Lab Objective
Configure MD5 authentication on an IS-IS-enabled interface between two routers, verify the adjacency remains stable when passwords match, then introduce a mismatch and observe the resulting adjacency failure.
Lab Purpose
Just as with the OSPF and EIGRP authentication labs covered earlier in this series, IS-IS without authentication allows any device sending properly formatted IS-IS hellos on a shared segment to potentially form an unauthorized adjacency. IS-IS authentication follows a syntax distinct from both prior protocols, worth understanding on its own terms.
Lab Topology
R2 ---- Serial0/0/1 ------------------ Serial0/0/1 ---- R3
Same topology as the multi-level IS-IS lab,
focusing on the R2-R3 Level 2 adjacencyTask 1: Verify the Current Healthy Adjacency
Confirm R2 and R3 show an active Level 2 IS-IS adjacency before adding authentication.
Task 2: Configure MD5 Authentication on R2's Interface
Enable IS-IS hello authentication on R2's interface with a specific key.
Task 3: Configure Matching Authentication on R3's Interface
Enable the identical key on R3's corresponding interface.
Task 4: Verify the Adjacency Remains Stable
Confirm the adjacency is unaffected, since both keys match.
Task 5: Introduce a Key Mismatch and Verify Failure
Change R3's key to a different value and observe the resulting adjacency loss.
Solution and Verification
R2# show clns neighbors
System Id Interface State Type Holdtime
0000.0000.0003 Se0/0/1 Up L2 28R2(config)# interface serial0/0/1
R2(config-if)# isis authentication mode md5
R2(config-if)# isis authentication key-chain ISIS-AUTH
R2(config-if)# exit
R2(config)# key chain ISIS-AUTH
R2(config-keychain)# key 1
R2(config-keychain-key)# key-string IsisKey2026
-- IS-IS, like EIGRP covered earlier in
-- this series, uses a key chain rather
-- than a directly configured password as
-- OSPF's ip ospf message-digest-key doesR3(config)# interface serial0/0/1
R3(config-if)# isis authentication mode md5
R3(config-if)# isis authentication key-chain ISIS-AUTH
R3(config-if)# exit
R3(config)# key chain ISIS-AUTH
R3(config-keychain)# key 1
R3(config-keychain-key)# key-string IsisKey2026R2# show clns neighbors
System Id Interface State Type Holdtime
0000.0000.0003 Se0/0/1 Up L2 29
-- Adjacency remains Up, since both sides
-- now share the identical keyR3(config)# key chain ISIS-AUTH
R3(config-keychain)# key 1
R3(config-keychain-key)# key-string DifferentKey999R2# show clns neighbors
-- (neighbor entry eventually disappears
-- once the hold timer expires, since
-- authentication now fails on every
-- subsequent hello)
R2# debug isis adj-packets
ISIS-Adj: Rejecting L2 IIH from
0000.0000.0003, auth failed
-- The debug output explicitly names the
-- cause -- an authentication failure --
-- rather than a vague or generic
-- adjacency-down symptomR3(config)# key chain ISIS-AUTH
R3(config-keychain)# key 1
R3(config-keychain-key)# key-string IsisKey2026
R2# show clns neighbors
System Id Interface State Type Holdtime
0000.0000.0003 Se0/0/1 Up L2 30
-- Adjacency recovers once the keys match againKey Takeaway
IS-IS authentication, like EIGRP's, relies on a key chain as an intermediate configuration object rather than a directly configured password on the interface, distinguishing its syntax from OSPF's approach covered earlier in this series — despite this syntactic difference across all three protocols, the underlying troubleshooting principle remains identical: a debug of the adjacency formation process will explicitly name an authentication mismatch rather than leaving the engineer to guess at a vague connectivity symptom.