Subject: [karp] What are the operational requirements for IS-IS keying

From: Sam Hartman <[email-masked]>
Date: Thu, 21 Oct 2010 13:29:47 -0400

If I'm understanding IS-Is security right, you could potentially have
the following passwords:

* A link-level password for hellos 
* a level-1 password for each area
* a domain password for the domain

Do implementations expose all these possibilities or do they simply use
the same key for the entire domain?

---

From: "Polk, William T." <[email-masked]>
Date: Thu, 21 Oct 2010 13:40:22 -0400

It is my understanding that these are all used in some (many?) deployments, and in fact there is generally a different password for each interface for the hellos.  That is, if a router is connected to more than one LAN or point-to-point link, it can have a different password for the hellos for each interface.  So, a Level 1/2 router has >= 3 different passwords in a deployed IS-IS routing system.

On 10/21/10 1:29 PM, "Sam Hartman" <[email-masked]> wrote:

Do implementations expose all these possibilities or do they simply use
the same key for the entire domain?
_______________________________________________
karp mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/karp

---

From: Uma Chunduri <[email-masked]>
Date: Thu, 21 Oct 2010 14:02:27 -0400

>>>Do implementations expose all these possibilities or do they simply use the same key for the entire domain?

I mostly saw 2 set of auth info provisioned:
1. SN Dependent (Circuit/link level)
 - Used for IIH packets
2. SN Independent (Instance level)
 - Used for LSPs/SNPs
 - Area and domain level granularity is theoretically possible (never saw)

Thanks,
Uma

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Sam Hartman
Sent: Thursday, October 21, 2010 10:30 AM
To: [email-masked]
Subject: [karp] What are the operational requirements for IS-IS keying

If I'm understanding IS-Is security right, you could potentially have the following passwords:

Do implementations expose all these possibilities or do they simply use the same key for the entire domain?
_______________________________________________
karp mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/karp