Technical Tip: VRRP MD5 authentication is not possible

[oconnort]

Description
This article describes the reason why MD5 authentication is not possible.
Solution

To configure VRRP on an interface on FortiGate, the following options are available: 

# config system interface

# config vrrp

    edit <vrid>

set version [2|3]

set vrgrp {integer}

set vrip {ipv4-address-any}

set priority {integer}

set adv-interval {integer}

set start-time {integer}

set preempt [enable|disable]

set accept-mode [enable|disable]

set vrdst {ipv4-address-any}

set vrdst-priority {integer}

set ignore-default-route [enable|disable]

set status [enable|disable]

    next

end

It is not possible to configure MD5 authentication for VRRP on FortiGate. 

Details regarding RFC: https://datatracker.ietf.org/doc/html/rfc3768

rfc3768 lists the following:

Note.

Earlier version of the VRRP specification had several defined authentication types [RFC2338]. 

These were removed in thisspecification because operational experience showed that it not providing any real security and would only cause multiple masters to becreated.

The authentication methods were supported in previous RFC: https://datatracker.ietf.org/doc/html/rfc2338

The implementation of VRRP on the FortiGate follows the new RFC.