Description

OSPF adjacency between two SRX devices is not coming up due to authentication mismatch and the error message "OSPF packet ignored: authentication type mismatch (0) from 172.16.3.2" is reported in the ospf trace log.


Symptoms

Topology:

SRX-1 ------------------ SRX-2
         OSPF Area 0    

Symptoms:

OSPF adjacency between two SRX devices is not coming up and the following 'mismatch' message is reported in the OSPF traceoptions log:

root@SRX-1# run show log ospf_r1
May 12 17:07:57 SRX-1 clear-log[3122]: logfile cleared
May 12 17:07:58.149761 task_process_events: recv ready for OSPF I/O./var/run/ppmd_control
May 12 17:07:58.150010 task_process_events: recv ready for OSPF I/O./var/run/ppmd_control
May 12 17:07:58.150130 task_timer_uset: timer OSPF I/O./var/run/ppmd_control_PPM Hold <Touched> set to offset 2:00 at 17:09:58
May 12 17:07:58.150196 OSPF periodic xmit from 172.16.3.1 to 224.0.0.5 (IFL 73 area 0.0.0.0)
May 12 17:07:58.151792 task_process_events: recv ready for OSPF I/O./var/run/ppmd_control
May 12 17:07:58.151972 task_process_events: recv ready for OSPF I/O./var/run/ppmd_control
May 12 17:07:58.152095 task_timer_uset: timer OSPF I/O./var/run/ppmd_control_PPM Hold <Touched> set to offset 2:00 at 17:09:58
May 12 17:07:59.277758 task_process_events: recv ready for OSPF I/O./var/run/ppmd_control
May 12 17:07:59.278292 task_timer_uset: timer OSPF I/O./var/run/ppmd_control_PPM Hold <Touched> set to offset 2:00 at 17:09:59
May 12 17:07:59.278355 OSPF packet ignored: authentication type mismatch (0) from 172.16.3.2

Solution

The OSPF authentication type and key must match on the two devices.

In this example, SRX-1 has OSPF MD5 authentication configured in OSPF area 0 on interface ge-0/0/1.0:

protocols {
     ospf {
         traceoptions {
             file ospf_r1;
             flag all;
         }

         area 0.0.0.0 {
             interface ge-0/0/1.0 {
                 authentication {
                     md5 1 key "$9$fTQntu1sSeApnRhcvMVwY4Zjq.5"; ## SECRET-DATA
                 }
             }
         }
    }
}

However, SRX-2 does not have any authentication configured on interface ge-0/0/1.0 in OSPF area 0.

protocols {
    ospf {
         area 0.0.0.0 {
             interface ge-0/0/1.0
            
         }
    }
}


If you do not have admin access to the OSPF neighbor, one can also check the OSPF authentication type on the interface by taking a packet-capture on that interface.

This is a packet capture from SRX-1 (172.16.3.1).  The authentication is configured:
alt


This is a packet capture from SRX-2 (172.16.3.2). The authentication is not configured:
alt :

From above packet capture's image, we can see that SRX-1 is using MD5 authentication and SRX-2 has no authentication configured in OSPF.



Important:
Another reason for getting the mismatch error is due to MD5 authentication key mismatch or key id mismatch. 

To correct the problem and establish an OSPF adjacency successfully, correct the authentication configuration so that they match on the two devices:

  • Enable OSPF MD5 authentication on SRX-2 with the same key on the interface which is connected to SRX-1.
OR
  • Disable the OSPF MD5 authentication from interface ge-0/0/1 of SRX-1

Related Information