Is-Is Authentication; Configure Authentication For Is-Is - Cisco NCS 5500 Series Configuration Manuals

Implementing IS-IS
(Optional) Display IS-IS database log information.

IS-IS Authentication

Authentication is available to limit the establishment of adjacencies by using the hello-password command,
and to limit the exchange of LSPs by using the lsp-password command.
IS-IS supports plain-text authentication, which does not provide security against unauthorized users. Plain-text
authentication allows you to configure a password to prevent unauthorized networking devices from forming
adjacencies with the router. The password is exchanged as plain text and is potentially visible to an agent able
to view the IS-IS packets.
When an HMAC-MD5 password is configured, the password is never sent over the network and is instead
used to calculate a cryptographic checksum to ensure the integrity of the exchanged data.
IS-IS stores a configured password using simple encryption. However, the plain-text form of the password is
used in LSPs, sequence number protocols (SNPs), and hello packets, which would be visible to a process that
can view IS-IS packets. The passwords can be entered in plain text (clear) or encrypted form.
To set the domain password, configure the lsp-password command for Level 2; to set the area password,
configure the lsp-password command for Level 1.
The keychain feature allows IS-IS to reference configured keychains. IS-IS key chains enable hello and LSP
keychain authentication. Keychains can be configured at the router level (in the case of the lsp-password
command) and at the interface level (in the case of the hello-password command) within IS-IS. These
commands reference the global keychain configuration and instruct the IS-IS protocol to obtain security
parameters from the global set of configured keychains.
IS-IS is able to use the keychain to implement hitless key rollover for authentication. ey rollover specification
is time based, and in the event of clock skew between the peers, the rollover process is impacted. The
configurable tolerance specification allows for the accept window to be extended (before and after) by that
margin. This accept window facilitates a hitless key rollover for applications (for example, routing and
management protocols).

Configure Authentication for IS-IS

This task explains how to configure authentication for IS-IS. This task is optional.
SUMMARY STEPS
1. configure
2. router isis instance-id
3. lsp-password { hmac-md5 | text } { clear | encrypted } password [ level { 1 | 2 }] [ send-only ]
[ snp send-only ]
4. interface type interface-path-id
5. hello-password { hmac-md5 | text } { clear | encrypted } password [ level { 1 | 2 }] [ send-only
]
6. commit
Routing Configuration Guide for Cisco NCS 5500 Series Routers, IOS XR Release 6.3.x
IS-IS Authentication
23