# IS-IS Authentication **URL:** \ **Category:** Lessons Discussion\ **Created:** [June 13, 2017, 11:38am UTC](https://forum.networklessons.com/t/is-is-authentication/1811 "2017-06-13T11:38:48Z")\ **Posts on this page:** 1\ **Showing post:** 6
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [January 28, 2026, 7:27am UTC](https://forum.networklessons.com/t/is-is-authentication/1811/6 "2026-01-28T07:27:56Z")
Hello David Hmm, that’s interesting. The only thing I can think of is that P2 is still installing P4’s Level-2 routes because IS-IS domain/area authentication does not affect Hellos. On some IOS XE/CML images, received LSPs are not strictly validated unless explicit validation is enforced, so mismatched passwords can still result in accepted L2 LSPs. This looks more like an image or platform-specific behavior rather than an IS-IS rule. If you want deterministic behavior where a mismatch blocks routing, use interface or Hello authentication or explicit LSP validation (or HMAC/MD5 key-chains). It looks like domain passwords alone are not sufficient to guarantee rejection. This documentation may also prove useful: > **[Configure IS-IS Authentication](https://www.cisco.com/c/en/us/support/docs/ip/integrated-intermediate-system-to-intermediate-system-is-is/13792-isis-authent.html)** > > This document describes the configuration of the authentication for routing protocols in order to prevent the introduction of malicious information in I hope this has been helpful! Laz --- _[View the full topic](https://forum.networklessons.com/t/is-is-authentication/1811)._