Skip to content
Log in Sign up My account

1.2 and 1.3 IS-IS and EIGRP Design

Blueprint 1.2: Stable, secure, and scalable routing designs for IS-IS

  • Level 1, Level 2 and Level 1/2 placement, the attached bit and route leaking
  • Metric style, network type, DIS behaviour, timers and prefix suppression
  • Authentication and overload bit for stability and security
  • Multi-topology versus single-topology IPv6

Blueprint 1.3: Stable, secure, and scalable routing designs for EIGRP

  • Query scoping with summarization, stubs and distribute lists
  • Hub-and-spoke, DMVPN and multi-site designs
  • Named mode, authentication, metrics and load balancing choices
  • Convergence: feasible successors, stuck-in-active avoidance

Both protocols are single-administration IGPs that scale by limiting the reach of failures. IS-IS does it with levels, EIGRP with queries. Protocol mechanics are in ENCOR EIGRP versus OSPF and the ENARSI EIGRP pages (DUAL and stubs, metrics and load balancing, named mode). This page is about when and how to use them.

IS-IS design

Why IS-IS appears in enterprise designs

IS-IS runs directly over Layer 2 (CLNS), not over IP, so it needs no IP addressing to form adjacencies and a misconfigured IP subnet does not stop it. It carries IPv4 and IPv6 in the same protocol. It is the underlay IGP chosen by SD-Access LAN Automation and is common in large provider-style cores. Its flooding and SPF behaviour scale well, and it has a clean two-level hierarchy.

Levels and the attached bit

Router type Adjacencies Database
Level 1 (L1) L1 neighbours in the same area L1 link-state database for its area only
Level 2 (L2) L2 neighbours in any area L2 database for the backbone
Level 1/2 (L1/L2) Both Two databases, acts as the area border
  • L1 routers know only their own area. An L1/L2 router sets the attached (ATT) bit in its L1 LSPs, and L1 routers install a default route to the nearest L1/L2 router that sets it. This is similar to a totally stubby OSPF area by default.
  • The L2 backbone is the contiguous set of L2-capable routers. Unlike OSPF there is no area 0 and no virtual link, and areas do not need to attach to a single backbone area. L2 adjacencies can span areas as long as the L2 routers are contiguous.
  • Route leaking (L2 into L1) is used when L1 routers need specific routes instead of just a default, for example for optimal exit selection or to carry loopbacks for MPLS or SD-Access.
  • IS-IS area boundaries are on the links, not on the router (a router belongs to one area, and the links between areas are L2). This differs from OSPF where an ABR sits in several areas.
graph TB
    subgraph A1["Area 49.0001"]
        L1a["L1 access"] --- BA["L1/L2 border"]
        L1b["L1 access"] --- BA
    end
    subgraph BB["L2 backbone"]
        BA --- C1["L2 core"]
        C1 --- C2["L2 core"]
    end
    subgraph A2["Area 49.0002"]
        BB2["L1/L2 border"] --- L1c["L1 access"]
    end
    C2 --- BB2

Design choices that matter

Decision Recommended Reason
Metric style metric-style wide Narrow metrics allow only 6 bits per link (maximum 63) and 10 bits per path (1023). Wide metrics give 24 bits per link and 32 bits per path. Wide is also needed for traffic engineering extensions.
Network type isis network point-to-point on routed Ethernet links Removes DIS election and the pseudonode LSP and speeds up adjacency formation
Level Single level (L2 only) for small and medium networks; L1/L2 hierarchy only when scale or failure containment requires it A flat L2 domain is simpler and avoids default-route suboptimal paths
Authentication Hello authentication on every interface and LSP/SNP authentication per level Stops rogue routers from forming adjacencies or injecting LSPs. Use HMAC-SHA keys where supported.
Prefix advertisement Advertise only loopbacks and summarized prefixes, suppress connected link prefixes Smaller LSPs, faster SPF and no transit-link attack surface
IPv6 Multi-topology when not all interfaces run both protocols; single topology only when every IS-IS interface is dual-stack In single-topology mode, IPv4 and IPv6 share one SPF, so a link without IPv6 breaks IPv6 paths
Overload bit Set on startup (set-overload-bit on-startup) during maintenance or after reload A router that has just booted or is being drained is not used for transit until its tables are ready

On broadcast networks IS-IS elects a DIS with no backup,. Preemption by priority is possible. Point-to-point behaviour is still the better design when only two devices are on the segment.

Typical timers: hello interval 10 seconds, hold multiplier 3 (hold time 30 seconds) per interface. Use BFD (ENARSI BFD) for sub-second failure detection instead of tuning hellos aggressively.

router isis CORE
 net 49.0001.0000.0000.0001.00
 is-type level-2-only
 metric-style wide
 advertise passive-only
 passive-interface Loopback0
 address-family ipv6
  multi-topology
!
interface TenGigabitEthernet1/0/1
 ip router isis CORE
 isis network point-to-point
 isis authentication mode md5
 isis authentication key-chain ISIS-KEYS
 isis bfd

advertise passive-only is the IS-IS equivalent of prefix suppression: it advertises only prefixes from passive interfaces (loopbacks), not transit link subnets. Use it only when no one needs to reach the link addresses.

Exam trap

An IS-IS L1 router sends traffic for unknown destinations to the nearest attached L1/L2 router, not the best exit. If a question describes suboptimal exit selection or asymmetric paths caused by the L1 default route, the fix is route leaking or moving to a single L2 level, not adding a virtual link (IS-IS has none) or changing the ATT bit.

Exam trap

Mixing narrow and wide metric styles in one level causes routes to be missing or ignored. During a migration use metric-style transition temporarily, then settle on wide. Wide metrics are required for IS-IS TE and are the default recommendation for new designs.

EIGRP design

Convergence and the query problem

EIGRP converges in milliseconds when a feasible successor exists. When none exists, the router goes active and sends queries to its neighbours, which can propagate across the whole network. A neighbour that cannot answer in time (the active timer is 3 minutes by default) leaves the route stuck in active (SIA), and the neighbour relationship is reset. EIGRP design is therefore the practice of bounding query scope.

Tool Effect on queries Typical use
Summarization A router that does not have the specific route answers the query immediately and the query stops Distribution layer toward the core, hub toward the rest of the network
Stub A stub router is not queried, and it advertises only what the stub options allow (connected, static, summary, redistributed) Remote and branch routers
Distribute list / prefix-list Limits what is advertised or accepted, so fewer routes are in play Border between domains
Feasible successors Avoid going active in the first place Redundant topologies with equal-quality alternative paths
Separate autonomous systems Queries do not cross AS boundaries, but redistribution between ASes is required Rarely recommended, since it adds redistribution risk

Hub and spoke and DMVPN

graph TB
    HUB["Hub: summarize toward spokes"] --- S1["Spoke 1: stub connected"]
    HUB --- S2["Spoke 2: stub connected"]
    HUB --- S3["Spoke 3: stub connected"]
    HUB --- CORE["Campus core"]
  • Configure all spokes as eigrp stub connected (or connected summary). The hub no longer queries them, and a spoke cannot become an accidental transit path.
  • The hub should send a default route or a summary to spokes so the spokes carry small tables and a hub-side failure is hidden from them.
  • On DMVPN, a hub that learns routes from one spoke and advertises them to the others needs split horizon disabled on the tunnel (no split-horizon under the af-interface in named mode, no ip split-horizon eigrp in classic mode), and no next-hop-self so spoke-to-spoke tunnels form directly in Phase 2. With Phase 3 the hub should instead summarize or send a default and rely on NHRP redirects.
  • Mind the NBMA hello and hold defaults. On multipoint NBMA interfaces of T1 speed or lower the defaults are 60 and 180 seconds; otherwise they are 5 and 15 seconds.

Named mode, authentication and metrics

  • Named mode is the current configuration style. It uses one structure for IPv4, IPv6 and the 64-bit wide metrics needed for links faster than 10 Gbps. Choose it for new designs and migrations.
  • Authentication: classic mode supports MD5 only, named mode adds HMAC-SHA-256. Use key chains so keys can rotate without outage.
  • Metric: the default K values (K1 and K3 equal to 1, the rest 0) use bandwidth and delay. Do not change K values in production designs because they must match on all neighbours. To steer traffic, change interface delay, not bandwidth, since bandwidth also scales the EIGRP packet limit (50 percent by default) and QoS calculations.
  • Load balancing: equal-cost over up to four paths by default (configurable to 32 on IOS XE). Unequal-cost uses variance, and only paths that are feasible successors are eligible. Traffic share is proportional to the metrics.
router eigrp CAMPUS
 address-family ipv4 unicast autonomous-system 100
  af-interface Tunnel0
   no split-horizon
   summary-address 10.0.0.0 255.255.0.0
   authentication mode hmac-sha-256 <secret>
  exit-af-interface
  topology base
   variance 2
  exit-af-topology

Exam trap

Summarization at the core boundary stops queries, which is a stability benefit, but it also hides specific-route failures. The summarizing router keeps advertising the summary while one component is down, so traffic for the failed part still arrives and is dropped there. EIGRP installs a discard route to Null0 with an administrative distance of 5 for the summary, so such traffic is dropped rather than looped to a less specific default.

Exam trap

The EIGRP stub feature stops the hub from querying a spoke. It does not stop the spoke from receiving routes. To keep a spoke's table small you must also summarize or send a default from the hub.

IS-IS, EIGRP and OSPF compared for design

Criterion IS-IS EIGRP OSPF
Hierarchy Two levels, contiguous L2 backbone None, uses summarization and stubs Areas with mandatory area 0
Transport CLNS (Layer 2) IP protocol 88 IP protocol 89
Failure containment Level boundary Summaries and stubs Area boundary, LSA filtering
Convergence Fast with BFD and tuned SPF Fastest with feasible successors Fast with BFD and tuned SPF
Multi-vendor Yes (open standard) Yes (published as RFC 7868) Yes
Typical enterprise role Provider-grade core, SD-Access underlay Cisco-only campus and WAN, DMVPN General purpose

Design exercise

Scenario. A manufacturer runs EIGRP across a campus and 60 branch sites connected through DMVPN Phase 3. Branches have two spokes each for redundancy. Twice in the last month a flapping link at one branch caused a route to go stuck in active at the hub, resetting neighbours at 20 other branches. Branch routers receive 8,000 routes from the hub and are running short of memory. Operations wants the smallest change that stops the outages and does not require replacing the protocol.

Requirements and constraints.

  • Stop branch failures from affecting other branches.
  • Reduce branch routing table size.
  • Keep EIGRP and DMVPN Phase 3.
  • Branches must still reach all campus and other branch prefixes.
Answer: how and why

Chosen design: configure every branch router as an EIGRP stub (connected plus summary as needed) and have the hub summarize the campus and branch space toward the spokes, or send a default route, relying on NHRP redirect and shortcut switching (Phase 3) for spoke-to-spoke traffic.

Stub stops the hub from sending queries to branches, so a branch link flap cannot propagate an active state to other branches. Summarization or a default at the hub shrinks the branch table from 8,000 routes to a handful. Phase 3 does not need specific routes at the spokes, because the first packet goes via the hub and NHRP then builds a shortcut.

Rejected alternatives:

  • Moving to OSPF or IS-IS: heavy migration for a problem that stubs and summaries already solve, and OSPF on a large DMVPN needs careful network-type choices.
  • Raising the active timer: hides the symptom and delays failure detection.
  • Splitting into several EIGRP autonomous systems: limits query reach but adds redistribution and loop risk.
  • Disabling split horizon on the hub only: required for Phase 2, irrelevant to the SIA problem.

Quick check

What does the ATT bit do in IS-IS?

An L1/L2 router sets the attached bit in its L1 LSPs to tell L1 routers it has a path to the L2 backbone. L1 routers install a default route to the nearest attached router.

A router with a feasible successor loses its successor. Does it send queries?

No. It promotes the feasible successor immediately without going active, so convergence is local and fast.

Why configure isis network point-to-point on routed Ethernet links?

It avoids the DIS election and pseudonode overhead, and the adjacency comes up faster. On a link with only two routers a broadcast network type adds no value.

References

  • IS-IS and EIGRP configuration guides: IP Routing, Cisco IOS XE (search "IP Routing IS-IS Configuration Guide IOS XE" and "EIGRP Configuration Guide IOS XE" on cisco.com)
  • RFC 1195 (IS-IS for IP), RFC 5308 (IS-IS for IPv6), RFC 5120 (multi-topology IS-IS), RFC 7868 (EIGRP) at rfc-editor.org
  • Cisco Enterprise Campus Design and DMVPN design guides (search on cisco.com)
  • Cisco Live On-Demand Library: search "IS-IS deployment" and "EIGRP design"