Spot the Issues: Answers

1. You will need to monitor the traffic being sent by the remote router with the tcpdump or monitor traffic CLI command to actually view the secret. Showing the configuration will display only the hash of the secret, and tracing indicates only that there is a problem with authentication.

2. The area-range statement for the 192.168.x summary is incorrectly specified. To summarize external LSAs in a NSSA, you must include the area-range statement within the NSSA stanza. The example shown will summarize only 192.168.x/24 routes if they are area 1 internals.

3. The router’s loopback address will not be advertised into OSPF because the RID was explicitly specified under routing-options. Omitting an explicit RID declaration will cause the router to advertise its loopback address as a stub route in the router LSAs it generates. If the loopback interface is placed into a particular area, then a network summary LSA is used to report the loop- back interface route in all other areas to which that router attaches.

4. No, this is normal. The external LSAs will be flushed when they have reached max-age. If their presence serves to distract you, you can expedite their demise by purging the OSPF LSDB.

5. The problem with this policy is that the first term is not associated with a terminating action. So all routes, whether they match term 1 or not, are evaluated by the second term, which accepts all routes from all protocols. The fact that the last term in a policy can be unnamed, as is this case in this example, can make spotting this type of policy problem very difficult. To meet the requirements of accepting only 192.168.x/24 RIP routes for export, your RIP export policy will need to have an accept action associated with term 1. An explicit reject action for all other routes is not required since this is the default policy for RIP export. Both of the following policy examples will work as desired:

   [edit policy-options] lab@r6# show policy-statement not-broke1 term 1 {    from {       protocol rip;       route-filter 192.168.0.0/16 orlonger;    }    then accept;  } [edit policy-options] lab@r6# show policy-statement not-broke2 from {    protocol rip;    route-filter 192.168.0.0/16 orlonger accept;  }

6. You must configure a default metric under the stub or NSSA area. This is often missed because default route origination is automatic for stub areas when using Cisco’s IOS.