--- title: Protect IS-IS Routing Data with MD5 Authentication «... description: A hands-on lab exercise covering IS-IS MD5 authentication configuration across three password scopes: interface (hello packets), area (level-1 LSPs), and... canonical: https://daily.dev/posts/protect-is-is-routing-data-with-md5-authentication-is-is-labs-hhn1z2dot twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Protect IS-IS Routing Data with MD5 Authentication « IS-IS Labs | daily.dev og:description: A hands-on lab exercise covering IS-IS MD5 authentication configuration across three password scopes: interface (hello packets), area (level-1 LSPs), and... og:url: https://daily.dev/posts/protect-is-is-routing-data-with-md5-authentication-is-is-labs-hhn1z2dot og:image: https://api.daily.dev/og/posts/HhN1Z2dOt.png og:image:alt: Protect IS-IS Routing Data with MD5 Authentication « IS-IS Labs og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Protect IS-IS Routing Data with MD5 Authentication « IS-IS Labs **[ipSpace.net Blog](https://daily.dev/sources/ipspace)** · 7 min read · 0 upvotes · 0 comments ## Summary A hands-on lab exercise covering IS-IS MD5 authentication configuration across three password scopes: interface (hello packets), area (level-1 LSPs), and domain (level-2 LSPs). The lab demonstrates the asymmetric adjacency behavior that occurs when one router lacks authentication while neighbors require it — FRRouting may show adjacencies as 'Up' while the authenticated peer sees none. Step-by-step validation shows how each password type affects LSP flooding and adjacency state, using FRRouting and Arista EOS as reference platforms. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What happens to IS-IS adjacency when one router has MD5 authentication and the neighbor does not? The behavior is asymmetric and implementation-dependent. FRRouting may report adjacencies as 'Up' on the unauthenticated router while the authenticated peer shows no neighbors at all. Arista EOS is more consistent, showing the adjacency stuck in INIT state on both sides. The authenticated routers ignore unauthenticated packets, so LSPs from the unauthenticated router are never flooded into the database. _Network engineers troubleshooting IS-IS authentication mismatches find the specific per-platform behavior documented on daily.dev._ ### What are the three types of IS-IS passwords and what traffic does each authenticate? IS-IS has three password scopes: interface passwords authenticate hello packets exchanged between adjacent routers, area passwords authenticate level-1 LSPs flooded within an area, and domain passwords authenticate level-2 LSPs flooded across the backbone. All three must be configured for full adjacency and complete LSP visibility. Some implementations (e.g., Arista EOS) call these interface, level-1, and level-2 passwords respectively. _Keeping up with IS-IS and other routing protocol nuances across vendors is easier when the right posts surface on daily.dev._ ### Why use MD5 authentication on IS-IS if IS-IS packets have no checksum? MD5 authentication on IS-IS serves two purposes beyond neighbor impersonation prevention: it detects malformed packets and catches inadvertent data corruption, since IS-IS packets carry no built-in checksum. Injecting IS-IS packets into a LAN segment without physical access is nearly impossible, so authentication is less critical than for EBGP, but the corruption-detection benefit remains useful even on trusted networks. _Developers and network engineers tracking protocol security trade-offs like these share findings on daily.dev._ ## Similar posts on daily.dev - [ASPA: making Internet routing more secure](https://daily.dev/posts/aspa-making-internet-routing-more-secure-r19ceuyg1) · Cloudflare · 0 upvotes · 0 comments - [Multivendor SR-MPLS « ipSpace.net blog](https://daily.dev/posts/multivendor-sr-mpls-ipspace-net-blog-qekokwduk) · ipSpace.net Blog · 0 upvotes · 0 comments - [RFC 4058 – Authentication Protocol Overview](https://daily.dev/posts/rfc-4058-authentication-protocol-overview-1ju7kdq53) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/protect-is-is-routing-data-with-md5-authentication-is-is-labs-hhn1z2dot) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Protect IS-IS Routing Data with MD5 Authentication « IS-IS Labs","url":"https://daily.dev/posts/protect-is-is-routing-data-with-md5-authentication-is-is-labs-hhn1z2dot","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/protect-is-is-routing-data-with-md5-authentication-is-is-labs-hhn1z2dot"},"datePublished":"2026-08-11T08:56:00.593Z","dateModified":"2026-08-11T09:30:25.571Z","description":"A hands-on lab exercise covering IS-IS MD5 authentication configuration across three password scopes: interface (hello packets), area (level-1 LSPs), and...","image":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","thumbnailUrl":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","isAccessibleForFree":true,"articleSection":"ipSpace.net Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ipSpace.net Blog","logo":"https://media.daily.dev/image/upload/s--xS7E82MT--/f_auto,q_auto/v1786438303/logos/ipspace?_a=BAMAMicg0","url":"https://daily.dev/sources/ipspace"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/protect-is-is-routing-data-with-md5-authentication-is-is-labs-hhn1z2dot","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ipSpace.net Blog","item":"https://daily.dev/sources/ipspace"},{"@type":"ListItem","position":3,"name":"Protect IS-IS Routing Data with MD5 Authentication « IS-IS Labs"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/protect-is-is-routing-data-with-md5-authentication-is-is-labs-hhn1z2dot#faq","mainEntity":[{"@type":"Question","name":"What happens to IS-IS adjacency when one router has MD5 authentication and the neighbor does not?","acceptedAnswer":{"@type":"Answer","text":"The behavior is asymmetric and implementation-dependent. FRRouting may report adjacencies as 'Up' on the unauthenticated router while the authenticated peer shows no neighbors at all. Arista EOS is more consistent, showing the adjacency stuck in INIT state on both sides. The authenticated routers ignore unauthenticated packets, so LSPs from the unauthenticated router are never flooded into the database. Network engineers troubleshooting IS-IS authentication mismatches find the specific per-platform behavior documented on daily.dev."}},{"@type":"Question","name":"What are the three types of IS-IS passwords and what traffic does each authenticate?","acceptedAnswer":{"@type":"Answer","text":"IS-IS has three password scopes: interface passwords authenticate hello packets exchanged between adjacent routers, area passwords authenticate level-1 LSPs flooded within an area, and domain passwords authenticate level-2 LSPs flooded across the backbone. All three must be configured for full adjacency and complete LSP visibility. Some implementations (e.g., Arista EOS) call these interface, level-1, and level-2 passwords respectively. Keeping up with IS-IS and other routing protocol nuances across vendors is easier when the right posts surface on daily.dev."}},{"@type":"Question","name":"Why use MD5 authentication on IS-IS if IS-IS packets have no checksum?","acceptedAnswer":{"@type":"Answer","text":"MD5 authentication on IS-IS serves two purposes beyond neighbor impersonation prevention: it detects malformed packets and catches inadvertent data corruption, since IS-IS packets carry no built-in checksum. Injecting IS-IS packets into a LAN segment without physical access is nearly impossible, so authentication is less critical than for EBGP, but the corruption-detection benefit remains useful even on trusted networks. Developers and network engineers tracking protocol security trade-offs like these share findings on daily.dev."}}]} ```