# IS-IS Authentication **URL:** \ **Category:** Lessons Discussion\ **Created:** [June 13, 2017, 11:38am UTC](https://forum.networklessons.com/t/is-is-authentication/1811 "2017-06-13T11:38:48Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![ReneMolenaar](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/renemolenaar/32/488_2.png) [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)\ **Post date:** [June 13, 2017, 11:38am UTC](https://forum.networklessons.com/t/is-is-authentication/1811/1 "2017-06-13T11:38:48Z")
This topic is to discuss the following lesson: [https://networklessons.com/cisco/ccie-enterprise-infrastructureis-is-authentication/](https://networklessons.com/cisco/ccie-enterprise-infrastructureis-is-authentication/) ---
**Author:** ![Zaman.rubd](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/z/45deac/32.png) [@Zaman.rubd](https://forum.networklessons.com/u/Zaman.rubd)\ **Post date:** [June 30, 2017, 2:39pm UTC](https://forum.networklessons.com/t/is-is-authentication/1811/2 "2017-06-30T14:39:22Z")
Thx Rene. Clear & Concise … ---
**Author:** ![fersous35](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/fersous35/32/1360_2.png) [@fersous35](https://forum.networklessons.com/u/fersous35)\ **Post date:** [December 27, 2018, 9:27pm UTC](https://forum.networklessons.com/t/is-is-authentication/1811/3 "2018-12-27T21:27:20Z")
I tried the instance authentication but I keep seeing this message: `*Mar 1 00:07:13.255: %CLNS-4-AUTH_FAIL: ISIS: CSNP authentication failed` what could be missing in my configuration? ``` ip router isis router isis net 49.0012.0000.0000.0001.00 authentication mode md5 authentication key-chain cisco@123 log-adjacency-changes interface FastEthernet0/0 ip address 192.168.12.1 255.255.255.0 ip router isis duplex auto speed auto end ``` ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [January 3, 2019, 10:45am UTC](https://forum.networklessons.com/t/is-is-authentication/1811/4 "2019-01-03T10:45:26Z")
Hello Kacem If you’re running this on GNS3 it could be an issue with the resources being allocated to dynamips. It has been known to create such error messages when the PC doesn’t have sufficient resources to provide for the emulator. This is especially the case when using MD5 as this takes up more resources. Despite the error, is everything else working correctly? Are you getting a neighbor relationship and is the routing table being populated? If so, this seems to indicate that the issue is with resources. If you’re sure your configs are correct, try to remove MD5 authentication and do clear text authentication and see if the error goes away. I hope this has been helpful! Laz ---
**Author:** ![davidilles](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/davidilles/32/9686_2.png) [@davidilles](https://forum.networklessons.com/u/davidilles)\ **Post date:** [January 24, 2026, 1:53pm UTC](https://forum.networklessons.com/t/is-is-authentication/1811/5 "2026-01-24T13:53:40Z")
Hello, everyone. I need someone to help me confirm this. ![obrázok]() ![obrázok]() ![obrázok]() The passwords are mismatched yet P2 is still installing P4’s L2 routes which it shouldn’t… ![obrázok]() ![obrázok]() ![obrázok]() How is this possible? Is this a bug in CML? David ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [January 28, 2026, 7:27am UTC](https://forum.networklessons.com/t/is-is-authentication/1811/6 "2026-01-28T07:27:56Z")
Hello David Hmm, that’s interesting. The only thing I can think of is that P2 is still installing P4’s Level-2 routes because IS-IS domain/area authentication does not affect Hellos. On some IOS XE/CML images, received LSPs are not strictly validated unless explicit validation is enforced, so mismatched passwords can still result in accepted L2 LSPs. This looks more like an image or platform-specific behavior rather than an IS-IS rule. If you want deterministic behavior where a mismatch blocks routing, use interface or Hello authentication or explicit LSP validation (or HMAC/MD5 key-chains). It looks like domain passwords alone are not sufficient to guarantee rejection. This documentation may also prove useful: > **[Configure IS-IS Authentication](https://www.cisco.com/c/en/us/support/docs/ip/integrated-intermediate-system-to-intermediate-system-is-is/13792-isis-authent.html)** > > This document describes the configuration of the authentication for routing protocols in order to prevent the introduction of malicious information in I hope this has been helpful! Laz ---
**Author:** ![davidilles](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/davidilles/32/9686_2.png) [@davidilles](https://forum.networklessons.com/u/davidilles)\ **Post date:** [January 28, 2026, 1:23pm UTC](https://forum.networklessons.com/t/is-is-authentication/1811/7 "2026-01-28T13:23:25Z")
Hello Laz. I accidentally figured it out and forgot to post, sorry. I’ve changed the passwords **after the adjacency went UP and the LSPs were exchanged**. Which most likely means that the LSPs were still installed in the LSPDB and were waiting to expire, that’s why I also saw those routes since no one really poisoned that LSP, I believe. David ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [February 2, 2026, 6:39am UTC](https://forum.networklessons.com/t/is-is-authentication/1811/8 "2026-02-02T06:39:53Z")
Hello David Ah I see, thanks for letting us know! This gives us more insight into how IS-IS operates. When you changed the IS-IS authentication password after the adjacency was up and LSPs were already exchanged, the adjacency did indeed drop because the routers could no longer authenticate Hello PDUs . Authentication failures prevent new Hello packets from being accepted. However, **previously received LSPs remained in the LSPDB** because they were **already validated** and installed before the password change. They remain valid based on their aging timers, not on the current adjacency state. No LSP purges were sent. Even if the neighbor tried, those purge packets would fail. IS-IS purges are just LSPs with remaining lifetime = 0, so if authentication is enabled and mismatched, any incoming LSP (including a purge) will be rejected. For this reason, routes persisted until LSP aging timed out. IS-IS LSPs have a default MaxAge of 1200 seconds or 20 minutes. Now, the question I like to ask at this point is, why is it designed this way? IS-IS separates or decouples adjacency maintenance (Hellos) from topology database maintenance (LSPs). Once LSPs are in the database, they persist based on their lifetime timers independent of adjacency state. Remember, IS-IS is built for stability and resiliency. This persistence or “maintaining the status quo” due to this decoupling is thus working as designed. I hope this has been helpful! Laz