1
00:00:00,000 --> 00:00:03,808
[AUDIO LOGO]

2
00:00:03,808 --> 00:00:07,150

3
00:00:07,150 --> 00:00:10,300
So now that we've gotten a good
introduction to virtual links,

4
00:00:10,300 --> 00:00:12,520
now let's jump onto
the command line

5
00:00:12,520 --> 00:00:16,690
and actually implement just
a couple to see how they work

6
00:00:16,690 --> 00:00:18,550
and to see some of
the nuances of how

7
00:00:18,550 --> 00:00:22,340
they work with authentication
on our different platforms.

8
00:00:22,340 --> 00:00:24,340
So let's start by
looking at our topology,

9
00:00:24,340 --> 00:00:26,830
plan out where we're going
to need our virtual links,

10
00:00:26,830 --> 00:00:30,620
and then jump into the
command line and build them.

11
00:00:30,620 --> 00:00:34,120
So once again, we are
on OSPF Topology 3

12
00:00:34,120 --> 00:00:35,620
so you can follow along.

13
00:00:35,620 --> 00:00:37,810
And let's take a
look at the places

14
00:00:37,810 --> 00:00:40,280
where we're going to have
to deal with some issues.

15
00:00:40,280 --> 00:00:43,070
So first and foremost,
we, of course,

16
00:00:43,070 --> 00:00:46,090
have an area 0 up
here on router 10

17
00:00:46,090 --> 00:00:51,010
as well as I guess what we'll
call our main area 0 down here

18
00:00:51,010 --> 00:00:52,670
on the bottom left.

19
00:00:52,670 --> 00:00:56,890
So clearly, we're going to need
a virtual link between router

20
00:00:56,890 --> 00:01:02,000
10 and router 6 in order to
join these two areas together.

21
00:01:02,000 --> 00:01:04,120
So we'll definitely be
building a virtual link

22
00:01:04,120 --> 00:01:06,040
between R6 and R10.

23
00:01:06,040 --> 00:01:09,440
Then we have another area
0 over here on the right.

24
00:01:09,440 --> 00:01:13,000
This is going to require a
virtual link between router

25
00:01:13,000 --> 00:01:16,360
3 and router 4, going
through area 100,

26
00:01:16,360 --> 00:01:18,980
so we'll have to build a
virtual link here as well.

27
00:01:18,980 --> 00:01:21,490
And, finally, we
have an area of 1000

28
00:01:21,490 --> 00:01:25,420
up here, which doesn't
join area 0 at all.

29
00:01:25,420 --> 00:01:30,310
Router 2 is only connected
to area 1000 and area 100.

30
00:01:30,310 --> 00:01:34,630
Therefore, again, we're going to
need a virtual link between R2

31
00:01:34,630 --> 00:01:36,070
and R1.

32
00:01:36,070 --> 00:01:37,960
So this is what we're
going to have to build.

33
00:01:37,960 --> 00:01:42,490
Let's go ahead and start up
here in area 200 building

34
00:01:42,490 --> 00:01:46,810
that virtual link
between R6 and R10.

35
00:01:46,810 --> 00:01:50,740
So let's begin here on
router 6 there is a loopback

36
00:01:50,740 --> 00:01:54,220
interface, loopback
100 on router 10,

37
00:01:54,220 --> 00:01:58,060
that we should really be
seeing here on router 6.

38
00:01:58,060 --> 00:02:02,620
However, if we do a
show ip route ospf,

39
00:02:02,620 --> 00:02:05,890
we actually don't have that
route in our routing table.

40
00:02:05,890 --> 00:02:11,600
It's supposed to
be a 100.1.1.0/24.

41
00:02:11,600 --> 00:02:14,500
However, if we look
in our database

42
00:02:14,500 --> 00:02:18,790
specifically for that
100.1.1.0, what we see

43
00:02:18,790 --> 00:02:21,040
is that we actually
have the entry.

44
00:02:21,040 --> 00:02:24,070
In fact, by all
arguments, it actually

45
00:02:24,070 --> 00:02:25,820
looks like a normal entry.

46
00:02:25,820 --> 00:02:29,140
However, if we look at
the internal information

47
00:02:29,140 --> 00:02:34,220
on this, what we see is that
it's missing the routing bit.

48
00:02:34,220 --> 00:02:37,180
Now in older code,
Cisco actually

49
00:02:37,180 --> 00:02:38,770
called this the routing bit.

50
00:02:38,770 --> 00:02:41,620
In newer code, it's
going to refer to this

51
00:02:41,620 --> 00:02:44,510
as the route reference count.

52
00:02:44,510 --> 00:02:47,740
Now we can see this if we
look at another network that

53
00:02:47,740 --> 00:02:49,100
is actually valid.

54
00:02:49,100 --> 00:02:52,870
So, for example, let's
look at 10.2.2.2.

55
00:02:52,870 --> 00:02:55,120
This would be a valid entry.

56
00:02:55,120 --> 00:02:57,220
And notice this line
right here where

57
00:02:57,220 --> 00:03:00,280
it says that it's
in the topology base

58
00:03:00,280 --> 00:03:03,610
with the multitopology
identifier of 0,

59
00:03:03,610 --> 00:03:10,000
meaning the main OSPF table with
a route reference count of 1.

60
00:03:10,000 --> 00:03:13,450
This is the equivalent
of the routing bit,

61
00:03:13,450 --> 00:03:17,080
meaning this route is being
entered into the routing table.

62
00:03:17,080 --> 00:03:22,190
Our entry doesn't look like that
because we need a virtual link.

63
00:03:22,190 --> 00:03:23,620
So let's go ahead and build it.

64
00:03:23,620 --> 00:03:26,660
So we simply go into
configuration mode.

65
00:03:26,660 --> 00:03:29,840
We're going to router ospf 1.

66
00:03:29,840 --> 00:03:34,800
We'll say area 200 virtual-link,
and this would be going

67
00:03:34,800 --> 00:03:40,060
to 10.10.10.10, which is
router 10's router ID.

68
00:03:40,060 --> 00:03:42,630
Notice that, right
away, it's telling us

69
00:03:42,630 --> 00:03:44,940
that it does not have
a valid authentication

70
00:03:44,940 --> 00:03:48,910
key for the virtual link.

71
00:03:48,910 --> 00:03:53,050
This is because it knows that
OSPF authentication is enabled

72
00:03:53,050 --> 00:03:55,840
for area 0, but we
don't have a key

73
00:03:55,840 --> 00:03:58,210
to use on this
virtual link which

74
00:03:58,210 --> 00:04:00,610
is, of course, part of area 0.

75
00:04:00,610 --> 00:04:05,080
But before we fix this, let's go
configure router 10 first just

76
00:04:05,080 --> 00:04:06,940
to see what happens.

77
00:04:06,940 --> 00:04:09,400
Now up here, on router 10,
we have a slightly different

78
00:04:09,400 --> 00:04:10,870
situation going on.

79
00:04:10,870 --> 00:04:13,665
Here, it's yelling that it's
receiving an invalid packet.

80
00:04:13,665 --> 00:04:15,770
And the whole reason
for this, of course,

81
00:04:15,770 --> 00:04:18,190
is we've only configured one
side of the virtual link.

82
00:04:18,190 --> 00:04:22,060
It's sending area
0 hellos to us,

83
00:04:22,060 --> 00:04:26,020
and we're very confused
because that interface is not

84
00:04:26,020 --> 00:04:27,250
in area 0.

85
00:04:27,250 --> 00:04:30,110
So once we finish the virtual
link, this will be fine.

86
00:04:30,110 --> 00:04:33,610
So let's go into configuration
mode, router ospf

87
00:04:33,610 --> 00:04:39,280
1, area 200 virtual-link
to 10.6.6.6.

88
00:04:39,280 --> 00:04:41,020
Notice that, once
again, it yells at us

89
00:04:41,020 --> 00:04:42,790
that there's no
valid authentication

90
00:04:42,790 --> 00:04:45,790
key for that interface
virtual link.

91
00:04:45,790 --> 00:04:49,660
Well, interestingly
enough, notice down here,

92
00:04:49,660 --> 00:04:52,330
it says that virtual link,
in fact, just came up.

93
00:04:52,330 --> 00:04:54,160
It just went from
loading to full.

94
00:04:54,160 --> 00:04:56,350
So that's an interesting
contradiction.

95
00:04:56,350 --> 00:04:59,650
Let's find out if it's
actually working or not.

96
00:04:59,650 --> 00:05:02,620
Let's go back over to router
6 and do our check again.

97
00:05:02,620 --> 00:05:07,400
By our check, I simply mean
looking at the routing table.

98
00:05:07,400 --> 00:05:12,320
Notice that here is the
100.1.1.0/24 in the routing

99
00:05:12,320 --> 00:05:13,260
table.

100
00:05:13,260 --> 00:05:17,180
So it actually is
up and working.

101
00:05:17,180 --> 00:05:19,700
If we do a show ip
ospf virtual-link,

102
00:05:19,700 --> 00:05:24,350
notice this incredibly dangerous
message here at the bottom--

103
00:05:24,350 --> 00:05:27,170
cryptographic
authentication is enabled.

104
00:05:27,170 --> 00:05:33,730
No key configured,
using default key id 0.

105
00:05:33,730 --> 00:05:37,540
I don't know about you, but this
doesn't seem like the best idea

106
00:05:37,540 --> 00:05:38,680
to me.

107
00:05:38,680 --> 00:05:44,350
We have forced both sides to
use area 0 authentication.

108
00:05:44,350 --> 00:05:48,110
The virtual link doesn't
have a key set on it

109
00:05:48,110 --> 00:05:52,480
so it just exchanges
the default key 0.

110
00:05:52,480 --> 00:05:57,460
Now rumor has it that
default key 0 is actually

111
00:05:57,460 --> 00:05:59,350
a key string of Cisco.

112
00:05:59,350 --> 00:06:02,470
I've never cared enough to do
any sort of packet capturing

113
00:06:02,470 --> 00:06:04,330
to try to figure
that out or anything.

114
00:06:04,330 --> 00:06:08,920
It doesn't really matter
what the key is for key 0--

115
00:06:08,920 --> 00:06:10,610
what the key string is.

116
00:06:10,610 --> 00:06:13,450
Fact of the matter is
it's not the password

117
00:06:13,450 --> 00:06:17,230
that we want to be using,
so this should never

118
00:06:17,230 --> 00:06:18,940
be left this way.

119
00:06:18,940 --> 00:06:21,790
It's just interesting that
it will go ahead and use

120
00:06:21,790 --> 00:06:26,050
this default key 0 and actually
bring the virtual link up,

121
00:06:26,050 --> 00:06:28,570
and it's fully functional.

122
00:06:28,570 --> 00:06:31,370
Now, of course, we're not
going to leave it like this.

123
00:06:31,370 --> 00:06:34,400
We're going to go put the key
on it like it's supposed to be.

124
00:06:34,400 --> 00:06:37,520
So let's do that.

125
00:06:37,520 --> 00:06:40,510
All we have to do is go
back into configuration.

126
00:06:40,510 --> 00:06:44,370
We'll go back up to our
virtual-link command,

127
00:06:44,370 --> 00:06:47,010
add authentication
message-digest,

128
00:06:47,010 --> 00:06:53,650
and then message-digest-key
1 md5 Cisco_PASS.

129
00:06:53,650 --> 00:06:55,720
We simply put it on
one big long line,

130
00:06:55,720 --> 00:07:00,550
and we go do the same
thing on router 10.

131
00:07:00,550 --> 00:07:02,990
Once this is configured
on both sides,

132
00:07:02,990 --> 00:07:04,690
if we look at the
virtual link again,

133
00:07:04,690 --> 00:07:08,530
now not only is the
cryptographic authentication

134
00:07:08,530 --> 00:07:12,130
enabled, but now it's
actually using the youngest

135
00:07:12,130 --> 00:07:14,290
key, which is key ID 1.

136
00:07:14,290 --> 00:07:16,480
This is how it
should be configured.

137
00:07:16,480 --> 00:07:20,290
Let's go see what happens if we
do pretty much the same thing

138
00:07:20,290 --> 00:07:22,660
between routers 3 and 4.

139
00:07:22,660 --> 00:07:25,580
Let's start on router 3.

140
00:07:25,580 --> 00:07:30,730
So let's go into configuration
mode for router OSPF 1.

141
00:07:30,730 --> 00:07:33,470
This is going to
be for area 100.

142
00:07:33,470 --> 00:07:35,150
And we'll set up a
virtual link again.

143
00:07:35,150 --> 00:07:39,620
This is going to go to 10.4.4.4,
which is router 4's router ID.

144
00:07:39,620 --> 00:07:41,010
Commit the changes.

145
00:07:41,010 --> 00:07:42,920
And we'll do the same
thing on router 4.

146
00:07:42,920 --> 00:07:44,930
Once again, router
4 is complaining

147
00:07:44,930 --> 00:07:48,770
about getting those OSPF
hellos with an area 0 in them,

148
00:07:48,770 --> 00:07:53,230
but it'll be fine once we
go ahead and configure this.

149
00:07:53,230 --> 00:07:58,360
Here, we see the virtual link
did, in fact, just come up.

150
00:07:58,360 --> 00:08:00,720
So let's do a show
ip ospf virtual-link,

151
00:08:00,720 --> 00:08:06,060
but notice that on IOS XR,
it brought the link up.

152
00:08:06,060 --> 00:08:07,440
It's working.

153
00:08:07,440 --> 00:08:09,270
In fact, again, if we
want to prove this,

154
00:08:09,270 --> 00:08:12,330
we could go over to, say,
a router away from this

155
00:08:12,330 --> 00:08:15,300
environment-- let's
just say router 7--

156
00:08:15,300 --> 00:08:19,470
do a show ip route ospf,
and let's look specifically

157
00:08:19,470 --> 00:08:21,570
for router 5's loopback.

158
00:08:21,570 --> 00:08:24,360
We see right here that we have
router 5's loopback, which

159
00:08:24,360 --> 00:08:27,030
would have been in a
discontiguous area 0.

160
00:08:27,030 --> 00:08:29,250
So the fact that this
is here indicates

161
00:08:29,250 --> 00:08:31,020
that our virtual
link is working,

162
00:08:31,020 --> 00:08:32,830
but there's no authentication.

163
00:08:32,830 --> 00:08:34,620
Let's go back over
to router 4 again.

164
00:08:34,620 --> 00:08:37,169
Notice there is
no authentication

165
00:08:37,169 --> 00:08:38,860
on this virtual link at all.

166
00:08:38,860 --> 00:08:41,909
So on IOS XR, it
actually brought it up

167
00:08:41,909 --> 00:08:43,890
without authentication.

168
00:08:43,890 --> 00:08:45,760
That's, of course,
not what we want,

169
00:08:45,760 --> 00:08:50,230
so let's configure the
authentication here.

170
00:08:50,230 --> 00:08:52,770
So, basically, we go
back into the area,

171
00:08:52,770 --> 00:08:54,060
back into the virtual link.

172
00:08:54,060 --> 00:08:57,350

173
00:08:57,350 --> 00:08:59,660
Here's where we configure
the authentication.

174
00:08:59,660 --> 00:09:01,970
First thing we do is
turn on message-digest,

175
00:09:01,970 --> 00:09:04,690
and then we set up the key.

176
00:09:04,690 --> 00:09:07,900
Commit the changes, and we have
to do the same thing on router

177
00:09:07,900 --> 00:09:08,590
3, of course.

178
00:09:08,590 --> 00:09:11,788

179
00:09:11,788 --> 00:09:15,470
If we look at our virtual
link again, notice now,

180
00:09:15,470 --> 00:09:18,110
message digest
authentication is enabled,

181
00:09:18,110 --> 00:09:20,495
and it's using the
youngest key ID of it.

182
00:09:20,495 --> 00:09:23,480
It also says it's in the
process of a rollover

183
00:09:23,480 --> 00:09:25,727
because one neighbor
is using the old key

184
00:09:25,727 --> 00:09:26,810
but there is no other key.

185
00:09:26,810 --> 00:09:28,730
We just configured one,
so it's not actually

186
00:09:28,730 --> 00:09:29,840
going to do a rollover.

187
00:09:29,840 --> 00:09:32,960
So just to wrap up, we
need one more virtual link

188
00:09:32,960 --> 00:09:35,240
between R1 and R2.

189
00:09:35,240 --> 00:09:37,670
However, this is going
to be exactly the same

190
00:09:37,670 --> 00:09:39,630
as the other virtual
links we built.

191
00:09:39,630 --> 00:09:43,080
So we'll just go ahead and copy
and paste that configuration.

192
00:09:43,080 --> 00:09:46,670
So on router 1, we'll paste in
the configuration for the link

193
00:09:46,670 --> 00:09:47,810
to router 2.

194
00:09:47,810 --> 00:09:50,960
Of course, we're including
the authentication here.

195
00:09:50,960 --> 00:09:52,980
On router 2, we
will do the same.

196
00:09:52,980 --> 00:09:55,910
We see that the virtual link
went from loading to full.

197
00:09:55,910 --> 00:09:59,300
We can verify with a
show ip ospf virtual.

198
00:09:59,300 --> 00:10:00,980
We see that it is, in fact, up.

199
00:10:00,980 --> 00:10:02,810
We also see some of
those other things

200
00:10:02,810 --> 00:10:06,320
that we talked about during
our virtual link overview.

201
00:10:06,320 --> 00:10:08,750
We see that it's being
run as a demand circuit,

202
00:10:08,750 --> 00:10:11,900
that DoNotAge is allowed,
and we see down here,

203
00:10:11,900 --> 00:10:15,260
under the Adjacency State,
that the hellos are suppressed.

204
00:10:15,260 --> 00:10:19,070
And as one final check,
let's jump over to router 7.

205
00:10:19,070 --> 00:10:21,270
Let's do a show ip route here.

206
00:10:21,270 --> 00:10:25,430
And what we should see
is all of the loopbacks

207
00:10:25,430 --> 00:10:27,180
from all of the routers.

208
00:10:27,180 --> 00:10:31,460
So here we see router
1, 2, 3, 4, 5, 6--

209
00:10:31,460 --> 00:10:33,087
of course, we're on router 7--

210
00:10:33,087 --> 00:10:36,470
8, 9, and 10.

211
00:10:36,470 --> 00:10:42,650
We also see that 100.1.1.0/24
coming from the area 0 up

212
00:10:42,650 --> 00:10:43,980
on router 10.

213
00:10:43,980 --> 00:10:46,280
So this indicates that
all of our virtual links

214
00:10:46,280 --> 00:10:50,150
are up and running,
working, and now we

215
00:10:50,150 --> 00:10:54,310
know they're also
properly authenticated.

216
00:10:54,310 --> 00:10:56,920
So in this video,
we jumped in and we

217
00:10:56,920 --> 00:11:03,010
saw how to configure virtual
links in a, well, very bad OSPF

218
00:11:03,010 --> 00:11:03,850
design.

219
00:11:03,850 --> 00:11:05,740
We just have 10
routers here, and we

220
00:11:05,740 --> 00:11:07,550
needed three virtual links.

221
00:11:07,550 --> 00:11:10,150
So this is definitely
not an example

222
00:11:10,150 --> 00:11:14,290
of how we should be building
our OSPF environments.

223
00:11:14,290 --> 00:11:17,050
Please understand
this was just done

224
00:11:17,050 --> 00:11:21,710
so we could have a good place to
demonstrate our virtual links.

225
00:11:21,710 --> 00:11:23,740
I hope this has been
informative for you,

226
00:11:23,740 --> 00:11:26,730
and I'd like to thank
you for viewing.

227
00:11:26,730 --> 00:11:30,000