Re: auth_type PASS

Please see comments inline

On Thu, 2017-02-23 at 14:50 +0200, barak adam wrote:
> Hi, 
> 
> 
> 
> Enabling AH, authentication works and drop non-authenticated packets
> 
> Enabling PASS - I see no impact. why??
> 
> 
> I know that authentication is discouraged by the latest RFC and I
> looked into vrrp_in_chk() source.
It's not so much that authentication is discouraged, but more that
authentication doesn't exist in the current RFCs for VRRPv2 and VRRPv3.

> 
> Using PASS should do nothing in VRRPv3? Do I need to force version to
> VRRPv2 in order to make PASS working ?

If authentication is configured for a version 3 instance, a message
should be logged reporting "VRRP version 3 does not support
authentication. Ignoring." If you look at RFC5798 (VRRPv3 RFC) at
section 5.1, you will see that there is nowhere in the VRRP header for
authentication. If you want to use authentication then you will need to
use VRRPv2, and the authentication is retained as a legacy from RFC2338
(RFC3768 which supersedes it removed authentication). You will also need
to ensure that you don't have strict mode enabled.
> 

It really is worth looking at the log entries that keepalived writes,
since they tell you what is happening.

Quentin Armitage

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot

_______________________________________________
Keepalived-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/keepalived-devel