IEOC - Internetwork Expert's Online Community

Hi All

The question states :

+ Ensure that host devices running OSPF on the segmant between R4 and R5 cannot intercept the OSPF communication between R4 and R5.

I just want to clarify why we converting the Ethernet links to non-broadcast. Is this the reason why?

Why did we convert these links to non-broadcast? -

Hi, ..

the key word in this task is "intercept".

The solution must satisfy that the OSPF communication R4 <--> R5 ca not be sniffed/intercept by a host that resides on the Ethernet Link, VLan45 afair.

If You leave the network type by default, OSPF control messages are sent by multicast and can easily be sniffed by every Host on Vlan45.

Changing the Network type to Non-broadcast changes the Transport from Multicast to Unicast, so the Communication is only transported between the Switchprts on which the Ethernet-Ports of R4 and R5 are connected.

Other possibilities, which may work, but are way more complex to implement :

•  GRE Tunnel between R4 and R5

•  GRE Tunnel with IPSec on Top

OSPF Authentication is no solution, because with authentication, the Communication is ony "signed", but not encrypted. The payload of a packet is still sent in cleartext, hence it can be "intercepted".

OSPF Authentication prevents You from being spoiled with spoofed LSAs, but does not prevent someone from "reading" Your OSPF Communication.

Any other suggestions / explanations are more than welcome.

Cheers,..

/Christian.

Thank you, that explains it in much detail. I understand now, you have brought light to the query.

Thank you Christian.