[AUDIO LOGO]
Finally, let's talk about IS-IS authentication.
Now, something a little interesting in IS-IS
is not only does it support two different types
of authentication, but it actually
supports two different things to authenticate.
So of course, let's jump in and take a look
at the details on that.
And then we'll jump into the command line
and see it in operation.
So the first thing to discuss is that IS-IS can actually
do authentication for either hellos or LSPs.
Or of course, we could do authentication for both.
Now, as far as the type of authentication, currently--
and you never know when things are
going to change, but at the time of this recording,
we currently only support either plaintext or MD5
authentication.
Now, of course, generally speaking,
we are not going to want to do plaintext authentication.
So I would say at this point, it's pretty much just
going to be MD5.
That's what we'll be looking at here in our demonstration.
One thing that's a little bit different
here is the hello authentication is actually
configured on the interface where the LSP authentication is
configured under the routing process.
So what we're going to do here is jump into the command line
and take a look at MD5 authentication
both for the hellos and for the LSPs.
So I don't think we really need the diagram for this one.
We're just going to configure this between routers 7 and 8.
So let's jump into the command line.
And we'll start with authenticating those hellos.
So let's begin by configuring our hello authentication.
So again, we'll just go into configuration mode.
And we'll start by making a key chain.
We'll just call it ISIS_KEY.
And we'll just make key 1.
And we'll make our key-string ISIS_PASS.
Then all we have to do is go to our interface.
In this case, it's gigabit 3 towards router 8.
And we'll say isis authentication.
We'll set the mode.
Again, on this code, we only have two choices--
text or md5.
Of course, we want to do md5.
And we're going to authenticate this either
for level 1 or level 2 or both.
In this case, it's just a level 2 adjacency.
So we can just say level-2.
And then we have to tell it the key to use.
So we assign the key-chain ISIS_KEY.
Now, as we can see, we immediately
start getting console messages here
that CLNS authentication has failed for the IS-IS hellos.
This, of course, will cause the neighborship
to go down to router 8.
So we can see here, as expected, the adjacency to router 8
has gone down.
Let's go over to router 8.
And here we have one of my personal favorite messages
in IOS that the adjacency to router 7
has gone down because the neighbor forgot us.
I just think that's a funny message.
But essentially, what it means is
we're no longer exchanging hellos.
So of course, we're going to have to configure router 8 here
the same way we did router 7.
So we'll go into configuration mode once again.
We'll make our key chain ISIS_KEY.
And that's without the dash.
Then we'll make key 1.
This one gets the dash--
key-string ISIS_PASS.
This time, its interface gigabit 1.
We'll set our mode to md5 again for level-2.
And we'll set our key-chain.
Once this is done, we should see the adjacency
to router 7 come back up.
We can see, of course, that it did,
even while we were saying that.
So let's take a look at a show isis 1 neighbor.
So we see that that's definitely back up.
So now why don't we jump into Wireshark
and see what these hellos look like on the wire,
now that we have authentication enabled.
We'll simply look at router 7's gigabit 3 interface.
So here in our Wireshark capture,
we see here that packet number four is actually an ISIS
HELLO coming from router 8.
If we expand the ISIS HELLO, we see now
that we have an authentication TLV type 10.
Let's go ahead and open that.
What we see here is our hmac-md5.
And we see the actual message digest itself.
So we can see that the authentication is not
only enabled, but it's also using MD5.
So that takes care of hello authentication.
Now let's jump back over to the command line
and configure our LSP authentication.
So we'll start here on router 8.
And to configure LSP authentication,
we go under router isis 1.
And all we have to do-- it's pretty much the same
as configuring for the hellos.
We just say authentication mode md5.
Once again, we'll just do the level-2 database.
And we tell it what key to use.
Now, just as a quick note here, we certainly
could use a different key chain here.
This doesn't have to be the same key chain or the same password.
But since we already have it created,
we'll just go ahead and use the one we already have.
And what we're going to see is, once again, our authentication
is going to start failing because router 8 is
doing authentication.
And router 7 is not, which means that as
of right now, if we do a show ip route isis,
router 8 no longer has any routes,
because nothing's being accepted from the database.
So let's go configure this on router 7 as well.
So it's of course the same configuration.
So we'll set our mode to md5 and set our key-chain.
Now, this is going to create an interesting problem for us.
We're now going to start failing with all of the other routers,
because router 7 here has neighborships with router
6, router 1, router 3.
In fact, if we do a show isis 1 neighbor,
we can see we have a lot more neighbors here
than just router 8.
So we're now back exchanging databases with router 8.
If I do a show ip route isis, router 7
is actually not going to have any routes
here, because again, we're only exchanging with 8.
And in our previous video, we filtered out 8.
So to see if the database exchange is actually OK,
we'd have to go to router 8.
So here if we do a show ip route isis again,
now we see router 7's loopback.
So we are now properly exchanging
routes with router 7.
However, router 7 is not exchanging routes
with anybody else.
So if we really wanted to make this work
through our environment, we would
have to turn on the LSP authentication
on all the other routers.
In this video, we took a look at IS-IS authentication.
We saw how we can turn on authentication
just for the hellos or for the LSPs, and the exchanging
of the database, and do either one or the other or both.
Now, the IS-IS hellos get authenticated on the interface.
And therefore, we can do that link by link
wherever we want to.
However, the database exchange is enabled
under the routing process.
The problem with that, as we just saw,
is if we turn it on, on one router, or maybe two or three,
we have to enable it on all of them
because, otherwise, we'll stop exchanging
databases with the routers that aren't configured for it.
So the LSP authentication is sort of an all or nothing
within a given level.
So of course, we could authenticate
level 1 in some places and not level 2, that sort of thing.
But we do have to enable it for the level.
So of course, if we do level two,
that's going to mean the whole backbone.
Or we could do level 1 in just one particular area
for the level 1 adjacencies.
I hope this has been informative for you,
and I'd like to thank you for viewing.