As we know that IS-IS support the authentication as below:

Based on packet types, the authentication is classified as follows:

l  Interface authentication: is configured in the interface view to authenticate Level-1 and Level-2 IS-to-IS Hello PDUs (IIHs).

l  Area authentication: is configured in the IS-IS process view to authenticate Level-1 CSNPs, PSNPs, and LSPs.

l  Routing domain authentication: is configured in the IS-IS process view to authenticate Level-2 CSNPS, PSNPs, and LSPs.

Based on the authentication modes of packets, the authentication is classified into the following types:

l  Simple authentication: The authenticated party directly adds the configured password to packets for authentication. This authentication mode provides the lowest password security.

l  MD5 authentication: uses the MD5 algorithm to encrypt a password before adding the password to the packet, which improves password security.

l  Keychain authentication: further improves network security with a configurable key chain that changes with time.

l  HMAC-SHA256 authentication: uses the HMAC-SHA256 algorithm to encrypt a password before adding the password to the packet, which improves password security.

Keychain authentication is more secure and easy to configure，we can configure it for IS-IS as below:

#

keychain core mode absolute

 #

 key-id 1

  algorithm hmac-md5

  key-string cipher Huawei@12345

  send-time 00:00 2018-12-01 duration infinite

  receive-time 00:00 2018-12-01 duration infinite

#

isis 1

domain-authentication-mode keychain core

#

interface interface-type interface-number

isis authentication-mode keychain core

#