CCIE OCG: IS-IS (Chapter 10)

IS-IS Terminology

• End System (ES) = a host.
• Intermediate System (IS) = a router.
• System = a network node.
• Circuit = an interface.
• Domain = an autonomous system.

NSAP Addressing

• An NSAP address is assigned to the entire network node, not to individual interfaces.
• A single node requires only one NSAP address, regardless of how many network interfaces it uses.
• Two parts: the Initial Domain Part (IDP) and the Domain Specific Part (DSP).
• IDP = Authority and Format Identifier (AFI) and the Initial Domain Identifier (IDI).
• IDI is indicated by AFI and might even be omitted.
• AFI + IDI = the routing domain.
• The System ID (6 octects) is the unique identifier of the node itself.
• NSEL identifies the particular service in or above the network layer.
• In typical IS-IS deployments, the addressing uses the AFI of 49 in which the length and meaning of the HO-DSP field are entirely up to the administrator.
• If the value of the SEL octet is 0, no particular service is being addressed, and the entire NSAP address simply identifies the destination node itself without referring to any particular service on that node.

Example: 49.0001.1234.5678.3333.00.

• The AFI is 49, signifying a local addres.
• The 0001 is the area number.
• The 1234.5678.3333 is the System ID of the node.
• The trailing 00 is the SEL value.

The use of the dot, however, is arbitrary, as long as it separates groups of integer octet length.
Therefore, all the following notations represent the same address:

• 49.0001.1234.5678.3333.00
• 4900.0112.3456.7833.3300
• 49.00.01.12.34.56.78.33.33.00
• 49000112.34.5678.33.3300
• 49000112345678333300

A Cisco router rewrites the address into the notation used in the first line.

Levels of Routing

• Level 0 routing: Routing between two ES nodes on the same link, or between an ES
  node and its nearest IS.
• Level 1 routing: Routing between ES nodes in a single area of a domain.
• Level 2 routing: Routing between ES nodes in different areas of a domain.
• Level 3 routing: Routing between ES nodes in different domains.
• Both ES and IS send a periodic Hello message advertising their existence.
• Aptly named, Hellos sent by ES nodes are called ES Hello (ESH), while Hellos sent by IS nodes are called IS Hello (ISH).
• On Level 1, IS nodes collect lists of all ES nodes directly attached to them, and advertise these lists to each other.
• On Level 2, IS nodes do not advertise the list of connected ES nodes anymore. Instead, in this level, IS nodes exchange area prefixes to learn how to reach particular areas.
• If a Level 1 IS determines that the packet’s destination ES is in a different area, it will forward the packet toward the nearest IS capable of Level 2 routing, regardless of the destination area.
• Hence, Level 1 routing can be described as routing by System ID, while Level 2 routing can be described as routing by area prefix.

IS-IS Metrics, Levels, and Adjacencies

• Four metric types:

1. Default: Required to be supported by all IS-IS implementations; usually relates to the bandwidth of the link (higher value represents a slower link).
2. Delay: Relates to the transit delay on the link.
3. Expense: Relates to the monetary cost of carrying data through the link.
4. Error: Relates to the residual bit error rate of the link.

• Most IS-IS implementations today support only the default metric.
• Cisco IS-IS implementation assigns all interfaces the default metric of 10, regardless of their bandwidth.
• Cisco IOS does not automatically recalculate an interface's bandwidth into its IS-IS metric.
• Narrow metrics: network metric path of 6 bits (1-63), and the complete path metric of 10 bits (1-1023).
• Wide metrics: 24 bits for the interface metric and 32 bits for the entire path metric.
• IS-IS routers operate on each routing level independently.
• For each level, an IS-IS router establishes separate adjacencies with its neighbors running on the same level, and maintains a separate link-state database.
• Each router belongs to a single area (only one NET that carries the area identifier).
• Level 1 adjacencies are created only between routers with the same area identifier.

IS-IS Packet Types

Four basic packet types:

• Hello packet
• Link State PDU
• Complete Sequence Numbers PDU (CSNP)
• Partial Sequence Numbers PDU (PSNP)

Hello Packets

• Also denoted as IIH (IS-IS Hello) discover and maintain IS-IS neighbors.
• On broadcast-type networks, IS-IS routers use separate Hello packets for L1 and L2 adjacencies.
• On point-to-point type interfaces, a single L1L2 Hello is used.
• Sent periodically every 10 seconds by default.
• Hold time = Hello multiplier x Hello time.
• By default, Hold time = 3 x 10 seconds = 30 seconds.
• The timers do not need to match on neighboring routers.
• On a DIS, the individual timers are always one-third of the configured timers.

Link State PDUs

• There are no different types of LSPs.
• Different network objects are described by distinct Type-Length-Value (TLV) records inside an LSP.
• LSPs are uniquely identified by three parts:

1. System ID of the router that originated the LSP.
2. Pseudonode ID that differentiates between the LSP describing the router itself and the LSPs for multiaccess networks in which the router is a Designated IS.
3. LSP Number denoting the fragment number of the LSP.

• LSPID = System ID + Pseudonode ID + LSP Number.
• For LSPs that describe routers themselves, the Pseudonode ID is always set to 0.
• Each LSP has a sequence number, incremented at each change.
• The LSP with the higher sequence number is more recent.
• Each LSP has a Remaining Lifetime value (20 minutes).
• IS-IS routers refresh their self-originated LSPs every 15 minutes.
• Flooding an empty LSP with the Remaining Lifetime set to 0 is called an LSP purge.
• After this timer expires, a router is required to wait at least another ZeroAgeLifetime (60 seconds) before flushing the LSP.
• If putting all TLV records into a single LSP would cause it to exceed the MTU, the router will simply create multiple LSPs.
• Fragmentation is performed only by the router that originates the LSP.
• Fragmentation is signified by an increasing LSP Number, starting from 0.
• After the LSP is flooded, it must not be modified by any other router, and also not be defragmented and/or refragmented.
• The MTU on interfaces must be identical.

R1# show isis database
IS-IS Level-1 Link State Database:
LSPID        LSP Seq Num  LSP Checksum  LSP Holdtime   ATT/P/OL
R1.00-00   * 0x00000002   0x4BD3        676            0/0/0
R1.00-01   * 0x00000002   0xF403        708            0/0/0
R1.00-02   * 0x00000003   0xF86B        643            0/0/0
R2.00-00     0x00000003   0x449C        574            0/0/0

• The router automatically substitutes the numerical System ID for the router's hostname to make the output easily readable.
• Each LSP is identified by the triplet SystemID.PseudonodeID-Fragment in the LSPID column.
• For LSPs that describe routers, the Pseudonode ID is always 0.
• Entries marked with the asterisk sign are the LSPs that the router has originated itself.
• A directly connected network is marked by an "IP" label.
• A neighboring router is marked by an "IS" label and identified by its System ID and Pseudonode ID.
• All metrics default to 10.
• Each IS-IS router originates only a single LSP (plus Pseudonode LSPs if it is a DIS), and has therefore only a single or a few self-originated LSPs to age and refresh.

Complete and Partial Sequence Numbers PDUs

• Used to synchronize link-state databases.
• Similar to OSPF DBD packets.
• Purpose is to advertise a complete list of LSPs in the sender's LSDB.
• Receivers can flood a newer or missing LSP if they have one, or request an LSP if they find it missing in their own database.
• If the sender’s link-state database contains so many LSPs that listing them all in a single CSNP packet would cause it to exceed the MTU, multiple CSNPs are sent.
• For this purpose, individual LSPIDs are advertised.
• LSPIDs range from 0000.0000.0000.00-00 to FFFF.FFFF.FFFF.FF-FF.
• The bold part is the System ID, the following octet is the Pseudonode ID, and the octet following the dash is the LSP Number ID.
• On point-to-point links, CSNP packets are exchanged usually only during initial adjacency buildup.
• On broadcast networks, CSNP packets are originated periodically by the DIS.
• PSNP packets are functionally similar to OSPF LSR and LSAck packets.
• PSNP packets are used to request an LSP or acknowledge its successful arrival.

IS-IS Operation over Different Network Types

• IS-IS natively supports only broadcast and point-to-point network types.
• Running IS-IS over any Layer 2 technology works right out of the box.
• No special provision to operate over partially meshed hub-and-spoke Frame Relay.
• Recommended action to configure point-to-point subinterfaces and IS-IS point-to-point links.
• Three possible adjacency states:

1. Down - The initial state. No IIHs have been received.
2. Initializing - IIHs have been received but the communication may not be bidirectional.
3. Up - IIHs have been received and it is certain that the neighbor is also receiving IIHs.

Over Point-to-Point Links 

• IS-IS expects to detect a single neighbor, bring up the adjacency, and synchronize the LSDB.
• A three-way handshake to verify bidirectional connectivity.
• The three-way handshake is simple:

1. Router A <--- (Down) Router B + Router A (Initializing) ---> Router B
2. Router A <--- (Up) Router B
3. Router A (Up) ---> Router B

• After the adjacency is declared as Up, routers will attempt to synchronize their link-state
• databases.
• Every LSP sent over a point-to-point link, whether during the initial database synchronization or anytime later when it is updated or purged, must be acknowledged, and this is done using PSNP or CSNP packets.

Over Broadcast Links

• Similar to OSPF.
• An IS-IS router lists the MAC address (or SNPAs) of all neighboring routers it hears in the IIH.
• If a router receives an IIH from a neighbor and finds its own SNPA indicated in the IIH, it knows that the routers can see each other, and can move the adjacency to the Up state.
• If IIH packets from a neighbor do not contain the receiving router’s SNPA, the adjacency is kept in the Initializing state.
• IS-IS elects on Designated IS (DIS) for each broadcast network.
• No backup DIS.
• Selection criteria:

1. The router with the highest interface priority.
2. The router with the highest SNPA.
3. If SNPAs are not comparable, the router with the highest System ID.

• 0 is a valid priority as well, and it does not exclude a router from participating in DIS election.
• DIS is preemptive.
• The DIS election is effectively performed with each received IIH.
• All routers on a common broadcast segment become fully adjacent, regardless of which is the DIS.
• DIS has two important operations:

1. Help routers synchronize on broadcast networks.
2. Represent the broadcast segment in the LSDB as a standalone object - the Pseudonode.

• Synchronization: The DIS creates and sends a CSNP packet in regular intervals (10 seconds by default) on the segment. This CSNP packet lists all LSPs present in the DIS’s link-state database. Other routers on the segment receive this CSNP and compare it to the index of their own link-state database.
• The DIS is not a relay of LSPs; rather, it is a reference point of comparison.
• If a router misses an LSP known by the DIS, or if the LSP is older than the one known by the DIS, the router will request the newer LSP through PSNP and the DIS will flood it.
• If a router knows about a newer LSP than the one known by the DIS, or if the DIS seems to miss it completely, the router will simply flood the LSP onto the network.
• No explicit acknowledgment by the DIS is sent.
• If the LSP has arrived, the DIS will advertise it in its next periodic CSNP, and this CSNP serves as an implicit acknowledgment.
• To exist as a pseudonode in a link-state database, a broadcast network must have its own LSP.
• It is the responsibility of the DIS to originate and flood the Pseudonode LSP.

Areas in IS-IS

• The entire node with all its interfaces belongs only to a single area.
• IS-IS uses the entire high-order part of the NSAP address up to the start of System ID as the area identifier.
• Nodes in a single area must obviously be addressed using the same NSAP format, the same initial domain identifier, and the same internal area number (high-order domain specific part).
• IS-IS routers maintain separate and independent Level 1 (L1 in short) and Level 2 (L2 in short) link-state databases, and do not allow LSPs from one database to ever leak into the other.
• L1 routing is a process of intra-area routing, delivering packets between stations located in the same area.
• Each L1 router advertises its directly connected IP networks in its L1 LSP.
• L2 routing is a process of inter-area routing, delivering packets between stations located in different areas.
• L2 backbone must be contiguous and pervade all areas within the domain.
• Each L2 router advertises its directly connected IP networks to achieve contiguous IP connectivity in the backbone, plus all other L1 routes from its own area with appropriate metrics , to advertise IP networks present in particular areas.
• L2 routers establish adjacencies regardless of their areas.
• L1 routers in an area behave as if they were in an OSPF Not So Stubby-Totally Stubby (NSSA-TS) area.
• IS-IS on Cisco routers defaults to L1L2 operation, meaning that both L1 and L2 routing are enabled by default.
• ATT/P/OL = ATTached, Partition repair, and Overload flags.
• ATT = 1 means that the router can reach other areas.
• L1 routers automatically install a default route toward their nearest L1L2 router whose ATT bit set.
• Cisco routers do not support the Partition repair function (always set to 0).
• The Overload bit was originally intended to signal that the router is, for whatever reason, unable to store all LSPs in its memory, and that its link-state database is overloaded.
• If a router’s LSP has the O bit set, the SPF computation on other routers will ignore this router when computing shortest paths to other routers and their networks.
• The router will not be used as a transit router to other routers, but it still will be considered as a router usable to reach its own directly connected networks.
• Looking at any L2 LSP in isolation, you do not even know which prefix is directly connected to the router and which one is an L1 prefix “uptaken” into L2—they are both advertised in the same manner.

Authentication in IS-IS 

• IIH packets are authenticated independently of LSP, CSNP, and PSNP packets.
• L1 LSPs must use the same area password or the level-1 authentication password.
• L2 LSPs must use the same domain password or the level-2 authentication password.
• IIH authentication is configured independently of non-IIH.
• IIH authentication is configured directly under the interface, so different neighbors can use different passwords.
• Non-IIH must use the same authentication type and the same password.
• If IIH packets received from a neighboring router fail authentication, no adjacency will be created between this router and the neighbor.
• As a result, these routers will not accept LSP, CSNP, or PSNP packets from each other, as these packets are accepted only from routers in the Up adjacency state.
• If IIH packets pass the authentication but the non-IIH packets fail it, the routers will be in the Up adjacency state but they will not be able to synchronize their link-state databases.

IPv6 Support in IS-IS

• IS-IS does not require a particular Layer 3 protocol to carry its packets.
• IS-IS can also carry information about destinations described by different address families in a single instance.
• Rules about advertising IPv6 prefixes in L1 and L2 LSPs are identical to those for IPv4.
• It is not necessary to start an additional IS-IS process to carry IPv6 routes along with IPv4.
• Instead, the existing IS-IS process is simply instructed to advertise IPv6 routes along with other information it is already advertising.

Configuring IS-IS

key chain ISISAuth
key 1
key-string S3cretP4ss
!
interface Serial0/0/0
description => To R2 <=
ip address 10.1.12.1 255.255.255.0
ip router isis
isis authentication mode md5
isis authentication key-chain ISISAuth
isis three-way-handshake ietf
!
router isis
net 49.0001.0000.0000.0001.00
is-type level-1
authentication mode md5
authentication key-chain ISISAuth
metric-style wide
log-adjacency-changes all

• Interfaces are added to IS-IS directly by configuring them with the ip router isis command. IS-IS has no network command; therefore, per-interface configuration is the way of adding networks and interfaces into IS-IS.
• If a router is configured for L1L2 operation, it will by default try to establish both L1 and L2 adjacencies over all active IS-IS interfaces.
• It is possible to limit its operation only to the selected level. That will prevent the router from sending and processing packets of a different routing level over that interface (Example: isis circuit-type level-2-only).