1
00:00:00,000 --> 00:00:00,974

2
00:00:00,974 --> 00:00:04,870
[MUSIC PLAYING]

3
00:00:04,870 --> 00:00:12,680

4
00:00:12,680 --> 00:00:15,440
So let's jump in and begin
here with trouble ticket.

5
00:00:15,440 --> 00:00:16,730
1 specifically.

6
00:00:16,730 --> 00:00:19,250
And something to
keep in mind as we

7
00:00:19,250 --> 00:00:23,060
go through these different
tickets in this skill, most

8
00:00:23,060 --> 00:00:27,770
of them are going to be
based off of OSPF Topology 3.

9
00:00:27,770 --> 00:00:32,390
Now, there is one ticket coming
up that is going to be IPv6

10
00:00:32,390 --> 00:00:35,390
So that is going to be based
on a different topology.

11
00:00:35,390 --> 00:00:38,690
But just keep an eye right
here on each of our tickets--

12
00:00:38,690 --> 00:00:41,310
will reference which
topology it's using.

13
00:00:41,310 --> 00:00:45,230
So let's take a look at what
this ticket actually says.

14
00:00:45,230 --> 00:00:51,050
So this ticket says that the
OSPF neighborship between R6

15
00:00:51,050 --> 00:00:54,180
and R10 is currently down.

16
00:00:54,180 --> 00:00:57,530
So what it's talking about is,
of course, this neighborship

17
00:00:57,530 --> 00:01:02,420
up here, which is going to be
in area 200 between router 6,

18
00:01:02,420 --> 00:01:03,710
and router 10.

19
00:01:03,710 --> 00:01:07,520
So let's go ahead and jump
in and take a look at this.

20
00:01:07,520 --> 00:01:10,750
We'll start off by verifying
that this is actually not

21
00:01:10,750 --> 00:01:11,250
working.

22
00:01:11,250 --> 00:01:15,540
So let's start off on the
command line on router 10.

23
00:01:15,540 --> 00:01:18,940
So again, we'll verify that
it's actually not working.

24
00:01:18,940 --> 00:01:21,840
So let's start with a
show IP OSPF neighbors.

25
00:01:21,840 --> 00:01:23,490
We see that, in
fact, it does not

26
00:01:23,490 --> 00:01:25,650
have any neighbors
because router 6 would

27
00:01:25,650 --> 00:01:27,570
be router 10's only neighbor.

28
00:01:27,570 --> 00:01:30,100
Next, let's verify
our interfaces.

29
00:01:30,100 --> 00:01:33,480
So let's just do a show
IP OSPF interface brief.

30
00:01:33,480 --> 00:01:37,680
What we see here is that,
particularly, our gigabit 1

31
00:01:37,680 --> 00:01:41,670
interface is in fact,
configured for OSPF.

32
00:01:41,670 --> 00:01:43,650
It's in area 200.

33
00:01:43,650 --> 00:01:46,800
It has the appropriate
IP address and mask.

34
00:01:46,800 --> 00:01:50,200
And it is a point to point link.

35
00:01:50,200 --> 00:01:52,690
We also see that it
has no neighbors.

36
00:01:52,690 --> 00:01:54,670
But we, sort of,
already knew that.

37
00:01:54,670 --> 00:01:57,300
So let's verify these
same things on router 6.

38
00:01:57,300 --> 00:01:59,790
So we'll do our show
IP OSPF neighbors.

39
00:01:59,790 --> 00:02:03,370
And router 6, of course,
has other neighbors

40
00:02:03,370 --> 00:02:07,410
but it does not have a
neighborship with router 10.

41
00:02:07,410 --> 00:02:10,320
We do our show IP
OSPF interface brief.

42
00:02:10,320 --> 00:02:13,320
What we're looking for here
is, specifically, the gigabit 2

43
00:02:13,320 --> 00:02:14,250
interface.

44
00:02:14,250 --> 00:02:17,340
We see that is also
configured in area 200, which

45
00:02:17,340 --> 00:02:18,120
it should be.

46
00:02:18,120 --> 00:02:20,970
It has the correct IP
address and mask on it.

47
00:02:20,970 --> 00:02:23,670
And it is also configured
for point to point.

48
00:02:23,670 --> 00:02:26,370
It, of course, also has no
neighbors, which, again,

49
00:02:26,370 --> 00:02:27,630
we've already seen.

50
00:02:27,630 --> 00:02:31,020
So at first glance,
everything appears to be OK.

51
00:02:31,020 --> 00:02:33,480
Let's take a look at a
little bit more detail

52
00:02:33,480 --> 00:02:35,610
on this interface
since we're not

53
00:02:35,610 --> 00:02:38,490
getting any information
off of the brief version

54
00:02:38,490 --> 00:02:39,610
of the command.

55
00:02:39,610 --> 00:02:43,455
So we simply take off brief
and we'll put in gigabit 2.

56
00:02:43,455 --> 00:02:45,270
Now, as we look
over this, there's

57
00:02:45,270 --> 00:02:48,420
obviously a lot of information
that's available here.

58
00:02:48,420 --> 00:02:51,810
But some of the big things
that can affect a neighborship,

59
00:02:51,810 --> 00:02:54,540
that we want to compare
two the other side, first,

60
00:02:54,540 --> 00:02:58,380
would be the Hello and the Dead
intervals because the timers do

61
00:02:58,380 --> 00:02:59,430
need to match.

62
00:02:59,430 --> 00:03:01,230
We see that this
particular side is

63
00:03:01,230 --> 00:03:06,630
set to 250 with a Dead interval
of 1 and also, authentication.

64
00:03:06,630 --> 00:03:09,240
We see here at the
bottom that this is doing

65
00:03:09,240 --> 00:03:10,950
cryptographic authentication.

66
00:03:10,950 --> 00:03:15,840
It is currently using key
1 using HMAC-SHAK-512.

67
00:03:15,840 --> 00:03:18,330
The key is OSPF key.

68
00:03:18,330 --> 00:03:20,670
The key chain name itself
doesn't necessarily

69
00:03:20,670 --> 00:03:24,100
matter but it does have
to be configured the same.

70
00:03:24,100 --> 00:03:27,220
Now, authentication could
definitely be an issue here.

71
00:03:27,220 --> 00:03:29,580
But let's go to the other
side and take a look

72
00:03:29,580 --> 00:03:32,280
at its detailed information
on its interface

73
00:03:32,280 --> 00:03:34,000
to see if anything jumps out.

74
00:03:34,000 --> 00:03:36,900
So once again, on this side,
we'll look at gigabit 1.

75
00:03:36,900 --> 00:03:39,000
Let's verify those timers.

76
00:03:39,000 --> 00:03:42,120
We see here that they're
set to 250 for the Hello.

77
00:03:42,120 --> 00:03:43,770
And one second for the Dead.

78
00:03:43,770 --> 00:03:45,240
So that's good.

79
00:03:45,240 --> 00:03:47,080
If we look down
here at the bottom,

80
00:03:47,080 --> 00:03:49,140
we see that it's
doing authentication

81
00:03:49,140 --> 00:03:51,280
and it's using the same type.

82
00:03:51,280 --> 00:03:54,540
Now again, we haven't
actually verified key 1

83
00:03:54,540 --> 00:03:57,430
but it is at least configured
for authentication.

84
00:03:57,430 --> 00:04:00,610
It is still a possibility
that the key is wrong.

85
00:04:00,610 --> 00:04:04,230
However, a more important
thing to look at here

86
00:04:04,230 --> 00:04:08,220
is we have this little
statement that says, No Hellos.

87
00:04:08,220 --> 00:04:11,310
Passive Interface.

88
00:04:11,310 --> 00:04:14,090
Here's the thing,
if we're not sending

89
00:04:14,090 --> 00:04:16,550
hello's out an
interface, then there's

90
00:04:16,550 --> 00:04:18,290
no way to form a neighborship.

91
00:04:18,290 --> 00:04:21,000
So this is definitely a problem.

92
00:04:21,000 --> 00:04:23,970
Let's take a look at
why it's set that way.

93
00:04:23,970 --> 00:04:25,940
Let's do a show IP OSPF.

94
00:04:25,940 --> 00:04:27,680
And if you look
over this output,

95
00:04:27,680 --> 00:04:30,740
this doesn't really
tell us a whole lot

96
00:04:30,740 --> 00:04:33,620
because this output
for this command

97
00:04:33,620 --> 00:04:39,590
is really more about the OSPF
process and the OSPF areas

98
00:04:39,590 --> 00:04:40,980
here at the bottom.

99
00:04:40,980 --> 00:04:45,990
But passive is not an area thing
or it's not a global process

100
00:04:45,990 --> 00:04:46,490
thing.

101
00:04:46,490 --> 00:04:48,320
Although, that is
where it's configured.

102
00:04:48,320 --> 00:04:50,760
This is more of an
interface thing.

103
00:04:50,760 --> 00:04:54,560
So let's try instead,
show IP protocol.

104
00:04:54,560 --> 00:04:57,380
If we look at the output
of the show IP protocol,

105
00:04:57,380 --> 00:05:01,400
specifically for OSPF 1,
we're going to see here

106
00:05:01,400 --> 00:05:03,480
exactly what we're looking for.

107
00:05:03,480 --> 00:05:06,470
We see that routing
on interfaces

108
00:05:06,470 --> 00:05:11,870
is configured explicitly in area
200 Loopback0 and gigabit 1.

109
00:05:11,870 --> 00:05:14,780
But look at our
passive interfaces.

110
00:05:14,780 --> 00:05:18,080
Passive interfaces
includes gigabit 1.

111
00:05:18,080 --> 00:05:20,490
It includes a lot of
other interfaces as well.

112
00:05:20,490 --> 00:05:23,550
But of course, gigabit 1 is
our primary concern right now.

113
00:05:23,550 --> 00:05:25,650
Well, why is it set that way?

114
00:05:25,650 --> 00:05:27,620
Let's do a show run.

115
00:05:27,620 --> 00:05:30,290
And we'll look at
the section for OSPF.

116
00:05:30,290 --> 00:05:32,900
Now, there's a lot going on
here because we're also running

117
00:05:32,900 --> 00:05:35,360
OSPF version 3 this router.

118
00:05:35,360 --> 00:05:38,550
But if we look down here,
all the way at the bottom,

119
00:05:38,550 --> 00:05:42,830
we see that passive
interface is set to default.

120
00:05:42,830 --> 00:05:46,790
That means that it's going to
do passive interface on all

121
00:05:46,790 --> 00:05:48,080
of its interfaces.

122
00:05:48,080 --> 00:05:50,000
In some situations,
that might be

123
00:05:50,000 --> 00:05:52,790
OK if we have a
lot of interfaces

124
00:05:52,790 --> 00:05:54,200
that we want to be passive.

125
00:05:54,200 --> 00:05:58,010
But we have to make sure that
we then turn off the passive

126
00:05:58,010 --> 00:06:01,820
interface on the one that
actually needs to send hello's.

127
00:06:01,820 --> 00:06:05,520
Now, that's actually
really easy to do.

128
00:06:05,520 --> 00:06:09,260
All we have to do is go into
the router OSPF process and say,

129
00:06:09,260 --> 00:06:11,660
no passive interface.

130
00:06:11,660 --> 00:06:13,760
And then you simply
put in the interface

131
00:06:13,760 --> 00:06:15,590
that you want to
make non passive.

132
00:06:15,590 --> 00:06:18,670
In our case, it's gigabit 1.

133
00:06:18,670 --> 00:06:20,830
Can exit out of configuration.

134
00:06:20,830 --> 00:06:22,030
Just as a note--

135
00:06:22,030 --> 00:06:25,150
alternative fixes here--
we could have just taken

136
00:06:25,150 --> 00:06:27,170
out the passive
interface default.

137
00:06:27,170 --> 00:06:29,680
So again, sort of,
two fixes here.

138
00:06:29,680 --> 00:06:31,880
Either take out the
passive interface default,

139
00:06:31,880 --> 00:06:33,880
which would then, of
course, send hello's on all

140
00:06:33,880 --> 00:06:39,700
the interfaces or just take off
passive on the one interface

141
00:06:39,700 --> 00:06:44,050
where we do need to send hello's
by simply doing the no pass

142
00:06:44,050 --> 00:06:45,980
and then listing the interface.

143
00:06:45,980 --> 00:06:47,890
In our case, gigabit 1.

144
00:06:47,890 --> 00:06:50,360
Let's see if our
neighborship is up now.

145
00:06:50,360 --> 00:06:53,320
And what we see is we now have
a neighborship with router

146
00:06:53,320 --> 00:06:56,920
6 over, not only the
gigabit 1 interface.

147
00:06:56,920 --> 00:07:00,550
But notice that our virtual
link interface has also

148
00:07:00,550 --> 00:07:01,510
come up here.

149
00:07:01,510 --> 00:07:03,220
This is because
a virtual link is

150
00:07:03,220 --> 00:07:05,560
needed between router
6 and router 10

151
00:07:05,560 --> 00:07:09,700
to connect that area 0 up
at the top of router 10

152
00:07:09,700 --> 00:07:13,720
to the rest of the area
0 down below router 6.

153
00:07:13,720 --> 00:07:16,900
So this means if we were to
do a show IP router OSPF,

154
00:07:16,900 --> 00:07:18,790
we have a couple entries.

155
00:07:18,790 --> 00:07:20,680
That indicates that
this neighborship

156
00:07:20,680 --> 00:07:23,850
is now up and working properly.

157
00:07:23,850 --> 00:07:26,210
Now at this point, we
don't have a whole lot

158
00:07:26,210 --> 00:07:29,070
of entries in the OSPF table.

159
00:07:29,070 --> 00:07:30,500
This is our first ticket.

160
00:07:30,500 --> 00:07:32,670
We have quite a
few tickets to go.

161
00:07:32,670 --> 00:07:34,910
So there are quite
a few other things

162
00:07:34,910 --> 00:07:36,750
broken in this environment.

163
00:07:36,750 --> 00:07:39,440
So we wouldn't be expecting
to see a whole lot of routes

164
00:07:39,440 --> 00:07:40,560
just yet.

165
00:07:40,560 --> 00:07:42,940
But as we go through
this skill, we

166
00:07:42,940 --> 00:07:44,690
should see more and
more routes showing up

167
00:07:44,690 --> 00:07:47,160
as we fix more and more issues.

168
00:07:47,160 --> 00:07:49,790
So in this video,
we just saw a ticket

169
00:07:49,790 --> 00:07:54,290
that gave us an example of
how passive interface works.

170
00:07:54,290 --> 00:07:56,900
Keep in mind, passive
interface is usually

171
00:07:56,900 --> 00:08:00,590
really good for client
facing interfaces.

172
00:08:00,590 --> 00:08:04,190
Interfaces facing end devices
and that could include things

173
00:08:04,190 --> 00:08:05,510
like servers, printers.

174
00:08:05,510 --> 00:08:08,240
Not just end user workstations.

175
00:08:08,240 --> 00:08:11,060
But really, any
subnet where we need

176
00:08:11,060 --> 00:08:14,600
to bring the network into
OSPF so that we can reach it.

177
00:08:14,600 --> 00:08:17,450
But we don't want to
form neighborships either

178
00:08:17,450 --> 00:08:20,690
by accident or because
somebody is maliciously

179
00:08:20,690 --> 00:08:24,810
trying to bring another
router into our environment.

180
00:08:24,810 --> 00:08:26,750
I hope this has been
informative for you.

181
00:08:26,750 --> 00:08:29,650
And I'd like to thank
you for viewing.

182
00:08:29,650 --> 00:08:33,000