Subject: [Isis-wg] query

From: "andy" <[email-masked]>
Date: Wed, 1 Aug 2001 12:32:43 +0530

hi list,
I have encountered a peculiar behaviour in Cisco-2600 series router. 
When i enable authentication at domain level or area level, the LSPs
generated have authentication information in them .
However the CSNP packets and PSNP packets generated by CISCO do not have
this authentication information. This is causing authentication failure.
Due to which the routes are not learnt by cisco router and test router.
However even if one CSNP packet is allowed to be processed by the test
router then the routes are exchanged and installed in both Cisco's and the
test router's main routing table.

My question is should there be authentication information in CSNP as well as
PSNP packets when i have enabled authentication at the domain or the Area
level?
please reply as soon as possible
thanks and regards

amrendras sharma
( Future software ltd,
  Chennai, 
  India)

---

From: stefano previdi <[email-masked]>
Date: Wed, 01 Aug 2001 14:46:43 +0200

>PSNP packets when i have enabled authentication at the domain or the Area

it's a cisco specific issue...not ietf one...
I'll take it offline.

s.

>please reply as soon as possible

_______________________________________________
Isis-wg mailing list  -  [email-masked]
http://external.juniper.net/mailman/listinfo/isis-wg

---

From: Darrin Walton <[email-masked]>
Date: Wed, 1 Aug 2001 16:11:36 +0000

On Wed, Aug 01, 2001 at 12:32:43PM +0530, andy wrote:
  |+ hi list,
  |+ I have encountered a peculiar behaviour in Cisco-2600 series router. 
  |+ When i enable authentication at domain level or area level, the LSPs
  |+ generated have authentication information in them .
  |+ However the CSNP packets and PSNP packets generated by CISCO do not have
  |+ this authentication information. This is causing authentication failure.

I thought the RFC stated this was optional, not mandatory.  Cisco's 
webpage however does say the PSNP packets should have authentication.

I ran into this awhile ago, and Cisco has said they have fixed this issue,
as it was causing us other problems.

I'm not sure what the other router vendor you're using, but what you
could do is disable the domain or area authentication, and enable
hello-authentication on each interface.

-- 
darrin walton, [email-masked]

---

From: stefano previdi <[email-masked]>
Date: Wed, 01 Aug 2001 19:50:10 +0200

>hello-authentication on each interface.

I replied offline to this problem but since other people seems to
be interested...yes, the problem has been fixed. Get in touch with
me for details.

s.

---

From: Tony Przygienda <[email-masked]>
Date: Wed, 01 Aug 2001 12:44:12 -0700

> be interested...yes, the problem has been fixed. Get in touch with

Stefano, thanks for clearing it up.  Original reaction has been correct,
this is not the  forum to wash dirty laundries or praise specific
implementations unless it affects the protocol specs ...

    thanks

    -- tony