Configure IS-IS

This chapter describes how to configure Integrated Intermediate System-to-Intermediate System (IS-IS) on the Cisco NX-OS device.

This chapter includes theses sections:

IS-IS

Intermediate System to Intermediate System (IS-IS) is an Interior Gateway Protocol (IGP) based on Standardization (ISO)/International Engineering Consortium (IEC) 10589 that

  • supports Internet Protocol version 4 (IPv4) and IPv6

  • is a dynamic link-state routing protocol, and

  • can detect changes in the network topology and calculate loop-free routes to other nodes in the network.

Each router running IS-IS maintains a link-state database that describes the state of the network and sends packets on every configured link to discover neighbors. IS-IS floods the link-state information across the network to each neighbor. The router also sends advertisements and updates on the link-state database through all the existing neighbors.

IS-IS hello packets and adjacency formation

Intermediate System to Intermediate System (IS-IS) sends a hello packet out every configured interface to discover IS-IS neighbor routers. The hello packet contains information such as:

  • authentication details

  • are information

  • supported protocols

The receiving interface uses these information to determine compatibility with the originating interface. Additionally, hello packets are padded to ensure that IS-IS only forms adjacencies with interfaces that have matching maximum transmission unit (MTU) settings.

Compatible interfaces form adjacencies, which update routing information in the link-state database through link-state update messages (LSPs). By default, the router sends a periodic LSP refresh every 10 minutes and the LSPs remain in the link-state database for 20 minutes (the LSP lifetime). If the router does not receive an LSP refresh before the end of the LSP lifetime, the router deletes the LSP from the database.

The LSP interval must be less than the LSP lifetime or the LSPs time out before they are refreshed.

IS-IS sends periodic hello packets to adjacent routers. If you configure transient mode for hello packets, these hello packets do not include the excess padding used before IS-IS establishes adjacencies. If the MTU value on adjacent routers changes, IS-IS can detect this change and send padded hello packets for a period of time. IS-IS uses this feature to detect mismatched MTU values on adjacent routers. For more information, see Configuring the Transient Mode for Hello Padding.

IS-IS areas

An IS-IS area is a network segment within an IS-IS routing domain that organizes routers for efficient routing. IS-IS areas can be designed as a single area encompassing all routers or as multiple areas connected through a backbone, known as the Level 2 area.

  • Level 1 areas: consist of routers called Level 1 routers. These routers establish adjacencies and perform routing only within their local area, known as intra-area routing.

  • Level 2 areas: consist of Level 2 routers that establish adjacencies with other Level Level 2 routers and handle routing between Level 1 areas, known as inter-area routing.

  • A router can be configured as both Level 1 and Level 2, called a Level 1/Level 2 router. These routers act as area border routers, routing traffic between the local Level 1 area and the Level 2 backbone area. See figure IS-IS Network Divided into Areas.

Within a Level 1 area, routers know how to reach all other routers in that area. The Level 2 routers know how to reach other area border routers and other Level 2 routers. Level 1/Level 2 routers straddle the boundary between two areas, routing traffic to and from the Level 2 backbone area. Level1/Level2 routers use the attached (ATT) bit signal Level 1 routers to set a default route to this Level1/Level2 router to connect to the Level 2 area.

In some instances, such as when you have two or more Level1/Level 2 routers in an area, you may want to control which Level1/Level2 router that the Level 1 routers use as the default route to the Level 2 area. You can configure which Level1/Level2 router sets the attached bit. For more information, see the Verifying the IS-IS Configuration section.

Each IS-IS instance in Cisco NX-OS supports either a single Level 1 or Level 2 area, or one of each. By default, all IS-IS instances automatically support Level 1 and Level 2 routing.

Figure 1. IS-IS Network Divided into Areas


An autonomous system boundary router (ASBR) advertises external destinations throughout the IS-IS autonomous system. External routes are the routes redistributed into IS-IS from any other protocol.

NET and system ID

A Network Entity Title (NET) is a unique identifier associated with each IS-IS (Intermediate System to Intermediate System) instance. It serves to identify the IS-IS instance within an area and consists of two key components:

  • System ID: A unique identifier that distinguishes the IS-IS instance within the area.

  • Area ID: Identifies the IS-IS area to which the instance belongs.

For example, if the NET is 47.0004.004d.0001.0001.0c11.1111.00, the system ID is 0000.0c11.1111.00 and the area is ID 47.0004.004d.0001.

Designated intermediate systems

IS-IS uses a designated intermediate system (DIS) in broadcast networks to prevent each router from forming unnecessary links with every other router on the broadcast network. IS-IS routers send LSPs to the DIS, which manages all the link-state information for the broadcast network. You can configure the IS-IS priority that IS-IS uses to select the DIS in an area.


Note

No DIS is required on a point-to-point network.

IS-IS authentication

IS-IS authentication helps you to configure authentication to control adjacencies and the exchange of LSPs.

Routers that want to become neighbors must exchange the same password for their configured level of authentication. IS-IS blocks a router that does not have the correct password. You can configure IS-IS authentication globally or for an individual interface for Level 1, Level 2, or both Level 1/Level 2 routing.

IS-IS supports these authentication methods:

  • Clear text: All packets exchanged carry a cleartext 128-bit password.

  • MD5 digest: All packets exchanged carry a message digest that is based on a 128-bit key.

To provide protection against passive attacks, IS-IS never sends the MD5 secret key as cleartext through the network. In addition, IS-IS includes a sequence number in each packet to protect against replay attacks.

You can use also keychains for hello and LSP authentication. See the Cisco Nexus 9000 Series NX-OS Security Configuration Guide for information on keychain management.

Mesh groups

A mesh group is a set of interfaces in which all routers reachable over the interfaces have at least one link to every other router. Many links can fail without isolating one or more routers from the network.

In normal flooding, an interface receives a new LSP and floods the LSP out over all other interfaces on the router. With mesh groups, when an interface that is part of a mesh group receives a new LSP, the interface does not flood the new LSP over the other interfaces that are part of that mesh group.


Note

You may want to limit LSPs in certain mesh network topologies to improve network scalability. Limiting LSP floods might also reduce the reliability of the network (in case of failures). For this reason, we recommend that you use mesh groups only if specifically required, and then only after you make a careful network design.

You can also configure mesh groups in block mode for parallel links between routers. In this mode, all LSPs are blocked on that interface in a mesh group after the routers initially exchange their link-state information.

Overload bits

IS-IS uses the overload bit to tell other routers not to use the local router to forward traffic but to continue routing traffic destined for that local router.

You can use overload bit in these situations:

  • The router is in a critical condition.

  • Graceful introduction and removal of the router to/from the network.

  • Other (administrative or traffic engineering) reasons such as waiting for BGP convergence.

Route summarization

Route summarization simplifies route tables by replacing more-specific addresses with an address that represents all the specific addresses. For example, you can replace 10.1.1.0/24, 10.1.2.0/24, and 10.1.3.0/24 with one summary address, 10.1.0.0/16.

If more specific routes are in the routing table, IS-IS advertises the summary address with a metric equal to the minimum metric of the more specific routes.


Note

Cisco NX-OS does not support automatic route summarization.

Route redistribution

Route redistribution is a processes that allows IS-IS to learn routes from other routing protocols. You can configure IS-IS to assign a specific link cost to these redistributed routes or apply a default link cost to all of them.

You must configure a route map with the redistribution to control which routes are passed into IS-IS. A route map allows you to filter routes based on attributes such as the destination, origination protocol, route type, route tag, and so on. For more information, see Configuring Route Policy Manager.

Whenever you redistribute routes into an IS-IS routing domain, Cisco NX-OS does not, by default, redistribute the default route into the IS-IS routing domain. You can generate a default route into IS-IS, which can be controlled by a route policy.

You also configure the default metric that is used for all imported routes into IS-IS.

Link prefix suppression

By default, IS-IS advertises the addresses of connected interfaces in the system LSP. By suppressing the advertisement of unwanted interface addresses, you can reduce the size of LSPs and reduce the number of routes that IS-IS maintains, improving convergence times.

Two prefix suppression methods are provided for reducing the number of routes in the LSP:

Load balance

Load balancing is a feature that allows a router to distribute traffic over all the router network ports that are the same distance from the destination address. Load balancing increases the utilization of network segments and increases the effective network bandwidth.

Cisco NX-OS supports the Equal Cost Multiple Paths (ECMP) feature with up to 16 equal-cost paths in the IS-IS route table and the unicast RIB. You can configure IS-IS to load balance traffic across some or all of those paths.

BFD

Bidirectional forwarding detection (BFD) is a detection protocol designed to provide fast forwarding-path failure detection times. IS-IS supports BFD for IPv4 and IPv6.

BFD provides subsecond failure detection between two adjacent devices and can be less CPU-intensive than protocol hello messages because some of the BFD load can be distributed onto the data plane on supported modules. See the Cisco Nexus 9000 Series NX-OS Interfaces Configuration Guide for more information.

Virtualization support

Cisco NX-OS supports multiple process instances for IS-IS. Each IS-IS instance can support multiple virtual routing and forwarding (VRF) instances, up to the system limit. For the number of supported IS-IS instances, see the Cisco Nexus 9000 Series NX-OS Verified Scalability Guide.

High availability and graceful restart

High availabilities in Cisco NX-OS provide a multilevel architecture that ensures continuous network operation and minimal downtime. IS-IS supports high availability.

IS-IS supports stateful restart, which is also referred to as non-stop routing (NSR). If IS-IS experiences problems, it attempts to restart from its previous run-time state. The neighbors would not register any neighbor event in this case. If the first restart is not successful and another problem occurs, IS-IS attempts a graceful restart as per RFC 3847. A graceful restart, or non-stop forwarding (NSF), allows IS-IS to remain in the data forwarding path through a process restart. When the restarting IS-IS interface is operational again, it rediscovers its neighbors, establishes adjacency, and starts sending its updates again. At this point, the NSF helpers recognize that the graceful restart has finished.

A stateful restart is used in these scenarios:

  • First recovery attempt after process experiences problems

  • User-initiated switchover using the system switchover command

A graceful restart is used in these scenarios:

  • Second recovery attempt after the process experiences problems within a 4-minute interval

  • Manual restart of the process using the restart isis command

  • Active supervisor removal

  • Active supervisor reload using the reload module active-sup command


Note

Graceful restart is on by default, and we strongly recommend that you do not disable it.

Multiple IS-IS instances

Cisco NX-OS supports multiple instances of the IS-IS protocol that run on the same node. You cannot configure multiple instances over the same interface. Every instance uses the same system router ID. For the number of supported IS-IS instances, see the Cisco Nexus 9000 Series NX-OS Verified Scalability Guide.

Guidelines and limitations for IS-IS

IS-IS has these configuration guidelines and limitations:

  • IS-IS Level-1 routes do not populate on the connecting Level-2-only switch if an explicit configuration is not added to the Level-1/Level-2 Cisco Nexus switch.

  • Because the default reference bandwidth is different for Cisco NX-OS and Cisco IOS, the advertised tunnel IS-IS metric is different for these two operating systems.

  • You can configure IS-IS over segment routing for all Cisco Nexus 9000 Series switches and the Cisco Nexus 3164Q and 31128PQ switches. For information, see the Cisco Nexus 9000 Series NX-OS Label Switching Configuration Guide.

Default settings

The table lists the default settings for IS-IS parameters.

Table 1. Default IS-IS Parameters

Parameters

Default

Administrative distance

115

Area level

Level-1-2

DIS priority

64

Graceful restart

Enabled

Hello multiplier

3

Hello padding

Enabled

Hello time

10 seconds

IS-IS feature

Disabled

LSP interval

33

LSP MTU

1492

Maximum LSP lifetime

1200 seconds

Maximum paths

8

Metric

40

Reference bandwidth

40 Gbps

Configure IS-IS

To configure IS-IS, follow these steps:

  1. Enable the IS-IS feature (see the Enabling the IS-IS Feature section).

  2. Create an IS-IS instance (see the Creating an IS-IS Instance section).

  3. Add an interface to the IS-IS instance (see the Configuring IS-IS on an Interface section).

  4. Configure optional features, such as authentication, mesh groups, and dynamic host exchange.


Note

If you are familiar with the Cisco IOS CLI, be aware that the Cisco NX-OS commands for this feature might differ from the Cisco IOS commands that you would use.

IS-IS Configuration Modes

The following sections show how to enter each of the configuration modes. You can enter the ? command to display the commands available in that mode.

Router Configuration Mode

This example shows how to enter router configuration mode: 

switch#: configure terminal
switch(config)# router isis isp
switch(config-router)#

Router Address Family Configuration Mode

This example shows how to enter router address family configuration mode: 

switch(config)# router isis isp
switch(config-router)# address-family ipv4 unicast
switch(config-router-af)#

Enable the IS-IS Feature

You must enable the IS-IS feature before you can configure IS-IS.

Procedure

Step 1

configure terminal

Example:

switch# configure terminal
switch(config)#

Enters global configuration mode.

Step 2

[no] feature isis

Example:

switch(config)# feature isis

Enables or disables the IS-IS feature.

Using the no option with this command disables the IS-IS feature and removes all associated configurations.

Step 3

(Optional) show feature

Example:

switch(config)# show feature

Displays enabled and disabled features.

Step 4

(Optional) copy running-config startup-config

Example:

switch(config)# copy running-config
startup-config

Saves this configuration change.

Create an IS-IS Instance

You can create an IS-IS instance and configure the area level for that instance.

Before you begin

You must enable IS-IS (see the Enabling the IS-IS Feature section).

Procedure

Step 1

configure terminal

Example:

switch# configure terminal
switch(config)#

Enters global configuration mode.

Step 2

[no] router isis instance-tag

Example:

switch(config)# router isis Enterprise
switch(config-router)#

Creates a new IS-IS instance with the configured instance tag.

Use the no form of this command to delete the IS-IS instance and all associated configurations.

Note

 

You must also remove any IS-IS commands that are configured in interface mode to completely remove all configurations for the IS-IS instance.

Step 3

net network-entity-title

Example:

switch(config-router)# net
47.0004.004d.0001.0001.0c11.1111.00

Configures the NET for this IS-IS instance.

Step 4

(Optional) is-type {level-1 | level-2 | level-1-2}

Example:

switch(config-router)# is-type level-2

Configures the area level for this IS-IS instance. The default is level-1-2.

Step 5

(Optional) show isis [vrf vrf-name] process

Example:

switch(config-router)# show isis process

Displays a summary of IS-IS information for all IS-IS instances.

Step 6

(Optional) distance value

Example:

switch(config-router)# distance 30

Sets the administrative distance for IS-IS. The range is from 1 to 255. The default is 115.

Step 7

(Optional) log-adjacency-changes

Example:

switch(config-router)#
log-adjacency-changes

Sends a system message whenever an IS-IS neighbor changes the state.

Step 8

(Optional) lsp-mtu size

Example:

switch(config-router)# lsp-mtu 600

Sets the MTU for LSPs in this IS-IS instance. The range is from 128 to 4352 bytes. The default is 1492.

Step 9

(Optional) maximum-paths number

Example:

switch(config-router)# maximum-paths 6

Configures the maximum number of equal-cost paths that IS-IS maintains in the route table. The range is from 1 to 64. The default is 8.

Step 10

(Optional) reference-bandwidth bandwidth-value {Mbps | Gbps}

Example:

switch(config-router)# reference-bandwidth
100 Gbps

Sets the default reference bandwidth used for calculating the IS-IS cost metric. The range is from 1 to 4000 Gbps. The default is 40 Gbps.

Step 11

(Optional) clear isis [instance-tag] adjacency [* | system-id | interface]

Example:

switch(config-router)# clear isis adjacency *

Clears neighbor statistics and removes adjacencies for this IS-IS instance.

Step 12

(Optional) copy running-config startup-config

Example:

switch(config-router)# copy running-config
startup-config

Saves this configuration change.

Example

The following example shows how to create an IS-IS instance in a level 2 area: 

switch# <userinput>configure terminal</userinput>
switch(config)# <userinput>router isis Enterprise</userinput>
switch(config-router)# <userinput>net 47.0004.004d.0001.0001.0c11.1111.00</userinput>
switch(config-router)# <userinput>is-type level-2</userinput>
switch(config-router)# <userinput>copy running-config startup-config</userinput>

Restart an IS-IS Instance

You can restart an IS-IS instance. This action clears all neighbors for the instance.

To restart an IS-IS instance and remove all associated neighbors, use the following command:

Procedure

restart isis instance-tag

Example:

switch(config)# restart isis Enterprise

Restarts the IS-IS instance and removes all neighbors.

Shut Down IS-IS

You can shut down the IS-IS instance. This action disables this IS-IS instance and retains the configuration.

To shut down the IS-IS instance, use the following command in router configuration mode:

Procedure

shutdown

Example:

switch(config-router)# shutdown

Disables the IS-IS instance.

Configure IS-IS on an Interface

You can add an interface to an IS-IS instance.

Before you begin

You must enable IS-IS (see the Enabling the IS-IS Feature section).

Procedure

Step 1

configure terminal

Example:

switch# configure terminal
switch(config)#

Enters global configuration mode.

Step 2

interfaceinterface-type slot/port

Example:

switch(config)# interface ethernet 1/2
switch(config-if)#

Enters interface configuration mode.

Step 3

(Optional) medium {broadcast | p2p}

Example:

switch(config-if)# medium p2p

Configures the broadcast or point-to-point mode for the interface. IS-IS inherits this mode.

Step 4

{ip | ipv6} router isis instance-tag

Example:

switch(config-if)# ip router isis
Enterprise

Associates this IPv4 or IPv6 interface with an IS-IS instance.

Step 5

(Optional) show isis [vrf vrf-name] [instance-tag] interface [interface-type slot/port]

Example:

switch(config-if)# show isis Enterprise
ethernet 1/2

Displays IS-IS information for an interface.

Step 6

(Optional) isis circuit-type {level-1 | level-2 | level-1-2}

Example:

switch(config-if)# isis circuit-type
level-2

Sets the type of adjacency that this interface participates in. Use this command only for routers that participate in both Level 1 and Level 2 areas.

Step 7

(Optional) isis metric value {level-1 | level-2}

Example:

switch(config-if)# isis metric 30

Sets the IS-IS metric for this interface. The range is from 1 to 16777214. The default is 10.

Step 8

(Optional) isis passive {level-1 | level-2 | level-1-2}

Example:

switch(config-if)# isis passive level-2

Prevents the interface from forming adjacencies but still advertises the prefix associated with the interface.

Step 9

(Optional) copy running-config startup-config

Example:

switch(config-if)# copy running-config
startup-config

Saves this configuration change.

Example

This example shows how to add the Ethernet 1/2 interface to an IS-IS instance:

switch# <userinput>configure terminal</userinput>
switch(config)# <userinput>interface ethernet 1/2</userinput>
switch(config-if)# <userinput>ip router isis Enterprise</userinput>
switch(config-if)# <userinput>copy running-config startup-config</userinput>

Shut Down IS-IS on an Interface

You can gracefully shut down IS-IS on an interface. This action removes all adjacencies and stops IS-IS traffic on this interface but preserves the IS-IS configuration.

To disable IS-IS on an interface, use the following command in interface configuration mode:

Procedure

isis shutdown

Example:

switch(config-if)# isis shutdown

Disables IS-IS on this interface. The IS-IS interface configuration remains.

Configure IS-IS Authentication in an Area

You can configure IS-IS to authenticate LSPs in an area.

Before you begin

You must enable IS-IS. See Enabling the IS-IS Feature.

Procedure

Step 1

configure terminal

Example:

switch# configure terminal
switch(config)#

Enters global configuration mode.

Step 2

router isis instance-tag

Example:

switch(config)# router isis Enterprise
switch(config-router)#

Creates a new IS-IS instance with the configured instance tag.

Step 3

authentication-type {cleartext | md5} {level-1 | level-2}

Example:

switch(config-router)#
authentication-type cleartext level-2

Sets the authentication method used for a Level 1 or Level 2 area as cleartext or as an MD5 authentication digest.

Step 4

authentication key-chain key {level-1 | level-2}

Example:

switch(config-router)# authentication
key-chain ISISKey level-2

Configures the authentication key that is used for an IS-IS area-level authentication.

Step 5

(Optional) authentication-check {level-1 | level-2}

Example:

switch(config-router)#
authentication-check level-2

Enables checking the authentication parameters in a received packet.

Step 6

(Optional) copy running-config startup-config

Example:

switch(config-router)# copy running-config
startup-config

Saves this configuration change.

Example

This example shows how to configure cleartext authentication on an IS-IS instance:

switch# <userinput>configure terminal</userinput>
switch(config)# <userinput>router isis Enterprise</userinput>
switch(config-router)# <userinput>authentication-type cleartext level-2</userinput>
switch(config-router)# <userinput>authentication key-chain ISISKey level-2</userinput>
switch(config-router)# <userinput>copy running-config startup-config</userinput>

Configure IS-IS Authentication on an Interface

You can configure IS-IS to authenticate Hello packets on an interface.

Before you begin

You must enable IS-IS (see the Enabling the IS-IS Feature section).

Procedure

Step 1

configure terminal

Example:

switch# configure terminal
switch(config)#

Enters global configuration mode.

Step 2

interface interface-type slot/port

Example:

switch(config)# interface ethernet 1/2
switch(config-if)#

Enters interface configuration mode.

Step 3

isis authentication-type {cleartext | md5} {level-1 | level-2}

Example:

switch(config-if)# isis
authentication-type cleartext level-2

Sets the authentication type for IS-IS on this interface as cleartext or as an MD5 authentication digest.

Step 4

isis authentication key-chain key {level-1 | level-2}

Example:

switch(config-if)# isis
authentication-key ISISKey level-2

Configures the authentication key used for IS-IS on this interface.

Step 5

(Optional) isis authentication-check {level-1 | level-2}

Example:

switch(config-if)# isis
authentication-check

Enables checking the authentication parameters in a received packet.

Step 6

(Optional) copy running-config startup-config

Example:

switch(config-if)# copy running-config
startup-config

Saves this configuration change.

Example

This example shows how to configure cleartext authentication on an IS-IS instance:

switch# <userinput>configure terminal</userinput>
switch(config)# <userinput>interface ethernet 1/2</userinput>
switch(config-if)# <userinput>isis authentication-type cleartext level-2</userinput>
switch(config-if)# <userinput>isis authentication key-chain ISISKey</userinput>
switch(config-if)# <userinput>copy running-config startup-config</userinput>

Configure a Mesh Group

You can add an interface to a mesh group to limit the amount of LSP flooding for interfaces in that mesh group. You can optionally block all LSP flooding on an interface in a mesh group.

To add an interface to a mesh group, use the following command in interface configuration mode:

Procedure

isis mesh-group {blocked | mesh-id}

Example:

switch(config-if)# isis mesh-group 1

Adds this interface to a mesh group. The range is from 1 to 4294967295.

Configure a Designated Intermediate System

You can configure a router to become the designated intermediate system (DIS) for a multiaccess network by setting the interface priority.

To configure the DIS, use the following command in interface configuration mode:

Procedure

isis priority number {level-1 | level-2}

Example:

switch(config-if)# isis priority 100
level-1

Sets the priority for DIS selection. The range is from 0 to 127. The default is 64.

Configuring Dynamic Host Exchange

You can configure IS-IS to map between the system ID and the hostname for a router using dynamic host exchange.

To configure dynamic host exchange, use the following command in router configuration mode:

SUMMARY STEPS

  1. hostname dynamic

DETAILED STEPS

Command or Action Purpose

hostname dynamic

Example:

switch(config-router)# hostname dynamic

Enables dynamic host exchange.

Set the Overload Bit

You can configure the router to signal other routers not to use this router as an intermediate hop in their shortest path first (SPF) calculations. You can optionally configure the overload bit temporarily on startup, until BGP converges.

In addition to setting the overload bit, you might also want to suppress certain types of IP prefix advertisements from LSPs for Level 1 or Level 2 traffic.

To set the overload bit, use the following command in router configuration mode:

Procedure

set-overload-bit {always | on-startup {seconds | wait-for bgp as-number}} [suppress [interlevel | external]]

Example:

switch(config-router)# set-overload-bit
on-startup 30

Sets the overload bit for IS-IS. The seconds range is from 5 to 86400.

Configure the Attached Bit

You can configure the attached bit to control which Level 1/Level 2 router that the Level 1 routers use as the default route to the Level 2 area. If you disable setting the attached bit, the Level 1 routers do not use this Level 1/Level 2 router to reach the Level 2 area.

To configure the attached bit for a Level 1/Level 2 router, use the following command in router configuration mode:

Procedure

[no] set-attached-bit

Example:

switch(config-router)# no attached-bit

Configures the Level 1/Level 2 router to set the attached bit. This feature is enabled by default.

Configure the Transient Mode for Hello Padding

You can configure the transient mode for hello padding to pad hello packets when IS-IS establishes adjacency and remove that padding after IS-IS establishes adjacency.

To configure the mode for hello padding, use the following command in interface configuration mode:

Procedure

[no] isis hello-padding

Example:

switch(config-if)# no isis hello-padding

Pads the hello packet to the full maximum transmission unit (MTU). The default is enabled. Use the no form of this command to configure the transient mode of hello padding.

Configure a Summary Address

You can create aggregate addresses that are represented in the routing table by a summary address. One summary address can include multiple groups of addresses for a given level. Cisco NX-OS advertises the smallest metric of all the more-specific routes.

Before you begin

You must enable IS-IS (see the Enabling the IS-IS Feature section).

Procedure

Step 1

configure terminal

Example:

switch# configure terminal
switch(config)#

Enters global configuration mode.

Step 2

router isisinstance-tag

Example:

switch(config)# router isis Enterprise
switch(config-router)#

Creates a new IS-IS instance with the configured instance tag.

Step 3

address-family {ipv4 | ipv6} unicast

Example:


switch(config-router)# address-family
ipv4 unicast
switch(config-router-af)#

Enters address family configuration mode.

Step 4

summary-address ip-prefix/mask-len {level-1 | level-2 | level-1-2}

Example:

switch(config-router-af)#
summary-address 192.0.2.0/24 level-2

Configures a summary address for an IS-IS area for IPv4 or IPv6 addresses.

Step 5

(Optional) show isis [vrfvrf-name] {ip | ipv6} summary-address ip-prefix [longer-prefixes]

Example:

Example:
switch(config-router-af)# show isis ip
summary-address

Displays IS-IS IPv4 or IPv6 summary address information.

Step 6

(Optional) copy running-config startup-config

Example:

switch(config-router-af)# copy running-config
startup-config

Saves this configuration change.

Example

This example shows how to configure an IPv4 unicast summary address for IS-IS:

switch# <userinput>configure terminal</userinput>
switch(config)# <userinput>router isis Enterprise</userinput>
switch(config-router)# <userinput>address-family ipv4 unicast</userinput>
switch(config-router-af)# <userinput>summary-address 192.0.2.0/24 level-2</userinput>
switch(config-router-af)# <userinput>copy running-config startup-config</userinput>

Configuring Redistribution

You can configure IS-IS to accept routing information from another routing protocol and redistribute that information through the IS-IS network. You can optionally assign a default route for redistributed routes.

Before you begin

You must enable IS-IS (see the Enabling the IS-IS Feature section).

SUMMARY STEPS

  1. configure terminal
  2. router isis instance-tag
  3. address-family {ipv4 | ipv6} unicast
  4. redistribute {bgp as | {eigrp | isis | ospf | ospfv3 | rip} instance-tag | static | direct} route-map map-name
  5. (Optional) default-information originate [always] [route-map map-name]
  6. (Optional) distribute {level-1 | level-2} into {level-1 | level-2} {route-map route-map | all}
  7. (Optional) show isis [vrf vrf-name] {ip | ipv6} route ip-prefix [detail | longer-prefixes [summary | detail]]
  8. (Optional) copy running-config startup-config

DETAILED STEPS

  Command or Action Purpose

Step 1

configure terminal

Example:

switch# configure terminal
switch(config)#

Enters global configuration mode.

Step 2

router isis instance-tag

Example:

switch(config)# router isis Enterprise
switch(config-router)#

Creates a new IS-IS instance with the configured instance tag.

Step 3

address-family {ipv4 | ipv6} unicast

Example:

switch(config-router)# address-family
ipv4 unicast
switch(config-router-af)#

Enters address family configuration mode.

Step 4

redistribute {bgp as | {eigrp | isis | ospf | ospfv3 | rip} instance-tag | static | direct} route-map map-name

Example:

switch(config-router-af)# redistribute
eigrp 201 route-map ISISmap

Redistributes routes from other protocols into IS-IS.

Step 5

(Optional) default-information originate [always] [route-map map-name]

Example:

switch(config-router-af)#
default-information originate always
 (Optional)

Generates a default route into IS-IS.

Step 6

(Optional) distribute {level-1 | level-2} into {level-1 | level-2} {route-map route-map | all}

Example:

switch(config-router-af)# distribute
level-1 into level-2 all
 (Optional)

Redistributes routes from one IS-IS level to the other IS-IS level.

Step 7

(Optional) show isis [vrf vrf-name] {ip | ipv6} route ip-prefix [detail | longer-prefixes [summary | detail]]

Example:

switch(config-router-af)# show isis ip
route
 (Optional)

Shows the IS-IS routes.

Step 8

(Optional) copy running-config startup-config

Example:

switch(config-router-af)# copy running-config
startup-config
(Optional)

Saves this configuration change.

Example

This example shows how to redistribute EIGRP into IS-IS: 

switch# configure terminal
switch(config)# router isis Enterprise
switch(config-router)# address-family ipv4 unicast
switch(config-router-af)# redistribute eigrp 201 route-map ISISmap
switch(config-router-af)# copy running-config startup-config

Limiting the number of redistributed routes

Route redistribution can add many routes to the IS-IS route table. You can configure a maximum limit to the number of routes accepted from external protocols. IS-IS provides the following options to configure redistributed route limits:

  • Fixed limit—Logs a message when IS-IS reaches the configured maximum. IS-IS does not accept any more redistributed routes. You can optionally configure a threshold percentage of the maximum where IS-IS logs a warning when that threshold is passed.

  • Warning only—Logs a warning only when IS-IS reaches the maximum. IS-IS continues to accept redistributed routes.

  • Withdraw—Starts the timeout period when IS-IS reaches the maximum. After the timeout period, IS-IS requests all redistributed routes if the current number of redistributed routes is less than the maximum limit. If the current number of redistributed routes is at the maximum limit, IS-IS withdraws all redistributed routes. You must clear this condition before IS-IS accepts more redistributed routes. You can optionally configure the timeout period.

Before you begin

You must enable IS-IS.

SUMMARY STEPS

  1. configure terminal
  2. router isis instance-tag
  3. redistribute {bgp id | direct | eigrpid | isis id | ospf id | rip id | static} route-map map-name
  4. redistribute maximum-prefix max [threshold] [warning-only | withdraw [num-retries timeout]]
  5. (Optional) show running-config isis
  6. (Optional) copy running-config startup-config

DETAILED STEPS

  Command or Action Purpose

Step 1

configure terminal

Example:

switch# configure terminal
switch(config)#

Enters global configuration mode.

Step 2

router isis instance-tag

Example:

switch(config)# router isis Enterprise
switch(config-router)#

Creates a new IS-IS instance with the configured instance tag.

Step 3

redistribute {bgp id | direct | eigrpid | isis id | ospf id | rip id | static} route-map map-name

Example:

switch(config-router)# redistribute bgp
route-map FilterExternalBGP

Redistributes the selected protocol into IS-IS through the configured route map.

Step 4

redistribute maximum-prefix max [threshold] [warning-only | withdraw [num-retries timeout]]

Example:

switch(config-router)# redistribute
maximum-prefix 1000 75 warning-only

Specifies a maximum number of prefixes that IS-IS distributes. The range is from 1 to 65535. You can optionally specify the following:

  • threshold —Percent of maximum prefixes that triggers a warning message.

  • warning-only —Logs a warning message when the maximum number of prefixes is exceeded.

  • withdraw —Withdraws all redistributed routes. You can optionally try to retrieve the redistributed routes. The num-retries range is from 1 to 12. The timeout is 60 to 600 seconds. The default is 300 seconds. Use the clear isis redistribution command if all routes are withdrawn.

Step 5

(Optional) show running-config isis

Example:

switch(config-router)# show
running-config isis
 (Optional)

Displays the IS-IS configuration.

Step 6

(Optional) copy running-config startup-config

Example:

switch(config-router)# copy
running-config startup-config
(Optional)

Saves this configuration change.

Example

This example shows how to limit the number of redistributed routes into IS-IS: 

switch# configure terminal
switch(config)# router isis Enterprise
switch(config-router)# redistribute bgp route-map FilterExternalBGP
switch(config-router)# redistribute maximum-prefix 1000 75

Advertise Only Passive Interface Prefixes

You can specify that only prefixes belonging to passive interfaces are advertised in the system link-state packets (LSPs).

Procedure

Step 1

configure terminal

Example:

switch# configure terminal
switch(config)#

Enters global configuration mode.

Step 2

router isisinstance-tag

Example:

switch(config)# router isis 200
switch(config-router)#

Creates a new IS-IS instance with the configured instance tag.

Step 3

address-family {ipv4 | ipv6} unicast

Example:


switch(config-router)# address-family
ipv4 unicast
switch(config-router-af)#

Enters address family configuration mode.

Step 4

[no] advertise passive-only {level-1 | level-2}

Example:

switch(config-router-af)# advertise passive-only level-1
switch(config-router-af)#

Enables the advertisement of only those prefixes that belong to passive interfaces.

Example

This example shows how to enable only the advertising of prefixes belonging to passive interfaces:


switch# <userinput>configure terminal</userinput>
switch(config)# <userinput>interface ethernet 1/2</userinput>
switch(config-if)# <userinput>address-family ipv4 unicast</userinput>
switch(config-router-af)# <userinput>advertise passive-only level-1</userinput>

Suppress Prefixes on an Interface

You can allow an IS-IS interface to participate in forming adjacencies without advertising connected prefixes in the system link-state packets (LSPs).

Procedure

Step 1

configure terminal

Example:

switch# configure terminal
switch(config)#

Enters global configuration mode.

Step 2

interface interface-type slot/port

Example:

switch(config)# interface ethernet 1/2
switch(config-if)#

Enters interface configuration mode.

Step 3

[no] isis suppress

Example:

switch(config-if)# isis suppress
switch(config-if)#

Disables the advertisement of connected prefixes on the interface.

Example

This example shows how to suppress the advertising of an interface's connected prefixes in the system link-state packets (LSPs):


switch# <userinput>configure terminal</userinput>
switch(config)# <userinput>interface ethernet 1/2</userinput>
switch(config-if)# <userinput>isis suppress</userinput>

Disable Strict Adjacency Mode

When both IPv4 and IPv6 address families are enabled, strict adjacency mode is enabled by default. In this mode, the device does not form an adjacency with any router that does not have both address families enabled. You can disable strict adjacency mode using the no adjacency-check command.

Before you begin

You must enable IS-IS (see the Enabling the IS-IS Feature section).

Procedure

Step 1

configure terminal

Example:

switch# configure terminal
switch(config)#

Enters global configuration mode.

Step 2

router isis instance-tag

Example:

switch(config)# router isis Enterprise
switch(config-router)#

Creates a new IS-IS instance with the configured instance tag.

Step 3

address-family ipv4 unicast

Example:

switch(config-router)# address-family
ipv4 unicast
switch(config-router-af)#

Enters address family configuration mode.

Step 4

no adjacency-check

Example:

switch(config-router-af)# no
adjacency-check

Disables strict adjacency mode for the IPv4 address family.

Step 5

exit

Example:

switch(config-router-af)# exit
switch(config-router)#

Exits address family configuration mode.

Step 6

address-family ipv6 unicast

Example:

switch(config-router)# address-family
ipv6 unicast
switch(config-router-af)#

Enters address family configuration mode.

Step 7

no adjacency-check

Example:

switch(config-router-af)# no
adjacency-check

Disables strict adjacency mode for the IPv6 address family.

Step 8

(Optional) show running-config isis

Example:

switch(config-router-af)# show
running-config isis

Displays the IS-IS configuration.

Step 9

(Optional) copy running-config startup-config

Example:

switch(config-router-af)# copy
running-config startup-config

Saves this configuration change.

Configure a Graceful Restart

You can configure a graceful restart for IS-IS.

Before you begin

You must enable IS-IS (see the Enabling the IS-IS Feature section).

Procedure

Step 1

configure terminal

Example:

switch# configure terminal
switch(config)#

Enters global configuration mode.

Step 2

router isisinstance-tag

Example:

switch(config)# router isis Enterprise
	switch(config-router)#

Creates a new IS-IS process with the configured name.

Step 3

graceful restart

Example:

switch(config-router)# graceful-restart

Enables a graceful restart and the graceful restart helper functionality. Enabled by default.

Step 4

graceful-restart t3 manualtime

Example:

switch(config-router)# graceful-restart
	t3 manual 300

Configures the graceful restart T3 timer. The range is from 30 to 65535 seconds. The default is 60.

Step 5

(Optional) show running-config isis

Example:

switch(config-router)# show
	running-config isis

Displays the IS-IS configuration.

Step 6

(Optional) copy running-config startup-config

Example:

switch(config-router)# copy
	running-config startup-config

Copies the running configuration to the startup configuration.

Example

This example shows how to enable a graceful restart: 
switch# <userinput>configure terminal</userinput>
switch(config)# <userinput>router isis Enterprise</userinput>
switch(config-router)# <userinput>graceful-restart</userinput>
switch(config-router)# <userinput>copy running-config startup-config</userinput>

Configure Virtualization

You can configure multiple IS-IS instances and multiple VRFs and use the same or multiple IS-IS instances in each VRF. You assign an IS-IS interface to a VRF.

You must configure a NET for the configured VRF.

Configure all other parameters for an interface after you configure the VRF for an interface. Configuring a VRF for an interface deletes all the configuration for that interface.

Before you begin

You must enable IS-IS (see the Enabling the IS-IS Feature section).

Procedure

Step 1

configure terminal

Example:

switch# configure terminal
switch(config)#

Enters global configuration mode.

Step 2

vrf contextvrf-name

Example:

switch(config)# vrf context
RemoteOfficeVRF
switch(config-vrf)#

Creates a new VRF and enters VRF configuration mode.

Step 3

exit

Example:

switch(config-vrf)# exit
switch(config)#

Exits VRF configuration mode.

Step 4

router isisinstance-tag

Example:

switch(config)# router isis Enterprise
switch(config-router)#

Creates a new IS-IS instance with the configured instance tag.

Step 5

(Optional) vrfvrf-name

Example:

switch(config-router)# vrf
RemoteOfficeVRF
switch(config-router-vrf)#

Enters router VRF configuration mode.

Step 6

netnetwork-entity-title

Example:

switch(config-router-vrf)# net
47.0004.004d.0001.0001.0c11.1111.00

Configures the NET for this IS-IS instance.

Step 7

exit

Example:

switch(config-router-vrf)# exit
switch(config-router)#

Exits router VRF configuration mode.

Step 8

exit

Example:

switch(config-router)# exit
switch(config)#

Exits router configuration mode.

Step 9

interface ethernetslot/port

Example:

switch(config)# interface ethernet 1/2
switch(config-if)#

Enters interface configuration mode.

Step 10

vrf membervrf-name

Example:

switch(config-if)# vrf member
RemoteOfficeVRF

Adds this interface to a VRF.

Step 11

{ip | ipv6) address ip-prefix/length

Example:

switch(config-if)# ip address
192.0.2.1/16

Configures an IP address for this interface. You must complete this step after you assign this interface to a VRF.

Step 12

{ip | ipv6) router isis instance-tag

Example:

switch(config-if)# ip router isis
Enterprise

Associates this IPv4 or IPv6 interface with an IS-IS instance.

Step 13

(Optional) show isis [vrf vrf-name] [instance-tag] interface [interface-type slot/port]

Example:

switch(config-if)# show isis Enterprise
ethernet 1/2

Displays IS-IS information for an interface in a VRF.

Step 14

(Optional) copy running-config startup-config

Example:

switch(config-if)# copy running-config
startup-config

Saves this configuration change.

Example

This example shows how to create a VRF and add an interface to the VRF:

switch# <userinput>configure terminal</userinput>
switch(config)# <userinput>vrf context NewVRF</userinput>
switch(config-vrf)# <userinput>exit</userinput>
switch(config)# <userinput>router isis Enterprise</userinput>
switch(config-router)# <userinput>vrf NewVRF</userinput>
switch(config-router-vrf)# <userinput>net 47.0004.004d.0001.0001.0c11.1111.00</userinput>
switch(config-router-vrf)# <userinput>exit</userinput>
switch(config-router)# <userinput>exit</userinput>
switch(config)# <userinput>interface ethernet 1/2</userinput>
switch(config-if)# <userinput>vrf member NewVRF</userinput>
switch(config-if)# <userinput>ip address 192.0.2.1/16</userinput>
switch(config-if)# <userinput>ip router isis Enterprise</userinput>
switch(config-if)# <userinput>copy running-config startup-config</userinput>

Tune IS-IS

You can tune IS-IS to match your network requirements.

You can use the following optional commands to tune IS-IS:

Procedure

Step 1

(Optional) lsp-gen-interval [level-1 | level-2] lsp-max-wait [lsp-initial-wait lsp-second-wait]

Example:

switch(config-router)# lsp-gen-interval
level-1 500 500 500

Configures the IS-IS throttle for LSP generation. The optional parameters are as follows:

  • lsp-max-wait —The maximum wait between the trigger and LSP generation. The range is from 500 to 65535 milliseconds.

  • lsp-initial-wait —The initial wait between the trigger and LSP generation. The range is from 50 to 65535 milliseconds.

  • lsp-second-wait —The second wait used for LSP throttle during backoff. The range is from 50 to 65535 milliseconds.

Step 2

(Optional) max-lsp-lifetime lifetime

Example:

switch(config-router)# max-lsp-lifetime
500
Sets the maximum LSP lifetime in seconds. The range is from 1 to 65535. The default is 1200.

Step 3

(Optional) spf-interval [level-1 | level-2] spf-max-wait [spf-initial-wait spf-second-wait]

Example:

switch(config-router)# spf-interval
level-2 500 500 500

Configures the interval between LSA arrivals. The optional parameters are as follows:

  • lsp-max-wait —The maximum wait between the trigger and SPF computation. The range is from 500 to 65535 milliseconds.

  • lsp-initial-wait —The initial wait between the trigger and SPF computation. The range is from 50 to 65535 milliseconds.

  • lsp-second-wait —The second wait used for SPF computation during backoff. The range is from 50 to 65535 milliseconds.

Step 4

(Optional) adjacency-check

Example:

switch(config-router-af)# adjacency-check
Performs an adjacency check to verify that an IS-IS instance forms an adjacency only with a remote IS-IS entity that supports the same address family. This command is enabled by default.

Step 5

(Optional) isis csnp-interval seconds [level-1 | level-2]

Example:

switch(config-if)# isis csnp-interval 20
Sets the complete sequence number PDU (CNSP) interval in seconds for IS-IS. The range is from 1 to 65535. The default is 10.

Step 6

(Optional) isis hello-interval seconds [level-1 | level-2]

Example:

switch(config-if)# isis hello-interval 20
Sets the hello interval in seconds for IS-IS. The range is from 1 to 65535. The default is 10.

Step 7

(Optional) isis hello-multiplier num [level-1 | level-2]

Example:

switch(config-if)# isis hello-multiplier 20
Specifies the number of IS-IS hello packets that a neighbor must miss before the router tears down an adjacency. The range is from 3 to 1000. The default is 3.

Step 8

(Optional) isis lsp-interval milliseconds

Example:

switch(config-if)# isis lsp-interval 20
Sets the interval in milliseconds between LSPs sent on this interface during flooding. The range is from 10 to 65535. The default is 33.

Verifying the IS-IS Configuration

To display the IS-IS configuration, perform one of the following tasks:

Command Purpose
show isis [instance-tag] adjacency [interface] [detail | summary] [vrf vrf-name]

Displays the IS-IS adjacencies. Use the clear isis adjacency command to clear these statistics.

Note

 

If the hostname is less than 14 characters, the show isis adjacency command displays the hostname. Otherwise, the System ID is displayed.

show isis [instance-tag] database [level-1 | level-2] [detail | summary] [lsp-id] [{ip | ipv6} prefixip-prefix] | [router-id router-id] | [adjacency node-id] | [zero-sequence]} [vrf vrf-name]

Displays the IS-IS LSP database.

show isis [instance-tag] hostname [vrf vrf-name]

Displays the dynamic host exchange information.

show isis [instance-tag] interface [brief | interface] [level-1 | level-2] [vrfvrf-name]

Displays the IS-IS interface information.

show isis [instance-tag] mesh-group [mesh-id] [vrfvrf-name]

Displays the mesh group information.

show isis [instance-tag] protocol [vrf vrf-name]

Displays information about the IS-IS protocol.

show isis [instance-tag] {ip | ipv6} redistribute route [ip-address | summary] [ip-prefix] [longer-prefixes [summary]] [vrf vrf-name]

Displays the IS-IS route redistribution information.

show isis [instance-tag] {ip | ipv6} route [ip-address | summary] [ip-prefix] [longer-prefixes [summary]] [detail] [vrf vrf-name]

Displays the IS-IS route table.

show isis [instance-tag] rrm [interface] [vrf vrf-name]

Displays the IS-IS interface retransmission information.

show isis [instance-tag] srm [interface] [vrf vrf-name]

Displays the IS-IS interface flooding information.

show isis [instance-tag] ssn [interface] [vrf vrf-name]

Displays the IS-IS interface PSNP information.

show isis [instance-tag] {ip | ipv6} summary-address] [ip-address] | [ip-prefix] [vrf vrf-name]

Displays the IS-IS summary address information.

show running-configuration isis

Displays the current running IS-IS configuration.

show tech-support isis [detail]

Displays the technical support details for IS-IS.

Monitor IS-IS

To display IS-IS statistics, use the following commands:

Command Purpose
show isis [instance-tag] adjacency [interface] [system-ID] [detail] [summary] [vrf vrf-name]

Displays the IS-IS adjacency statistics.

show isis [instance-tag] database [level-1 | level-2] [detail] | summary] [lsip] {[adjacency id {ip | ipv6} prefix prefix] [router-id id] [zero-sequence]} [vrf vrf-name]

Displays the IS-IS database statistics.

show isis [instance-tag] statistics [interface] [vrf vrf-name]

Displays the IS-IS interface statistics.

show isis {ip | ipv6} route-map statistics redistribute {bgp id | eigrp id | isis id | ospf id | rip id | static} [vrf vrf-name]

Displays the IS-IS redistribution statistics.

show isis ip route-map statistics distribute {level-1 | level-2} into {level-1 | level-2} [vrf vrf-name]

Displays IS-IS distribution statistics for routes distributed between levels.

show isis [instance-tag] spf-log [detail] [vrf vrf-name]

Displays the IS-IS SPF calculation statistics.

show isis [instance-tag] traffic [interface] [vrf vrf-name]

Displays the IS-IS traffic statistics.

To clear IS-IS configuration statistics, perform one of the following tasks:

Command Purpose
clear isis [instance-tag] adjacency [* | [interface] [system-id id]] [vrf vrf-name]

Clears the IS-IS adjacency statistics.

clear isis {ip | ipv6} route map statistics redistribute {bgp id | direct | eigrp id | isis id | ospf id | rip id | static} [vrf vrf-name]

Clears the IS-IS redistribution statistics

clear isis route-map statistics distribute {level-1 | level-2} into {level-1 | level-2} [vrf vrf-name]

Clears IS-IS distribution statistics for routes distributed between levels.

clear isis [instance-tag] statistics [* | interface] [vrf vrf-name]

Clears the IS-IS interface statistics.

clear isis [instance-tag] traffic [* | interface] [vrf vrf-name]

Clears the IS-IS traffic statistics.

Configuration Examples for IS-IS

This example shows how to configure IS-IS: 

router isis Enterprise
        is-type level-1
        net 49.0001.0000.0000.0003.00
        graceful-restart
        address-family ipv4 unicast
        default-information originate 
        
        interface ethernet 2/1
        ip address 192.0.2.1/24
        isis circuit-type level-1
        ip router isis Enterprise