WEBVTT

1
00:00.000 --> 00:03.840
In previous skills, we walked through configuring a passive interface.

2
00:03.840 --> 00:08.600
And for IPv4 using OSPF version 3, it's a little bit different than the

3
00:08.600 --> 00:11.280
traditional flavor of OSPF for IPv4.

4
00:11.280 --> 00:14.820
So let's remind ourselves, first of all, why we would ever want to make an

5
00:14.820 --> 00:16.600
interface a passive interface.

6
00:16.600 --> 00:21.290
If we knew that here on router well, we would never have any OSPF neighbors off

7
00:21.290 --> 00:22.040
of this segment,

8
00:22.040 --> 00:26.080
it would be beneficial to set that interface as passive.

9
00:26.080 --> 00:29.400
And that way we're not going to be sending or processing incoming hello

10
00:29.400 --> 00:30.000
messages.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:30.000 --> 00:34.370
And as a result, there's no possible way that we would be revealing information

12
00:34.370 --> 00:36.280
to a hacker or somebody else who's out here.

13
00:36.280 --> 00:40.520
And if we accidentally have another OSPF speaker here or from the attacker put

14
00:40.520 --> 00:41.760
the OSPF speaker here,

15
00:41.760 --> 00:45.480
we're not going to accidentally form an adjacency with some unknown device.

16
00:45.480 --> 00:50.160
Because we're no longer sending and processing any inbound hello messages if we

17
00:50.160 --> 00:51.040
have a passive interface.

18
00:51.040 --> 00:55.540
So one question might be, "Will Keith, why not just not enable OSPF version 3

19
00:55.540 --> 00:58.800
for address family IPv4 at all on this interface?"

20
00:58.800 --> 01:03.140
Well, if we don't enable this interface for OSPF version 3, we're not going to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

20
00:58.800 --> 01:03.140
Well, if we don't enable this interface for OSPF version 3, we're not going to

21
01:03.140 --> 01:05.680
be advertising the 10-01 subnet.

22
01:05.680 --> 01:09.480
And so if you want reachability back to this 10-01 subnet, which you do if you

23
01:09.480 --> 01:10.800
have clients here and so forth,

24
01:10.800 --> 01:13.200
we'd want to go ahead and make sure we're including that in OSPF.

25
01:13.200 --> 01:16.320
But for the benefit of security, we can make it passive.

26
01:16.320 --> 01:19.640
And that way we can restrict the sending of any hello messages and if there are

27
01:19.640 --> 01:21.680
inbound hello messages, we're just going to drop them,

28
01:21.680 --> 01:23.360
we're not going to process them or believe them.

29
01:23.360 --> 01:26.160
So to demonstrate this, let me take an interface.

30
01:26.160 --> 01:28.800
Let's take serial 3/1 down here in our 7.

31
01:28.800 --> 01:31.600
We don't currently have OSPF enabled over here at all.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

31
01:28.800 --> 01:31.600
We don't currently have OSPF enabled over here at all.

32
01:31.600 --> 01:35.920
So let's imagine that we want to enable this interface, serial 3/1 for OSPF

33
01:35.920 --> 01:39.520
version 3, process ID1 for the address family IPv4,

34
01:39.520 --> 01:43.760
because we want that network 10-78-0 to be advertising OSPF.

35
01:43.760 --> 01:47.270
But at the same time, we don't want the ability to form an adjacency with

36
01:47.270 --> 01:48.480
anybody off of that segment.

37
01:48.480 --> 01:49.920
So let's take a two-step approach here.

38
01:49.920 --> 01:54.400
First, we'll enable OSPF-3 for address family IPv4 on this interface.

39
01:54.400 --> 01:57.680
We'll verify that that route is then seen by the rest of the network.

40
01:57.680 --> 02:03.640
And then we'll go in further and we'll set serial 3/1 as a passive interface in
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:57.680 --> 02:03.640
And then we'll go in further and we'll set serial 3/1 as a passive interface in

41
02:03.640 --> 02:05.520
OSPF to prevent any kind of

42
02:05.520 --> 02:09.760
naborship ever forming should some other device try to neighbor up with us.

43
02:09.760 --> 02:14.060
So the first thing I like to do in our topology is just verify that in our 7,

44
02:14.060 --> 02:16.000
this serial 3/1 interface

45
02:16.000 --> 02:18.080
is up and does have an IP address.

46
02:18.080 --> 02:22.850
So let's go over to our 7 and here on our 7, let's go ahead and do a show IP

47
02:22.850 --> 02:23.680
interface brief.

48
02:23.680 --> 02:28.160
And there it is, serial 3/1, 10-78-07.

49
02:28.160 --> 02:32.800
The other router, our 8, even though it doesn't have OSPF enabled over there on
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

49
02:28.160 --> 02:32.800
The other router, our 8, even though it doesn't have OSPF enabled over there on

50
02:32.800 --> 02:34.480
its serial 3/2 interface.

51
02:34.480 --> 02:36.000
Let's just take a look at the picture real quick.

52
02:36.000 --> 02:38.640
What we should be able to do is ping it because we're directly connected.

53
02:38.640 --> 02:41.280
Let's just ping and verify we can get over there.

54
02:41.280 --> 02:46.400
So do a ping over to 10.78.08 and that looks good.

55
02:46.400 --> 02:50.230
We can also do a show, CDP neighbors, just to verify that our 8's hanging off

56
02:50.230 --> 02:51.120
that connection.

57
02:51.120 --> 02:52.720
And it is fantastic.

58
02:52.720 --> 02:57.440
So let's go into a show OSPF B3 interface brief.

59
02:57.440 --> 03:02.720
And I'm leaving off the IPv4, IPv6 before the interface command because we're
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

59
02:57.440 --> 03:02.720
And I'm leaving off the IPv4, IPv6 before the interface command because we're

60
03:02.720 --> 03:04.000
only running IPv4.

61
03:04.000 --> 03:08.840
So great, I've got these two interfaces. Let's go ahead and go into the serial

62
03:08.840 --> 03:10.480
3/1 and add it to the

63
03:10.480 --> 03:17.120
party with the command OSPF version 3, process ID1, IPv4, and area.

64
03:17.120 --> 03:20.800
This is going to be an area 1 as all the other interfaces are.

65
03:20.800 --> 03:21.600
Press enter.

66
03:21.600 --> 03:26.640
And now if we do a show OSPF version 3, interface brief, that also means that

67
03:26.640 --> 03:27.920
if we go to another router.

68
03:27.920 --> 03:30.560
For example, let's go up to router 1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

68
03:27.920 --> 03:30.560
For example, let's go up to router 1.

69
03:30.560 --> 03:36.460
We should be able to see that route as an interarea OSPF route for 10.78.0

70
03:36.460 --> 03:37.760
because our 7

71
03:37.760 --> 03:42.720
is including that. And that's being forwarded as a LSA type 3 by R3 up into

72
03:42.720 --> 03:43.520
area 0.

73
03:43.520 --> 03:48.320
So if we go to R1 and here on R1, if we do a show IP route, press enter.

74
03:48.320 --> 03:51.520
That this is a show IP route, OSPF B3.

75
03:51.520 --> 03:53.440
So you can see just the OSPF learned routes.

76
03:53.440 --> 03:55.440
And there is that network right there.

77
03:55.440 --> 03:57.200
This is the 10.78.0 network.

78
03:57.200 --> 04:03.030
So our next step, let's go down to R7 and let's do a debug of OSPF B3 hello
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

78
03:57.200 --> 04:03.030
So our next step, let's go down to R7 and let's do a debug of OSPF B3 hello

79
04:03.030 --> 04:03.920
messages.

80
04:03.920 --> 04:08.400
And we'll verify that currently it's sending out hello messages on serial 3/1.

81
04:08.400 --> 04:12.450
And then after we make it passive, those hello messages on that interface will

82
04:12.450 --> 04:12.960
stop.

83
04:12.960 --> 04:18.240
So let's go back to R7 and let's do a debug OSPF version 3 hello.

84
04:18.240 --> 04:19.760
Just like that.

85
04:19.760 --> 04:24.400
And we'll wait till we get at least one or two messages that indicate they're

86
04:24.400 --> 04:26.000
going out serial 3/1.

87
04:26.000 --> 04:28.640
All right, so there's one of them and there is another one.

88
04:28.640 --> 04:30.320
So I'll go ahead and do an undybug all.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

88
04:28.640 --> 04:30.320
So I'll go ahead and do an undybug all.

89
04:30.320 --> 04:34.560
And again, notice they're using IPv6 multicast addresses to send those hello.

90
04:34.560 --> 04:39.080
Another reminder that IPv6 needs to be enabled on the interfaces if you want OS

91
04:39.080 --> 04:40.400
PF version 3 to work.

92
04:40.400 --> 04:44.160
In fact, I'm going to leave the debug on and let's go into router configuration

93
04:44.160 --> 04:44.320
mode.

94
04:44.320 --> 04:46.880
Let's do a do show run section router.

95
04:46.880 --> 04:48.880
And then I can just copy paste as we go in.

96
04:48.880 --> 04:52.400
So I'm going to go into router OSPF B3, process ID1.

97
04:52.400 --> 04:55.920
Then I'm going to go into the address family for IPv4 unicast.

98
04:55.920 --> 05:00.960
And then from here, I'm going to go ahead and say passive interface serial 3/1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

98
04:55.920 --> 05:00.960
And then from here, I'm going to go ahead and say passive interface serial 3/1.

99
05:00.960 --> 05:05.730
And once we do that, the hello messages that we're being sent through serial 3/

100
05:05.730 --> 05:06.000
1,

101
05:06.000 --> 05:07.680
those should no longer be sent.

102
05:07.680 --> 05:10.480
And that's because serial 3/1 is passive.

103
05:10.480 --> 05:14.550
So the network that it's connected to, and that's this one right here, the 1078

104
05:14.550 --> 05:14.640
,

105
05:14.640 --> 05:16.960
is still being advertised in OSPF.

106
05:16.960 --> 05:21.840
But serial 3/1 is no longer sending hello messages for OSPF.

107
05:21.840 --> 05:24.560
And if it receives a hello message, it's not going to process it.

108
05:24.560 --> 05:28.410
So we have no risk of forming an adjacency over that serial link or that

109
05:28.410 --> 05:29.200
network segment

110
05:29.200 --> 05:30.880
because we're not processing the lows.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

110
05:29.200 --> 05:30.880
because we're not processing the lows.

111
05:30.880 --> 05:32.720
All right, so I'm going to go ahead and leave that in place.

112
05:32.720 --> 05:36.960
Let's take an undybug all and let's do a show run section router.

113
05:36.960 --> 05:41.040
So that's exactly how we enable passive interface for IPv4.

114
05:41.040 --> 05:43.040
So we simply went into the routing process.

115
05:43.040 --> 05:46.080
We went further into the address family for IPv4 unicast.

116
05:46.080 --> 05:49.040
And specified that serial 3/1 is a passive interface.

117
05:49.040 --> 05:52.320
Which caused it to stop sending hello messages off of that interface.

118
05:52.320 --> 05:55.760
But at the same time, we go to R1 and we look at the routing table there.

119
05:55.760 --> 05:59.200
We still have the OSPF Interarea route for 1078-0.

120
05:59.200 --> 06:01.920
And in the next video, I'd like to walk you through the setting up of
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

120
05:59.200 --> 06:01.920
And in the next video, I'd like to walk you through the setting up of

121
06:01.920 --> 06:06.800
Stubb and totally stubby areas for IPv4 using OSPF version 3.

122
06:06.800 --> 06:08.560
So I'll see you there in just a moment.