet was received. If this fails, the packet is dropped. If the
received RSVP-TE message is an RESV message and does not have an integrity object,
then the PLR node will accept it only if it originated from the MP node.
A 7705 SAR MP node will accept RSVP-TE messages received over the bypass tunnel with
and without the integrity object. If an integrity object is present, the proper digest verification
for the key of the interface over which the packet was received is performed. If this fails, the
packet is dropped.
The 7705 SAR MD5 implementation does not support the authentication challenge
procedures in RFC 2747.
3HE 18686 AAAB TQZZA
• the HMAC-MD5 authentication algorithm
• the key used with the authentication algorithm
• the lifetime of the key; the user-entered key is valid until the user deletes it from the
interface
• the source address of the sending system
• the latest sending sequence number used with this key identifier
Use subject to Terms available at: www.nokia.com
© 2022 Nokia.
MPLS and RSVP-TE
225