1
00:00:00,000 --> 00:00:02,868
[AUDIO LOGO]

2
00:00:02,868 --> 00:00:07,170

3
00:00:07,170 --> 00:00:11,800
Finally, let's talk about
IS-IS authentication.

4
00:00:11,800 --> 00:00:14,970
Now, something a little
interesting in IS-IS

5
00:00:14,970 --> 00:00:19,680
is not only does it
support two different types

6
00:00:19,680 --> 00:00:22,170
of authentication,
but it actually

7
00:00:22,170 --> 00:00:25,450
supports two different
things to authenticate.

8
00:00:25,450 --> 00:00:27,570
So of course, let's
jump in and take a look

9
00:00:27,570 --> 00:00:29,230
at the details on that.

10
00:00:29,230 --> 00:00:31,230
And then we'll jump
into the command line

11
00:00:31,230 --> 00:00:34,810
and see it in operation.

12
00:00:34,810 --> 00:00:39,480
So the first thing to discuss
is that IS-IS can actually

13
00:00:39,480 --> 00:00:46,770
do authentication for
either hellos or LSPs.

14
00:00:46,770 --> 00:00:50,470
Or of course, we could do
authentication for both.

15
00:00:50,470 --> 00:00:53,963
Now, as far as the type of
authentication, currently--

16
00:00:53,963 --> 00:00:55,380
and you never know
when things are

17
00:00:55,380 --> 00:00:58,570
going to change, but at
the time of this recording,

18
00:00:58,570 --> 00:01:03,120
we currently only support
either plaintext or MD5

19
00:01:03,120 --> 00:01:04,540
authentication.

20
00:01:04,540 --> 00:01:06,550
Now, of course,
generally speaking,

21
00:01:06,550 --> 00:01:09,730
we are not going to want to
do plaintext authentication.

22
00:01:09,730 --> 00:01:12,660
So I would say at this
point, it's pretty much just

23
00:01:12,660 --> 00:01:14,070
going to be MD5.

24
00:01:14,070 --> 00:01:17,935
That's what we'll be looking
at here in our demonstration.

25
00:01:17,935 --> 00:01:19,560
One thing that's a
little bit different

26
00:01:19,560 --> 00:01:23,910
here is the hello
authentication is actually

27
00:01:23,910 --> 00:01:29,460
configured on the interface
where the LSP authentication is

28
00:01:29,460 --> 00:01:33,250
configured under
the routing process.

29
00:01:33,250 --> 00:01:36,900
So what we're going to do here
is jump into the command line

30
00:01:36,900 --> 00:01:40,150
and take a look at
MD5 authentication

31
00:01:40,150 --> 00:01:44,400
both for the hellos
and for the LSPs.

32
00:01:44,400 --> 00:01:47,230
So I don't think we really
need the diagram for this one.

33
00:01:47,230 --> 00:01:51,090
We're just going to configure
this between routers 7 and 8.

34
00:01:51,090 --> 00:01:52,920
So let's jump into
the command line.

35
00:01:52,920 --> 00:01:57,450
And we'll start with
authenticating those hellos.

36
00:01:57,450 --> 00:02:01,810
So let's begin by configuring
our hello authentication.

37
00:02:01,810 --> 00:02:04,230
So again, we'll just go
into configuration mode.

38
00:02:04,230 --> 00:02:07,080
And we'll start by
making a key chain.

39
00:02:07,080 --> 00:02:09,849
We'll just call it ISIS_KEY.

40
00:02:09,849 --> 00:02:12,360
And we'll just make key 1.

41
00:02:12,360 --> 00:02:16,590
And we'll make our
key-string ISIS_PASS.

42
00:02:16,590 --> 00:02:18,810
Then all we have to do
is go to our interface.

43
00:02:18,810 --> 00:02:22,260
In this case, it's gigabit
3 towards router 8.

44
00:02:22,260 --> 00:02:26,490
And we'll say isis
authentication.

45
00:02:26,490 --> 00:02:27,900
We'll set the mode.

46
00:02:27,900 --> 00:02:30,930
Again, on this code, we
only have two choices--

47
00:02:30,930 --> 00:02:32,700
text or md5.

48
00:02:32,700 --> 00:02:35,430
Of course, we want to do md5.

49
00:02:35,430 --> 00:02:37,620
And we're going to
authenticate this either

50
00:02:37,620 --> 00:02:40,510
for level 1 or level 2 or both.

51
00:02:40,510 --> 00:02:43,030
In this case, it's just
a level 2 adjacency.

52
00:02:43,030 --> 00:02:45,300
So we can just say level-2.

53
00:02:45,300 --> 00:02:48,010
And then we have to
tell it the key to use.

54
00:02:48,010 --> 00:02:53,260
So we assign the
key-chain ISIS_KEY.

55
00:02:53,260 --> 00:02:55,260
Now, as we can
see, we immediately

56
00:02:55,260 --> 00:02:57,450
start getting
console messages here

57
00:02:57,450 --> 00:03:03,870
that CLNS authentication has
failed for the IS-IS hellos.

58
00:03:03,870 --> 00:03:06,270
This, of course, will
cause the neighborship

59
00:03:06,270 --> 00:03:10,650
to go down to router 8.

60
00:03:10,650 --> 00:03:15,240
So we can see here, as expected,
the adjacency to router 8

61
00:03:15,240 --> 00:03:16,770
has gone down.

62
00:03:16,770 --> 00:03:19,080
Let's go over to router 8.

63
00:03:19,080 --> 00:03:21,780
And here we have one of my
personal favorite messages

64
00:03:21,780 --> 00:03:24,750
in IOS that the
adjacency to router 7

65
00:03:24,750 --> 00:03:28,420
has gone down because
the neighbor forgot us.

66
00:03:28,420 --> 00:03:30,180
I just think that's
a funny message.

67
00:03:30,180 --> 00:03:31,860
But essentially,
what it means is

68
00:03:31,860 --> 00:03:34,230
we're no longer
exchanging hellos.

69
00:03:34,230 --> 00:03:37,500
So of course, we're going to
have to configure router 8 here

70
00:03:37,500 --> 00:03:40,140
the same way we did router 7.

71
00:03:40,140 --> 00:03:42,720
So we'll go into
configuration mode once again.

72
00:03:42,720 --> 00:03:46,620
We'll make our key
chain ISIS_KEY.

73
00:03:46,620 --> 00:03:48,580
And that's without the dash.

74
00:03:48,580 --> 00:03:51,060
Then we'll make key 1.

75
00:03:51,060 --> 00:03:52,780
This one gets the dash--

76
00:03:52,780 --> 00:03:56,400
key-string ISIS_PASS.

77
00:03:56,400 --> 00:03:59,700
This time, its
interface gigabit 1.

78
00:03:59,700 --> 00:04:04,920
We'll set our mode to
md5 again for level-2.

79
00:04:04,920 --> 00:04:07,230
And we'll set our key-chain.

80
00:04:07,230 --> 00:04:09,420
Once this is done, we
should see the adjacency

81
00:04:09,420 --> 00:04:11,140
to router 7 come back up.

82
00:04:11,140 --> 00:04:12,630
We can see, of
course, that it did,

83
00:04:12,630 --> 00:04:14,620
even while we were saying that.

84
00:04:14,620 --> 00:04:18,899
So let's take a look at
a show isis 1 neighbor.

85
00:04:18,899 --> 00:04:21,730
So we see that that's
definitely back up.

86
00:04:21,730 --> 00:04:24,540
So now why don't we
jump into Wireshark

87
00:04:24,540 --> 00:04:27,780
and see what these hellos
look like on the wire,

88
00:04:27,780 --> 00:04:30,630
now that we have
authentication enabled.

89
00:04:30,630 --> 00:04:35,670
We'll simply look at router
7's gigabit 3 interface.

90
00:04:35,670 --> 00:04:38,000
So here in our
Wireshark capture,

91
00:04:38,000 --> 00:04:42,020
we see here that packet number
four is actually an ISIS

92
00:04:42,020 --> 00:04:45,110
HELLO coming from router 8.

93
00:04:45,110 --> 00:04:49,040
If we expand the ISIS
HELLO, we see now

94
00:04:49,040 --> 00:04:52,460
that we have an
authentication TLV type 10.

95
00:04:52,460 --> 00:04:54,710
Let's go ahead and open that.

96
00:04:54,710 --> 00:04:58,610
What we see here
is our hmac-md5.

97
00:04:58,610 --> 00:05:02,160
And we see the actual
message digest itself.

98
00:05:02,160 --> 00:05:04,580
So we can see that the
authentication is not

99
00:05:04,580 --> 00:05:09,440
only enabled, but
it's also using MD5.

100
00:05:09,440 --> 00:05:12,780
So that takes care of
hello authentication.

101
00:05:12,780 --> 00:05:15,800
Now let's jump back
over to the command line

102
00:05:15,800 --> 00:05:21,140
and configure our
LSP authentication.

103
00:05:21,140 --> 00:05:23,380
So we'll start here on router 8.

104
00:05:23,380 --> 00:05:26,170
And to configure
LSP authentication,

105
00:05:26,170 --> 00:05:28,900
we go under router isis 1.

106
00:05:28,900 --> 00:05:31,390
And all we have to do--
it's pretty much the same

107
00:05:31,390 --> 00:05:33,250
as configuring for the hellos.

108
00:05:33,250 --> 00:05:37,150
We just say
authentication mode md5.

109
00:05:37,150 --> 00:05:40,060
Once again, we'll just
do the level-2 database.

110
00:05:40,060 --> 00:05:42,620
And we tell it what key to use.

111
00:05:42,620 --> 00:05:45,250
Now, just as a quick
note here, we certainly

112
00:05:45,250 --> 00:05:47,650
could use a different
key chain here.

113
00:05:47,650 --> 00:05:50,890
This doesn't have to be the same
key chain or the same password.

114
00:05:50,890 --> 00:05:52,930
But since we already
have it created,

115
00:05:52,930 --> 00:05:55,870
we'll just go ahead and use
the one we already have.

116
00:05:55,870 --> 00:05:58,990
And what we're going to see is,
once again, our authentication

117
00:05:58,990 --> 00:06:01,780
is going to start failing
because router 8 is

118
00:06:01,780 --> 00:06:03,100
doing authentication.

119
00:06:03,100 --> 00:06:06,820
And router 7 is not,
which means that as

120
00:06:06,820 --> 00:06:11,140
of right now, if we do
a show ip route isis,

121
00:06:11,140 --> 00:06:13,270
router 8 no longer
has any routes,

122
00:06:13,270 --> 00:06:16,610
because nothing's being
accepted from the database.

123
00:06:16,610 --> 00:06:20,120
So let's go configure
this on router 7 as well.

124
00:06:20,120 --> 00:06:23,030
So it's of course the
same configuration.

125
00:06:23,030 --> 00:06:27,950
So we'll set our mode to
md5 and set our key-chain.

126
00:06:27,950 --> 00:06:31,060
Now, this is going to create
an interesting problem for us.

127
00:06:31,060 --> 00:06:35,860
We're now going to start failing
with all of the other routers,

128
00:06:35,860 --> 00:06:39,850
because router 7 here has
neighborships with router

129
00:06:39,850 --> 00:06:42,940
6, router 1, router 3.

130
00:06:42,940 --> 00:06:47,860
In fact, if we do a
show isis 1 neighbor,

131
00:06:47,860 --> 00:06:50,470
we can see we have a
lot more neighbors here

132
00:06:50,470 --> 00:06:52,300
than just router 8.

133
00:06:52,300 --> 00:06:57,880
So we're now back exchanging
databases with router 8.

134
00:06:57,880 --> 00:07:01,450
If I do a show ip
route isis, router 7

135
00:07:01,450 --> 00:07:03,550
is actually not going
to have any routes

136
00:07:03,550 --> 00:07:06,580
here, because again, we're
only exchanging with 8.

137
00:07:06,580 --> 00:07:10,810
And in our previous
video, we filtered out 8.

138
00:07:10,810 --> 00:07:13,600
So to see if the database
exchange is actually OK,

139
00:07:13,600 --> 00:07:15,820
we'd have to go to router 8.

140
00:07:15,820 --> 00:07:19,000
So here if we do a show
ip route isis again,

141
00:07:19,000 --> 00:07:21,920
now we see router 7's loopback.

142
00:07:21,920 --> 00:07:24,310
So we are now
properly exchanging

143
00:07:24,310 --> 00:07:26,500
routes with router 7.

144
00:07:26,500 --> 00:07:29,710
However, router 7 is
not exchanging routes

145
00:07:29,710 --> 00:07:31,760
with anybody else.

146
00:07:31,760 --> 00:07:33,550
So if we really wanted
to make this work

147
00:07:33,550 --> 00:07:35,500
through our
environment, we would

148
00:07:35,500 --> 00:07:38,290
have to turn on the
LSP authentication

149
00:07:38,290 --> 00:07:41,900
on all the other routers.

150
00:07:41,900 --> 00:07:46,760
In this video, we took a
look at IS-IS authentication.

151
00:07:46,760 --> 00:07:49,430
We saw how we can
turn on authentication

152
00:07:49,430 --> 00:07:54,080
just for the hellos or for
the LSPs, and the exchanging

153
00:07:54,080 --> 00:07:58,770
of the database, and do either
one or the other or both.

154
00:07:58,770 --> 00:08:03,350
Now, the IS-IS hellos get
authenticated on the interface.

155
00:08:03,350 --> 00:08:05,960
And therefore, we can
do that link by link

156
00:08:05,960 --> 00:08:07,610
wherever we want to.

157
00:08:07,610 --> 00:08:10,790
However, the database
exchange is enabled

158
00:08:10,790 --> 00:08:12,650
under the routing process.

159
00:08:12,650 --> 00:08:15,410
The problem with
that, as we just saw,

160
00:08:15,410 --> 00:08:20,510
is if we turn it on, on one
router, or maybe two or three,

161
00:08:20,510 --> 00:08:23,330
we have to enable
it on all of them

162
00:08:23,330 --> 00:08:25,670
because, otherwise,
we'll stop exchanging

163
00:08:25,670 --> 00:08:29,220
databases with the routers
that aren't configured for it.

164
00:08:29,220 --> 00:08:33,530
So the LSP authentication
is sort of an all or nothing

165
00:08:33,530 --> 00:08:35,700
within a given level.

166
00:08:35,700 --> 00:08:37,309
So of course, we
could authenticate

167
00:08:37,309 --> 00:08:41,820
level 1 in some places and not
level 2, that sort of thing.

168
00:08:41,820 --> 00:08:44,880
But we do have to
enable it for the level.

169
00:08:44,880 --> 00:08:47,150
So of course, if
we do level two,

170
00:08:47,150 --> 00:08:49,640
that's going to mean
the whole backbone.

171
00:08:49,640 --> 00:08:52,940
Or we could do level 1 in
just one particular area

172
00:08:52,940 --> 00:08:55,460
for the level 1 adjacencies.

173
00:08:55,460 --> 00:08:57,740
I hope this has been
informative for you,

174
00:08:57,740 --> 00:09:00,910
and I'd like to thank
you for viewing.

175
00:09:00,910 --> 00:09:04,000