IS-IS Authentication (hello-password and lsp-password)

IS-IS authentication comes in two kinds — one protects adjacencies, the other protects the link-state database — configured in different places and covering different PDUs. Configure one and the other is left unprotected. The symptoms of failure are opposites too: with the first the adjacency never comes up; with the second it stays up while no routes arrive.

This article works through the mechanism the standards define, and then confirms on IOS XR hardware and in captures what each of the two passwords protects.

The only method the standard defines is a cleartext password

Clause 6.6.1 (design goals) of ISO/IEC 10589:2002 positions its own authentication like this:

The specific mechanism supported in this International Standard however, only supports a weak form of authentication using passwords, and thus is useful only for protection against accidental misconfiguration errors and does not protect against any serious security threat.

Authentication information travels in TLV 10 (CODE — 10, LENGTH — 1 to 254 octets). The first octet of the VALUE is the Authentication Type; the only values the standard defines are 1 = Cleartext Password and 255 (a routeing-domain private method), with 0 and 2 to 254 RESERVED. The TLV appears with the same definition in every PDU of 9.5 to 9.13 (LAN IIH, P2P IIH, LSP, CSNP and PSNP, at both levels).

Receipt is governed by 7.3.15 for LSPs and SNPs and by 8.2.5 and 8.4.2 for IIHs: a PDU with no Authentication Information, or with a value that does not match, is discarded and an authenticationFailure event is generated. It is dropped silently; the sender is never told.

Authentication has three scopes

There are three pairs of management parameters holding passwords — one for transmitting, and a set for receiving.

Management parameter	PDUs it protects	IOS XR configuration
`circuitTransmitPassword` / `circuitReceivePasswords`	IIHs (15 / 16 / 17)	`hello-password` (under the interface)
`areaTransmitPassword` / `areaReceivePasswords`	Level 1 LSPs and SNPs (18 / 24 / 26)	`lsp-password level 1`
`domainTransmitPassword` / `domainReceivePasswords`	Level 2 LSPs and SNPs (19 / 25 / 27)	`lsp-password level 2`

The circuit password is per circuit; the area and domain passwords are one each per router. The receive side is a set so that old and new values can both be accepted during a rollover, which IOS XR does with a key chain.

Only the side with a password configured checks anything

The part that is easy to miss is that the receive-side check is conditional. Clause 7.3.15.1 opens like this:

If this is a level 1 LSP, and the value of areaTransmitPassword or the set of areaReceivePasswords is non-null, then perform the following tests:

A receiver with no password performs no test, and accepts PDUs with or without authentication information. IIHs and SNPs carry the same condition. So a password configured on one side only breaks one direction: the side that has it discards the peer’s PDUs, and the side that does not accepts them.

RFC 5304: HMAC-MD5 (Type 54)

A cleartext password can be read from a capture. RFC 5304 replaced it with HMAC-MD5, Authentication Type 54. It obsoletes RFC 3567 and updates RFC 1195. Two points matter.

LSPs are computed with the Checksum and Remaining Lifetime set to zero. Those fields change every time the LSP is relayed, and including them would break the digest at the next hop
SNPs use the same password as LSPs. Level 1 uses the area string and Level 2 the domain string; there is no SNP-specific one

The Security Considerations of that RFC state plainly that replay attacks are not prevented. An IIH whose contents do not change carries the same digest every time.

RFC 5310: generalizing to HMAC-SHA (Type 3)

With concern over the strength of MD5, RFC 5310 defined a form in which the algorithm can be swapped. The Authentication Type is 3 and the value is a Key ID (2 octets) plus Authentication Data, with HMAC-SHA-1 / 224 / 256 / 384 / 512 available. Because the Key ID names an algorithm-and-key pair, keys are easy to roll over.

Both 3 and 54 were assigned by the IETF out of the 2 to 254 range ISO marks RESERVED.

What a mismatched password does

When hello-password does not match, the adjacency never forms; when lsp-password does not match, the adjacency stays up and only the peer’s LSPs fail to arrive. Neither gives you routes, but show isis neighbors looks the opposite way in each. An adjacency that is up while no routes arrive points at lsp-password. The receiver simply drops the PDUs, so nothing appears in the sender’s log.

Configuring it on IOS XR

hello-password goes under the interface and lsp-password under router isis. The choices are the same.

The choices for lsp-password and hello-password (IOS XR 26.1.1)
RP/0/RP0/CPU0:R1(config)#router isis 1
RP/0/RP0/CPU0:R1(config-isis)# lsp-password ?
  WORD       The unencrypted (clear text) LSP/SNP password
  accept     Use password for incoming authentication only
  clear      Specifies an unencrypted password will follow
  encrypted  Specifies an encrypted password will follow
  hmac-md5   Use HMAC-MD5 authentication
  keychain   Specifies a Key Chain name will follow
  text       Use cleartext password authentication
RP/0/RP0/CPU0:R1(config-isis)# lsp-password 
% Incomplete command.
RP/0/RP0/CPU0:R1(config-isis)# interface GigabitEthernet0/0/0/0
RP/0/RP0/CPU0:R1(config-isis-if)#  hello-password ?
  WORD       The unencrypted (clear text) hello password
  accept     Use password for incoming authentication only
  clear      Specifies an unencrypted password will follow
  encrypted  Specifies an encrypted password will follow
  hmac-md5   Use HMAC-MD5 authentication
  keychain   Specifies a Key Chain name will follow
  text       Use cleartext password authentication
RP/0/RP0/CPU0:R1(config-isis-if)#  hello-password 
% Incomplete command.
RP/0/RP0/CPU0:R1(config-isis-if)#commit
Wed Sep  9 11:18:08.871 UTC
RP/0/RP0/CPU0:R1(config-isis-if)#end

text is the cleartext password (Type 1) and hmac-md5 is HMAC-MD5 (Type 54). A string entered with clear is stored as encrypted in the running configuration. These options can follow the password.

Option	`lsp-password`	`hello-password`
`level`	Restrict to one level	Same
`send-only`	Attach to outgoing PDUs only; do not check incoming	Same
`snp`	Set the SNP authentication mode separately	—
`enable-poi`	Enable TLV 13 (RFC 6232)	—

Verifying on real equipment

The test topology

R1, R2 and R3 are chained, with R2’s circuit-type making R1 to R2 Level 1 only and R2 to R3 Level 2 only, so the area password and the domain password can be exercised separately in one lab.

Router	NET	is-type	Links
R1	`49.0001.0010.0100.1001.00`	level-1	Gi0/0/0/0 10.1.2.1
R2	`49.0001.0020.0200.2002.00`	level-1-2	Gi0/0/0/0 10.1.2.2 (`circuit-type level-1`) / Gi0/0/0/1 10.2.3.2 (`circuit-type level-2-only`)
R3	`49.0002.0030.0300.3003.00`	level-2-only	Gi0/0/0/0 10.2.3.3

The STEPs

STEP	Change	Purpose
0	No authentication (default)	Confirm TLV 10 is absent
1	`hello-password text` on both ends of R1 to R2	The cleartext password being readable
2	Both ends to `hello-password hmac-md5`	The type changing to 54
3	R1 only to a different password	The adjacency dropping
4	R1 back, then `lsp-password` on R1 and R2 only	The adjacency staying up while the LSDB breaks, in one direction only
5	`lsp-password` on R3 as well	Synchronization returning
6	Remove everything (final state)	Same as STEP 0

No authentication (STEP 0)

One Level 1 and one Level 2 adjacency are up. The IIHs carry no TLV 10 yet; everything up to No.29 of the capture isis-auth-hello-text.pcap is in this state.

STEP 0: show isis neighbors on R2
RP/0/RP0/CPU0:R2#show isis neighbors
Wed Sep  9 11:17:29.419 UTC

IS-IS 1 neighbors:
System Id      Interface        SNPA           State Holdtime Type IETF-NSF
R1             Gi0/0/0/0        *PtoP*         Up    29       L1   Capable 
R3             Gi0/0/0/1        *PtoP*         Up    20       L2   Capable 

Total neighbor count: 2

Adding a cleartext password (STEP 1)

It goes on both R1 and R2. One side alone would drop the adjacency, so the two commits follow immediately.

STEP 1: the configuration applied to both R1 and R2
router isis 1
 interface GigabitEthernet0/0/0/0
  hello-password text clear ISISHELLO

No.30 is the IIH R2 sent right after the commit. TLV 10 is the only difference from No.29 before it.

The IIH R2 sent in the STEP 1 state (No.30)
$ tshark -r isis-auth-hello-text.pcap -n -V -Y "frame.number == 30"
ISO 10589 ISIS InTRA Domain Routeing Information Exchange Protocol
    Intradomain Routing Protocol Discriminator: ISIS (0x83)
    Length Indicator: 20
    Version/Protocol ID Extension: 1
    ID Length: 0
    000. .... = Reserved: 0x0
    ...1 0001 = PDU Type: P2P HELLO (17)
    Version: 1
    Reserved: 0
    Maximum Area Addresses: 0
ISIS HELLO
    .... ..01 = Circuit type: Level 1 only (0x1)
    0000 00.. = Reserved: 0x00
    SystemID {Sender of PDU}: 0020.0200.2002
    Holding timer: 30
    PDU length: 1497
    Local circuit ID: 0
    Point-to-point Adjacency State (t=240, l=15)
        Type: 240
        Length: 15
        Adjacency State: Up (0)
        Extended Local circuit ID: 0x00000004
        Neighbor SystemID: 0010.0100.1001
        Neighbor Extended Local circuit ID: 0x00000003
    Authentication (t=10, l=10)
        Type: 10
        Length: 10
        clear text (1), password (length 9) = ISISHELLO
    Protocols Supported (t=129, l=1)
        Type: 129
        Length: 1
        NLPID: IP (0xcc)
            NLPID: 0xcc
    Restart Signaling (t=211, l=3)
        Type: 211
        Length: 3
        Restart Signaling Flags: 0x00
            .... .0.. = Suppress Adjacency: False
            .... ..0. = Restart Acknowledgment: False
            .... ...0 = Restart Request: False
    Area address(es) (t=1, l=4)
        Type: 1
        Length: 4
        Area address (3): 49.0001
    IP Interface address(es) (t=132, l=4)
        Type: 132
        Length: 4
        IPv4 interface address: 10.1.2.2
    Unknown code (t=21, l=4)
        Type: 21
        Length: 4
        Dissector for IS-IS CLV (21) code not implemented, Contact Wireshark developers if you want this supported
            [Expert Info (Note/Undecoded): Dissector for IS-IS CLV (21) code not implemented, Contact Wireshark developers if you want this supported]
                [Dissector for IS-IS CLV (21) code not implemented, Contact Wireshark developers if you want this supported]
                [Severity level: Note]
                [Group: Undecoded]
    Padding (t=8, l=255)
        Type: 8
        Length: 255
    Padding (t=8, l=255)
        Type: 8
        Length: 255
    Padding (t=8, l=255)
        Type: 8
        Length: 255
    Padding (t=8, l=255)
        Type: 8
        Length: 255
    Padding (t=8, l=255)
        Type: 8
        Length: 255
    Padding (t=8, l=135)
        Type: 8
        Length: 135

Download the pcap of the packet in the tshark output above (No.30 IIH)

clear text (1), password (length 9) = ISISHELLO: the password is right there in the packet. This is the form the standard has in mind when it speaks of protection against accidental misconfiguration only.

Switching to HMAC-MD5 (STEP 2)

The password stays the same; only the method changes, again on both sides.

STEP 2: the configuration applied to both R1 and R2
router isis 1
 interface GigabitEthernet0/0/0/0
  hello-password hmac-md5 clear ISISHELLO

In the capture isis-auth-hello-md5.pcap, everything up to No.3 is cleartext and No.4 onwards is hmac-md5.

The IIH R2 sent in the STEP 2 state (No.4)
$ tshark -r isis-auth-hello-md5.pcap -n -V -Y "frame.number == 4"
ISO 10589 ISIS InTRA Domain Routeing Information Exchange Protocol
    Intradomain Routing Protocol Discriminator: ISIS (0x83)
    Length Indicator: 20
    Version/Protocol ID Extension: 1
    ID Length: 0
    000. .... = Reserved: 0x0
    ...1 0001 = PDU Type: P2P HELLO (17)
    Version: 1
    Reserved: 0
    Maximum Area Addresses: 0
ISIS HELLO
    .... ..01 = Circuit type: Level 1 only (0x1)
    0000 00.. = Reserved: 0x00
    SystemID {Sender of PDU}: 0020.0200.2002
    Holding timer: 30
    PDU length: 1497
    Local circuit ID: 0
    Point-to-point Adjacency State (t=240, l=15)
        Type: 240
        Length: 15
        Adjacency State: Up (0)
        Extended Local circuit ID: 0x00000004
        Neighbor SystemID: 0010.0100.1001
        Neighbor Extended Local circuit ID: 0x00000003
    Authentication (t=10, l=17)
        Type: 10
        Length: 17
        hmac-md5 (54), message digest (length 16) = 15e744957bb46c8bda9f08ba36bcdb40
    Protocols Supported (t=129, l=1)
        Type: 129
        Length: 1
        NLPID: IP (0xcc)
            NLPID: 0xcc
    Restart Signaling (t=211, l=3)
        Type: 211
        Length: 3
        Restart Signaling Flags: 0x00
            .... .0.. = Suppress Adjacency: False
            .... ..0. = Restart Acknowledgment: False
            .... ...0 = Restart Request: False
    Area address(es) (t=1, l=4)
        Type: 1
        Length: 4
        Area address (3): 49.0001
    IP Interface address(es) (t=132, l=4)
        Type: 132
        Length: 4
        IPv4 interface address: 10.1.2.2
    Unknown code (t=21, l=4)
        Type: 21
        Length: 4
        Dissector for IS-IS CLV (21) code not implemented, Contact Wireshark developers if you want this supported
            [Expert Info (Note/Undecoded): Dissector for IS-IS CLV (21) code not implemented, Contact Wireshark developers if you want this supported]
                [Dissector for IS-IS CLV (21) code not implemented, Contact Wireshark developers if you want this supported]
                [Severity level: Note]
                [Group: Undecoded]
    Padding (t=8, l=255)
        Type: 8
        Length: 255
    Padding (t=8, l=255)
        Type: 8
        Length: 255
    Padding (t=8, l=255)
        Type: 8
        Length: 255
    Padding (t=8, l=255)
        Type: 8
        Length: 255
    Padding (t=8, l=255)
        Type: 8
        Length: 255
    Padding (t=8, l=128)
        Type: 8
        Length: 128

Download the pcap of the packet in the tshark output above (No.4 IIH)

It reads hmac-md5 (54), message digest (length 16); the password itself is no longer on the wire. The TLV grows from 10 octets to 17 (type plus a 16-octet digest). Because both sides changed almost at once, the adjacency did not drop.

STEP 2: show isis adjacency-log on R1
RP/0/RP0/CPU0:R1#show isis adjacency-log
Wed Sep  9 11:22:01.084 UTC

  IS-IS 1  Level 1  Adjacency Log                Capacity: 100, Size: 2

When          System          Interface          State   Details
--- Wed Sep  9 2026 ---
11:15:49.412  R2              Gi0/0/0/0          d -> i  
11:15:50.021  R2              Gi0/0/0/0          i -> u  New adjacency
                                                         IPv4 Unicast Up

Changing the password on one side only (STEP 3)

STEP 3: the configuration applied to R1 alone
router isis 1
 interface GigabitEthernet0/0/0/0
  hello-password hmac-md5 clear ISISWRONG

Both ends discard the other’s IIHs, so the holding time runs out and the adjacency goes down. The reason shown is Holdtime expired; authentication is not mentioned.

STEP 3: show isis adjacency-log on R1
RP/0/RP0/CPU0:R1#show isis adjacency-log
Wed Sep  9 11:29:07.146 UTC

  IS-IS 1  Level 1  Adjacency Log                Capacity: 100, Size: 3

When          System          Interface          State   Details
--- Wed Sep  9 2026 ---
11:15:49.412  R2              Gi0/0/0/0          d -> i  
11:15:50.021  R2              Gi0/0/0/0          i -> u  New adjacency
                                                         IPv4 Unicast Up
11:23:45.302  R2              Gi0/0/0/0          u -> d  Holdtime expired
                                                         IPv4 Unicast Down

That the PDUs were dropped for authentication shows in Last PDU Rejected of show isis interface. R1 shows the same.

STEP 3: show isis interface on R2 (the first part of Gi0/0/0/0)
GigabitEthernet0/0/0/0      Enabled
  Adjacency Formation:      Enabled
  Prefix Advertisement:     Enabled
  Bandwidth:                1000000
  RSI SRLG:                 Not Registered
  
  Circuit Type:             level-1
  Media Type:               P2P
  Circuit Number:           0
  Extended Circuit Number:  0
  Last IIH Received:        11:23:19 (00:06:02 ago), 1497 octets
  Last PDU Rejected:        11:29:18 (3.33 sec ago), 1497 octets, P2P IIH, Authentication Failed
  Last IIH Sent:            11:29:18 (3.63 sec ago), 1497 octets
  Sending next P2P IIH in:  4 s

Adding a password to the LSPs (STEP 4)

R1’s password goes back, and lsp-password is added to R1 and R2 only. R3 is left alone.

STEP 4: the configuration applied to R1 and R2 (R3 unconfigured)
router isis 1
 lsp-password hmac-md5 clear ISISLSP
 interface GigabitEthernet0/0/0/0
  hello-password hmac-md5 clear ISISHELLO

The Level 1 side has it on both ends and does not change. The Level 2 LSPs R2 sends now carry the same TLV 10 as the IIHs; No.10 of the capture isis-auth-lsp.pcap is one (No.4 is from before the change, with no TLV 10).

The Level 2 LSP R2 sent in the STEP 4 state (No.10)
$ tshark -r isis-auth-lsp.pcap -n -V -Y "frame.number == 10"
ISO 10589 ISIS InTRA Domain Routeing Information Exchange Protocol
    Intradomain Routing Protocol Discriminator: ISIS (0x83)
    Length Indicator: 27
    Version/Protocol ID Extension: 1
    ID Length: 0
    000. .... = Reserved: 0x0
    ...1 0100 = PDU Type: L2 LSP (20)
    Version: 1
    Reserved: 0
    Maximum Area Addresses: 0
ISO 10589 ISIS Link State Protocol Data Unit
    PDU length: 133
    Remaining lifetime: 1200
    LSP-ID: 0020.0200.2002.00-00
    Sequence number: 0x0000000b
    Checksum: 0xd687 [correct]
    [Checksum Status: Good]
    Type block(0x03): Partition Repair:0, Attached bits:0, Overload bit:0, IS type:3
        0... .... = Partition Repair: Not supported
        .000 0... = Attachment: 0
            .0.. .... = Error metric: Not set
            ..0. .... = Expense metric: Not set
            ...0 .... = Delay metric: Not set
            0... .... = Default metric: Not set
        .... .0.. = Overload bit: Not set
        .... ..11 = Type of Intermediate System: Level 2 (3)
    Authentication (t=10, l=17)
        Type: 10
        Length: 17
        hmac-md5 (54), message digest (length 16) = b2f6439f0c9e610b8c2205d9b6fcac43
    Area address(es) (t=1, l=4)
        Type: 1
        Length: 4
        Area address (3): 49.0001
    Originating neighbor buffer size (t=14, l=2)
        Type: 14
        Length: 2
        Neighbor originating buffer size: 1492
    Protocols supported (t=129, l=1)
        Type: 129
        Length: 1
        NLPID: IP (0xcc)
            NLPID: 0xcc
    IP Interface address(es) (t=132, l=4)
        Type: 132
        Length: 4
        IPv4 interface address: 2.2.2.2
    Hostname (t=137, l=2)
        Type: 137
        Length: 2
        Hostname: R2
    IP Internal reachability (t=128, l=48)
        Type: 128
        Length: 48
        IPv4 prefix: 1.1.1.1/32
            ..00 1010 = Default Metric: 10
            .0.. .... = Default Metric IE: Internal
            0... .... = Distribution: Up
            ..00 0000 = Delay Metric: 0
            1... .... = Delay Metric: Not Supported
            .0.. .... = Delay Metric: Internal
            ..00 0000 = Expense Metric: 0
            1... .... = Expense Metric: Not Supported
            .0.. .... = Expense Metric: Internal
            ..00 0000 = Error Metric: 0
            1... .... = Error Metric: Not Supported
            .0.. .... = Error Metric: Internal
        IPv4 prefix: 2.2.2.2/32
            ..00 0000 = Default Metric: 0
            .0.. .... = Default Metric IE: Internal
            0... .... = Distribution: Up
            ..00 0000 = Delay Metric: 0
            1... .... = Delay Metric: Not Supported
            .0.. .... = Delay Metric: Internal
            ..00 0000 = Expense Metric: 0
            1... .... = Expense Metric: Not Supported
            .0.. .... = Expense Metric: Internal
            ..00 0000 = Error Metric: 0
            1... .... = Error Metric: Not Supported
            .0.. .... = Error Metric: Internal
        IPv4 prefix: 10.1.2.0/24
            ..00 1010 = Default Metric: 10
            .0.. .... = Default Metric IE: Internal
            0... .... = Distribution: Up
            ..00 0000 = Delay Metric: 0
            1... .... = Delay Metric: Not Supported
            .0.. .... = Delay Metric: Internal
            ..00 0000 = Expense Metric: 0
            1... .... = Expense Metric: Not Supported
            .0.. .... = Expense Metric: Internal
            ..00 0000 = Error Metric: 0
            1... .... = Error Metric: Not Supported
            .0.. .... = Error Metric: Internal
        IPv4 prefix: 10.2.3.0/24
            ..00 1010 = Default Metric: 10
            .0.. .... = Default Metric IE: Internal
            0... .... = Distribution: Up
            ..00 0000 = Delay Metric: 0
            1... .... = Delay Metric: Not Supported
            .0.. .... = Delay Metric: Internal
            ..00 0000 = Expense Metric: 0
            1... .... = Expense Metric: Not Supported
            .0.. .... = Expense Metric: Internal
            ..00 0000 = Error Metric: 0
            1... .... = Error Metric: Not Supported
            .0.. .... = Error Metric: Internal
    IS Reachability (t=2, l=12)
        Type: 2
        Length: 12
        Reserved: 0x00
        IS Neighbor: 0030.0300.3003.00
            ..00 1010 = Default Metric: 10
            .0.. .... = Default Metric: Internal
            ..00 1010 = Delay Metric: 10
            0... .... = Delay Metric: Supported
            .0.. .... = Delay Metric: Internal
            ..00 1010 = Expense Metric: 10
            0... .... = Expense Metric: Supported
            .0.. .... = Expense Metric: Internal
            ..00 1010 = Error Metric: 10
            0... .... = Error Metric: Supported
            .0.. .... = Error Metric: Internal
            IS Neighbor: 0030.0300.3003.00

Download the pcap of the packet in the tshark output above (No.10 LSP)

R3 has no password, so it accepts this LSP without checking. R3’s own PDUs carry no authentication, and R2 discards them.

STEP 4: show isis interface on R2 (the first part of Gi0/0/0/1)
GigabitEthernet0/0/0/1      Enabled
  Adjacency Formation:      Enabled
  Prefix Advertisement:     Enabled
  Bandwidth:                1000000
  RSI SRLG:                 Not Registered
  
  Circuit Type:             level-2-only
  Media Type:               P2P
  Circuit Number:           0
  Extended Circuit Number:  3
  Last IIH Received:        11:49:53 (3.28 sec ago), 1497 octets
  Last PDU Rejected:        11:49:55 (0.88 sec ago), 35 octets, L2 PSNP, Authentication Failed
  Last IIH Sent:            11:49:55 (1.59 sec ago), 1497 octets
  Sending next P2P IIH in:  6 s

The PSNPs R3 returns (the acknowledgements for LSPs) are dropped, so R2 keeps retransmitting.

STEP 4: show isis statistics on R2 (the first part)
IS-IS 1 Packet and Event Statistics
                                              Dropped        Dropped
  Total PDUs       Sent       Received       On Input      By Update
    Hello:          480            426              0              -
    CSNP:             3              3              -              0
    PSNP:            10             10              0              0
    LSP:            270             12              0              0
  
  LSP Retransmissions:           255
  LSP Checksum Errors:           0

The copy R2 holds of R3’s LSP is never refreshed, so its holding time (1200 seconds) runs out and it disappears. The route goes with it, while the adjacency stays up.

STEP 4: show isis database on R2
RP/0/RP0/CPU0:R2#show isis database
Wed Sep  9 11:49:57.515 UTC

IS-IS 1 (Level-1) Link State Database
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime/Rcvd  ATT/P/OL
R1.00-00              0x00000008   0xe79d        912  /1200         0/0/0
R2.00-00            * 0x0000000c   0xb665        1083 /*            0/0/0

 Total Level-1 LSP count: 2     Local Level-1 LSP count: 1

IS-IS 1 (Level-2) Link State Database
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime/Rcvd  ATT/P/OL
R2.00-00            * 0x0000000c   0x157a        917  /*            0/0/0
0030.0300.3003.00-00  0x00000006   0x013f        0 (3)/*            0/0/0

 Total Level-2 LSP count: 2     Local Level-2 LSP count: 1

STEP 4: show route isis on R2
RP/0/RP0/CPU0:R2#show route isis
Wed Sep  9 11:49:56.056 UTC

i L1 1.1.1.1/32 [115/10] via 10.1.2.1, 00:19:26, GigabitEthernet0/0/0/0

R3 has lost nothing. Only one direction is broken.

STEP 4: show route isis on R3
RP/0/RP0/CPU0:R3#show route isis
Wed Sep  9 11:50:14.462 UTC

i L2 1.1.1.1/32 [115/20] via 10.2.3.2, 00:19:45, GigabitEthernet0/0/0/0
i L2 2.2.2.2/32 [115/10] via 10.2.3.2, 00:34:08, GigabitEthernet0/0/0/0
i L2 10.1.2.0/24 [115/20] via 10.2.3.2, 00:34:08, GigabitEthernet0/0/0/0

Adding it on the other side too (STEP 5)

With the same lsp-password on R3, R3’s LSP comes back with a new sequence number and the route returns.

STEP 5: the configuration applied to R3
router isis 1
 lsp-password hmac-md5 clear ISISLSP

STEP 5: show isis database on R2
RP/0/RP0/CPU0:R2#show isis database
Wed Sep  9 11:52:26.455 UTC

IS-IS 1 (Level-1) Link State Database
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime/Rcvd  ATT/P/OL
R1.00-00              0x00000008   0xe79d        763  /1200         0/0/0
R2.00-00            * 0x0000000d   0x4013        1161 /*            1/0/0

 Total Level-1 LSP count: 2     Local Level-1 LSP count: 1

IS-IS 1 (Level-2) Link State Database
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime/Rcvd  ATT/P/OL
R2.00-00            * 0x0000000c   0x157a        768  /*            0/0/0
R3.00-00              0x00000008   0x42f3        1161 /1200         0/0/0

 Total Level-2 LSP count: 2     Local Level-2 LSP count: 1

STEP 5: show route isis on R2
RP/0/RP0/CPU0:R2#show route isis
Wed Sep  9 11:52:25.191 UTC

i L1 1.1.1.1/32 [115/10] via 10.1.2.1, 00:21:56, GigabitEthernet0/0/0/0
i L2 3.3.3.3/32 [115/10] via 10.2.3.3, 00:00:36, GigabitEthernet0/0/0/1

Removing everything (STEP 6)

Removing every hello-password and lsp-password returns the routers to the initial state (the ..._run.txt files for STEP 0 and STEP 6 match). Removal, like addition, is done on both ends in quick succession.

Design guidance

Configure both. hello-password alone lets LSPs and SNPs through; lsp-password alone lets anyone form an adjacency
Use hmac-md5 or better. text puts the password on the wire
Change both ends together. A one-sided state drops the adjacency. When that is impossible, roll out send-only everywhere first and enable the receive-side check afterwards; use keychain for rollovers
Isolate from show isis neighbors. No adjacency points at hello-password; an adjacency without routes points at lsp-password. Last PDU Rejected in show isis interface names the PDU type with Authentication Failed

This article verified text and hmac-md5. keychain, send-only, snp and the HMAC-SHA family of RFC 5310 were not exercised.

Verification configs and show output

For every STEP the following were captured from all three routers, per router. The verification config is these ..._run.txt files (final state: STEP 6).

File	Contents
`..._show.txt`	`show version` / `show interface description` / `show route` / `show route isis` / `show isis` / `show isis hostname` / `show isis interface` / `show isis interface brief` / `show isis neighbors` / `show isis neighbors detail` / `show isis database` / `show isis database detail` / `show isis topology` / `show isis adjacency` / `show isis adjacency-log` / `show isis spf-log` / `show isis lsp-log` / `show isis statistics` / `show cef`
`..._log.txt`	`show logging` narrowed to that STEP (STEP 0 holds the whole history since boot)
`..._run.txt`	`show running-config` at that STEP
`..._debug.txt`	CLI help: R1 at STEP 0 (`lsp-password ?` / `hello-password ?`) and R2 at STEP 4 (`lsp-password hmac-md5 clear ISISLSP ?`)

STEP 0: no authentication (default)

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run

STEP 1: hello-password text on both ends of R1 to R2

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run

STEP 2: both ends to hello-password hmac-md5

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run

STEP 3: R1 only to a different password

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run

STEP 4: R1 back, lsp-password on R1 and R2 only

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run

STEP 5: lsp-password on R3 as well

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run

STEP 6: everything removed (final state)

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run

CLI help: R1 at STEP 0 / R2 at STEP 4

There are three capture files.

Download the R1 to R2 capture up to the cleartext password, STEP 0 and 1

Download the R1 to R2 capture across the switch to HMAC-MD5, STEP 2

Download the R2 to R3 capture from the lsp-password change onwards, STEP 4

References

Standard	Title	Summary
ISO/IEC 10589:2002 (2nd edition)	Intermediate System to Intermediate System intra-domain routeing information exchange protocol	The IS-IS specification. This article draws on 6.6.1 (authentication as a weak form), 9.5 to 9.13 (TLV 10 and the Authentication Type values), 7.3.15 (receive tests for LSPs and SNPs), 8.2.5 / 8.4.2 (receive tests for IIHs) and the password management parameters (`circuit` / `area` / `domain`).
RFC 5304	IS-IS Cryptographic Authentication	HMAC-MD5 (Type 54). LSPs are computed with Checksum and Remaining Lifetime zeroed. Obsoletes RFC 3567, updates RFC 1195. States that replay attacks are not prevented.
RFC 5310	IS-IS Generic Cryptographic Authentication	Type 3. Key ID (2 octets) plus Authentication Data. HMAC-SHA-1 / 224 / 256 / 384 / 512.
RFC 6232	Purge Originator Identification TLV for IS-IS	TLV 13, which `enable-poi` on IOS XR corresponds to.
RFC 1142	OSI IS-IS Intra-domain Routing Protocol	A republication of the Draft Proposal of ISO 10589 (1990), now Historic. It must not be cited in place of ISO/IEC 10589 (RFC 7142).
RFC 7142	Reclassification of RFC 1142 to Historic	States that the document to cite is ISO/IEC 10589:2002, 2nd edition.