Configuring Password Security

The ExtremeXOS software supports passwords for the following IS-IS AS components:

Level 2 domains
Level 1 areas
VLAN interfaces

Domain and area authentication prevents intruders from injecting invalid routing information into the router. Because passwords must be configured to match at both ends of a connection, password security also helps detect unconfigured and misconfigured interfaces. After configuration, the password is inserted into LSP, CSNP, and PSNP PDUs and are validated on the receiving end.

Note

The password configuration commands in this section provide an encrypted option, which controls how the passwords are saved and displayed on the switch. The encrypted option does not encrypt messages that are transmitted on the network. All passwords are transmitted in clear text.

To configure password security for a level 2 domain, use the following command:
configure isis area area_name domain-password [none | {encrypted} simple password {authenticate-snp {tx-only}}]
To configure password security for a level 1 area, use the following command:
configure isis area area_name area-password [none | {encrypted} simple password {authenticate-snp {tx-only}}]

Interface authentication prevents unauthorized routers from forming an adjacency. This is achieved by inserting a password in hello PDUs and validating the password on the receiving end. You can configure password protection separately for level 1 and level 2.
To configure password security for a VLAN interface, use the following command:
configure isis [vlan all | {vlan} vlan_name] password [none | {encrypted} simple password] level [1 | 2]