Technical Tip: VRRP MD5 authentication is not possible

Description
This article describes the reason why MD5 authentication is not possible.
Solution

# config system interface

# config vrrp

    edit <vrid>

set version [2|3]

set vrgrp {integer}

set vrip {ipv4-address-any}

set priority {integer}

set adv-interval {integer}

set start-time {integer}

set preempt [enable|disable]

set accept-mode [enable|disable]

set vrdst {ipv4-address-any}

set vrdst-priority {integer}

set ignore-default-route [enable|disable]

set status [enable|disable]

    next

end

 

It is not possible to configure MD5 authentication for VRRP on FortiGate. 

 

Details regarding RFC: https://datatracker.ietf.org/doc/html/rfc3768

 

rfc3768 lists the following:

 

Note.

Earlier version of the VRRP specification had several defined authentication types [RFC2338]. 

These were removed in thisspecification because operational experience showed that it not providing any real security and would only cause multiple masters to becreated.

 

The authentication methods were supported in previous RFC: https://datatracker.ietf.org/doc/html/rfc2338

 

The implementation of VRRP on the FortiGate follows the new RFC.