A bank backbone runs IS-IS with strict compliance requiring neighbor authentication, plus frequent access-layer flaps that trigger unwanted backbone SPF runs and slow convergence on link failures. Which IS-IS authentication and stability tuning approach secures and stabilizes this backbone?
Select an answer to reveal the explanation.
Short Explanation
You need both secure authentication and a way to absorb repeated flaps. HMAC protection at both levels plus fast hellos and exponential backoff gives you resilience: quick detection when links fail, without letting access-layer churn repeatedly disrupt the backbone.
Full Explanation
HMAC-based adjacency and LSP authentication provides cryptographic neighbor validation and protects the link-state database, while fast hellos detect failures quickly and exponential backoff dampens repeated SPF and LSP-generation work during access-layer flaps. Together, these settings meet the strict authentication requirement while helping the backbone converge quickly on real failures without recalculating on every transient flap. Adjacency-only HMAC leaves LSPs unauthenticated, so forged or replayed LSPs could still affect the database. Full HMAC with fixed aggressive SPF timers protects both authentication levels but can trigger repeated SPF work during flaps instead of progressively backing off. Standard hellos with full HMAC and exponential backoff can delay failure detection, undermining the need for faster convergence. Exam caveat: distinguish authentication scope from timer tuning, and remember that SPF throttling is not the same as partial route calculation for prefix-only changes; topology changes may require full SPF. Practical check: use show isis neighbors, show isis database detail, and show isis spf-log to verify neighbor detection, authenticated LSPs, and backoff behavior during and after flaps.