[AUDIO LOGO]
And now let's wrap up with Trouble Ticket 5.
This ticket involves R1 not being able to neighbor
up with router 9.
Now, this should be a relatively easy ticket
just from the perspective that we've already
looked at router 9.
If you remember from our previous ticket, router 9,
we know it's configured to use dynamic neighborship.
It's got a listen range listening
to the physical interfaces.
So let's hop into the command line.
We'll start on router 9 and look at its configuration
quickly just as a reminder.
And then let's go look at router 1 and see well,
what's not configured to be compatible.
So as we said, here's the configuration of router 9.
We can see once again it's using that listen range 50.1.0.0/16,
Putting that range into a peer group.
The peer group is configured with all
of its necessary parameters.
But one thing to note here is it is
configured to use a password, so let's keep that in mind.
Now, let's go over and see what's going on router 1
Now, we haven't actually verified this ticket yet,
and that is usually our first step.
So let's do a show ip bgp summary.
And as we can see here, our connection to router 9
is currently active.
So not a big surprise there.
Let's just go right ahead and look at our configuration.
So we'll do our show run router bgp.
And if we look here at the information for router 9,
we see that it's configured for a key chain.
So it's configured to use BGP KEY.
Very interesting.
Let's take a look at that key chain.
Now, since it's encrypted, we can't tell easily
if this is the correct password.
On IOS XE, there's a command show key chain.
And on IOS XE, this would actually
show you the password in plain text.
We can see that IOS XR doesn't work exactly the same way.
But here's the point in this entire discussion.
Notice, the cryptographic algorithm on this key chain,
it's set to MD5, which, theoretically,
should be correct.
Router 9, which is running IOS XE, is also using MD5.
But if you remember, we discussed
this in a previous skill that the MD5 used in a key chain
actually uses an experimental field in the TCP header
where the MD5 password from IOS XE is carried in TCP option 19,
making these two things incompatible.
So just so we can see it, let's go into Wireshark real quick
and look at that optional field being set here by router 1.
So here, we have our TCP send request going
from 50.1.19.1 to 50.1.19.9.
Those are, of course, the correct addresses.
But let's go ahead and open up our TCP header.
Then let's open Options.
Notice under TCP Options, we have the experimental field,
but we don't have option 19 or the MD5 header.
So again, this is using an incompatible type of packet.
Now, let's go back to router 1 and change
this to use proper MD5 from the perspective of IOS XE.
So let's go into configuration mode, into router BGP.
The neighbor is 50.1.19.9.
We'll say no key chain because we can't have both configured.
And then we'll say password.
And I'll just paste in our password.
We'll commit our changes and the exit configuration.
Let's do our show ip bgp summary again.
And we see that now, we are up with a neighborship
to 50.1.19.9.
So clearly, this was an authentication problem,
and our neighborship is back up.
So in this video, we saw a ticket related
to MD5 authentication with BGP.
Keep in mind that IOS XE will do MD5 authentication
using the TCP option 19 header.
On IOS XR, if you configure the password under the neighborship
configuration and use the password command,
it will use MD5 authentication and option 19.
But if you use a key chain, it doesn't
matter if that key chain is SHA-1 or MD5,
it will still use the TCP experimental header
to send that information.
So what that ultimately means is if you
want to use a key chain with MD5 on IOS XR,
it's going to have to be to another IOS XR device.
I hope this has been informative for you,
and I'd like to thank you for viewing.