# LDP Authentication

Load **isis.cfg**

```
#IOS-XE
config replace flash:isis.cfg

#IOS-XR
configure
load bootflash:isis.cfg
commit replace
y
```



* Configure LDP on all routers using LDP IGP autoconfig.
* Configure R1 and R2 to use LDP authentication with a password of “LDP12”
* Configure XR1 and R6 to use an LDP password of “LPD619”
* Configure R3 and R4 to use LDP authentication with a keychain called “KC34” and password of “LDP34”
* Configure all other LDP sessions to use a password of “LDPDEFAULT”











































## Answer <a href="#id-8d998d0f-8584-4dc9-afbd-95865e16a97b" id="id-8d998d0f-8584-4dc9-afbd-95865e16a97b"></a>

```
#R1-R6
router isis
 mpls ldp autoconfig

#XR1
router isis 1
 add ipv4
  mpls ldp auto-config
!
mpls ldp

#R1
mpls ldp password fallback LDP12

#R2
mpls ldp password fallback LDPDEFAULT
mpls ldp neighbor 1.1.1.1 password LDP12

#R3
key chain KC34
 key 1
  key-string LDP34
!
access-list 1 permit 4.4.4.4
!
mpls ldp password fallback LDPDEFAULT
mpls ldp password option 1 for 1 key-chain KC34

#R4
key chain KC34
 key 1
  key-string LDP34
!
access-list 1 permit 3.3.3.3
!
mpls ldp password fallback LDPDEFAULT
mpls ldp password option 1 for 1 key-chain KC34

#R5
mpls ldp password fallback LDPDEFAULT

#R6
mpls ldp password fallback LDPDEFAULT
mpls ldp neighbor 19.19.19.19 password LDP619

#XR1
mpls ldp
 neighbor
  password clear LDPDEFAULT
  6.6.6.6:0 password clear LDP619

#XR2
mpls ldp
 neighbor
  password clear LDPDEFAULT
```



## Explanation <a href="#bf9b2287-1957-4808-b944-f24ac6b7474e" id="bf9b2287-1957-4808-b944-f24ac6b7474e"></a>

LDP authentication uses the same mechanism as BGP authentication - TCP option 19 in the TCP header. This only authenticates the LDP TCP session, not the UDP discovery Hellos.



LDP authentication on IOS-XE has quite a few options which can be a little confusing. Let’s first look at IOS-XR, as it is much more straightforward.



On IOS-XR, you set the password for all neighbors as follows:

```
#IOS-XR
mpls ldp
 neighbor
  password clear LDPDEFAULT
```



You set the password per-neighbor as follows:

```
#IOS-XR
mpls ldp
 neighbor
  6.6.6.6:0 password clear LDP619
```



When you make this change, the change is disruptive. The session is torn down and re-established using the new TCP MD5 auth password.



On IOS-XE, we set the default neighbor password using the “fallback” password. The idea is that, if we don’t have a specific neighbor password already, we “fallback” to the “fallback” password.

```
#IOS-XE
mpls ldp password fallback LDPDEFAULT
```



To set the password per-neighbor, we use the following command:

```
#IOS-XE
mpls ldp neighbor 1.1.1.1 password LDP12
```



By default, LDP sessions are _not_ torn down on IOS-XE when you make this change. The password isn’t required until the session is reset. To change this behavior, you can use the following command. With this command, IOS-XE acts like IOS-XR, and reestablishes the session with the TCP authentication password. Note that even without this command, the password is still required whenever the session is reset after you make a change to the LDP password.

```
#IOS-XE
mpls ldp password required
```



We also have the ability to use a keychain for LDP authentication. You can apply this to the fallback password using the following command:

```
#IOS-XE
mpls ldp password fallback key-chain key-chain-name
```



However, you can’t directly apply this to a specific neighbor. Instead, you have to create a standard ACL which matches the remote LDP neighbor’s RID (not transport address) and sets the key-chain using a “password option.”

```
#IOS-XE
key chain KC34
 key 1
  key-string LDP34
!
access-list 1 permit 3.3.3.3
!
mpls ldp password option 1 for 1 key-chain KC34
```



On IOS-XE, we also have the ability to do password rollover. This can allow you to gracefully change the password, without the new password taking effect right away. For example, we can do this:

```
#IOS-XE
mpls ldp password fallback PASS123
mpls ldp password required
mpls ldp rollover duration 3
!
mpls ldp password fallback PASS456
```



The above password won’t take effect for three minutes after entering the command. However, the router will still accept this password. This gives you a “grace period” to change the LDP password on all routers.



## Verification <a href="#id-0b8ad73a-a452-42b4-9a53-7a02af5ea0cf" id="id-0b8ad73a-a452-42b4-9a53-7a02af5ea0cf"></a>

We’ll start with verification on IOS-XR, as that is the simplest. We can simply look at LDP neighbors and verify that “MD5 on” is seen. On IOS-XR, the password is always “required.”

<div align="left"><figure><img src="https://3072390383-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkUz2C3GqnZcWhoVL6jfk%2Fuploads%2F30HC5cWYlyCK8zmzGpm0%2Fimage.png?alt=media&#x26;token=726f80dc-65ba-4867-aa03-55b4a7cc7305" alt=""><figcaption></figcaption></figure></div>



On IOS-XE we must look at the detailed LDP neighbor output. Below we see that on R3, all of the passwords are “not required.” This means that the command **mpls ldp password required** was not entered. But don’t be fooled - these passwords are “required” if the session is ever re-established! Next, we can see whether the password for the peer is using the “fallback” password, a per-neighbor password, or a password option. Finally, we see whether the password is actually being used or, if it is stale, meaning it will be used whenever the session is next reset.

<div align="left"><figure><img src="https://3072390383-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkUz2C3GqnZcWhoVL6jfk%2Fuploads%2FnVdN2eJUxv9aCx6q2dGE%2Fimage.png?alt=media&#x26;token=c55bed69-65b1-44fd-8441-4f53e14a01e6" alt=""><figcaption></figcaption></figure></div>



Above, we see that R3’s LDP sessions with R2 and R6 are “stale,” meaning they are not using the configured fallback password yet. If we reset one of these sessions, we should see it move to “in use.”

```
#R3
clear mpls ldp nei 6.6.6.6
```

<div align="left"><figure><img src="https://3072390383-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkUz2C3GqnZcWhoVL6jfk%2Fuploads%2FkEtpHoPOrp7409WhMu69%2Fimage.png?alt=media&#x26;token=7fa957d3-edee-4e3a-ba48-750c16bfabbe" alt=""><figcaption></figcaption></figure></div>
