Skip to content
Log in Sign up My account

IS-IS for enterprise engineers: a step-by-step lab

This lab builds a two-area IS-IS network on IOS XE: NETs, L1 and L2 routers, point-to-point adjacencies, wide metrics, passive loopbacks, authentication, L2 to L1 route leaking and summarization. Each step has the configuration and the show commands that prove it. The last section covers the failures you will hit most often and how to spot them. IS-IS is common in service provider cores and increasingly in large enterprise and data centre underlays, so it is worth knowing even if your campus runs OSPF.

Note

The outputs below are representative of IOS XE. Interface names, hostnames, timers and exact metrics vary by platform and release, so expect small differences on your devices.

Topology

graph LR
    R1["R1 L1<br/>49.0001<br/>lo0 10.1.255.1"]
    R2["R2 L1/L2<br/>49.0001<br/>lo0 10.1.255.2"]
    R3["R3 L1/L2<br/>49.0002<br/>lo0 10.2.255.3"]
    R4["R4 L1<br/>49.0002<br/>lo0 10.2.255.4"]
    R1 ---|"10.1.12.0/30 L1"| R2
    R2 ---|"10.0.23.0/30 L2"| R3
    R3 ---|"10.2.34.0/30 L1"| R4
Link Subnet Addresses Circuit type
R1 - R2 10.1.12.0/30 R1 .1, R2 .2 level-1
R2 - R3 10.0.23.0/30 R2 .1, R3 .2 level-2-only
R3 - R4 10.2.34.0/30 R3 .1, R4 .2 level-1

R1 and R4 are internal L1 routers. R2 and R3 are the L1/L2 border routers that form the backbone between the two areas. Interfaces are GigabitEthernet2 and 3 as placeholders, so match them to your platform. Any virtual lab (CML, EVE-NG, GNS3, containerlab) works. For a lab setup, see the CCNP lab guide.

IS-IS concepts you need first

IS-IS runs directly over layer 2 (CLNS), not over IP. It still carries IPv4 prefixes in TLVs, which is why a single process can route IP without any IP-level neighbour discovery.

NET. Every router has a Network Entity Title, written like 49.0001.0000.0000.0001.00. Read it from the right:

  • the last byte 00 is the NSEL and is always 00 on a router
  • the six bytes before it (0000.0000.0001) are the system ID, which must be unique in the domain
  • everything before the system ID is the area ID (49.0001). The 49 is the private AFI, equivalent to RFC 1918 space.

Levels. L1 routers know only their own area and use the closest L1/L2 router as a default exit. L2 routers form a contiguous backbone that carries inter-area routes. An L1/L2 router does both and sets the ATT (attached) bit in its L1 LSP when it has an L2 neighbour in a different area. L1 routers install a default route toward any router advertising ATT.

Areas are per router, not per link. Unlike OSPF, an area boundary sits inside a router. A link is L1, L2 or both, depending on the adjacency formed on it.

Step 1: Addressing and loopbacks

Configure interface addresses and loopbacks first. Do not turn on IS-IS yet. R1 is shown, repeat for the others with the addresses from the table.

hostname R1
!
interface Loopback0
 ip address 10.1.255.1 255.255.255.255
!
interface GigabitEthernet2
 ip address 10.1.12.1 255.255.255.252
 no shutdown

Step 2: Basic IS-IS with NETs and levels

Start with R1 and R2 in area 49.0001. R1 is L1 only, R2 is the default level-1-2.

! R1
router isis
 net 49.0001.0000.0000.0001.00
 is-type level-1
!
interface Loopback0
 ip router isis
!
interface GigabitEthernet2
 ip router isis
 isis network point-to-point

! R2
router isis
 net 49.0001.0000.0000.0002.00
 is-type level-1-2
!
interface Loopback0
 ip router isis
!
interface GigabitEthernet2
 description to R1
 ip router isis
 isis network point-to-point
 isis circuit-type level-1
!
interface GigabitEthernet3
 description to R3
 ip router isis
 isis network point-to-point
 isis circuit-type level-2-only

! R3
router isis
 net 49.0002.0000.0000.0003.00
 is-type level-1-2
!
interface Loopback0
 ip router isis
!
interface GigabitEthernet2
 description to R2
 ip router isis
 isis network point-to-point
 isis circuit-type level-2-only
!
interface GigabitEthernet3
 description to R4
 ip router isis
 isis network point-to-point
 isis circuit-type level-1

! R4
router isis
 net 49.0002.0000.0000.0004.00
 is-type level-1
!
interface Loopback0
 ip router isis
!
interface GigabitEthernet2
 ip router isis
 isis network point-to-point

Points worth noting:

  • ip router isis on the interface is what enables IS-IS there. There is no network statement as in OSPF.
  • isis network point-to-point on Ethernet links avoids DIS election and the pseudonode, and gives a simpler, faster adjacency. Use it on every routed link between two routers.
  • is-type on a router limits which levels run at all. isis circuit-type limits levels per interface.
  • An optional metric-style wide comes in the next step, so expect narrow metrics for the moment.

Verify adjacencies

R2# show isis neighbors

Tag null:
System Id      Type Interface   IP Address      State Holdtime Circuit Id
R1             L1   Gi2         10.1.12.1       UP    26       00
R3             L2   Gi3         10.0.23.2       UP    25       00

On R2, the neighbour to R1 is L1 and the neighbour to R3 is L2, as configured. If two L1/L2 routers in the same area connect over a link with circuit type level-1-2, you would see two rows, one per level. Hostnames show because IOS XE advertises the dynamic hostname by default. show isis hostname lists the system ID to name mapping.

R2# show clns neighbors

System Id      Interface   SNPA                State  Holdtime  Type Protocol
R1             Gi2         *HDLC*              Up     26        L1   IS-IS
R3             Gi3         *HDLC*              Up     25        L2   IS-IS

The *HDLC* SNPA is normal for point-to-point circuits on Ethernet.

Check the interface view as well:

R2# show clns interface GigabitEthernet2
GigabitEthernet2 is up, line protocol is up
  Checksums enabled, MTU 1497, Encapsulation SAP
  ERPDUs enabled, min. interval 10 msec.
  CLNS fast switching enabled
  CLNS SSE switching disabled
  DEC compatibility mode OFF for this interface
  Next ESH/ISH in 12 seconds
  Routing Protocol: IS-IS
    Circuit Type: level-1
    Interface number 0x1, local circuit ID 0x100
    Neighbor System-ID: R1
    Level-1 Metric: 10, Priority: 64, Circuit ID: R2.00
    Number of active level-1 adjacencies: 1

The CLNS MTU is smaller than the IP MTU because of the LLC header. That matters in the failure section.

Step 3: Wide metrics and passive interfaces

Narrow metrics allow 6 bits per interface (max 63) and 10 bits per path, and cannot carry some newer TLVs. Wide metrics use 24 bits per interface and 32 bits per path. Use wide everywhere. Routers must agree: a mismatch makes one side ignore the other's prefixes or reject them.

! all four routers
router isis
 metric-style wide
 passive-interface Loopback0

passive-interface Loopback0 stops hellos on the loopback while still advertising its prefix. It is the right way to advertise a loopback. Every non-transit interface, such as a user VLAN SVI, should be treated the same way. On IOS XE you can also use passive-interface default and then no passive-interface on the transit links.

Tip

You can also set the default metric under the router process with metric 10, or per interface with isis metric 50. In wide mode the default per-interface metric is 10. Scale your metrics to the link speed yourself. IS-IS has no reference bandwidth.

Verify the database and routes on R1:

R1# show isis database

Tag null:
IS-IS Level-1 Link State Database:
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime/Rcvd      ATT/P/OL
R1.00-00            * 0x00000006   0x4F2A        1042/*                 0/0/0
R2.00-00              0x00000008   0x8D13        1105/1198              1/0/0

The ATT field is 1 in R2's LSP. That is the border router telling R1 that it has a path out of the area.

R1# show ip route isis
Codes: L - local, C - connected, ... i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area, * - candidate default

Gateway of last resort is 10.1.12.2 to network 0.0.0.0

i*L1  0.0.0.0/0 [115/10] via 10.1.12.2, 00:02:41, GigabitEthernet2
      10.0.0.0/8 is variably subnetted, ...
i L1     10.1.255.2/32 [115/20] via 10.1.12.2, 00:02:41, GigabitEthernet2

R1 has the default route from the ATT bit and its local area's prefixes, and nothing from area 49.0002.

Step 4: Authentication

Authenticate both hellos and LSPs. Hello authentication is per interface, and LSP/SNP authentication is per level under the router process. Define a key chain, then apply it.

key chain ISIS-KEY
 key 1
  key-string UseAStrongSecretHere

! hello authentication on every IS-IS link (both ends)
interface GigabitEthernet2
 isis authentication mode md5
 isis authentication key-chain ISIS-KEY

! LSP and SNP authentication under the process
router isis
 authentication mode md5 level-1
 authentication key-chain ISIS-KEY level-1
 authentication mode md5 level-2
 authentication key-chain ISIS-KEY level-2

Apply the L2 lines only on routers that run L2, and the L1 lines only where L1 runs. On a link that carries a single level, set the level on the interface command, for example isis authentication mode md5 level-2. Without the level keyword the interface command applies to both levels.

Key points:

  • Hello authentication and LSP authentication are separate. Missing either leaves a gap. With hello auth only, a rogue LSP can still be injected if it reaches a router that does not check LSPs, and with LSP auth only, a rogue neighbour could still form an adjacency.
  • If the hello keys differ, the adjacency does not come up. If only the LSP keys differ, adjacencies form but LSPs are dropped and the database stays incomplete, which is harder to diagnose.
  • MD5 is weak by modern standards. Check your IOS XE release for HMAC-SHA support in IS-IS before relying on MD5 in a sensitive network. Never use mode text outside a lab.

Warning

Roll authentication out one interface at a time during a change window. Enabling it on one end of a link drops that adjacency until the other end matches.

Step 5: Route leaking from L2 to L1

By default L1 routers know nothing outside the area and use the ATT default. That is fine until you want optimal exit selection or need specific routes, for example for MPLS or when two borders offer different paths. Leaking L2 routes into L1 on the border router provides this.

In the L1 database R1 currently has no route to R4's loopback beyond the default. The leak is configured on the L1/L2 router (R2):

! R2
ip access-list standard LEAK-TO-L1
 permit 10.2.0.0 0.0.255.255
!
router isis
 redistribute isis ip level-2 into level-1 distribute-list LEAK-TO-L1

Without a distribute-list, the command leaks everything from L2 into L1, which defeats the point of having areas. Always filter, with an ACL or prefix list. Note that only routes present in the L2 database leak. L1 routes advertised by R3 into L2 appear in R2's L2 database, and R2 then re-originates the permitted ones into its L1 LSP.

Verify on R1:

R1# show ip route isis
...
Gateway of last resort is 10.1.12.2 to network 0.0.0.0

i*L1  0.0.0.0/0 [115/10] via 10.1.12.2, 00:09:12, GigabitEthernet2
      10.0.0.0/8 is variably subnetted, ...
i L1     10.1.255.2/32 [115/20] via 10.1.12.2, 00:09:12, GigabitEthernet2
i ia     10.2.255.3/32 [115/40] via 10.1.12.2, 00:00:44, GigabitEthernet2
i ia     10.2.255.4/32 [115/50] via 10.1.12.2, 00:00:44, GigabitEthernet2
i ia     10.2.34.0/30 [115/40] via 10.1.12.2, 00:00:44, GigabitEthernet2

The ia code marks routes leaked from another level (inter-area). The default route is still present.

R1# show isis database detail R2 level-1

You should see R2's L1 LSP with the leaked prefixes and the up/down bit set on them. The up/down bit stops a leaked route from being leaked back into L2, which prevents loops.

Tip

Leak a few host routes (loopbacks) only. Leaking whole domains turns an L1 area into a flat network and costs you the scaling benefit of the hierarchy.

Step 6: Summarization

Summarize at the level boundary. On the L1/L2 router you can summarize L1 prefixes as they go into L2, so the rest of the backbone sees one route per area.

! R2: area 49.0001 into L2
router isis
 summary-address 10.1.0.0 255.255.0.0 level-2

! R3: area 49.0002 into L2
router isis
 summary-address 10.2.0.0 255.255.0.0 level-2

The summary is advertised only while at least one more-specific route exists, and the router installs a Null0 discard route for it, just like OSPF area range. Because the summaries cover 10.1.0.0/16 and 10.2.0.0/16, keep the inter-router link block 10.0.23.0/30 outside them.

The summary applies to routes redistributed into or advertised into the given level. Check the L2 database on R3:

R3# show isis database level-2 detail R2

Tag null:
IS-IS Level-2 Link State Database:
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime/Rcvd      ATT/P/OL
R2.00-00              0x0000000B   0x7AC1        1160/1175              0/0/0
  Area Address: 49.0001
  NLPID:        0xCC
  Hostname: R2
  IP Address:   10.1.255.2
  Metric: 10         IS-Extended R3.00
  Metric: 10         IP 10.0.23.0/30
  Metric: 20         IP 10.1.0.0/16

R3 now has one route to area 1 rather than three.

Warning

The leak and the summary interact. If you leak 10.2.0.0/16 specifics into L1 on R2 and also summarize on R3, R1 gets the specifics only if R3 still advertises them into L2, which it does not once a level-2 summary covers them. In that case R2 leaks the summary. This is the same trade-off as filtering by summary in any hierarchical design. Decide what level of detail the L1 routers really need and test it.

Step 7: End-to-end verification

Check reachability from the far side, sourced from loopbacks:

R4# ping 10.1.255.1 source Loopback0
Sending 5, 100-byte ICMP Echos to 10.1.255.1, timeout is 2 seconds:
Packet sent with a source address of 10.2.255.4
!!!!!
Success rate is 100 percent (5/5)

R4# traceroute 10.1.255.1 source Loopback0
 1 10.2.34.1 ... R3
 2 10.0.23.1 ... R2
 3 10.1.12.1 ... R1

A short checklist of commands for any IS-IS problem:

Command What it tells you
show isis neighbors Adjacency state, level and interface
show clns interface <int> Circuit type, metric, number of adjacencies
show isis database LSP contents, ATT and overload bits
show isis database detail <router> TLVs and prefixes in a given LSP
show isis topology SPF results per level
show isis hostname System ID to hostname mapping
show ip protocols Process settings, passive interfaces, redistribution and summaries
show ip route isis What got installed
debug isis adj-packets Hello exchange in real time. Use carefully.

Common failures

Adjacency stuck or missing

  • Area mismatch on an L1 link. L1 routers only form L1 adjacencies with a matching area ID. Two routers with different areas on a link with circuit type level-1 will not come up. Fix the NET or make the circuit type level-2-only (or level-1-2 between L1/L2 routers).
  • Circuit type mismatch. One end level-1, the other level-2-only leaves no common level.
  • Duplicate system ID. Two routers with the same system ID cause LSP purging and constant flapping, and logs say duplicate system ID. Fix one NET.
  • Authentication mismatch. Different keys or modes on hellos. debug isis adj-packets shows hellos being dropped for authentication.
  • Missing ip router isis or a stray passive-interface on a transit link. The interface sends no hellos.
  • MTU problems. IS-IS pads hellos to the full interface MTU by default, so a mismatch or a path that drops large frames stops adjacencies even though small pings work. no isis hello padding is available but is a workaround. Fix the MTU.

Adjacency up but routes missing

  • Metric style mismatch. If one router uses narrow and another wide on the same level, they do not understand each other's metrics reliably. Standardize on metric-style wide.
  • LSP authentication mismatch. Adjacencies are up, databases differ. Compare show isis database on both sides.
  • No default route on an L1 router. The border router has no L2 adjacency to a different area (so no ATT bit), or it is not L1/L2. Check ATT in show isis database.
  • Suboptimal routing from the ATT default. An L1 router in an area with two borders picks the nearest by metric even when the far exit is better for a prefix. This is when you leak.
  • Overload bit. A router with the OL bit set is not used for transit. Look at the OL field in show isis database. It may be set intentionally with set-overload-bit or after a restart with on-startup.
  • Leak without a matching L2 route. Only L2 database routes can be leaked. Verify the prefix is in the L2 database on the border first.

Flapping

  • Unstable links with the default aggressive hello timers. Consider isis hello-interval and isis hello-multiplier, and use BFD (isis bfd) for fast failure detection rather than extremely short hellos.

References