[VIDEO LOGO]
So let's go ahead and jump into trouble ticket 1.
And for trouble ticket 1, we will be using IS-IS topology 1.
We'll be using this topology for most of these tickets.
It will be referenced over here if this ever changes.
We'll keep an eye on that to make sure
that we're always using the same topology diagram.
But this is the same topology diagram, again,
that we used through the majority of our IS-IS skills.
So let's take a look at our ticket.
Our ticket is going to be down here at the bottom.
And in this case, we're saying that the IS-IS neighborship
between R7 and R8 is currently down.
So we're talking about this neighborship right here.
Let's go ahead and jump into the command line
and take a look at this.
We may as well start on, say, router 8.
So let's begin just by verifying the ticket.
We'll do a show IS-IS neighbor, and we
see that, in fact, router 8 has no neighborships.
Let's take a look at a show CLNS interface.
We'll specify gigabit 1.
So we see here that the gigabit Interface is up, up.
We also see that the Routing Protocol is set to IS-IS.
It's supposed to be a level-2.
However, we also see that the number
of active level-2 adjacencies is currently zero.
There's nothing here really indicating a problem, however.
Let's try looking at a show IS-IS protocol.
So here, we see that the System ID appears to be set correctly.
The IS type is level-1, level-2, which
is what router 8 is supposed to be.
We see that the area is set to essentially area 20.
And we see that it is supporting IS-IS for IP
on the loopback and IP and IPv6 6 on gigabit 1.
Now, that is a mismatch.
However, we don't really need IPv6 support
for this particular ticket.
This is just about the neighborship.
So that's not really a concern as far
as the neighborship goes, what protocols are supported
on the loopback interface?
But otherwise, everything in this output
generally looks like it's configured properly as well.
So let's jump over and see if maybe there's
a problem on router 7 just in this recursory overview
of the IS-IS configuration.
So on router 7, we'll start with our show IS-IS neighbors.
And we see that router 7 actually
only has a neighborship with router 3 right now.
Well, it's supposed to have a lot more neighborships
than that, particularly to router 8, which is our concern
at the moment.
So let's look at that configuration on its gigabit 3
interface.
So again, we'll do a show CLNS for the interface gigabit 3.
So once again, we see the Interface is up, up.
We see that the Routing Protocol is set to IS-IS.
We see that the Number of Active Layer-2 adjacencies
is, again, zero.
So once again, everything here appears to be correct,
except there's no neighborship.
Let's do a show IS-IS protocol.
So we see that the System ID does
appear to be set correctly.
This router's IS type is only level-2.
But again, this isn't going to be a problem because the two
routers have level-2 in common.
So even though one of them is level-1, level-2 and this one's
level-2, that's still fine.
They're in different areas anyway.
So they should be forming a level-2 adjacency.
So again, as long as they have level-2 in common,
we should be good to go.
That's not the problem we're looking for.
So as I just said, they are in different areas.
We see that this router is in area 100, which
again is correct.
We see that IS-IS is enabled on its gigabit interface.
In fact, it's enabled on three of its gigabit interfaces,
1, 2 and 3 for IP and IPv6.
We also see that it's passive for loopback 0.
Again, that's not going to effect neighborship
in any case.
So once again, generally speaking, everything here
looks good.
So maybe what we should do is look at Wireshark
and see if these routers are actually exchanging HELLOs.
So let's take a look at Wireshark.
We'll just look at router 8's gigabit 1 interface.
So what we see here is our packet
4 is, in fact, an IS-IS HELLO coming from router 7.
So let's go ahead and expand the IS-IS HELLO field.
And as we look over this, everything
seems to look fairly normal here.
We have a circuit-type of Level-2-Only.
The System ID is, in fact, router 7's ID.
We see we have a PDU of 1496.
But notice here, we have authentication.
This could definitely create an issue
for IS-IS adjacency, which is our current ticket.
So this is definitely something worth investigating.
If we open the Authentication section,
we see that it's actually doing HMACMD5.
Let's take a look at a HELLO from router 8
and see if it's doing this as well.
So we'll highlight packet 6 here.
So now, we see that it's coming from router 8.
And if we look at the authentication,
we see that it's also doing HMAC.
So let's jump back over to the command-line
and take a look at the password that it's actually using.
They're both agreeing on the authentication for the HELLOs,
but let's see if they're doing it correct.
So since we're already on router 7, we'll just start here.
Let's do a show run for interface gigabit 3.
And we see that it is, in fact, set to MD5 authentication
and it's using a key chain called IS-IS_KEY.
So let's also do a show run, and we'll do a section for key.
And we see that our key chain, IS-IS key,
has one key and one key string, IS-IS_PASS.
So let's go see if router 8 is the same.
So we'll start with our show run of interface gigabit 1.
And we see that, again, it's configured for authentication,
which we knew.
But we really just want to see what key chain it's using,
which is IS-IS_KEY.
So let's do a show run section key.
Once again, we see that it's using the key chain
IS-IS_KEY with one key and a key string of IS-IS_PASS.
So everything looks OK here.
Let's see what our log is saying about this.
So we'll do a show log and we see
that we're actually getting quite a few IS-IS
authentication failed messages.
Now, this is a quick note here.
Looking into your logs is probably a pretty good place
to actually start.
However, we want to walk through and look
at some of the other methods we can use for troubleshooting.
Just so we know, in the real world,
this is actually a really good place to start.
Also, note that this would have been showing up
as console messages as well.
So if you're SSH-ed into the device,
having terminal monitor enabled would have also shown this.
We're purposefully logging into these devices
right now without terminal monitor
on just so the errors and the mistakes that we're
trying to fix aren't just so obviously right in our face.
But there are a few other ways we could have seen this other
than looking at the logs.
So let's take a look at those.
So like I said, the first would have been definitely
to look at console messages and the logs.
However, if we were to repeat our show run section key,
another good way to see this is we can highlight the password.
Because at this point, we don't really
know what the problem is.
The password looks correct.
However, if we highlight this in our terminal software,
this will vary a little bit, by the way,
depending on what terminal software you're using.
I'm using SecureCRT here.
PuTTY will do this as well.
Your mileage may vary with other terminal software.
But notice, this is actually highlighting a space
after the password.
If we go back over to router 7 and we highlight this one,
this one does not have a space after it.
Now, clearly highlighting things in the terminal
isn't really our go-to way to do this.
Because as I said, your mileage may vary with other terminal
software.
So of course, there's a better way to see all of this.
Let's go back to router 8 since that appears
to be where the problem is.
And here's a much better way to tell.
And the way that we really should be looking at this, just
do a show key chain.
Notice, in the show key chain, it literally
shows you the text of the key string in quotes.
So you can tell without any doubt
whatsoever that there's a space in this password.
So now, we can clearly see what the problem is.
Router 8 is configured with the correct password,
but it has a space after it.
So what we have to do is go into Configuration
and simply put the password in without the space.
So let's go ahead and fix the problem,
and then CFR adjacency comes back up between router 7
and router 8 since everything else appears
to be configured properly.
So we'll simply go into Configuration.
We'll go into our Key.
And all we have to do is change the key string.
And just so you understand how this problem
happens, to begin with.
What a lot of times people will do
is they'll be entering the key string like this
and then they'll go, well, is there
anything that has to come after this?
So in good Cisco command-line style,
we hit Space question mark.
Get our context-sensitive help and find out
what's supposed to come next.
And of course, it comes back and says,
Oh, just enter a line and hit Enter.
So they say, OK, and they hit Enter.
The problem is notice that space is still there.
The question mark, of course, disappears
when you get context-sensitive help, but not the space.
So if you're going to do that and you get the help,
that's fine.
Just make sure you don't put the space in after the password
because, as you've seen here, that definitely
counts as part of the password.
So as soon as we put our password in,
this neighborship should come back up with router 7.
We'll do our show IS-IS neighbor,
and we see that our neighborship with router 7
has, in fact, come back up.
Which means if we do a show IP route IS-IS,
we actually have some IS-IS entries in our routing table.
So this looks like it's up and working,
and it appears that we have solved the ticket.
So in this video, we explored a ticket
involving IS-IS authentication.
In this particular case, it wasn't a matter
of the wrong type of authentication,
which also would be an issue.
But in this case, it was simply a password
that was mistyped on one side of the connection.
And again, this is actually a very, very common mistake
because people try to get that context-sensitive help
after their password, realize that there's nothing else
to put there, hit Enter, and don't get rid
of that final space, and it ends up being part of the password.
So this is actually a fairly common thing to watch out for.
I hope this has been informative for you,
and I'd like to thank you for viewing.