Protocol Atlas

L3 · igp · reviewed

IS-IS

Intermediate System to Intermediate System

A CLNS link-state protocol that carries IP as TLVs: areas are levels, the LAN elects a DIS that preempts, and the metric width is a configuration, not a constant.

Presenter modeEmbed this figure

Overview of the ISO IS-IS ProtocolRFC 1195 · PROPOSED STANDARD · December 1990LANs, Designated Routers, and PseudonodesRFC 1195 · PROPOSED STANDARD · December 1990Level 1 Link State PDURFC 1195 · PROPOSED STANDARD · December 1990HandshakingRFC 5303 · PROPOSED STANDARD · October 2008The Extended IS Reachability TLVRFC 5305 · PROPOSED STANDARD · October 2008The up/down BitRFC 5305 · PROPOSED STANDARD · October 2008ISO/IEC 10589 §7.2.7

Why it exists

IS-IS was an ISO protocol for routing CLNS. RFC 1195 put IP prefixes in TLVs so the same FSM, the same LSP, and the same SPF could forward IPv4 without pretending to be OSPF. Overview of the Integrated IS-ISRFC 1195 · PROPOSED STANDARD · December 1990

It remains on service-provider and large DC underlays because the TLV encoding made extensions cheap: wide metrics, IPv6, TE, SR. The cost is a NET, a System ID, and a pair of levels instead of an OSPF area ID.

A LAN Hello, a DIS, a pseudonode

Three ISes on Ethernet elect a DIS. Every pair is adjacent; the DIS originates a pseudonode LSP so SPF sees a star instead of a mesh.

R1 · pri 64R2 · pri 64LANR3 · pri 80L1L1L1
  • Link
  • Blocking
  • Packet in flight
  • Discarded
  • Emphasis
Select a device to read its state. Arrow keys walk the topology.
Text equivalent of this diagram
Devices and links at this step
ElementKindState
R1 · pri 64router—
R2 · pri 64router—
LANswitch—
R3 · pri 80router—
R1 · pri 64 — LANlinkup · L1
R2 · pri 64 — LANlinkup · L1
R3 · pri 80 — LANlinkup · L1
1 / 4
t = 0 s

Each IS multicasts a LAN Hello. Unlike OSPF, listing your neighbour in the IS Neighbours TLV is the three-way handshake: seeing yourself there is adjacency, not a prelude to ExStart.

What changed

  • LAN Hello · R1 floods from R1 · pri 64
  • LAN Hello · R2 floods from R2 · pri 64
  • LAN Hello · R3 floods from R3 · pri 80

How it works

An IS is addressed by a NET: area address, six-octet System ID, and a zero n-selector. Two ISes with different area addresses are not in the same Level-1 area. They can still be Level-2 neighbours. Addressing Routers in IS-IS PacketsRFC 1195 · PROPOSED STANDARD · December 1990

Level-1 is intra-area. Level-2 is the backbone. An L1L2 IS sets the attached bit in its L1 LSP so L1-only routers have a default toward other areas. That is the ABR analogue, without a reserved area 0. Overview of the ISO IS-IS ProtocolRFC 1195 · PROPOSED STANDARD · December 1990

On a LAN, the DIS is the highest priority, then the highest SNPA. It preempts. There is no backup. Point-to-point Hellos use RFC 5303’s three-way handshake so two ISes do not both believe the link is up when it is not. HandshakingRFC 5303 · PROPOSED STANDARD · October 2008

Narrow metrics are 6 bits in the original neighbour TLV — maximum 63. Wide metrics (TLV 22, RFC 5305) are 24 bits. A domain that mixes them computes two different trees and does not notice until traffic takes the “short” 63-capped path. The Extended IS Reachability TLVRFC 5305 · PROPOSED STANDARD · October 2008

The overload bit tells the domain not to transit this IS. Attached tells L1 routers this L1L2 can reach other areas. Up/down on a leaked prefix tells every L1L2 not to export it back to L2. The up/down BitRFC 5305 · PROPOSED STANDARD · October 2008

IS-IS is not IP. A filter that only permits IP will drop Hellos. Seeing “protocol 89” in a capture means you are looking at OSPF.

Try it

Elect a DIS

Raise a priority and the DIS changes immediately. There is no backup, which is the contrast with OSPF.

LAN Hello priority

DIS: R3 · Backup DIS: none

  1. priorityR3 has the highest priority (80). SNPA is not consulted.
  2. preemptionThere is no Backup DIS. A newly attached IS with a better priority takes over immediately, and the previous DIS purges its pseudonode LSP.
Role on this LAN
ISSNPAPriorityRole
R100:1a:2b:00:00:0164other
R200:1a:2b:00:00:0264other
R300:1a:2b:00:00:0380dis

Run SPF

Change a link cost and step through the candidate list. A router joins the tree when it is the cheapest candidate, and nothing added later can make it cheaper.

Interface cost
Iteration 1 of 6
10101030101010R1cost 0R2candidate 10R3unreachedR4candidate 10R5unreachedR6unreached

R1 is the root, so it starts on the tree at cost 0.

  • R2 enters the candidate list at 10, through R1.
  • R4 enters the candidate list at 10, through R1.
Candidate list after this iteration
RouterCostThrough
R210R1
R410R1
Resulting routing table at R1
DestinationCostNext hop
R210R2
R320R2
R410R4
R520R4
R630R2

On the wire

Constructed examples, encoded from the field table below them — not captured traffic.

R1 claiming the LAN. Priority 64, LAN ID equal to its own System ID plus circuit 1, holding time 10 seconds. TLVs follow and are not in this layout.

Ethernet
Destination 01:80:C2:00:00:14 (AllL1ISs) or 01:80:C2:00:00:15 (AllL2ISs). NLPID 0x83. RFC 1195
IS-IS common header
Intradomain routing protocol discriminator, length, version, ID length, PDU type. RFC 1195
LAN Hello
Circuit type, source ID, holding time, PDU length, priority, LAN ID. RFC 1195

Configure it

Give the box a NET, speak Level-2 only, and use wide metrics on a p2p Ethernet link.

Cisco IOS-XE 17.12 · Catalyst 9500, ASR 1000draft

  1. router isis UNDERLAY
 net 49.0001.0000.0000.0001.00
 is-type level-2-only
 metric-style wide

    The NET is area 49.0001, System ID 0000.0000.0001, n-selector 00. Without it there is no process. Wide metrics are 24-bit; leaving them narrow caps every link at 63.

    Common mistake: Two boxes cloned with the same NET. System IDs must be unique; a duplicate is two originators for one LSP ID.

    RFC 1195 §3.3

  2. interface GigabitEthernet0/0
 ip router isis UNDERLAY
 isis network point-to-point
 isis circuit-type level-2

    Point-to-point skips DIS election on Ethernet. Circuit-type level-2 matches `is-type` so the link does not try L1 against a different area.

    RFC 1195 §4.3

Verify

show isis neighbors
Adjacency Up, type L2, no DIS on a p2p link.

Caveats

  • IOS-XE process names are local. The neighbour’s process name does not have to match.

When it breaks

Symptom first, because that is what you have when it happens.

  1. Two ISes on a link will not form a Level-1 adjacency. Level-2, if configured, comes up.

    Narrow it down

    1. Compare NETs. The area address (everything before the System ID) must match for L1.
    2. Confirm circuit type allows L1 on both sides.

    Cause

    Level-1 adjacency requires the same area address. Different areas can still be L2 neighbours.

    Fix

    Align the area bytes of the NET, or run the link as L2-only.

    Addressing Routers in IS-IS PacketsRFC 1195 · PROPOSED STANDARD · December 1990

  2. A 10 Gb/s link and a 1 Gb/s link have the same metric. Traffic does not prefer the faster path.

    Narrow it down

    1. Check whether `metric-style wide` (or the vendor equivalent) is on every IS.
    2. Look at the neighbour TLV in the LSP: TLV 2 is narrow, TLV 22 is wide.

    Cause

    Narrow metrics saturate at 63. Any interface you meant to cost 10 more than that costs 63.

    Fix

    Enable wide metrics domain-wide. Mixing styles is two topologies.

    The Extended IS Reachability TLVRFC 5305 · PROPOSED STANDARD · October 2008

  3. Pseudonode LSP originator keeps changing. SPF runs. OSPF-trained eyes look for a failing DR.

    Narrow it down

    1. Compare LAN Hello priorities and SNPAs.
    2. Look for a newly attached IS with a higher priority — that is preemption, not a failure.

    Cause

    IS-IS DIS preempts. A new IS with a better priority is supposed to take over.

    Fix

    If you do not want preemption, pin the DIS with a high priority on the intended IS and a low one everywhere else. Do not expect OSPF’s non-preemption.

    LANs, Designated Routers, and PseudonodesRFC 1195 · PROPOSED STANDARD · December 1990

  4. A prefix bounces between two L1L2 ISes. CPU and LSP churn, traffic loops in the area.

    Narrow it down

    1. Inspect the Extended IP Reachability TLV for the up/down bit on the leaked prefix.
    2. See whether the second L1L2 is redistributing L1 into L2 without honouring that bit.

    Cause

    A leaked prefix was re-exported to L2. The up/down bit exists to forbid that.

    Fix

    Leak with the up/down bit set, and never redistribute an up/down prefix back to L2.

    The up/down BitRFC 5305 · PROPOSED STANDARD · October 2008

  5. The IS-IS process is configured on interfaces and does nothing. No Hellos.

    Narrow it down

    1. show isis (or vendor equivalent) and confirm a NET is configured.
    2. Confirm the n-selector is 00. A non-zero n-selector is a different NSAP, not “the router.”

    Cause

    Without a NET the process has no System ID and cannot source an LSP or a Hello.

    Fix

    Configure a NET. Area + unique System ID + n-selector 00.

    Addressing Routers in IS-IS PacketsRFC 1195 · PROPOSED STANDARD · December 1990

Design notes

Point-to-point on Ethernet, as in OSPF underlays, skips the DIS and the pseudonode. Two ISes, one LSP each, no LAN ID. The network type is the first thing to check when a “LAN” of two routers keeps electing a DIS.

Leaking is how an L1-only IS gets more than a default. The up/down bit is not optional decoration; it is the loop-prevention. A leak without it is a future outage. The up/down BitRFC 5305 · PROPOSED STANDARD · October 2008

ISO/IEC 10589 is the protocol. RFC 1195 is how IP rides it. When the two disagree, 10589 wins for the FSM and 1195 wins for the IP TLVs.

Misconceptions

“The DIS is just an IS-IS name for the OSPF DR, including non-preemption and a backup.”
The DIS preempts and has no backup. Adjacencies are still to every IS on the LAN. Treating it as a DR is how people ignore a DIS change that was supposed to happen. LANs, Designated Routers, and PseudonodesRFC 1195 · PROPOSED STANDARD · December 1990
“IS-IS needs area 0 as a backbone, like OSPF.”
The backbone is Level-2. Area addresses are ISO area IDs, not OSPF area numbers. Writing 0.0.0.0 into a NET is a 49.0000… that happens to look familiar. Overview of the ISO IS-IS ProtocolRFC 1195 · PROPOSED STANDARD · December 1990
“IS-IS metrics work like OSPF interface cost: you can always tell a 10G from a 1G.”
Only with wide metrics. Narrow maxes out at 63, and that is the entire dynamic range of the original TLV. The Extended IS Reachability TLVRFC 5305 · PROPOSED STANDARD · October 2008

More walkthroughs

A better DIS takes over nowcomparison

R4 joins the LAN with priority 127. It becomes DIS immediately. There is no BDR, so the old pseudonode is purged and a new one is originated. Contrast with OSPF, where this would do nothing.

R1 · pri 64R3 · DIS · pri 80DISRole: DISLANL1L1
  • Link
  • Blocking
  • Packet in flight
  • Discarded
  • Emphasis
Select a device to read its state. Arrow keys walk the topology.
Text equivalent of this diagram
Devices and links at this step
ElementKindState
R1 · pri 64router—
R3 · DIS · pri 80routerRole: DIS
LANswitch—
R1 · pri 64 — LANlinkup · L1
R3 · DIS · pri 80 — LANlinkup · L1
1 / 3
before

R3 is DIS. Its pseudonode LSP is in every database. OSPF instincts say a newcomer will sit quietly. Those instincts are about to be wrong.

What changed

  • Emphasis: DIS
  • R3 · DIS · pri 80: Role → DIS
  • Hidden: R4 · pri 127

Leaking L2 into L1, and the bit that stops a loopdesign-choice

An L1L2 IS leaks a prefix from Level-2 into Level-1 with the up/down bit set. Another L1L2 must not leak that prefix back to L2, or the domain has a routing loop.

L1-onlyExit: default toward attached L1L2L1L2-AATTL2 coreL1L2-BL1L2L2L1 same area
  • Link
  • Blocking
  • Packet in flight
  • Discarded
  • Emphasis
Select a device to read its state. Arrow keys walk the topology.
Text equivalent of this diagram
Devices and links at this step
ElementKindState
L1-onlyrouterExit: default toward attached L1L2
L1L2-Arouter—
L2 corerouter—
L1L2-Brouter—
L1-only — L1L2-Alinkup · L1
L1L2-A — L2 corelinkup · L2
L2 core — L1L2-Blinkup · L2
L1L2-A — L1L2-Blinkup · L1 same area
1 / 3

Without leaking, an L1-only IS uses a default toward any L1L2 whose LSP has the attached bit set. It cannot tell one external prefix from another.

What changed

  • L1-only: Exit → default toward attached L1L2
  • Emphasis: ATT

Terms

NET
Network Entity Title: the NSAP an IS-IS process sources from. Area address, six-octet System ID, n-selector 00. Without it the process cannot send a Hello.
DIS
Designated Intermediate System on an IS-IS LAN. Highest priority then highest SNPA, preempting, with no backup. Originates the pseudonode LSP.
Wide metric
The 24-bit IS-IS metric in TLV 22 (RFC 5305). The original neighbour TLV is 6 bits, maximum 63, which is why two 10 Gb/s links can look equal until wide is enabled.
Overload bit
A flag in the LSP header telling the domain not to transit this IS. Prefixes it originates remain reachable; paths through it do not.
Up/down bit
In an Extended IP Reachability TLV, set when a prefix is leaked from L2 into L1 (or must not be exported upward). Another L1L2 IS must not advertise that prefix into L2.

Check yourself

  • A new IS joins a LAN with a higher Hello priority than the current DIS. What happens?
  • How many Backup DIS roles exist on an IS-IS LAN?
  • What is the largest neighbour metric the original (narrow) TLV can carry?
  • A NET is 49.0001.0000.0000.0001.00. What is the System ID?
  • A prefix in a Level-1 LSP has the up/down bit set. What must an L1L2 IS not do?
  • The overload bit is set in an IS’s LSP. What does the rest of the domain do?
  • Two ISes have different area addresses in their NETs. Which adjacency can they form?
  • Point-to-point IS-IS Hellos need a three-way handshake (RFC 5303) because…