[AUDIO LOGO]
And finally, let's talk about our last two topics--
OSPF version 3 authentication and virtual links.
So once again, this is going to be very, very similar to what
we saw in OSPF version 2.
In fact, the virtual links are pretty much identical.
The authentication is going to be just a little bit different,
because it uses IPsec.
But beyond that, it's going to be pretty
much the same configuration.
So let's go ahead and jump in and get started.
We'll quickly look at our topology,
just really to see where that virtual link needs to be.
For authentication, we're just going to authenticate area 0.
But for the virtual link, we need
to see where that needs to be built.
And then we'll jump into the command line
and implement these two features.
So again, as we mentioned during our introduction,
we're going to be turning on authentication for area 0.
But what we really wanted to look at
is where we need the virtual link.
Right now, we have this area 1000 up here with router 9
in it that's not connected to area 0.
So we're going to need a virtual link between router 1
and router 2 here in order to join area 0 out here
to area 1000.
We're also going to want to make sure
that we have our authentication running on this virtual link
as well since it is a member of area 0.
So this is what we're going to be configuring.
Let's start with the authentication in area 0.
We'll just go ahead and start on router 1.
So starting off here on router 1, all we have to do
is go into router ospfv3 1.
We'll go into the area where we want to enable authentication.
We turn on authentication.
Notice that the only choice here is really to disable it
or do IPsec.
So of course, we're going to do IPsec.
Then we have to supply the SPI.
This, of course, can be a number from 256 up to 4.2 billion.
But we're just going to do something like 500.
And here's where we have a choice, where
we can do either MD5 or SHA-1.
Since MD5 has been compromised, it's usually a better option
to go with SHA-1.
Since we have the choice here, let's go ahead
and configure SHA-1 for our authentication.
So we do sha1.
And then it needs a 40-hex key.
Well, the easiest way to do that is we're
just going to put in four sets of 10.
There we go.
We'll commit those changes.
Exit configuration.
And ultimately, what should happen
is neighborships are going to start timing out
and going down.
But in the meantime, we can go around and start
configuring the other routers.
Now, this is going to be the exact same configuration
on router 3.
So we'll just copy and paste it.
We see that the neighborship with router 1
had gone down up here at the top of the screen.
And we see here at the bottom that it just
came back up, now that we've enabled our authentication.
We also have to configure router 6.
This is IOS XE, but it's still almost the same.
So I just pasted the config in.
We can see that the only real difference is rather than going
into area 0 and then typing authentication,
it just goes on one line here--
area 0 authentication.
So we'll go ahead and turn that on.
And we have to do the same thing on 7 and 8.
Once again, exact same configuration.
Once this is all configured, a good check
would be to make sure that router 1 got
all of its neighbors back.
We can see here that it's back up with routers
6, 7, and 3, which are the ones that are in area 0.
And if we say jump over to router 7,
and we say show ospfv3, we can see here, under area 0,
that SHA-1 authentication using SPI 500 is in fact enabled.
So this all indicates that authentication
is working in area 0.
So next, let's take a look at that virtual link.
Let's start by going to router 9.
Let's do a show ipv6 route ospf.
And we see, by no big surprise, that it's
routing table is empty because we don't have a virtual link.
So we need to configure this virtual link between router 1
and 2.
Let's hop over to router 1.
So we'll go into configuration mode, into our routing process.
We go into the address-family ipv6.
Then we go into the area that the virtual link
is going to traverse.
In this case, that's area 100.
And we do our virtual-link to 10.2.2.2, the router
ID of router 2.
Let's commit those changes.
And do the same thing on router 2.
This will, of course, go to 10.1.1.1.
We'll commit those changes.
We see the neighborship comes up over our virtual link.
Let's do a show ospfv3 virtual link.
The problem we have here, however,
is even though the virtual link is up,
there's no authentication on the virtual link.
So what we're going to have to do
is put our authentication on the virtual link now.
The good news is this is essentially
the same command, just authentication ipsec spi 500
sha1, and then our key.
We'll commit those changes.
And we'll do the same thing on router 1.
If we do a show ospfv3 virtual link,
we see that now it has AH authentication
SHA-1 using SPI 500.
So now we have authentication on our virtual link as well.
So of course, as one final test, we
have to make sure that all the routes are now
showing up on router 9 as they're supposed to.
So let's jump over to router 9.
We'll do our command again.
And now we see that we're getting all of the IPv6 routes
from OSPF version 3.
In this video, we just wrapped up
with two final features in OSPF version 3.
We saw how to turn on authentication
using IPsec and SHA-1.
Remember, MD5 was also an option.
But we chose to go with SHA-1.
And then we took a look at doing a virtual link
to link areas that may not be connected to area 0.
Also, remember, that just like with OSPF version
2, the virtual link can, of course,
also be used to fix a disjoint OSPF area 0.
I hope this has been informative for you,
and I'd like to thank you for viewing.