Network & Infrastructure / OSPF & Underlay Convergence
OSPF authentication rollover without an adjacency outage
A scheduled key change breaks adjacency because the endpoints stop accepting the old key before both transmit the new one. Clock or key-lifetime differences can narrow the expected overlap.
Environment and inputs: OSPFv2 IPv4 underlays, with OSPFv3 explicitly identified where used; timers and diagnostics vary by platform. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Record supported authentication mechanism, key IDs, send and accept lifetimes, clock state and rollout order. Inspect authentication errors without exposing key material in the support record.
Explain the result
Authentication depends on matching mechanisms and valid keys at the same time. An operational overlap must cover propagation, clock uncertainty and devices that cannot maintain multiple accepted keys.
Plan the fix
Use the implementation's documented staged rollover sequence and a tested rollback key window. Coordinate all interfaces in the adjacency set instead of updating only the management inventory.
Check the result and rollback
Verify continuous adjacency and authenticated exchange through the overlap and expiration periods. Restore the previous valid configuration if errors begin; never publish actual secrets in validation artifacts.