1
00:00:00,000 --> 00:00:00,998

2
00:00:00,998 --> 00:00:04,491
[AUDIO LOGO]

3
00:00:04,491 --> 00:00:11,480

4
00:00:11,480 --> 00:00:15,380
And now let's wrap up
with Trouble Ticket 5.

5
00:00:15,380 --> 00:00:19,760
This ticket involves R1
not being able to neighbor

6
00:00:19,760 --> 00:00:22,280
up with router 9.

7
00:00:22,280 --> 00:00:25,760
Now, this should be a
relatively easy ticket

8
00:00:25,760 --> 00:00:29,060
just from the perspective
that we've already

9
00:00:29,060 --> 00:00:31,070
looked at router 9.

10
00:00:31,070 --> 00:00:34,010
If you remember from our
previous ticket, router 9,

11
00:00:34,010 --> 00:00:37,550
we know it's configured to
use dynamic neighborship.

12
00:00:37,550 --> 00:00:39,770
It's got a listen
range listening

13
00:00:39,770 --> 00:00:41,940
to the physical interfaces.

14
00:00:41,940 --> 00:00:44,610
So let's hop into
the command line.

15
00:00:44,610 --> 00:00:47,390
We'll start on router 9 and
look at its configuration

16
00:00:47,390 --> 00:00:49,130
quickly just as a reminder.

17
00:00:49,130 --> 00:00:51,980
And then let's go look
at router 1 and see well,

18
00:00:51,980 --> 00:00:55,400
what's not configured
to be compatible.

19
00:00:55,400 --> 00:00:58,900
So as we said, here's the
configuration of router 9.

20
00:00:58,900 --> 00:01:05,019
We can see once again it's using
that listen range 50.1.0.0/16,

21
00:01:05,019 --> 00:01:07,990
Putting that range
into a peer group.

22
00:01:07,990 --> 00:01:10,810
The peer group is
configured with all

23
00:01:10,810 --> 00:01:13,030
of its necessary parameters.

24
00:01:13,030 --> 00:01:15,520
But one thing to
note here is it is

25
00:01:15,520 --> 00:01:20,090
configured to use a password,
so let's keep that in mind.

26
00:01:20,090 --> 00:01:23,680
Now, let's go over and see
what's going on router 1

27
00:01:23,680 --> 00:01:26,320
Now, we haven't actually
verified this ticket yet,

28
00:01:26,320 --> 00:01:28,730
and that is usually
our first step.

29
00:01:28,730 --> 00:01:32,150
So let's do a show
ip bgp summary.

30
00:01:32,150 --> 00:01:35,890
And as we can see here,
our connection to router 9

31
00:01:35,890 --> 00:01:37,880
is currently active.

32
00:01:37,880 --> 00:01:40,910
So not a big surprise there.

33
00:01:40,910 --> 00:01:43,820
Let's just go right ahead and
look at our configuration.

34
00:01:43,820 --> 00:01:46,810
So we'll do our
show run router bgp.

35
00:01:46,810 --> 00:01:50,860
And if we look here at the
information for router 9,

36
00:01:50,860 --> 00:01:53,960
we see that it's
configured for a key chain.

37
00:01:53,960 --> 00:01:57,460
So it's configured
to use BGP KEY.

38
00:01:57,460 --> 00:01:58,790
Very interesting.

39
00:01:58,790 --> 00:02:01,400
Let's take a look
at that key chain.

40
00:02:01,400 --> 00:02:05,170
Now, since it's encrypted,
we can't tell easily

41
00:02:05,170 --> 00:02:08,020
if this is the correct password.

42
00:02:08,020 --> 00:02:13,420
On IOS XE, there's a
command show key chain.

43
00:02:13,420 --> 00:02:16,240
And on IOS XE,
this would actually

44
00:02:16,240 --> 00:02:19,760
show you the password
in plain text.

45
00:02:19,760 --> 00:02:23,860
We can see that IOS XR doesn't
work exactly the same way.

46
00:02:23,860 --> 00:02:27,850
But here's the point in
this entire discussion.

47
00:02:27,850 --> 00:02:32,710
Notice, the cryptographic
algorithm on this key chain,

48
00:02:32,710 --> 00:02:36,730
it's set to MD5,
which, theoretically,

49
00:02:36,730 --> 00:02:38,440
should be correct.

50
00:02:38,440 --> 00:02:44,170
Router 9, which is running
IOS XE, is also using MD5.

51
00:02:44,170 --> 00:02:46,870
But if you remember,
we discussed

52
00:02:46,870 --> 00:02:53,140
this in a previous skill that
the MD5 used in a key chain

53
00:02:53,140 --> 00:02:57,820
actually uses an experimental
field in the TCP header

54
00:02:57,820 --> 00:03:04,480
where the MD5 password from IOS
XE is carried in TCP option 19,

55
00:03:04,480 --> 00:03:07,330
making these two
things incompatible.

56
00:03:07,330 --> 00:03:11,440
So just so we can see it, let's
go into Wireshark real quick

57
00:03:11,440 --> 00:03:17,660
and look at that optional field
being set here by router 1.

58
00:03:17,660 --> 00:03:21,410
So here, we have our
TCP send request going

59
00:03:21,410 --> 00:03:27,080
from 50.1.19.1 to 50.1.19.9.

60
00:03:27,080 --> 00:03:29,900
Those are, of course,
the correct addresses.

61
00:03:29,900 --> 00:03:33,650
But let's go ahead and
open up our TCP header.

62
00:03:33,650 --> 00:03:36,080
Then let's open Options.

63
00:03:36,080 --> 00:03:40,910
Notice under TCP Options, we
have the experimental field,

64
00:03:40,910 --> 00:03:46,020
but we don't have option
19 or the MD5 header.

65
00:03:46,020 --> 00:03:50,400
So again, this is using an
incompatible type of packet.

66
00:03:50,400 --> 00:03:53,120
Now, let's go back to
router 1 and change

67
00:03:53,120 --> 00:03:59,330
this to use proper MD5 from
the perspective of IOS XE.

68
00:03:59,330 --> 00:04:04,430
So let's go into configuration
mode, into router BGP.

69
00:04:04,430 --> 00:04:08,150
The neighbor is 50.1.19.9.

70
00:04:08,150 --> 00:04:12,570
We'll say no key chain because
we can't have both configured.

71
00:04:12,570 --> 00:04:14,970
And then we'll say password.

72
00:04:14,970 --> 00:04:17,660
And I'll just paste
in our password.

73
00:04:17,660 --> 00:04:21,810
We'll commit our changes
and the exit configuration.

74
00:04:21,810 --> 00:04:24,690
Let's do our show ip
bgp summary again.

75
00:04:24,690 --> 00:04:28,190
And we see that now, we
are up with a neighborship

76
00:04:28,190 --> 00:04:31,100
to 50.1.19.9.

77
00:04:31,100 --> 00:04:34,040
So clearly, this was an
authentication problem,

78
00:04:34,040 --> 00:04:37,990
and our neighborship is back up.

79
00:04:37,990 --> 00:04:41,370
So in this video, we
saw a ticket related

80
00:04:41,370 --> 00:04:45,030
to MD5 authentication with BGP.

81
00:04:45,030 --> 00:04:50,460
Keep in mind that IOS XE
will do MD5 authentication

82
00:04:50,460 --> 00:04:54,510
using the TCP option 19 header.

83
00:04:54,510 --> 00:05:00,510
On IOS XR, if you configure the
password under the neighborship

84
00:05:00,510 --> 00:05:04,380
configuration and use
the password command,

85
00:05:04,380 --> 00:05:09,600
it will use MD5
authentication and option 19.

86
00:05:09,600 --> 00:05:12,840
But if you use a key
chain, it doesn't

87
00:05:12,840 --> 00:05:16,860
matter if that key
chain is SHA-1 or MD5,

88
00:05:16,860 --> 00:05:20,580
it will still use the
TCP experimental header

89
00:05:20,580 --> 00:05:22,630
to send that information.

90
00:05:22,630 --> 00:05:25,470
So what that ultimately
means is if you

91
00:05:25,470 --> 00:05:30,270
want to use a key chain
with MD5 on IOS XR,

92
00:05:30,270 --> 00:05:34,350
it's going to have to be
to another IOS XR device.

93
00:05:34,350 --> 00:05:36,540
I hope this has been
informative for you,

94
00:05:36,540 --> 00:05:39,620
and I'd like to thank
you for viewing.

95
00:05:39,620 --> 00:05:43,000