Skip to content

Fix ISIS authentication configuration for Cisco FNTs #6032

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
shpaulch wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Fix ISIS authentication configuration for Cisco FNTs #6032

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
ce913f4
Fix ISIS authentication configuration for Cisco FNTs
shpaulch Sep 12, 2026
01d40ba
Address review comments for ISIS FNTs
shpaulch Sep 12, 2026
7125b74
Remove ISIS authentication deviation globally
shpaulch Sep 15, 2026
7ce1bc2
Merge current main and resolve metadata protobuf conflict
shpaulch Sep 15, 2026
ddb8b66
Update feature/isis/otg_tests/isis_interface_hello_padding_enable_tes…
shpaulch Sep 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions feature/gnmi/tests/full_configuration_replace_test/metadata.textproto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,14 @@ uuid: "f28e7a1a-7ce4-4ccc-810e-1d6cc4eac21e"
plan_id: "gNMI-1.2"
description: "Benchmarking: Full Configuration Replace"
testbed: TESTBED_DUT_ATE_2LINKS
platform_exceptions: {
platform: {
vendor: CISCO
}
deviations: {
set_isis_auth_with_interface_authentication_container: true
}
}
platform_exceptions: {
platform: {
vendor: NOKIA
Expand Down
30 changes: 24 additions & 6 deletions ...ests/isis_interface_hello_padding_enable_test/isis_interface_hello_padding_enable_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ import (
"github.com/openconfig/featureprofiles/internal/otgutils"
"github.com/openconfig/ondatra/gnmi"
"github.com/openconfig/ondatra/gnmi/oc"
otgtelemetry "github.com/openconfig/ondatra/gnmi/otg"
"github.com/openconfig/ygnmi/ygnmi"
"github.com/openconfig/ygot/ygot"
)
Expand Down Expand Up @@ -129,10 +130,19 @@ func configureISIS(t *testing.T, ts *isissession.TestSession) {
isisIntfLevel.LevelNumber = ygot.Uint8(2)
isisIntfLevel.SetEnabled(true)
isisIntfLevel.Enabled = ygot.Bool(true)
isisIntfLevel.GetOrCreateHelloAuthentication().Enabled = ygot.Bool(true)
isisIntfLevel.GetHelloAuthentication().AuthPassword = ygot.String(password)
isisIntfLevel.GetHelloAuthentication().AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
isisIntfLevel.GetHelloAuthentication().AuthMode = oc.IsisTypes_AUTH_MODE_MD5
if deviations.SetISISAuthWithInterfaceAuthenticationContainer(ts.DUT) {
intfAuth := intf.GetOrCreateAuthentication()
intfAuth.Enabled = ygot.Bool(true)
intfAuth.AuthPassword = ygot.String(password)
intfAuth.AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
intfAuth.AuthMode = oc.IsisTypes_AUTH_MODE_MD5
} else {
helloAuth := isisIntfLevel.GetOrCreateHelloAuthentication()
helloAuth.Enabled = ygot.Bool(true)
helloAuth.AuthPassword = ygot.String(password)
helloAuth.AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
helloAuth.AuthMode = oc.IsisTypes_AUTH_MODE_MD5
}

isisIntfLevelTimers := isisIntfLevel.GetOrCreateTimers()
isisIntfLevelTimers.HelloInterval = ygot.Uint32(5)
Expand Down Expand Up @@ -218,14 +228,20 @@ func TestIsisInterfaceHelloPaddingEnable(t *testing.T) {
pcl := ts.DUTConf.GetNetworkInstance(deviations.DefaultNetworkInstance(ts.DUT)).GetProtocol(oc.PolicyTypes_INSTALL_PROTOCOL_TYPE_ISIS, isissession.ISISName)
fptest.LogQuery(t, "Protocol ISIS", isissession.ProtocolPath(ts.DUT).Config(), pcl)

ts.PushAndStart(t)
if err := ts.PushAndStart(t); err != nil {
t.Fatalf("PushAndStart failed: %v", err)
}

// Do not consume the IS-IS adjacency timeout while either end of the link
// is still becoming operational after the OTG configuration push.
gnmi.Await(t, ts.DUT, gnmi.OC().Interface(ts.DUTPort1.Name()).OperStatus().State(), 2*time.Minute, oc.Interface_OperStatus_UP)
gnmi.Await(t, otg, gnmi.OTG().Port(ts.ATEPort1.ID()).Link().State(), 2*time.Minute, otgtelemetry.Port_Link_UP)
Comment thread
shpaulch marked this conversation as resolved.

statePath := isissession.ISISPath(ts.DUT)
intfName := ts.DUTPort1.Name()
if deviations.ExplicitInterfaceInDefaultVRF(ts.DUT) || deviations.InterfaceRefInterfaceIDFormat(ts.DUT) {
intfName += ".0"
}
deadline := time.Now().Add(1 * time.Minute)
t.Run("Isis telemetry", func(t *testing.T) {

// Checking adjacency
Expand Down Expand Up @@ -309,6 +325,7 @@ func TestIsisInterfaceHelloPaddingEnable(t *testing.T) {
})
t.Run("Adjacency state checks", func(t *testing.T) {
adjPath := statePath.Interface(intfName).Level(2).Adjacency(ateSysID)
deadline := time.Now().Add(time.Minute)

if got := gnmi.Get(t, ts.DUT, adjPath.SystemId().State()); got != ateSysID {
t.Errorf("FAIL- Expected neighbor system id not found, got %s, want %s", got, ateSysID)
Expand Down Expand Up @@ -374,6 +391,7 @@ func TestIsisInterfaceHelloPaddingEnable(t *testing.T) {
})
t.Run("System level counter checks", func(t *testing.T) {
if deviations.MissingValueForDefaults(ts.DUT) {
deadline := time.Now().Add(time.Minute)
missingValueForDefaults := deviations.MissingValueForDefaults(ts.DUT)
sysCounts := isissession.ISISPath(ts.DUT).Level(2).SystemLevelCounters()
validators := []check.Validator{
Expand Down
1 change: 1 addition & 0 deletions feature/isis/otg_tests/isis_interface_hello_padding_enable_test/metadata.textproto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@ platform_exceptions: {
isis_interface_level1_disable_required: true
isis_dis_sysid_unsupported: true
isis_database_overloads_unsupported: true
set_isis_auth_with_interface_authentication_container: true
}
}
platform_exceptions: {
Expand Down
22 changes: 16 additions & 6 deletions ...ure/isis/otg_tests/isis_interface_level_passive_test/isis_interface_level_passive_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,11 +104,19 @@ func configureISIS(t *testing.T, ts *isissession.TestSession) {
isisIntfLevel2.LevelNumber = ygot.Uint8(2)
isisIntfLevel2.SetEnabled(true)
isisIntfLevel2.Enabled = ygot.Bool(true)

isisIntfLevel2.GetOrCreateHelloAuthentication().Enabled = ygot.Bool(true)
isisIntfLevel2.GetHelloAuthentication().AuthPassword = ygot.String(password)
isisIntfLevel2.GetHelloAuthentication().AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
isisIntfLevel2.GetHelloAuthentication().AuthMode = oc.IsisTypes_AUTH_MODE_MD5
if deviations.SetISISAuthWithInterfaceAuthenticationContainer(ts.DUT) {
intfAuth := intf.GetOrCreateAuthentication()
intfAuth.Enabled = ygot.Bool(true)
intfAuth.AuthPassword = ygot.String(password)
intfAuth.AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
intfAuth.AuthMode = oc.IsisTypes_AUTH_MODE_MD5
} else {
helloAuth := isisIntfLevel2.GetOrCreateHelloAuthentication()
helloAuth.Enabled = ygot.Bool(true)
helloAuth.AuthPassword = ygot.String(password)
helloAuth.AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
helloAuth.AuthMode = oc.IsisTypes_AUTH_MODE_MD5
}

isisIntfLevel2.GetOrCreateAf(oc.IsisTypes_AFI_TYPE_IPV4, oc.IsisTypes_SAFI_TYPE_UNICAST).Enabled = ygot.Bool(true)
isisIntfLevel2.GetOrCreateAf(oc.IsisTypes_AFI_TYPE_IPV4, oc.IsisTypes_SAFI_TYPE_UNICAST).Metric = ygot.Uint32(v4Metric)
Expand Down Expand Up @@ -184,7 +192,9 @@ func TestISISLevelPassive(t *testing.T) {
pcl := ts.DUTConf.GetNetworkInstance(deviations.DefaultNetworkInstance(ts.DUT)).GetProtocol(oc.PolicyTypes_INSTALL_PROTOCOL_TYPE_ISIS, isissession.ISISName)
fptest.LogQuery(t, "Protocol ISIS", isissession.ProtocolPath(ts.DUT).Config(), pcl)

ts.PushAndStart(t)
if err := ts.PushAndStart(t); err != nil {
t.Fatalf("PushAndStart failed: %v", err)
}
time.Sleep(time.Minute * 2)

@gemini-code-assist gemini-code-assist Bot Sep 12, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

According to the Repository Style Guide, static time.Sleep calls after pushing configurations or starting protocols are an anti-pattern and must be avoided. Instead, use otgutils.WaitForARP to dynamically wait for IPv4 neighbor resolution before proceeding. Avoid waiting for IPv6 neighbor resolution (ND) if there are no native IPv6 flows destined for a configured VLAN or interface.

Suggested change
if err := ts.PushAndStart(t); err != nil {
t.Fatalf("PushAndStart failed: %v", err)
}
time.Sleep(time.Minute * 2)
if err := ts.PushAndStart(t); err != nil {
t.Fatalf("PushAndStart failed: %v", err)
}
otgutils.WaitForARP(t, otg, ts.ATETop, "IPv4")
References
  1. Avoid using static sleeps after pushing configurations or starting protocols in OTG tests. Instead, rely on dynamic waiting mechanisms like WaitForARP. (link)
  2. Avoid waiting for IPv6 neighbor resolution (ND) in OTG tests if there are no native IPv6 flows destined for a configured VLAN or interface. (link)


statePath := isissession.ISISPath(ts.DUT)
Expand Down
1 change: 1 addition & 0 deletions feature/isis/otg_tests/isis_interface_level_passive_test/metadata.textproto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ platform_exceptions: {
isis_interface_level_passive_unsupported: true
isis_dis_sysid_unsupported: true
isis_database_overloads_unsupported: true
set_isis_auth_with_interface_authentication_container: true
}
}
platform_exceptions: {
Expand Down
21 changes: 16 additions & 5 deletions ...isis/otg_tests/isis_metric_style_wide_enabled_test/isis_metric_style_wide_enabled_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,10 +115,19 @@ func configureISIS(t *testing.T, ts *isissession.TestSession) {
isisIntfLevel.LevelNumber = ygot.Uint8(2)
isisIntfLevel.SetEnabled(true)
isisIntfLevel.Enabled = ygot.Bool(true)
isisIntfLevel.GetOrCreateHelloAuthentication().Enabled = ygot.Bool(true)
isisIntfLevel.GetHelloAuthentication().AuthPassword = ygot.String(password)
isisIntfLevel.GetHelloAuthentication().AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
isisIntfLevel.GetHelloAuthentication().AuthMode = oc.IsisTypes_AUTH_MODE_MD5
if deviations.SetISISAuthWithInterfaceAuthenticationContainer(ts.DUT) {
intfAuth := intf.GetOrCreateAuthentication()
intfAuth.Enabled = ygot.Bool(true)
intfAuth.AuthPassword = ygot.String(password)
intfAuth.AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
intfAuth.AuthMode = oc.IsisTypes_AUTH_MODE_MD5
} else {
helloAuth := isisIntfLevel.GetOrCreateHelloAuthentication()
helloAuth.Enabled = ygot.Bool(true)
helloAuth.AuthPassword = ygot.String(password)
helloAuth.AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
helloAuth.AuthMode = oc.IsisTypes_AUTH_MODE_MD5
}

isisIntfLevelTimers := isisIntfLevel.GetOrCreateTimers()
isisIntfLevelTimers.HelloInterval = ygot.Uint32(5)
Expand Down Expand Up @@ -200,7 +209,9 @@ func TestISISWideMetricEnabled(t *testing.T) {
pcl := ts.DUTConf.GetNetworkInstance(deviations.DefaultNetworkInstance(ts.DUT)).GetProtocol(oc.PolicyTypes_INSTALL_PROTOCOL_TYPE_ISIS, isissession.ISISName)
fptest.LogQuery(t, "Protocol ISIS", isissession.ProtocolPath(ts.DUT).Config(), pcl)

ts.PushAndStart(t)
if err := ts.PushAndStart(t); err != nil {
t.Fatalf("PushAndStart failed: %v", err)
}
time.Sleep(time.Minute * 2)

@gemini-code-assist gemini-code-assist Bot Sep 12, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

According to the Repository Style Guide, static time.Sleep calls after pushing configurations or starting protocols are an anti-pattern and must be avoided. Instead, use otgutils.WaitForARP to dynamically wait for IPv4 neighbor resolution before proceeding. Avoid waiting for IPv6 neighbor resolution (ND) if there are no native IPv6 flows destined for a configured VLAN or interface.

Suggested change
if err := ts.PushAndStart(t); err != nil {
t.Fatalf("PushAndStart failed: %v", err)
}
time.Sleep(time.Minute * 2)
if err := ts.PushAndStart(t); err != nil {
t.Fatalf("PushAndStart failed: %v", err)
}
otgutils.WaitForARP(t, otg, ts.ATETop, "IPv4")
References
  1. Avoid using static sleeps after pushing configurations or starting protocols in OTG tests. Instead, rely on dynamic waiting mechanisms like WaitForARP. (link)
  2. Avoid waiting for IPv6 neighbor resolution (ND) in OTG tests if there are no native IPv6 flows destined for a configured VLAN or interface. (link)


statePath := isissession.ISISPath(ts.DUT)
Expand Down
1 change: 1 addition & 0 deletions feature/isis/otg_tests/isis_metric_style_wide_enabled_test/metadata.textproto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@ platform_exceptions: {
isis_interface_level1_disable_required: true
isis_dis_sysid_unsupported: true
isis_database_overloads_unsupported: true
set_isis_auth_with_interface_authentication_container: true
}
}
platform_exceptions: {
Expand Down
3 changes: 2 additions & 1 deletion feature/mpls/otg_tests/label_block/metadata.textproto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,5 +28,6 @@ platform_exceptions: {
}
deviations: {
sr_igp_config_unsupported: true
set_isis_auth_with_interface_authentication_container: true
}
}
}
21 changes: 16 additions & 5 deletions feature/mpls/otg_tests/label_block/mpls_label_block_with_isis_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -213,10 +213,19 @@ func configureISISMPLSSR(t *testing.T, ts *isissession.TestSession) {
isisIntfLevel.LevelNumber = ygot.Uint8(2)
isisIntfLevel.SetEnabled(true)
isisIntfLevel.Enabled = ygot.Bool(true)
isisIntfLevel.GetOrCreateHelloAuthentication().Enabled = ygot.Bool(true)
isisIntfLevel.GetHelloAuthentication().AuthPassword = ygot.String(password)
isisIntfLevel.GetHelloAuthentication().AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
isisIntfLevel.GetHelloAuthentication().AuthMode = oc.IsisTypes_AUTH_MODE_MD5
if deviations.SetISISAuthWithInterfaceAuthenticationContainer(ts.DUT) {
intfAuth := intf.GetOrCreateAuthentication()
intfAuth.Enabled = ygot.Bool(true)
intfAuth.AuthPassword = ygot.String(password)
intfAuth.AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
intfAuth.AuthMode = oc.IsisTypes_AUTH_MODE_MD5
} else {
helloAuth := isisIntfLevel.GetOrCreateHelloAuthentication()
helloAuth.Enabled = ygot.Bool(true)
helloAuth.AuthPassword = ygot.String(password)
helloAuth.AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
helloAuth.AuthMode = oc.IsisTypes_AUTH_MODE_MD5
}

isisIntfLevelTimers := isisIntfLevel.GetOrCreateTimers()
isisIntfLevelTimers.HelloInterval = ygot.Uint32(5)
Expand Down Expand Up @@ -442,7 +451,9 @@ func TestMPLSLabelBlockWithISIS(t *testing.T) {

}

ts.PushAndStart(t)
if err := ts.PushAndStart(t); err != nil {
t.Fatalf("PushAndStart failed: %v", err)
}
time.Sleep(time.Minute * 2)

@gemini-code-assist gemini-code-assist Bot Sep 12, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

According to the Repository Style Guide, static time.Sleep calls after pushing configurations or starting protocols are an anti-pattern and must be avoided. Instead, use otgutils.WaitForARP to dynamically wait for IPv4 neighbor resolution before proceeding. Avoid waiting for IPv6 neighbor resolution (ND) if there are no native IPv6 flows destined for a configured VLAN or interface.

Suggested change
if err := ts.PushAndStart(t); err != nil {
t.Fatalf("PushAndStart failed: %v", err)
}
time.Sleep(time.Minute * 2)
if err := ts.PushAndStart(t); err != nil {
t.Fatalf("PushAndStart failed: %v", err)
}
otgutils.WaitForARP(t, otg, ts.ATETop, "IPv4")
References
  1. Avoid using static sleeps after pushing configurations or starting protocols in OTG tests. Instead, rely on dynamic waiting mechanisms like WaitForARP. (link)
  2. Avoid waiting for IPv6 neighbor resolution (ND) in OTG tests if there are no native IPv6 flows destined for a configured VLAN or interface. (link)


// Checking ISIS
Expand Down
18 changes: 13 additions & 5 deletions internal/gnmi/setup/setup.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -240,11 +240,19 @@ func BuildBenchmarkingConfig(t *testing.T) *oc.Root {

isisIntfLevel := isisIntf.GetOrCreateLevel(2)
isisIntfLevel.Enabled = ygot.Bool(true)
isisIntfLevelAuth := isisIntfLevel.GetOrCreateHelloAuthentication()
isisIntfLevelAuth.Enabled = ygot.Bool(true)
isisIntfLevelAuth.AuthPassword = ygot.String(authPassword)
isisIntfLevelAuth.AuthMode = oc.IsisTypes_AUTH_MODE_MD5
isisIntfLevelAuth.AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
if deviations.SetISISAuthWithInterfaceAuthenticationContainer(dut) {
isisIntfAuth := isisIntf.GetOrCreateAuthentication()
isisIntfAuth.Enabled = ygot.Bool(true)
isisIntfAuth.AuthPassword = ygot.String(authPassword)
isisIntfAuth.AuthMode = oc.IsisTypes_AUTH_MODE_MD5
isisIntfAuth.AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
} else {
isisIntfLevelAuth := isisIntfLevel.GetOrCreateHelloAuthentication()
isisIntfLevelAuth.Enabled = ygot.Bool(true)
isisIntfLevelAuth.AuthPassword = ygot.String(authPassword)
isisIntfLevelAuth.AuthMode = oc.IsisTypes_AUTH_MODE_MD5
isisIntfLevelAuth.AuthType = oc.KeychainTypes_AUTH_TYPE_SIMPLE_KEY
}

isisIntfLevelTimers := isisIntfLevel.GetOrCreateTimers()
isisIntfLevelTimers.HelloInterval = ygot.Uint32(1)
Expand Down
Loading