I had a hard time figuring out how to configure OSPFv3 authentication on a Palo Alto Networks NGFW due to its different configuration formats compared to a Cisco router.
TL;DR: The SPI must be set in hexadecimal, while the actual key (40 chars, hexadecimal) must be grouped in 5 sections, separated with hyphens.
Talking about Cisco’s IOS, OSPFv3 authentication is set at the interface configuration level with the following command:
|
1 |
ipv6 ospf authentication ipsec spi <256-4294967295> sha1 <hey-string 40 chars> |
e.g.:
|
1 |
ipv6 ospf authentication ipsec spi 305419896 sha1 CC41D07E889B5D610FAE78E88E88C559E45D1021 |
However, trying to set those values on Palo’s OSPFv3 Auth Profile, I encountered the following commit error: Error: Failed to parse IPSec manual-key tunnel/profile 'ah-sha1' authentication key.
Luckily, I wasn’t the first person struggling with this, hence DuckDuckGo led me to this post: “OSPFv3 Authentication Palo Alto to Cisco Router“.
The corresponding values to the above-mentioned example are:
|
1 2 |
SPI: 0x12345678 Key: CC41D07E-889B5D61-0FAE78E8-8E88C559-E45D1021 |
Configured under Network -> Routing -> Routing Profiles -> OSPFv3 -> OSPFv3 Auth Profile (using a PA-440 with PAN-OS 11.2.10, Advanced Routing Engine enabled):
(Of course, other hash algorithms than SHA-1 must be used, but my lab counterparts are not capable of it. ;))
Enabled either at the OSPFv3 – Area level:
OR at the individual Interface level (preferred from my point of view):
Now, the SPI is consistent with the representation in Wireshark. Note the “Authentication Header” within the IP header, as the OSPFv3 authentication leverages the IPv6 extension header for IPsec:
Speaking about the SPI, the hexadecimal format (Palo) makes more sense compared to the decimal format (Cisco). However, I find it rather nonsensical that you have to insert hyphens in the key. 🤦♂️
Final note: If you have set your intrazone-default policy (default: allow) to deny, you need explicit rules for OSPF to work. Little stumbling block here: with OSPFv3 authentication, you have to allow “ipsec-ah” in addition to “ospf” in order to work. Both the session table and the traffic log will show both applications (!), dependent on the originating node, which is either the Palo or the other routers on the network: (I’ve no idea where this “from port / to port” 20033 comes from.)
Soli Deo Gloria!
Photo by George Prentzas on Unsplash.