A game studio rotates an OSPF authentication key. The new key becomes valid only after the old key has expired, and the adjacency drops in that gap. What would have kept the neighbors up through the change?
Select an answer to reveal the explanation.
Short Explanation
A key chain is a pair of keys that have to overlap in your hand while you pass the lock. You let the new OSPF key become valid before the old one expires, so both neighbors still share a key they will accept. A gap where neither key works drops the adjacency even though the passwords were typed correctly.
Full Explanation
A key chain gives routing peers a sequence of keys with send and accept lifetimes. During a rotation both routers must still accept at least one common key, which means the new key's lifetime has to overlap the old one. The studio started the new key only after the old key expired, so there was a gap with no acceptable key and OSPF dropped the adjacency. Overlapping the lifetimes removes that gap. MACsec encrypts frames on a hop and uses its own key agreement. It does not rotate the OSPF authentication key and it does not fill a gap in the routing key chain. A TACACS shared secret authenticates operator logins or command authorization. OSPF does not verify that secret as its protocol key. HSRP hellos maintain a gateway group. They do not carry the OSPF authentication key, and stretching the HSRP timer does not keep an OSPF adjacency up through a key gap. Caveat: the overlap has to exist on both peers, because a key that one side sends before the other side will accept it still fails authentication. Operational check: configure the overlapping lifetimes, change keys in a test window, and confirm the neighbor stays up the entire time.