1
00:00:00,000 --> 00:00:03,856
[AUDIO LOGO]

2
00:00:03,856 --> 00:00:07,230

3
00:00:07,230 --> 00:00:11,190
And finally, let's talk
about our last two topics--

4
00:00:11,190 --> 00:00:16,710
OSPF version 3 authentication
and virtual links.

5
00:00:16,710 --> 00:00:21,030
So once again, this is going to
be very, very similar to what

6
00:00:21,030 --> 00:00:23,520
we saw in OSPF version 2.

7
00:00:23,520 --> 00:00:27,720
In fact, the virtual links
are pretty much identical.

8
00:00:27,720 --> 00:00:30,780
The authentication is going to
be just a little bit different,

9
00:00:30,780 --> 00:00:33,090
because it uses IPsec.

10
00:00:33,090 --> 00:00:35,880
But beyond that, it's
going to be pretty

11
00:00:35,880 --> 00:00:37,750
much the same configuration.

12
00:00:37,750 --> 00:00:40,510
So let's go ahead and
jump in and get started.

13
00:00:40,510 --> 00:00:42,450
We'll quickly look
at our topology,

14
00:00:42,450 --> 00:00:45,360
just really to see where that
virtual link needs to be.

15
00:00:45,360 --> 00:00:48,810
For authentication, we're just
going to authenticate area 0.

16
00:00:48,810 --> 00:00:50,460
But for the virtual
link, we need

17
00:00:50,460 --> 00:00:52,150
to see where that
needs to be built.

18
00:00:52,150 --> 00:00:53,880
And then we'll jump
into the command line

19
00:00:53,880 --> 00:00:57,920
and implement
these two features.

20
00:00:57,920 --> 00:01:01,330
So again, as we mentioned
during our introduction,

21
00:01:01,330 --> 00:01:05,620
we're going to be turning on
authentication for area 0.

22
00:01:05,620 --> 00:01:07,900
But what we really
wanted to look at

23
00:01:07,900 --> 00:01:09,880
is where we need
the virtual link.

24
00:01:09,880 --> 00:01:14,680
Right now, we have this area
1000 up here with router 9

25
00:01:14,680 --> 00:01:17,260
in it that's not
connected to area 0.

26
00:01:17,260 --> 00:01:21,190
So we're going to need a
virtual link between router 1

27
00:01:21,190 --> 00:01:26,020
and router 2 here in order
to join area 0 out here

28
00:01:26,020 --> 00:01:27,760
to area 1000.

29
00:01:27,760 --> 00:01:29,740
We're also going to
want to make sure

30
00:01:29,740 --> 00:01:32,860
that we have our authentication
running on this virtual link

31
00:01:32,860 --> 00:01:36,253
as well since it is
a member of area 0.

32
00:01:36,253 --> 00:01:38,170
So this is what we're
going to be configuring.

33
00:01:38,170 --> 00:01:42,040
Let's start with the
authentication in area 0.

34
00:01:42,040 --> 00:01:45,610
We'll just go ahead
and start on router 1.

35
00:01:45,610 --> 00:01:49,000
So starting off here on
router 1, all we have to do

36
00:01:49,000 --> 00:01:52,330
is go into router ospfv3 1.

37
00:01:52,330 --> 00:01:55,600
We'll go into the area where we
want to enable authentication.

38
00:01:55,600 --> 00:01:57,310
We turn on authentication.

39
00:01:57,310 --> 00:02:00,340
Notice that the only choice
here is really to disable it

40
00:02:00,340 --> 00:02:01,840
or do IPsec.

41
00:02:01,840 --> 00:02:03,700
So of course, we're
going to do IPsec.

42
00:02:03,700 --> 00:02:06,610
Then we have to supply the SPI.

43
00:02:06,610 --> 00:02:10,720
This, of course, can be a number
from 256 up to 4.2 billion.

44
00:02:10,720 --> 00:02:13,330
But we're just going to
do something like 500.

45
00:02:13,330 --> 00:02:15,490
And here's where we
have a choice, where

46
00:02:15,490 --> 00:02:19,340
we can do either MD5 or SHA-1.

47
00:02:19,340 --> 00:02:24,140
Since MD5 has been compromised,
it's usually a better option

48
00:02:24,140 --> 00:02:26,120
to go with SHA-1.

49
00:02:26,120 --> 00:02:28,460
Since we have the choice
here, let's go ahead

50
00:02:28,460 --> 00:02:32,280
and configure SHA-1
for our authentication.

51
00:02:32,280 --> 00:02:33,830
So we do sha1.

52
00:02:33,830 --> 00:02:37,012
And then it needs a 40-hex key.

53
00:02:37,012 --> 00:02:38,720
Well, the easiest way
to do that is we're

54
00:02:38,720 --> 00:02:40,640
just going to put
in four sets of 10.

55
00:02:40,640 --> 00:02:42,180
There we go.

56
00:02:42,180 --> 00:02:43,850
We'll commit those changes.

57
00:02:43,850 --> 00:02:45,500
Exit configuration.

58
00:02:45,500 --> 00:02:47,510
And ultimately,
what should happen

59
00:02:47,510 --> 00:02:50,630
is neighborships are
going to start timing out

60
00:02:50,630 --> 00:02:51,650
and going down.

61
00:02:51,650 --> 00:02:53,810
But in the meantime, we
can go around and start

62
00:02:53,810 --> 00:02:55,950
configuring the other routers.

63
00:02:55,950 --> 00:02:58,580
Now, this is going to be
the exact same configuration

64
00:02:58,580 --> 00:02:59,750
on router 3.

65
00:02:59,750 --> 00:03:01,730
So we'll just copy and paste it.

66
00:03:01,730 --> 00:03:07,020

67
00:03:07,020 --> 00:03:09,020
We see that the
neighborship with router 1

68
00:03:09,020 --> 00:03:11,620
had gone down up here at
the top of the screen.

69
00:03:11,620 --> 00:03:13,370
And we see here at the
bottom that it just

70
00:03:13,370 --> 00:03:16,460
came back up, now that we've
enabled our authentication.

71
00:03:16,460 --> 00:03:18,530
We also have to
configure router 6.

72
00:03:18,530 --> 00:03:22,320
This is IOS XE, but it's
still almost the same.

73
00:03:22,320 --> 00:03:24,510
So I just pasted the config in.

74
00:03:24,510 --> 00:03:28,430
We can see that the only real
difference is rather than going

75
00:03:28,430 --> 00:03:31,640
into area 0 and then
typing authentication,

76
00:03:31,640 --> 00:03:33,860
it just goes on one line here--

77
00:03:33,860 --> 00:03:36,000
area 0 authentication.

78
00:03:36,000 --> 00:03:38,070
So we'll go ahead
and turn that on.

79
00:03:38,070 --> 00:03:40,760
And we have to do the
same thing on 7 and 8.

80
00:03:40,760 --> 00:03:43,700
Once again, exact
same configuration.

81
00:03:43,700 --> 00:03:52,170

82
00:03:52,170 --> 00:03:54,420
Once this is all
configured, a good check

83
00:03:54,420 --> 00:03:56,310
would be to make sure
that router 1 got

84
00:03:56,310 --> 00:03:57,820
all of its neighbors back.

85
00:03:57,820 --> 00:04:00,690
We can see here that
it's back up with routers

86
00:04:00,690 --> 00:04:06,510
6, 7, and 3, which are the
ones that are in area 0.

87
00:04:06,510 --> 00:04:08,730
And if we say jump
over to router 7,

88
00:04:08,730 --> 00:04:14,130
and we say show ospfv3, we
can see here, under area 0,

89
00:04:14,130 --> 00:04:19,390
that SHA-1 authentication using
SPI 500 is in fact enabled.

90
00:04:19,390 --> 00:04:22,170
So this all indicates
that authentication

91
00:04:22,170 --> 00:04:23,910
is working in area 0.

92
00:04:23,910 --> 00:04:27,240
So next, let's take a
look at that virtual link.

93
00:04:27,240 --> 00:04:30,690
Let's start by
going to router 9.

94
00:04:30,690 --> 00:04:33,240
Let's do a show ipv6 route ospf.

95
00:04:33,240 --> 00:04:36,240
And we see, by no big
surprise, that it's

96
00:04:36,240 --> 00:04:40,150
routing table is empty because
we don't have a virtual link.

97
00:04:40,150 --> 00:04:44,010
So we need to configure this
virtual link between router 1

98
00:04:44,010 --> 00:04:44,670
and 2.

99
00:04:44,670 --> 00:04:46,290
Let's hop over to router 1.

100
00:04:46,290 --> 00:04:50,190
So we'll go into configuration
mode, into our routing process.

101
00:04:50,190 --> 00:04:53,160
We go into the
address-family ipv6.

102
00:04:53,160 --> 00:04:55,410
Then we go into the area
that the virtual link

103
00:04:55,410 --> 00:04:56,460
is going to traverse.

104
00:04:56,460 --> 00:04:58,560
In this case, that's area 100.

105
00:04:58,560 --> 00:05:02,910
And we do our virtual-link
to 10.2.2.2, the router

106
00:05:02,910 --> 00:05:04,950
ID of router 2.

107
00:05:04,950 --> 00:05:06,810
Let's commit those changes.

108
00:05:06,810 --> 00:05:08,640
And do the same
thing on router 2.

109
00:05:08,640 --> 00:05:17,710

110
00:05:17,710 --> 00:05:20,230
This will, of course,
go to 10.1.1.1.

111
00:05:20,230 --> 00:05:21,830
We'll commit those changes.

112
00:05:21,830 --> 00:05:25,510
We see the neighborship comes
up over our virtual link.

113
00:05:25,510 --> 00:05:29,830
Let's do a show
ospfv3 virtual link.

114
00:05:29,830 --> 00:05:31,870
The problem we
have here, however,

115
00:05:31,870 --> 00:05:34,420
is even though the
virtual link is up,

116
00:05:34,420 --> 00:05:38,025
there's no authentication
on the virtual link.

117
00:05:38,025 --> 00:05:39,400
So what we're
going to have to do

118
00:05:39,400 --> 00:05:43,180
is put our authentication
on the virtual link now.

119
00:05:43,180 --> 00:05:44,860
The good news is
this is essentially

120
00:05:44,860 --> 00:05:50,020
the same command, just
authentication ipsec spi 500

121
00:05:50,020 --> 00:05:52,180
sha1, and then our key.

122
00:05:52,180 --> 00:05:53,890
We'll commit those changes.

123
00:05:53,890 --> 00:05:56,395
And we'll do the same
thing on router 1.

124
00:05:56,395 --> 00:06:01,650

125
00:06:01,650 --> 00:06:04,470
If we do a show
ospfv3 virtual link,

126
00:06:04,470 --> 00:06:08,370
we see that now it
has AH authentication

127
00:06:08,370 --> 00:06:11,740
SHA-1 using SPI 500.

128
00:06:11,740 --> 00:06:15,430
So now we have authentication
on our virtual link as well.

129
00:06:15,430 --> 00:06:18,015
So of course, as
one final test, we

130
00:06:18,015 --> 00:06:19,890
have to make sure that
all the routes are now

131
00:06:19,890 --> 00:06:23,470
showing up on router 9
as they're supposed to.

132
00:06:23,470 --> 00:06:25,080
So let's jump over to router 9.

133
00:06:25,080 --> 00:06:26,770
We'll do our command again.

134
00:06:26,770 --> 00:06:30,690
And now we see that we're
getting all of the IPv6 routes

135
00:06:30,690 --> 00:06:34,492
from OSPF version 3.

136
00:06:34,492 --> 00:06:37,070
In this video, we
just wrapped up

137
00:06:37,070 --> 00:06:40,630
with two final features
in OSPF version 3.

138
00:06:40,630 --> 00:06:43,640
We saw how to turn
on authentication

139
00:06:43,640 --> 00:06:46,730
using IPsec and SHA-1.

140
00:06:46,730 --> 00:06:49,610
Remember, MD5 was
also an option.

141
00:06:49,610 --> 00:06:52,400
But we chose to go with SHA-1.

142
00:06:52,400 --> 00:06:56,150
And then we took a look
at doing a virtual link

143
00:06:56,150 --> 00:07:00,770
to link areas that may not
be connected to area 0.

144
00:07:00,770 --> 00:07:03,590
Also, remember, that just
like with OSPF version

145
00:07:03,590 --> 00:07:06,330
2, the virtual link
can, of course,

146
00:07:06,330 --> 00:07:12,140
also be used to fix a
disjoint OSPF area 0.

147
00:07:12,140 --> 00:07:14,300
I hope this has been
informative for you,

148
00:07:14,300 --> 00:07:17,410
and I'd like to thank
you for viewing.

149
00:07:17,410 --> 00:07:21,000