<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof"><span style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0 ContentPasted1 ContentPasted2">Hello,<br>
<br>
OSPF with cryptographic authentication does work now. In Mikrotiks 7.7, the auth-id is defaulted to 0.
<a href="https://help.mikrotik.com/docs/display/ROS/OSPF" id="LPlnkOWALinkPreview">
https://help.mikrotik.com/docs/display/ROS/OSPF</a> Changing that to 1 does fix the problem. ^^
<div class="_Entity _EType_OWALinkPreview _EId_OWALinkPreview _EReadonly_1">
<div id="LPBorder_GTaHR0cHM6Ly9oZWxwLm1pa3JvdGlrLmNvbS9kb2NzL2Rpc3BsYXkvUk9TL09TUEY." class="LPBorder354906" style="width: 100%; margin-top: 16px; margin-bottom: 16px; position: relative; max-width: 800px; min-width: 424px;">
<table id="LPContainer354906" role="presentation" style="padding: 12px 36px 12px 12px; width: 100%; border-width: 1px; border-style: solid; border-color: rgb(200, 200, 200); border-radius: 2px;">
<tbody>
<tr valign="top" style="border-spacing: 0px;">
<td style="width: 100%;">
<div id="LPTitle354906" style="font-size: 21px; font-weight: 300; margin-right: 8px; font-family: wf_segoe-ui_light, "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; margin-bottom: 12px;">
<a target="_blank" id="LPUrlAnchor354906" href="https://help.mikrotik.com/docs/display/ROS/OSPF" style="text-decoration: none; color: var(--themePrimary);">OSPF - RouterOS - MikroTik Documentation</a></div>
<div id="LPDescription354906" style="font-size: 14px; max-height: 100px; color: rgb(102, 102, 102); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; margin-bottom: 12px; margin-right: 8px; overflow: hidden;">
Neighbour Relationship and Adjacency. OSPF is a link-state protocol that assumes that the interface of the router is considered an OSPF link. Whenever OSPF is started, it adds the state of all the links in the local link-state database.. There are several steps
before the OSPF network becomes fully functional:</div>
<div id="LPMetadata354906" style="font-size: 14px; font-weight: 400; color: rgb(166, 166, 166); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif;">
help.mikrotik.com</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<br>
</span></div>
<div class="elementToProof">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div id="divtagdefaultwrapper" style="font-size: 12pt; font-family: Calibri, Arial, Helvetica, sans-serif; color: rgb(0, 0, 0);">
<p>Theera K.</p>
<p><br>
</p>
</div>
</div>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Bird-users <bird-users-bounces@network.cz> on behalf of Theera Kittichareonpot <tkittich@hotmail.com><br>
<b>Sent:</b> Saturday, January 14, 2023 07:06<br>
<b>To:</b> Kees Meijs | Nefos <kees@nefos.nl>; bird-users@network.cz <bird-users@network.cz><br>
<b>Subject:</b> Re: Potential OSPF authentication issues with Mikrotik routers</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Hello Kees,<br>
<br>
Thank you so much. Upgrading Mikrotik to 7.7 does fix the issue with simple authentication in OSPF. It does work now. ^^<br>
<br>
However, md5 authentication still doesn't work. On Mikrotiks, OSPF has an authentication-key-id option which can be set and is defaulted to 1.
<a href="https://wiki.mikrotik.com/wiki/Manual:Routing/OSPF">https://wiki.mikrotik.com/wiki/Manual:Routing/OSPF</a> But there is no such option in Bird. Perhaps that's why Mikrotiks gave error about "authentication failed from X.X.X.X wrong SA ID".<br>
<br>
Theera K.<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
From: Kees Meijs | Nefos <kees@nefos.nl><br>
Sent: Saturday, January 14, 2023 00:59<br>
To: Theera Kittichareonpot <tkittich@hotmail.com>; bird-users@network.cz <bird-users@network.cz><br>
Subject: Re: Potential OSPF authentication issues with Mikrotik routers <br>
<br>
Hi Theera,<br>
<br>
We're using Mikrotik extensively as well, in combination with BIRD2.<br>
<br>
In RouterOS 7 there's been quite some work done on OSPF specifically. The latest release 7.7 (see
<a href="https://mikrotik.com/download/changelogs/stable)">https://mikrotik.com/download/changelogs/stable)</a> incorporates some fixes for yet another bugs in this context.<br>
<br>
Apart from BIRD configuration, I would suggest to upgrade to RouterOS 7.6 at least or even better 7.7.<br>
<br>
Cheers,<br>
Kees<br>
<br>
On 13-01-2023 18:11, Theera Kittichareonpot wrote:<br>
Hello,<br>
<br>
I am very new to Bird so I could be doing something wrong. But it seems Bird 2.0.11 could have compatibility issues with Mikrotik routers when OSPF authentication is used. <br>
<br>
When simple authentication is used, the neighbor state stays at Init and doesn't change at all.<br>
<br>
When cryptographic password is used, the Mikrotik router gave errors about wrong SA/SP id: "ospf-instance-1 { version: 2 router-id: 192.168.120.1 } ospf-area-1 { 0.0.0.0 } interface { instance-id: 5 broadcast 192.168.10.1%br-lan } authentication failed from
192.168.10.197 wrong SA ID". I've tried md5 sha256 and sha512, but all gave the same error.<br>
<br>
Kindly let me know if I did something wrong or what additional info is needed. Thank you.<br>
<br>
The following is my bird.conf:<br>
<br>
log syslog all; <br>
#debug protocols all;<br>
<br>
#router id 192.168.10.197;<br>
<br>
ipv4 table master4;<br>
<br>
protocol device {<br>
}<br>
<br>
protocol direct direct4 {<br>
ipv4; # Connect to default IPv4 table<br>
}<br>
<br>
protocol kernel kernel4 {<br>
ipv4 {<br>
import all;<br>
export all;<br>
};<br>
}<br>
<br>
protocol static static4 {<br>
ipv4;<br>
}<br>
<br>
protocol ospf v2 ospf4 {<br>
instance id 5; # set to the same as other routers'<br>
ipv4 {<br>
import all;<br>
export all;<br>
};<br>
<br>
area 0 {<br>
interface "eth0" {<br>
type broadcast;<br>
hello 10; # same as other routers'<br>
retransmit 5;<br>
transmit delay 1;<br>
dead 40;<br>
<br>
#simple authentication doesn't work with Mikrotik either. The state stays at Init and doesn't change at all.<br>
#authentication simple;<br>
#password "12345678";<br>
<br>
# cryptographic password doesn't seem to work with mikrotik too; got errors about wrong SA/SP id<br>
#authentication cryptographic;<br>
#password "12345678" { algorithm hmac sha512; };<br>
};<br>
};<br>
}<br>
<br>
<br>
Theera K.<br>
<br>
<br>
</div>
</span></font></div>
</body>
</html>