A game studio rotates an OSPF key chain at a planned time. One Nexus starts sending the new key and drops the old key at that instant. Its peer, whose clock is slightly behind, still sends the old key, and the adjacency drops. What avoids that gap?
Select an answer to reveal the explanation.
Short Explanation
Key rotation is a relay handoff, and both runners have to hold the baton for a moment. You overlap the key lifetimes so the peer that still sends the old key is accepted while the new key takes over. MACsec on the link is a different lock and does not fill this gap.
Full Explanation
A key chain can hold more than one key, and each key has a send lifetime and an accept lifetime. During rotation the sending side should start the new key while the receiving side still accepts the old key for an overlap window. The studio removed the old key at the same instant the new key began, so the peer that is still sending the old key fails authentication and the adjacency drops. Overlapping the lifetimes closes that gap. MACsec encrypts frames on a link with its own key agreement. It is not a substitute for the OSPF key chain, and leaving OSPF authentication empty does not let mismatched OSPF keys succeed. A RADIUS shared secret authenticates operator or network-access sessions. OSPF does not rotate its key chain by reading the RADIUS secret. A key chain is built to hold multiple keys. Deleting the lifetime so only one key exists is the opposite of a rotation plan, and it does not give the lagging peer a key it can still send. Caveat: the overlap has to cover the real clock skew between the peers, and the key ID and the key string of the key in use still have to match on both ends. Operational check: configure the overlap, then confirm the adjacency stays up across the rotation and both peers show the new key in use after the window.