Subject: [VRRP] Shared Password Authentication

From: PC Drew <[email-masked]>
Date: Thu, 06 Mar 2003 07:00:39 -0700

I know I probably shouldn't bring this up again, but I'm still kind of 
confused as to why everyone is so against using the password 
authentication in VRRP.  Many other protocols implement this same kind 
of authentication with success (i.e. OSPF).  I feel that this kind of 
authentication is a good, cheap way to prevent forged packets from 
screwing up my network.  Of course, I have the potential of screwing 
myself up by entering the wrong password in the configuration...but the 
same thing could happen when I'm running OSPF in authentication mode.

To simplify my question: what is the benefit of *removing* this 
functionality vs. keeping it in?

-- 
PC Drew
Manager, Client Services

IBSN
12600 W. Cedar Drive, Suite 100
Lakewood, CO 80228

Email: [email-masked]
Phone: 303-984-4727
Cell: 720-841-4543
Fax: 303-984-4730

_______________________________________________
vrrp mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/vrrp

---

From: "Don Provan" <[email-masked]>
Date: Fri, 7 Mar 2003 09:26:22 -0800

The argument, in a nutshell, is that any entity that can
inject proper VRRP packets into your network (including
the 255 IP TTL, for example) can deceive the rest of the
network directly without having any need to fool the VR
master into relinquishing control. Besides, such an entity
would almost certainly be in a position to monitor VRRP
traffic to read the password if it wanted. So the password
accomplished nothing to improve security.

So *all* the password did was ensure that misconfigured
hosts couldn't talk to each other. This might seem like
a good idea in itself, but actually it has exactly the
opposite of any desired effect: when they don't talk to
each other, the network is hosed because the conflicting
routers will fight uncontrollably for control of the
Virtual Router's addresses.

In short, worthless as a defense, yet dangerous
when innocently misconfigured. No upside.

There are several differences for OSPF. For one thing,
a forged packet fools the entire OSPF area, not just
the immediately connected network that an intruder
would be able to fool anyway. For another, by ignoring
a bad password in OSPF, you keep the offending node
outside "the club". In VRRP, it just divides the
environment into two clubs, neither having any
intrinsic authority from the point of view of the
systems being served.

-don provan
[email-masked]

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of PC
> Drew
> Sent: Thursday, March 06, 2003 6:01 AM
> To: [email-masked]
> Subject: [VRRP] Shared Password Authentication
>
>