Configure keychains for IS-IS

Updated: June 9, 2026

Want to summarize with AI?

Guides you through configuring keychains for IS-IS to secure protocol communications, including authentication setup for router and interface levels using keychains for LSPs, Sequence Number PDUs, and HELLO PDUs.

Secure IS-IS protocol messages by configuring keychains at both router and interface levels.

Keychains are used in IS-IS to authenticate Link State PDUs (LSPs) and HELLO PDUs. Configuring keychains enhances protocol security and enables verification of network communication integrity.

Before you begin

Identify the keychain names and authentication keys for your IS-IS deployment.
Ensure you are in global configuration mode on the device.

Procedure

	1.	Enter IS-IS router configuration mode, and configure the router-level keychain for IS-IS LSPs and Sequence Number PDUs. Example: `Router(config)# router isis isp Router(config-isis)# lsp-password keychain isis_a level 1`
	2.	Enter interface configuration mode for the IS-IS-enabled interface, and configure the interface-level keychain for HELLO PDUs. Example: `Router(config-isis)# interface HundredGigE 0/1/0/3 Router(config-isis-if)# hello-password keychain isis_b`

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Configure keychains for IS-IS

Before you begin

Procedure

Example:

Example: