1 00:00:00,000 --> 00:00:03,423 [VIDEO LOGO] 2 00:00:03,423 --> 00:00:11,740 3 00:00:11,740 --> 00:00:15,490 So let's go ahead and jump into trouble ticket 1. 4 00:00:15,490 --> 00:00:21,430 And for trouble ticket 1, we will be using IS-IS topology 1. 5 00:00:21,430 --> 00:00:24,940 We'll be using this topology for most of these tickets. 6 00:00:24,940 --> 00:00:28,090 It will be referenced over here if this ever changes. 7 00:00:28,090 --> 00:00:29,890 We'll keep an eye on that to make sure 8 00:00:29,890 --> 00:00:33,010 that we're always using the same topology diagram. 9 00:00:33,010 --> 00:00:36,070 But this is the same topology diagram, again, 10 00:00:36,070 --> 00:00:40,490 that we used through the majority of our IS-IS skills. 11 00:00:40,490 --> 00:00:42,340 So let's take a look at our ticket. 12 00:00:42,340 --> 00:00:44,630 Our ticket is going to be down here at the bottom. 13 00:00:44,630 --> 00:00:48,880 And in this case, we're saying that the IS-IS neighborship 14 00:00:48,880 --> 00:00:53,380 between R7 and R8 is currently down. 15 00:00:53,380 --> 00:00:56,960 So we're talking about this neighborship right here. 16 00:00:56,960 --> 00:00:58,840 Let's go ahead and jump into the command line 17 00:00:58,840 --> 00:01:00,160 and take a look at this. 18 00:01:00,160 --> 00:01:04,519 We may as well start on, say, router 8. 19 00:01:04,519 --> 00:01:07,370 So let's begin just by verifying the ticket. 20 00:01:07,370 --> 00:01:10,910 We'll do a show IS-IS neighbor, and we 21 00:01:10,910 --> 00:01:14,270 see that, in fact, router 8 has no neighborships. 22 00:01:14,270 --> 00:01:18,230 Let's take a look at a show CLNS interface. 23 00:01:18,230 --> 00:01:20,570 We'll specify gigabit 1. 24 00:01:20,570 --> 00:01:24,110 So we see here that the gigabit Interface is up, up. 25 00:01:24,110 --> 00:01:28,280 We also see that the Routing Protocol is set to IS-IS. 26 00:01:28,280 --> 00:01:31,280 It's supposed to be a level-2. 27 00:01:31,280 --> 00:01:33,920 However, we also see that the number 28 00:01:33,920 --> 00:01:38,150 of active level-2 adjacencies is currently zero. 29 00:01:38,150 --> 00:01:41,870 There's nothing here really indicating a problem, however. 30 00:01:41,870 --> 00:01:45,260 Let's try looking at a show IS-IS protocol. 31 00:01:45,260 --> 00:01:49,100 So here, we see that the System ID appears to be set correctly. 32 00:01:49,100 --> 00:01:51,800 The IS type is level-1, level-2, which 33 00:01:51,800 --> 00:01:54,500 is what router 8 is supposed to be. 34 00:01:54,500 --> 00:01:58,910 We see that the area is set to essentially area 20. 35 00:01:58,910 --> 00:02:03,800 And we see that it is supporting IS-IS for IP 36 00:02:03,800 --> 00:02:09,020 on the loopback and IP and IPv6 6 on gigabit 1. 37 00:02:09,020 --> 00:02:10,850 Now, that is a mismatch. 38 00:02:10,850 --> 00:02:14,540 However, we don't really need IPv6 support 39 00:02:14,540 --> 00:02:16,250 for this particular ticket. 40 00:02:16,250 --> 00:02:18,200 This is just about the neighborship. 41 00:02:18,200 --> 00:02:20,330 So that's not really a concern as far 42 00:02:20,330 --> 00:02:23,630 as the neighborship goes, what protocols are supported 43 00:02:23,630 --> 00:02:25,790 on the loopback interface? 44 00:02:25,790 --> 00:02:28,040 But otherwise, everything in this output 45 00:02:28,040 --> 00:02:31,080 generally looks like it's configured properly as well. 46 00:02:31,080 --> 00:02:32,990 So let's jump over and see if maybe there's 47 00:02:32,990 --> 00:02:37,100 a problem on router 7 just in this recursory overview 48 00:02:37,100 --> 00:02:39,720 of the IS-IS configuration. 49 00:02:39,720 --> 00:02:43,860 So on router 7, we'll start with our show IS-IS neighbors. 50 00:02:43,860 --> 00:02:45,710 And we see that router 7 actually 51 00:02:45,710 --> 00:02:48,853 only has a neighborship with router 3 right now. 52 00:02:48,853 --> 00:02:51,020 Well, it's supposed to have a lot more neighborships 53 00:02:51,020 --> 00:02:54,290 than that, particularly to router 8, which is our concern 54 00:02:54,290 --> 00:02:55,530 at the moment. 55 00:02:55,530 --> 00:02:58,250 So let's look at that configuration on its gigabit 3 56 00:02:58,250 --> 00:02:59,670 interface. 57 00:02:59,670 --> 00:03:05,081 So again, we'll do a show CLNS for the interface gigabit 3. 58 00:03:05,081 --> 00:03:08,480 So once again, we see the Interface is up, up. 59 00:03:08,480 --> 00:03:12,680 We see that the Routing Protocol is set to IS-IS. 60 00:03:12,680 --> 00:03:15,740 We see that the Number of Active Layer-2 adjacencies 61 00:03:15,740 --> 00:03:17,450 is, again, zero. 62 00:03:17,450 --> 00:03:20,420 So once again, everything here appears to be correct, 63 00:03:20,420 --> 00:03:22,870 except there's no neighborship. 64 00:03:22,870 --> 00:03:25,690 Let's do a show IS-IS protocol. 65 00:03:25,690 --> 00:03:27,880 So we see that the System ID does 66 00:03:27,880 --> 00:03:29,890 appear to be set correctly. 67 00:03:29,890 --> 00:03:34,150 This router's IS type is only level-2. 68 00:03:34,150 --> 00:03:37,690 But again, this isn't going to be a problem because the two 69 00:03:37,690 --> 00:03:40,490 routers have level-2 in common. 70 00:03:40,490 --> 00:03:43,630 So even though one of them is level-1, level-2 and this one's 71 00:03:43,630 --> 00:03:46,000 level-2, that's still fine. 72 00:03:46,000 --> 00:03:48,490 They're in different areas anyway. 73 00:03:48,490 --> 00:03:51,530 So they should be forming a level-2 adjacency. 74 00:03:51,530 --> 00:03:54,280 So again, as long as they have level-2 in common, 75 00:03:54,280 --> 00:03:55,370 we should be good to go. 76 00:03:55,370 --> 00:03:58,460 That's not the problem we're looking for. 77 00:03:58,460 --> 00:04:00,530 So as I just said, they are in different areas. 78 00:04:00,530 --> 00:04:03,790 We see that this router is in area 100, which 79 00:04:03,790 --> 00:04:05,980 again is correct. 80 00:04:05,980 --> 00:04:09,980 We see that IS-IS is enabled on its gigabit interface. 81 00:04:09,980 --> 00:04:13,450 In fact, it's enabled on three of its gigabit interfaces, 82 00:04:13,450 --> 00:04:18,160 1, 2 and 3 for IP and IPv6. 83 00:04:18,160 --> 00:04:20,920 We also see that it's passive for loopback 0. 84 00:04:20,920 --> 00:04:22,900 Again, that's not going to effect neighborship 85 00:04:22,900 --> 00:04:24,680 in any case. 86 00:04:24,680 --> 00:04:27,730 So once again, generally speaking, everything here 87 00:04:27,730 --> 00:04:29,050 looks good. 88 00:04:29,050 --> 00:04:32,530 So maybe what we should do is look at Wireshark 89 00:04:32,530 --> 00:04:36,970 and see if these routers are actually exchanging HELLOs. 90 00:04:36,970 --> 00:04:39,190 So let's take a look at Wireshark. 91 00:04:39,190 --> 00:04:44,220 We'll just look at router 8's gigabit 1 interface. 92 00:04:44,220 --> 00:04:46,910 So what we see here is our packet 93 00:04:46,910 --> 00:04:52,640 4 is, in fact, an IS-IS HELLO coming from router 7. 94 00:04:52,640 --> 00:04:56,760 So let's go ahead and expand the IS-IS HELLO field. 95 00:04:56,760 --> 00:04:59,030 And as we look over this, everything 96 00:04:59,030 --> 00:05:00,830 seems to look fairly normal here. 97 00:05:00,830 --> 00:05:03,950 We have a circuit-type of Level-2-Only. 98 00:05:03,950 --> 00:05:07,610 The System ID is, in fact, router 7's ID. 99 00:05:07,610 --> 00:05:11,870 We see we have a PDU of 1496. 100 00:05:11,870 --> 00:05:16,100 But notice here, we have authentication. 101 00:05:16,100 --> 00:05:17,960 This could definitely create an issue 102 00:05:17,960 --> 00:05:22,050 for IS-IS adjacency, which is our current ticket. 103 00:05:22,050 --> 00:05:24,710 So this is definitely something worth investigating. 104 00:05:24,710 --> 00:05:27,480 If we open the Authentication section, 105 00:05:27,480 --> 00:05:31,460 we see that it's actually doing HMACMD5. 106 00:05:31,460 --> 00:05:34,250 Let's take a look at a HELLO from router 8 107 00:05:34,250 --> 00:05:37,140 and see if it's doing this as well. 108 00:05:37,140 --> 00:05:39,360 So we'll highlight packet 6 here. 109 00:05:39,360 --> 00:05:42,680 So now, we see that it's coming from router 8. 110 00:05:42,680 --> 00:05:44,270 And if we look at the authentication, 111 00:05:44,270 --> 00:05:47,060 we see that it's also doing HMAC. 112 00:05:47,060 --> 00:05:50,330 So let's jump back over to the command-line 113 00:05:50,330 --> 00:05:54,290 and take a look at the password that it's actually using. 114 00:05:54,290 --> 00:05:58,250 They're both agreeing on the authentication for the HELLOs, 115 00:05:58,250 --> 00:06:01,110 but let's see if they're doing it correct. 116 00:06:01,110 --> 00:06:03,710 So since we're already on router 7, we'll just start here. 117 00:06:03,710 --> 00:06:08,195 Let's do a show run for interface gigabit 3. 118 00:06:08,195 --> 00:06:12,290 And we see that it is, in fact, set to MD5 authentication 119 00:06:12,290 --> 00:06:16,590 and it's using a key chain called IS-IS_KEY. 120 00:06:16,590 --> 00:06:21,290 So let's also do a show run, and we'll do a section for key. 121 00:06:21,290 --> 00:06:24,020 And we see that our key chain, IS-IS key, 122 00:06:24,020 --> 00:06:29,570 has one key and one key string, IS-IS_PASS. 123 00:06:29,570 --> 00:06:32,940 So let's go see if router 8 is the same. 124 00:06:32,940 --> 00:06:36,620 So we'll start with our show run of interface gigabit 1. 125 00:06:36,620 --> 00:06:39,510 And we see that, again, it's configured for authentication, 126 00:06:39,510 --> 00:06:40,490 which we knew. 127 00:06:40,490 --> 00:06:43,170 But we really just want to see what key chain it's using, 128 00:06:43,170 --> 00:06:45,780 which is IS-IS_KEY. 129 00:06:45,780 --> 00:06:49,280 So let's do a show run section key. 130 00:06:49,280 --> 00:06:51,770 Once again, we see that it's using the key chain 131 00:06:51,770 --> 00:06:58,580 IS-IS_KEY with one key and a key string of IS-IS_PASS. 132 00:06:58,580 --> 00:07:01,610 So everything looks OK here. 133 00:07:01,610 --> 00:07:04,770 Let's see what our log is saying about this. 134 00:07:04,770 --> 00:07:07,580 So we'll do a show log and we see 135 00:07:07,580 --> 00:07:11,330 that we're actually getting quite a few IS-IS 136 00:07:11,330 --> 00:07:14,400 authentication failed messages. 137 00:07:14,400 --> 00:07:16,310 Now, this is a quick note here. 138 00:07:16,310 --> 00:07:20,180 Looking into your logs is probably a pretty good place 139 00:07:20,180 --> 00:07:22,040 to actually start. 140 00:07:22,040 --> 00:07:24,320 However, we want to walk through and look 141 00:07:24,320 --> 00:07:27,140 at some of the other methods we can use for troubleshooting. 142 00:07:27,140 --> 00:07:28,850 Just so we know, in the real world, 143 00:07:28,850 --> 00:07:32,550 this is actually a really good place to start. 144 00:07:32,550 --> 00:07:35,060 Also, note that this would have been showing up 145 00:07:35,060 --> 00:07:37,170 as console messages as well. 146 00:07:37,170 --> 00:07:39,620 So if you're SSH-ed into the device, 147 00:07:39,620 --> 00:07:43,910 having terminal monitor enabled would have also shown this. 148 00:07:43,910 --> 00:07:46,310 We're purposefully logging into these devices 149 00:07:46,310 --> 00:07:48,830 right now without terminal monitor 150 00:07:48,830 --> 00:07:51,770 on just so the errors and the mistakes that we're 151 00:07:51,770 --> 00:07:55,980 trying to fix aren't just so obviously right in our face. 152 00:07:55,980 --> 00:07:59,360 But there are a few other ways we could have seen this other 153 00:07:59,360 --> 00:08:00,840 than looking at the logs. 154 00:08:00,840 --> 00:08:02,833 So let's take a look at those. 155 00:08:02,833 --> 00:08:05,000 So like I said, the first would have been definitely 156 00:08:05,000 --> 00:08:07,550 to look at console messages and the logs. 157 00:08:07,550 --> 00:08:12,290 However, if we were to repeat our show run section key, 158 00:08:12,290 --> 00:08:16,827 another good way to see this is we can highlight the password. 159 00:08:16,827 --> 00:08:18,410 Because at this point, we don't really 160 00:08:18,410 --> 00:08:19,850 know what the problem is. 161 00:08:19,850 --> 00:08:22,440 The password looks correct. 162 00:08:22,440 --> 00:08:27,110 However, if we highlight this in our terminal software, 163 00:08:27,110 --> 00:08:29,340 this will vary a little bit, by the way, 164 00:08:29,340 --> 00:08:32,010 depending on what terminal software you're using. 165 00:08:32,010 --> 00:08:34,309 I'm using SecureCRT here. 166 00:08:34,309 --> 00:08:36,289 PuTTY will do this as well. 167 00:08:36,289 --> 00:08:39,630 Your mileage may vary with other terminal software. 168 00:08:39,630 --> 00:08:43,490 But notice, this is actually highlighting a space 169 00:08:43,490 --> 00:08:45,050 after the password. 170 00:08:45,050 --> 00:08:50,120 If we go back over to router 7 and we highlight this one, 171 00:08:50,120 --> 00:08:52,940 this one does not have a space after it. 172 00:08:52,940 --> 00:08:56,300 Now, clearly highlighting things in the terminal 173 00:08:56,300 --> 00:08:58,940 isn't really our go-to way to do this. 174 00:08:58,940 --> 00:09:02,420 Because as I said, your mileage may vary with other terminal 175 00:09:02,420 --> 00:09:03,450 software. 176 00:09:03,450 --> 00:09:06,960 So of course, there's a better way to see all of this. 177 00:09:06,960 --> 00:09:09,230 Let's go back to router 8 since that appears 178 00:09:09,230 --> 00:09:11,950 to be where the problem is. 179 00:09:11,950 --> 00:09:13,970 And here's a much better way to tell. 180 00:09:13,970 --> 00:09:17,920 And the way that we really should be looking at this, just 181 00:09:17,920 --> 00:09:19,810 do a show key chain. 182 00:09:19,810 --> 00:09:22,750 Notice, in the show key chain, it literally 183 00:09:22,750 --> 00:09:27,680 shows you the text of the key string in quotes. 184 00:09:27,680 --> 00:09:29,740 So you can tell without any doubt 185 00:09:29,740 --> 00:09:34,760 whatsoever that there's a space in this password. 186 00:09:34,760 --> 00:09:37,840 So now, we can clearly see what the problem is. 187 00:09:37,840 --> 00:09:41,440 Router 8 is configured with the correct password, 188 00:09:41,440 --> 00:09:44,390 but it has a space after it. 189 00:09:44,390 --> 00:09:46,840 So what we have to do is go into Configuration 190 00:09:46,840 --> 00:09:50,600 and simply put the password in without the space. 191 00:09:50,600 --> 00:09:52,960 So let's go ahead and fix the problem, 192 00:09:52,960 --> 00:09:57,190 and then CFR adjacency comes back up between router 7 193 00:09:57,190 --> 00:10:00,310 and router 8 since everything else appears 194 00:10:00,310 --> 00:10:03,360 to be configured properly. 195 00:10:03,360 --> 00:10:06,230 So we'll simply go into Configuration. 196 00:10:06,230 --> 00:10:08,180 We'll go into our Key. 197 00:10:08,180 --> 00:10:11,840 And all we have to do is change the key string. 198 00:10:11,840 --> 00:10:14,120 And just so you understand how this problem 199 00:10:14,120 --> 00:10:15,980 happens, to begin with. 200 00:10:15,980 --> 00:10:17,570 What a lot of times people will do 201 00:10:17,570 --> 00:10:19,880 is they'll be entering the key string like this 202 00:10:19,880 --> 00:10:22,100 and then they'll go, well, is there 203 00:10:22,100 --> 00:10:24,120 anything that has to come after this? 204 00:10:24,120 --> 00:10:27,470 So in good Cisco command-line style, 205 00:10:27,470 --> 00:10:30,020 we hit Space question mark. 206 00:10:30,020 --> 00:10:32,960 Get our context-sensitive help and find out 207 00:10:32,960 --> 00:10:34,880 what's supposed to come next. 208 00:10:34,880 --> 00:10:36,870 And of course, it comes back and says, 209 00:10:36,870 --> 00:10:39,260 Oh, just enter a line and hit Enter. 210 00:10:39,260 --> 00:10:41,750 So they say, OK, and they hit Enter. 211 00:10:41,750 --> 00:10:45,710 The problem is notice that space is still there. 212 00:10:45,710 --> 00:10:47,960 The question mark, of course, disappears 213 00:10:47,960 --> 00:10:52,020 when you get context-sensitive help, but not the space. 214 00:10:52,020 --> 00:10:54,260 So if you're going to do that and you get the help, 215 00:10:54,260 --> 00:10:55,410 that's fine. 216 00:10:55,410 --> 00:10:59,630 Just make sure you don't put the space in after the password 217 00:10:59,630 --> 00:11:02,510 because, as you've seen here, that definitely 218 00:11:02,510 --> 00:11:05,580 counts as part of the password. 219 00:11:05,580 --> 00:11:08,090 So as soon as we put our password in, 220 00:11:08,090 --> 00:11:12,890 this neighborship should come back up with router 7. 221 00:11:12,890 --> 00:11:15,200 We'll do our show IS-IS neighbor, 222 00:11:15,200 --> 00:11:18,050 and we see that our neighborship with router 7 223 00:11:18,050 --> 00:11:20,130 has, in fact, come back up. 224 00:11:20,130 --> 00:11:24,170 Which means if we do a show IP route IS-IS, 225 00:11:24,170 --> 00:11:28,530 we actually have some IS-IS entries in our routing table. 226 00:11:28,530 --> 00:11:31,190 So this looks like it's up and working, 227 00:11:31,190 --> 00:11:34,930 and it appears that we have solved the ticket. 228 00:11:34,930 --> 00:11:38,010 So in this video, we explored a ticket 229 00:11:38,010 --> 00:11:41,220 involving IS-IS authentication. 230 00:11:41,220 --> 00:11:44,190 In this particular case, it wasn't a matter 231 00:11:44,190 --> 00:11:46,210 of the wrong type of authentication, 232 00:11:46,210 --> 00:11:48,010 which also would be an issue. 233 00:11:48,010 --> 00:11:50,610 But in this case, it was simply a password 234 00:11:50,610 --> 00:11:55,050 that was mistyped on one side of the connection. 235 00:11:55,050 --> 00:11:58,920 And again, this is actually a very, very common mistake 236 00:11:58,920 --> 00:12:02,070 because people try to get that context-sensitive help 237 00:12:02,070 --> 00:12:05,550 after their password, realize that there's nothing else 238 00:12:05,550 --> 00:12:08,280 to put there, hit Enter, and don't get rid 239 00:12:08,280 --> 00:12:12,160 of that final space, and it ends up being part of the password. 240 00:12:12,160 --> 00:12:16,660 So this is actually a fairly common thing to watch out for. 241 00:12:16,660 --> 00:12:18,810 I hope this has been informative for you, 242 00:12:18,810 --> 00:12:21,920 and I'd like to thank you for viewing. 243 00:12:21,920 --> 00:12:25,000