IS-IS Single-Area Networks

Before you start the hands-on part of this module, you should load the appropriate configuration and verify that the testbed is up and running by executing the corresponding robot file:

In order to get a better understanding, the lab setup is shown in the picture below.

IS-IS, or Intermediate System to Intermediate System, is an open standard routing protocol. In IS-IS, a router is called an Intermediate System (IS). The original specification was published as ISO 10589 and describes a way to route datagrams as part of the OSI stack.

The protocol relies on device level addresses called network service access point (NSAP) addresses. Therefore, IS-IS does not use interface addresses. An interesting aspect is, that IS-IS runs at the link layer of the OSI model. The basic idea is that it does not make a lot of sense for a routing protocol to operate the control plane over the same network layer as the protocol it is doing the route calculation for, e.g., IPv4. IETF later defined the use of OSI IS-IS for IP routing in RFC 1195.

IS-IS is a link-state routing protocol which uses three fundamental different types of protocol data units (PDUs) to exchange information between routers:

Based on the information stored in the LSDB, IS-IS calculates the best loop-free path to each destination with the Dijkstra Shortest Path First (SPF) algorithm.

IS-IS supports two levels of routing hierarchy known as Level-1 and Level-2, where Level-2 is considered to be the backbone of the network, while Level-1 forms areas to improve scalability. An IS-IS router can establish IS-IS adjacencies to another router either using Level-1 only, Level-2 only, or Level-1 and Level-2 at the same time.

The IS-IS configuration is part of the routing protocol configuration within a routing instance, i.e., the corresponding CLI commands have the syntax set instance <instance> protocol isis <attribute> <value>.

There is a variety of parameters that can be set while configuring IS-IS, but let’s start with the most basic ones. In order to get IS-IS running, you must configure

The area address can be represented in 1, 3, 5, or 13 byte format and must include the area length in bits, e.g., using a 3-byte format, the area address looks like 49.0001/24. The first byte of the area address is called the authority format identifier (AFI) and you will often see it set to 49, which indicates private assignment. IS-IS routers must have identical area address in order to form Level-1 adjacencies.

The system ID is a 6-byte identifier which must be unique within the routing domain.

You should not see any adjacencies at all. But what’s the problem? Assuming everything is configured correctly, let’s check whether the remote switch is sending any useful packets or not.

Configuring IS-IS authentication is not mandatory but it is necessary that both sides agree on whether to authenticate or not. If authentication is used, the authentication type, key-id and key-string need to match.

Once the IS-IS adjacencies are up, we can inspect the IS-IS database for information learned from the neighbors. The IS-IS database must be the same on all routers within the same Level-1 area and on all routers in Level-2. A high-level summary of the database can be seen using the show isis database command:

From the output, we can see that there are three IS-IS routers in the Level-1 network. You may notice that the LSP-ID for all other IS-IS speakers is represented with a node name, while the local router is represented with its system-ID. This system-ID to hostname mapping is dynamically distributed in IS-IS and can be viewed using the show isis hostname command:

In order to better understand IS-IS operation, let’s explore the IS-IS link-state database in more detail. IS-IS maintains a separate database for Level-1 and Level-2. The entries in the database represent the IS-IS Link State PDU (LSP) where the LSP ID takes the form

system-ID.XX-YY

where

For each router in the corresponding level, there should be one LSP with N-selector set to 00, for example

The content of a specific LSP can be viewed using the show isis database command with either the lsp id <lsp-id> or system <hostname> option:

IS-IS uses Type Length Value (TLV) format to encode information. This mechanism is very flexible and allows enhancements to be implemented easily. If there is a new feature, then a new TLV has to be defined and added to the LSPs. By default, IS-IS supports both IPv4 (TLV 135) and IPv6 (TLV 236). The LSP contains the view of the network of corresponding node including

Based on the link-state database, IS-IS uses the SPF algorithm to calculate the best path to each destination. The best path is the one with the lowest total metric to the destination. As IS-IS is independent of IP addresses, the result of the SPF calculation reflects a topology based on system IDs:

Now that we have IS-IS protocol up and running, let’s get back to the two-level network hierarchy that IS-IS provides. A network can be split into IS-IS areas. All routers within a single area are called Level-1 (L1) router. All routers in the backbone area are called Level-2 (L2) routers. For L1 routers to reach destinations outside of its area, there has to be at least one L1L2 router, i.e., a router within the L1 area that also connects to the L2 backbone.

In RBFS, there is no global command to enable or disable the IS-IS level. Association to a level is configured on a per-interface bases.

We remember that the loopback IPv4 address of router R4 is 192.168.0.4/32. Let’s take a look at the routing table for this destination:

As R1 is now a Level-1 only router, it does not get any routing information from outside the area. But reachability is still available through the default route via R2 and R3. However, if we inspect the LSP of R2 again, we won’t find any reachability TLV for 0.0.0.0/0:

In IS-IS, a L1L2 router that has an adjacency to a L2 router outside of its own area, informs all L1 router that it is a possible exit point by setting the Attached bit in the LSP header. For a L1 router, it is possible to skip evaluation of attached bit and thus not install any default router. The corresponding command is

If you have completed the exercise, you can check the results by executing