1
00:00:00,000 --> 00:00:03,297
[AUDIO LOGO]

2
00:00:03,297 --> 00:00:07,070

3
00:00:07,070 --> 00:00:10,730
So remember that we
have a rule in OSPF

4
00:00:10,730 --> 00:00:15,110
that says all other areas
must be directly connected

5
00:00:15,110 --> 00:00:21,170
to area 0, and area 0
must be contiguous--

6
00:00:21,170 --> 00:00:23,900
meaning there can
only be one area 0

7
00:00:23,900 --> 00:00:26,270
and all the routers
in area 0 have

8
00:00:26,270 --> 00:00:27,770
to have at least
one neighbor ship

9
00:00:27,770 --> 00:00:30,620
to another router in area 0.

10
00:00:30,620 --> 00:00:36,380
Now, the reason this is done
is to prevent loops in OSPF.

11
00:00:36,380 --> 00:00:41,600
Type 3 LSAs that are passed
by the ABRs between the areas

12
00:00:41,600 --> 00:00:46,160
could potentially loop
around between multiple ABRs

13
00:00:46,160 --> 00:00:48,950
connecting one area to area 0.

14
00:00:48,950 --> 00:00:53,450
So to prevent this, we have
sort of a very simple rule--

15
00:00:53,450 --> 00:00:59,540
an ABR may not
receive a type 3 LSA

16
00:00:59,540 --> 00:01:04,950
on any interface that is
not a member of area 0.

17
00:01:04,950 --> 00:01:08,670
Because of this, if
there is a discontiguous

18
00:01:08,670 --> 00:01:13,110
area 0, or an area not
connected to area 0 at all,

19
00:01:13,110 --> 00:01:16,200
this will prevent
the OSPF updates

20
00:01:16,200 --> 00:01:18,510
from entering that area.

21
00:01:18,510 --> 00:01:22,320
Now, sometimes these
things can't be avoided.

22
00:01:22,320 --> 00:01:27,030
Now, as we jump into
this topic, keep in mind

23
00:01:27,030 --> 00:01:29,730
we're going to be talking
about virtual links.

24
00:01:29,730 --> 00:01:32,310
And virtual links
should really never

25
00:01:32,310 --> 00:01:34,860
be part of your actual design.

26
00:01:34,860 --> 00:01:38,010
We don't generally start
off in OSPF saying,

27
00:01:38,010 --> 00:01:40,470
oh, well, let's build it
like this and like this.

28
00:01:40,470 --> 00:01:43,320
And well, that means this
area doesn't touch area 0,

29
00:01:43,320 --> 00:01:45,150
so we'll just build a
virtual link for that

30
00:01:45,150 --> 00:01:47,040
and that's how we'll fix it.

31
00:01:47,040 --> 00:01:47,940
No.

32
00:01:47,940 --> 00:01:53,070
This is going to be to fix
something that happened usually

33
00:01:53,070 --> 00:01:56,850
because of an outage or maybe
a merger between two companies,

34
00:01:56,850 --> 00:02:00,930
and there's just some reason
that we have to put up with a--

35
00:02:00,930 --> 00:02:04,440
we'll say less than
optimal OSPF design

36
00:02:04,440 --> 00:02:06,210
for one reason or another.

37
00:02:06,210 --> 00:02:08,970
Now, hopefully, of
course, the long-term goal

38
00:02:08,970 --> 00:02:12,120
here is going to be to
either fix the problem

39
00:02:12,120 --> 00:02:14,310
or in the case of
something like a merger,

40
00:02:14,310 --> 00:02:16,230
maybe redesign our network.

41
00:02:16,230 --> 00:02:19,290
And within a relatively
short amount of time,

42
00:02:19,290 --> 00:02:21,630
hopefully fix this
issue so that we

43
00:02:21,630 --> 00:02:24,690
don't need to continue
using virtual links.

44
00:02:24,690 --> 00:02:26,910
But in this video,
we're going to jump

45
00:02:26,910 --> 00:02:29,850
in we're going to take a look
at virtual links, a little bit

46
00:02:29,850 --> 00:02:33,030
about their attributes,
how they have to be run,

47
00:02:33,030 --> 00:02:36,030
some of their rules and
regulations and such.

48
00:02:36,030 --> 00:02:38,820
And then in our
next video, we'll

49
00:02:38,820 --> 00:02:41,190
jump into the command
line, set some of these

50
00:02:41,190 --> 00:02:42,870
up, and see how they work.

51
00:02:42,870 --> 00:02:45,330
So let's jump in and
start talking about some

52
00:02:45,330 --> 00:02:49,810
of the rules and attributes
of our virtual links.

53
00:02:49,810 --> 00:02:52,390
So as we said during
our introduction there,

54
00:02:52,390 --> 00:02:55,150
virtual links are used
to correct some rather

55
00:02:55,150 --> 00:02:59,800
specific area issues,
specifically areas that

56
00:02:59,800 --> 00:03:02,560
are not connected to area 0.

57
00:03:02,560 --> 00:03:04,960
Again, remember that is
one of our requirements.

58
00:03:04,960 --> 00:03:10,425
And if needed, to repair
a discontinuous area 0.

59
00:03:10,425 --> 00:03:12,550
So these are the two things
that we're really going

60
00:03:12,550 --> 00:03:14,200
to use our virtual links for.

61
00:03:14,200 --> 00:03:17,140
The primary issues with
this are, of course,

62
00:03:17,140 --> 00:03:20,110
if there is no
area 0 on a router,

63
00:03:20,110 --> 00:03:24,820
the router will not consider
itself to even be an ABR.

64
00:03:24,820 --> 00:03:27,730
And if the router is not
an ABR, it's sure as heck

65
00:03:27,730 --> 00:03:30,580
not going to
generate type 3 LSAs.

66
00:03:30,580 --> 00:03:34,840
Even if there is an
area 0, the router

67
00:03:34,840 --> 00:03:37,300
will consider itself an ABR.

68
00:03:37,300 --> 00:03:41,590
However, as we mentioned,
OSPF loop prevention

69
00:03:41,590 --> 00:03:43,060
is going to kick in.

70
00:03:43,060 --> 00:03:49,000
And again, the effect is that
these type 3 LSAs are not

71
00:03:49,000 --> 00:03:54,340
going to be allowed to show up
on any interface that is not

72
00:03:54,340 --> 00:03:55,780
in area 0.

73
00:03:55,780 --> 00:03:58,660
Now, we'll still learn
it in the database

74
00:03:58,660 --> 00:04:00,970
because the fundamental
rule of OSPF

75
00:04:00,970 --> 00:04:03,280
is that all routers
in an area have

76
00:04:03,280 --> 00:04:07,210
to share the same
database, but we will not

77
00:04:07,210 --> 00:04:09,760
set the routing bit.

78
00:04:09,760 --> 00:04:12,190
This means that we
will not be using it.

79
00:04:12,190 --> 00:04:14,290
So yes, it will be
in the database,

80
00:04:14,290 --> 00:04:17,230
but we will not be allowed
to actually use it.

81
00:04:17,230 --> 00:04:20,440
In other words, putting it into
our routing table, of course.

82
00:04:20,440 --> 00:04:22,360
Now, just some other
attributes and rules

83
00:04:22,360 --> 00:04:25,930
with OSPF virtual links is
that this is really just

84
00:04:25,930 --> 00:04:31,750
to correct and fix, hopefully,
temporary situations.

85
00:04:31,750 --> 00:04:34,990
Again, maybe because
of outages, maybe

86
00:04:34,990 --> 00:04:37,180
because of a merger
with another company,

87
00:04:37,180 --> 00:04:41,710
but these really should not
be built into our OSPF design.

88
00:04:41,710 --> 00:04:47,050
Also keep in mind that virtual
links are just a control plane

89
00:04:47,050 --> 00:04:47,950
tunnel.

90
00:04:47,950 --> 00:04:50,290
They are not a
data plane tunnel.

91
00:04:50,290 --> 00:04:54,970
This can actually lead to loops
in some rather poor designs

92
00:04:54,970 --> 00:04:57,400
if you don't understand this.

93
00:04:57,400 --> 00:05:00,160
The routers in
the middle are not

94
00:05:00,160 --> 00:05:04,150
going to be aware of the virtual
link and the traffic itself

95
00:05:04,150 --> 00:05:05,410
is not tunneled.

96
00:05:05,410 --> 00:05:09,730
As a quick example, imagine that
we simply had four routers--

97
00:05:09,730 --> 00:05:11,650
two of these are ABRs.

98
00:05:11,650 --> 00:05:13,090
We'll simply connect
them together

99
00:05:13,090 --> 00:05:15,557
like this and these
two ABRs connect out

100
00:05:15,557 --> 00:05:17,890
to the rest of the network
where maybe there's a network

101
00:05:17,890 --> 00:05:19,842
X that we're trying to get to.

102
00:05:19,842 --> 00:05:22,300
We're not going to get into
all the details of why we would

103
00:05:22,300 --> 00:05:24,610
need a virtual link
here, but again,

104
00:05:24,610 --> 00:05:26,710
for the sake of
argument, let's say

105
00:05:26,710 --> 00:05:29,620
that we build a virtual
link and we build it

106
00:05:29,620 --> 00:05:32,560
from this router to this router.

107
00:05:32,560 --> 00:05:34,390
Again, the reason
could be maybe this

108
00:05:34,390 --> 00:05:37,510
is area 0 over here
on the left and maybe

109
00:05:37,510 --> 00:05:41,410
this router up here is connected
to some other area 0 as well.

110
00:05:41,410 --> 00:05:43,780
So we're trying to
join our area 0.

111
00:05:43,780 --> 00:05:46,600
Here's where the problem
could potentially come in.

112
00:05:46,600 --> 00:05:51,430
What if this link down
here had a cost of 100

113
00:05:51,430 --> 00:05:54,940
where all the other
links have a cost of 1?

114
00:05:54,940 --> 00:05:58,150
What could potentially
happen is traffic

115
00:05:58,150 --> 00:06:00,730
coming in from area
0 on this router

116
00:06:00,730 --> 00:06:04,870
would figuratively speaking
go through the virtual link.

117
00:06:04,870 --> 00:06:09,520
But again, the virtual link is
only a control plane tunnel.

118
00:06:09,520 --> 00:06:11,650
This is where the
problem comes in.

119
00:06:11,650 --> 00:06:14,410
From a physical
perspective, it's

120
00:06:14,410 --> 00:06:17,650
going to try to forward the
traffic towards this ABR.

121
00:06:17,650 --> 00:06:19,870
And from this top
router's perspective,

122
00:06:19,870 --> 00:06:22,660
that best path would
be to go down this way.

123
00:06:22,660 --> 00:06:24,910
And right here is where
the problem comes in.

124
00:06:24,910 --> 00:06:27,760
When the traffic hits this
router on the bottom right,

125
00:06:27,760 --> 00:06:30,610
all it's looking at
is the destination.

126
00:06:30,610 --> 00:06:33,760
It's looking at how to get
to network X over here,

127
00:06:33,760 --> 00:06:38,890
and it sees a cost of 100 to
go to the left and only a cost

128
00:06:38,890 --> 00:06:41,440
of 2 to go across the top.

129
00:06:41,440 --> 00:06:42,940
So what does it do?

130
00:06:42,940 --> 00:06:46,360
It sends the traffic
right back up this way--

131
00:06:46,360 --> 00:06:49,810
and just like that, you
have a routing loop.

132
00:06:49,810 --> 00:06:52,210
Now, there are, of
course, numerous ways

133
00:06:52,210 --> 00:06:53,710
to fix this problem.

134
00:06:53,710 --> 00:06:57,430
First, I could build a
virtual link to both ABRs

135
00:06:57,430 --> 00:06:59,980
and then it wouldn't
necessarily be a problem.

136
00:06:59,980 --> 00:07:03,940
I can adjust these costs so that
the router on the bottom right

137
00:07:03,940 --> 00:07:07,180
there agrees on which
way to send the traffic.

138
00:07:07,180 --> 00:07:09,760
There's a couple of
ways we could fix this.

139
00:07:09,760 --> 00:07:12,610
But the point is
since this is only

140
00:07:12,610 --> 00:07:15,460
a control plane tunnel,
not a data plane

141
00:07:15,460 --> 00:07:18,760
tunnel, just be aware that in--

142
00:07:18,760 --> 00:07:21,070
we'll call them
really bad designs--

143
00:07:21,070 --> 00:07:24,010
this could, in fact,
potentially create a loop.

144
00:07:24,010 --> 00:07:26,560
So this is something we
want to watch out for.

145
00:07:26,560 --> 00:07:28,840
Next, just as a
general rule here,

146
00:07:28,840 --> 00:07:33,340
a virtual link can only
traverse a normal area.

147
00:07:33,340 --> 00:07:38,230
In other words, it cannot
go across a stub or an NSSA,

148
00:07:38,230 --> 00:07:40,420
it has to be a normal area.

149
00:07:40,420 --> 00:07:44,380
Also keep in mind that the
virtual link just by its nature

150
00:07:44,380 --> 00:07:47,080
is always a member of area 0.

151
00:07:47,080 --> 00:07:49,090
What we were doing
with our virtual link

152
00:07:49,090 --> 00:07:53,110
here in our diagram is we were
simply connecting this area

153
00:07:53,110 --> 00:07:59,560
0 with this area 0 because this
virtual link is also, again,

154
00:07:59,560 --> 00:08:05,200
by nature in area 0 therefore
we made a contiguous area 0.

155
00:08:05,200 --> 00:08:08,170
Another rule here is that
a virtual link can only

156
00:08:08,170 --> 00:08:13,000
traverse one area at a time, but
they can be changed together.

157
00:08:13,000 --> 00:08:15,220
That simply means
that if we say,

158
00:08:15,220 --> 00:08:19,480
for example, had a router here,
a router here, a router here,

159
00:08:19,480 --> 00:08:22,330
and we say, for example,
they're just linked together.

160
00:08:22,330 --> 00:08:27,550
Over here we have area 0, maybe
between these, we have area 51.

161
00:08:27,550 --> 00:08:29,710
Over here is area 37.

162
00:08:29,710 --> 00:08:32,169
And then over here,
we have area 0 again.

163
00:08:32,169 --> 00:08:35,620
Again, the virtual link can
only be built between the ABRs

164
00:08:35,620 --> 00:08:37,030
in one area.

165
00:08:37,030 --> 00:08:39,549
However, I could
build one virtual link

166
00:08:39,549 --> 00:08:42,220
through area 51
like this, and then

167
00:08:42,220 --> 00:08:46,180
simply build another
virtual link through area 37

168
00:08:46,180 --> 00:08:50,740
and therefore, once again join
area 0 because, again, these

169
00:08:50,740 --> 00:08:53,620
are members, of
course, of area 0.

170
00:08:53,620 --> 00:08:56,500
Again, this would be an
absolutely horrible design,

171
00:08:56,500 --> 00:08:58,180
but it could be done.

172
00:08:58,180 --> 00:09:00,490
Just a couple other
things to keep in mind.

173
00:09:00,490 --> 00:09:04,420
If area 0 is authenticated
like we talked about

174
00:09:04,420 --> 00:09:08,500
in our last video, we
also have to put a key

175
00:09:08,500 --> 00:09:10,000
on the virtual link.

176
00:09:10,000 --> 00:09:12,550
Now, there is some default
behavior what happens here.

177
00:09:12,550 --> 00:09:15,910
We'll talk about that as we
go through configuration.

178
00:09:15,910 --> 00:09:18,670
So it does depend a
little bit on the IOS

179
00:09:18,670 --> 00:09:21,700
what actually happens here,
so that will take a little bit

180
00:09:21,700 --> 00:09:22,780
more discussion.

181
00:09:22,780 --> 00:09:25,870
But just as a
general rule, don't

182
00:09:25,870 --> 00:09:28,600
forget to authenticate the
virtual link because it

183
00:09:28,600 --> 00:09:30,670
is a member of area 0.

184
00:09:30,670 --> 00:09:34,090
Virtual links are run
as demand circuits.

185
00:09:34,090 --> 00:09:38,080
What that simply means is that
the hellos are suppressed.

186
00:09:38,080 --> 00:09:41,050
There's no need to send
hellos over the virtual link.

187
00:09:41,050 --> 00:09:44,440
It simply relies on
the underlying hellos

188
00:09:44,440 --> 00:09:46,600
to ensure that all of
the neighbors are up.

189
00:09:46,600 --> 00:09:49,300
Also as part of being
a demand circuit,

190
00:09:49,300 --> 00:09:54,640
we also use Do Not Age,
or DNA, on all of the LSAs

191
00:09:54,640 --> 00:09:55,930
in the database.

192
00:09:55,930 --> 00:09:58,660
This means they will
not age out the same way

193
00:09:58,660 --> 00:10:01,930
that they do with normal LSAs.

194
00:10:01,930 --> 00:10:04,030
This can actually
become an issue

195
00:10:04,030 --> 00:10:06,700
with clearing up
the database if you

196
00:10:06,700 --> 00:10:08,710
have to get rid of the
virtual link later.

197
00:10:08,710 --> 00:10:12,820
So again, you put it in as a
temporary repair hopefully,

198
00:10:12,820 --> 00:10:15,040
and then later, you're
going to get rid of it.

199
00:10:15,040 --> 00:10:18,190
These LSAs will just
stay in the database

200
00:10:18,190 --> 00:10:21,970
potentially until you reset
all of your OSPF routers,

201
00:10:21,970 --> 00:10:24,190
or at least all the
routers in that area.

202
00:10:24,190 --> 00:10:26,800
Now, they will go to unused.

203
00:10:26,800 --> 00:10:29,260
So is this really
a massive problem?

204
00:10:29,260 --> 00:10:30,190
No.

205
00:10:30,190 --> 00:10:32,860
But they'll also never age out.

206
00:10:32,860 --> 00:10:34,930
So this is something
to keep in mind.

207
00:10:34,930 --> 00:10:36,910
You may see these
entries and wonder why

208
00:10:36,910 --> 00:10:38,320
they're still in your database.

209
00:10:38,320 --> 00:10:40,750
Even after you get rid
of the virtual link,

210
00:10:40,750 --> 00:10:41,770
they'll stay there.

211
00:10:41,770 --> 00:10:44,740
So at some point, maybe
during a maintenance window,

212
00:10:44,740 --> 00:10:46,660
you might want to reload
some of these routers

213
00:10:46,660 --> 00:10:49,540
or at least clear the
OSPF processes to clear

214
00:10:49,540 --> 00:10:51,250
these out of the database.

215
00:10:51,250 --> 00:10:54,130
Also keep in mind just when
it comes to configuration

216
00:10:54,130 --> 00:10:59,920
that these are configured or
built between OSPF router IDs.

217
00:10:59,920 --> 00:11:04,690
We do not use IP addresses when
we're building virtual links.

218
00:11:04,690 --> 00:11:07,060
They're formatted
like IP addresses

219
00:11:07,060 --> 00:11:12,540
just because router IDs are, in
fact, 32 bits, but they're not.

220
00:11:12,540 --> 00:11:17,940
One final thing to keep
in mind is in RFC 3509,

221
00:11:17,940 --> 00:11:22,080
there's reference to something
called an inactive area 0.

222
00:11:22,080 --> 00:11:25,740
This is essentially a
router that has an area 0,

223
00:11:25,740 --> 00:11:30,270
but has zero
neighbors in area 0.

224
00:11:30,270 --> 00:11:33,270
It sort of makes it
like a pseudo ABR.

225
00:11:33,270 --> 00:11:38,010
It's not really an ABR because
it has no neighbors in area 0,

226
00:11:38,010 --> 00:11:41,730
but on the other hand, it does
have interfaces in area 0.

227
00:11:41,730 --> 00:11:47,760
So it's sort of a pseudo ABR and
because it cannot create a loop

228
00:11:47,760 --> 00:11:52,290
without that link or
neighbor ship in area 0,

229
00:11:52,290 --> 00:11:57,840
we actually break the loop
prevention rule and it allows

230
00:11:57,840 --> 00:12:04,140
those type 3 LSAs to arrive
on that non-area 0 interface.

231
00:12:04,140 --> 00:12:06,930
Remember that that rule
is for loop prevention

232
00:12:06,930 --> 00:12:09,270
and we don't need
that if there's

233
00:12:09,270 --> 00:12:12,860
zero possibility of a loop.

234
00:12:12,860 --> 00:12:17,000
So in this video, we got an
introduction to virtual links.

235
00:12:17,000 --> 00:12:19,370
We took a look at some
of their attributes,

236
00:12:19,370 --> 00:12:21,980
when we should or
shouldn't use them,

237
00:12:21,980 --> 00:12:25,400
which not using them should
really be most of the time.

238
00:12:25,400 --> 00:12:28,610
We shouldn't design our
networks to use virtual links.

239
00:12:28,610 --> 00:12:30,290
These are something
that are used

240
00:12:30,290 --> 00:12:33,320
to fix a problem
that comes up later,

241
00:12:33,320 --> 00:12:36,560
again, usually due to
some sort of a failure

242
00:12:36,560 --> 00:12:39,440
or possibly a merger
between companies.

243
00:12:39,440 --> 00:12:42,650
Either way, these should
be used temporarily

244
00:12:42,650 --> 00:12:45,650
until we can find a more
permanent and better solution

245
00:12:45,650 --> 00:12:46,730
to the problem.

246
00:12:46,730 --> 00:12:48,860
I hope this has been
informative for you.

247
00:12:48,860 --> 00:12:51,850
And I'd like to thank
you for viewing.

248
00:12:51,850 --> 00:12:55,000