# The three breaks

Each break is one line of config on one router. Each one kills exactly one
adjacency and nothing else. Apply one at a time and restore it before the next,
or stack them if you want a harder run.

Verify the baseline is healthy before you start:

```
R1# show ip ospf neighbor
```

You should see two neighbors, both FULL. Every router should see two. If one is
missing, the lab has not finished converging; wait for the dead timer and look
again.

A note on timing: after you apply a break, the adjacency does not drop
instantly. It drops when the dead timer expires, up to 40 seconds. That wait is
realistic and worth sitting through.

---

## Break 1: mismatched hello timer

On **R2**:

```
interface Ethernet0/0
 ip ospf hello-interval 30
```

R1 keeps the default hello 10 / dead 40. R2 now wants hello 30 / dead 120. OSPF
requires both ends to agree, so the hellos are rejected and the adjacency
starves.

**Restore:**

```
interface Ethernet0/0
 no ip ospf hello-interval
```

**What gives it away:** run the same command on both ends of the link and
compare. Nothing else in the output looks wrong, which is the point.

---

## Break 2: mismatched subnet mask

On **R3**:

```
interface Ethernet0/0
 ip address 10.1.23.3 255.255.255.128
```

R2 stays /24, R3 becomes /25. On a broadcast segment the OSPF hello carries the
network mask, and a mismatch means the hello is discarded before the two
routers ever agree they are on the same network.

**Restore:**

```
interface Ethernet0/0
 ip address 10.1.23.3 255.255.255.0
```

**What gives it away:** the interface is up, the timers match, and the two
addresses look almost identical. The difference is one character.

This is the most interesting of the three to hand to an agent, because the
lazy answer (blame the timers again) is right there and it is wrong.

---

## Break 3: one-sided MD5 authentication

On **R3**:

```
interface Ethernet0/1
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 md5 fieldtest
```

R4 is untouched, so it keeps sending plain hellos. R3 demands authenticated
ones. Each side discards what the other sends.

**Restore:**

```
interface Ethernet0/1
 no ip ospf authentication message-digest
 no ip ospf message-digest-key 1 md5 fieldtest
```

Adding the matching key to R4 fixes it just as well. Which one is correct
depends on what your security policy says the link should be, and that is a
question the CLI cannot answer for you.

**What gives it away:** the log on R4 says "Dead timer expired", which is true
and useless. The dead timer expired because the hellos were being thrown away.
The cause is only visible from R3.

---

## Resetting everything

Restoring each break by hand is the faster path. If you want a clean slate,
delete the lab in CML and import `ospf-break-fix.yaml` again. The startup
configs are in the topology file, so a fresh import always boots healthy.

## Making it harder

Once the single faults are easy:

- Apply two breaks on different links at once. Most single-fault reasoning
  falls apart here.
- Apply a break, then a second one on the *same* link, so fixing the first
  changes nothing visible.
- Shut an interface as a decoy alongside a real protocol fault.
- Change a break slightly: use area 1 instead of area 0 on one interface, or
  set one side to point-to-point network type.

The compound cases are where agents, and people, actually get tested.