Specifying MD5 Start and Stop Timing

With each of the MD5 commands, you can specify when the router will start and stop accepting packets that include a digest made with this key. You can also specify when the router will start and stop generating packets that include a digest made with this key. If you specify a time for any of these actions, you can further specify the day, month, and year. The default times are as follows:

• Start accepting keys (startAcceptTime)—Current time
• Stop accepting keys (stopAcceptTime)—Never
• Start generating keys (startGenTime)—Current time plus 2 minutes
• Stop generating keys (stopGenTime)—Never

If you specify times, you must follow these guidelines to achieve appropriate timing between the actions:

• startAcceptTime must be less than startGenTime.
• stopGenTime must be less than stopAcceptTime.
• When a new key replaces an old one, the startGenTime time for the new key must be less than or equal to the stopGenTime time of the old key.

For example, suppose you configure authentication on router A and router B. If the startGenTime for router A is earlier than the startAcceptTime for router B, router B does not accept packets from router A until the current time matches its startAcceptTime.

The router accepts any packet authenticated with a key you have defined if the packet is received within the period defined for the key by its startAcceptTime and stopAcceptTime. If more than one key has been defined for that period, the router determines which key to use by comparing the startGenTime with the current time. When the startGenTime of a key matches the current time, the router starts using this key to transmit packets and stops using the previous key.

Copyright © 2008, Juniper Networks, Inc. All rights reserved. Trademark Notice.