--- a/nhrpd/nhrp_nhs.c
+++ b/nhrpd/nhrp_nhs.c
@@ -221,6 +221,15 @@ static int nhrp_reg_send_req(struct thre
 
 	nhrp_ext_request(zb, hdr, ifp);
 
+	/* Cisco auth extension */
+
+	if (if_ad->cisco_authentification) {
+		debugf(NHRP_DEBUG_COMMON, "NHS: cisco authentification %s", if_ad->cisco_authentification);
+		ext = nhrp_ext_push(zb, hdr, NHRP_EXTENSION_AUTHENTICATION | NHRP_EXTENSION_FLAG_COMPULSORY);
+		nhrp_auth_push(zb, hdr, if_ad->cisco_authentification);
+		nhrp_ext_complete(zb, ext);
+	}
+
 	/* Cisco NAT detection extension */
 	if (sockunion_family(&r->proto_addr) != AF_UNSPEC) {
 		nhs_proto = r->proto_addr;
--- a/nhrpd/nhrp_packet.c
+++ b/nhrpd/nhrp_packet.c
@@ -157,6 +157,29 @@ struct nhrp_cie_header *nhrp_cie_push(st
 	return cie;
 }
 
+struct nhrp_cisco_authentication_extension *nhrp_auth_push(struct zbuf *zb, struct nhrp_packet_header *hdr, char *auth)
+{
+	struct nhrp_cisco_authentication_extension *ext;
+	size_t auth_len = strlen(auth);
+
+	ext = zbuf_pushn(zb, auth_len + sizeof(ext->type));
+	if (!ext)
+		return NULL;
+
+	if (!hdr->extension_offset)
+		hdr->extension_offset =
+			htons(zb->tail - (uint8_t *)hdr
+			      - sizeof(struct nhrp_cisco_authentication_extension));
+
+	*ext = (struct nhrp_cisco_authentication_extension){
+		.type = htonl(NHRP_AUTHENTICATION_PLAINTEXT),
+	};
+	debugf(NHRP_DEBUG_COMMON, "nhrp_auth_push: AUTH LEN %d", auth_len);
+	memcpy(ext->secret, auth, auth_len);
+
+	return ext;
+}
+
 struct nhrp_cie_header *nhrp_cie_pull(struct zbuf *zb,
 				      struct nhrp_packet_header *hdr,
 				      union sockunion *nbma,
--- a/nhrpd/nhrp_vty.c
+++ b/nhrpd/nhrp_vty.c
@@ -344,6 +344,42 @@ DEFUN(if_nhrp_network_id, if_nhrp_networ
 	return CMD_SUCCESS;
 }
 
+DEFUN(if_nhrp_cisco_authentification, if_nhrp_cisco_authentification_cmd,
+	AFI_CMD " nhrp cisco-authentification <PASSW>",
+	AFI_STR
+	NHRP_STR
+	"Pass phrase for cisco-authentification\n"
+	"Specify password, max 8 symbols\n")
+{
+	VTY_DECLVAR_CONTEXT(interface, ifp);
+	struct nhrp_interface *nifp = ifp->info;
+	afi_t afi = cmd_to_afi(argv[0]);
+	nifp->afi[afi].cisco_authentification = calloc(MAX_AUTHENTIFICATION_LENGTH, sizeof(char));
+	snprintf(nifp->afi[afi].cisco_authentification, MAX_AUTHENTIFICATION_LENGTH, "%s", argv[3]->arg);
+	nhrp_interface_update(ifp);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(if_no_nhrp_cisco_authentification, if_no_nhrp_cisco_authentification_cmd,
+	"no " AFI_CMD " nhrp cisco-authentification [<PASSW>]",
+	NO_STR
+	AFI_STR
+	NHRP_STR
+	"Pass phrase for cisco-authentification\n"
+	"Specify password max 8 symbols\n")
+{
+	VTY_DECLVAR_CONTEXT(interface, ifp);
+	struct nhrp_interface *nifp = ifp->info;
+	afi_t afi = cmd_to_afi(argv[1]);
+
+	free(nifp->afi[afi].cisco_authentification);
+	nifp->afi[afi].cisco_authentification = NULL;
+	nhrp_interface_update(ifp);
+
+	return CMD_SUCCESS;
+}
+
 DEFUN(if_no_nhrp_network_id, if_no_nhrp_network_id_cmd,
 	"no " AFI_CMD " nhrp network-id [(1-4294967295)]",
 	NO_STR
@@ -1175,6 +1211,10 @@ static int interface_config_write(struct
 				vty_out(vty, " %s nhrp network-id %u\n", aficmd,
 					ad->network_id);
 
+			if (ad->cisco_authentification)
+				vty_out(vty, " %s nhrp cisco-authentification %s\n", aficmd,
+					ad->cisco_authentification);
+
 			if (ad->holdtime != NHRPD_DEFAULT_HOLDTIME)
 				vty_out(vty, " %s nhrp holdtime %u\n", aficmd,
 					ad->holdtime);
@@ -1279,4 +1319,6 @@ void nhrp_config_init(void)
 	install_element(INTERFACE_NODE, &if_no_nhrp_map_multicast_cmd);
 	install_element(INTERFACE_NODE, &if_nhrp_nhs_cmd);
 	install_element(INTERFACE_NODE, &if_no_nhrp_nhs_cmd);
+	install_element(INTERFACE_NODE, &if_nhrp_cisco_authentification_cmd);
+	install_element(INTERFACE_NODE, &if_no_nhrp_cisco_authentification_cmd);
 }
--- a/nhrpd/nhrpd.h
+++ b/nhrpd/nhrpd.h
@@ -113,6 +113,7 @@ struct nhrp_interface;
 
 #define MAX_ID_LENGTH			64
 #define MAX_CERT_LENGTH			2048
+#define MAX_AUTHENTIFICATION_LENGTH	9
 
 enum nhrp_notify_type {
 	NOTIFY_INTERFACE_UP,
@@ -345,6 +346,7 @@ struct nhrp_interface {
 		unsigned int holdtime;
 		struct nhrp_nhslist_head nhslist_head;
 		struct nhrp_mcastlist_head mcastlist_head;
+		char *cisco_authentification;
 	} afi[AFI_MAX];
 };
 
@@ -502,6 +504,9 @@ struct nhrp_cie_header *nhrp_cie_pull(st
 
 struct nhrp_extension_header *
 nhrp_ext_push(struct zbuf *zb, struct nhrp_packet_header *hdr, uint16_t type);
+
+struct nhrp_cisco_authentication_extension * nhrp_auth_push(struct zbuf *zb, struct nhrp_packet_header *hdr, char *auth);
+
 void nhrp_ext_complete(struct zbuf *zb, struct nhrp_extension_header *ext);
 struct nhrp_extension_header *nhrp_ext_pull(struct zbuf *zb,
 					    struct zbuf *payload);
