IS-IS Inbound Filtering

The Intermediate System-to-Intermediate System (IS-IS) Inbound Filtering feature prevents unwanted IS-IS routes from being installed in a routing table. A user can deny or permit a route from being installed in a routing table using the feature in combination with access lists, prefix lists, route maps, or gateways.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.

Prerequisites for IS-IS Inbound Filtering

IS-IS must be configured on the network.

Information About IS-IS Inbound Filtering

You can deny or permit Intermediate System-to-Intermediate System (IS-IS) routes from being installed in the routing table.

Devices configured with IS-IS run Shortest Path First (SPF) on the routes received through link-state packet (LSP) updates and install updated routes in a routing table. You can configure access lists, prefix lists, gateways, or route maps with permit or deny rules and apply these to the routing table using the distribute-list command.

The distribution list can be applied globally or to routes using a specific interface as the outgoing interface.

Filtering Based on a Route Tag

Users can assign tags to external routes when they are redistributed to IS-IS routes. Then, the user can deny or permit those routes in the IS-IS domain by identifying that tag in the route-map and distribute-list in commands.

In the route map, you can create rules for specific route attributes that are defined using the match command. The match options are as follows:

  • match interface

  • match ip address

  • match ip next-hop

  • match ip route-source

  • match metric

  • match route-type

  • match tag

One application of filtering based on route tags is on Autonomous System Boundary Routers (ASBRs), where users can tag prefixes when they are distributed on the ASBRs, and later use the tags to filter the prefixes and prevent them from getting installed on the routing table of other external devices.

Filtering Based on an Interface

When a match is done on the interface, the interface represents the outgoing interface of the route that IS-IS is trying to install in the routing table.

Filtering Based on Next Hop/Source of Updates

When a match is done on the next hop, the next hop represents the next-hop IP address of the route that IS-IS is trying to install in the routing table. You can thus filter routes based on the source of the updates.

How to Configure IS-IS Inbound Filtering

Configuring Route Filtering by Route Destination Using an Access List

Perform this task to filter a route by route destination. An access list is defined to permit or deny a destination IP address and this access list is applied to the routing table.

SUMMARY STEPS

  1. enable
  2. configure terminal
  3. access-list access-list-number {permit | deny } ip any destination-address destination-wildcard
  4. interface type number
  5. ip router isis route-tag
  6. router isis route-tag
  7. distribute-list access-list-number in [interface-type interface-number]

DETAILED STEPS

  Command or Action Purpose
Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.
Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.
Step 3

access-list access-list-number {permit | deny } ip any destination-address destination-wildcard

Example:

Device(config)# access-list 101 deny ip any 198.51.100.15 0.0.0.63

Defines an access list permitting or denying an IP address or a subnet.

  • 1 in the source-wildcard indicates that the corresponding position in the source-address need not be considered.
Step 4

interface type number

Example:

Device(config)# interface fastethernet 0/0

Configures an interface type and enters interface configuration mode.
Step 5

ip router isis route-tag

Example:

Device(config-if)# ip router isis 121

Configures an IS-IS routing process for IP on an interface and attaches an area designator to the routing process.
Step 6

router isis route-tag

Example:

Device(config-if)# router isis 121

Enables an Intermediate System-to-Intermediate System (IS-IS) routing protocol and enters router configuration mode.
Step 7

distribute-list access-list-number in [interface-type interface-number]

Example:

Device(config-router)# distribute-list 101 in

Filters the routing table based on the access list.

Configuring Route Filtering by Next Hop (or Route Source)

Perform this task to filter a route by the next-hop IP address of the route (source of routing updates). A prefix list is defined to permit or deny a next-hop IP address and applied to the routing table.

SUMMARY STEPS

  1. enable
  2. configure terminal
  3. ip prefix-list prefix-list-name [seq number] {permit | deny } network/length [ge ge-length] [le le-length]
  4. interface type number
  5. ip router isis route-tag
  6. router isis route-tag
  7. distribute-list gateway prefix-list-name in [interface-type interface-number]

DETAILED STEPS

  Command or Action Purpose
Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.
Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.
Step 3

ip prefix-list prefix-list-name [seq number] {permit | deny } network/length [ge ge-length] [le le-length]

Example:

Device(config)# ip prefix-list List2 seq 5 deny 198.51.100.21/24

Defines a prefix list permitting or denying an IP address or a subnet.

  • The optional ge keyword represents the greater than or equal to operator.

  • The optional le keyword represents the lesser than or equal to operator.

Step 4

interface type number

Example:

Device(config)# interface fastethernet 0/0

Configures an interface type and enters interface configuration mode.
Step 5

ip router isis route-tag

Example:

Device(config-if)# ip router isis 125

Configures an IS-IS routing process for IP on an interface and attaches an area designator to the routing process.
Step 6

router isis route-tag

Example:

Device(config-if)# router isis 125

Enables an IS-IS routing protocol and enters router configuration mode.
Step 7

distribute-list gateway prefix-list-name in [interface-type interface-number]

Example:

Device(config-router)# distribute-list gateway List2 in

Filters the routing table based on the next hop (or route source).

Configuring Route Filtering by Route Destination Using a Prefix List

Perform this task to filter a route by route destination. A prefix list is defined to permit or deny a destination IP address and applied to the routing table.

SUMMARY STEPS

  1. enable
  2. configure terminal
  3. ip prefix-list prefix-list-name [seq number] {permit | deny } network/length [ge ge-length] [le le-length]
  4. interface type number
  5. ip router isis route-tag
  6. router isis route-tag
  7. distribute-list prefix prefix-list-name in [interface-type interface-number]

DETAILED STEPS

  Command or Action Purpose
Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.
Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.
Step 3

ip prefix-list prefix-list-name [seq number] {permit | deny } network/length [ge ge-length] [le le-length]

Example:

Device(config)# ip prefix-list List1 seq 5 deny 198.51.100.23/24

Defines a prefix list permitting or denying an IP address or a subnet.

  • The optional ge keyword represents the greater than or equal to operator.

  • The optional le keyword represents the lesser than or equal to operator.

Step 4

interface type number

Example:

Device(config)# interface fastethernet 0/0

Configures an interface type and enters interface configuration mode.
Step 5

ip router isis route-tag

Example:

Device(config-if)# ip router isis 122

Configures an IS-IS routing process for IP on an interface and attaches an area designator to the routing process.
Step 6

router isis route-tag

Example:

Device(config-if)# router isis 122

Enables an IS-IS routing protocol and enters router configuration mode.
Step 7

distribute-list prefix prefix-list-name in [interface-type interface-number]

Example:

Device(config-router)# distribute-list prefix List1 in

Filters the routing table based on the prefix list.

Configuring Route Filtering Using Tags

Perform this task to filter a route using route tags. A route map is defined to permit or deny a route tag and applied to the routing table.

SUMMARY STEPS

  1. enable
  2. configure terminal
  3. route-map route-map-name [permit | deny ] sequence-number
  4. match tag tag-value
  5. exit
  6. interface type number
  7. ip router isis route-tag
  8. router isis route-tag
  9. distribute-list route-map route-map-name in

DETAILED STEPS

  Command or Action Purpose
Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.
Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.
Step 3

route-map route-map-name [permit | deny ] sequence-number

Example:

Device(config)# route-map Map1 deny 10

Creates a route map, associates a permit or deny condition with it, and enters route-map configuration mode
Step 4

match tag tag-value

Example:

Device(config-route-map)# match tag 200
Associates a match tag rule with the route map and matches routes with a specified name to be used as the route map is referenced.

  • At least one match command is required, but it need not be this match command. This is just an example.

  • The list of match commands available to be used in this type of route map appears on the distribute-list in command reference page.

  • This type of route map will have no set commands.

Step 5

exit

Example:

Device(config-route-map)# exit

Enters global configuration mode.
Step 6

interface type number

Example:

Device(config)# interface fastethernet 0/0

Configures an interface type and enters interface configuration mode.
Step 7

ip router isis route-tag

Example:

Device(config-if)# ip router isis 150

Configures an IS-IS routing process for IP on an interface and attaches an area designator to the routing process.
Step 8

router isis route-tag

Example:

Device(config-if)# router isis 150

Enables an IS-IS routing protocol and enters router configuration mode.
Step 9

distribute-list route-map route-map-name in

Example:

Device(config-router)# distribute-list route-map Map1 in

Filters the routing table based on the route tags specified in the route map.

Configuring Route Filtering by IPv6 Route Destination Using a Prefix List

Perform this task to filter a route by IPv6 route destination. A prefix list is defined to permit or deny a destination IPv6 address and applied to the routing table.

SUMMARY STEPS

  1. enable
  2. configure terminal
  3. ipv6 prefix-list prefix-list-name [seq number] {permit | deny } network/length [ge ge-length] [le le-length]
  4. router isis
  5. address-family ipv6
  6. distribute-list prefix-list prefix-list-name in [interface-type interface-number]

DETAILED STEPS

  Command or Action Purpose
Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.
Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.
Step 3

ipv6 prefix-list prefix-list-name [seq number] {permit | deny } network/length [ge ge-length] [le le-length]

Example:

Device(config)# ipv6 prefix-list 101 seq 5 deny 2001:DB8::/32

Defines a prefix list permitting or denying an IPv6 address or a subnet.

  • The optional ge keyword represents the greater than or equal to operator.

  • The optional le keyword represents the lesser than or equal to operator.

Step 4

router isis

Example:

Device(config)# router isis

Enters router configuration mode.
Step 5

address-family ipv6

Example:

Device(config-router)# address-family ipv6

Enables configuration of IS-IS routing sessions for IPv6 address prefixes and enters address family configuration mode.
Step 6

distribute-list prefix-list prefix-list-name in [interface-type interface-number]

Example:

Device(config-router-af)# distribute-list prefix-list 101 in

Filters the routing table based on the prefix list.

Configuration Examples for IS-IS Inbound Filtering

Example: Configuring Route Filtering by Route Destination Using an Access List

The following example shows how to filter three routes from the routing table using a specified access list:

Device(config)# access-list 101 deny ip any 192.168.4.0 0.0.0.127
Device(config)# access-list 101 deny ip any 192.168.4.128 0.0.0.63
Device(config)# access-list 101 deny ip any 192.168.4.192 0.0.0.63 
Device(config)# interface fastethernet 0/0
Device(config-if)# ip router isis 121
Device(config-if)# router isis 121
Device(config-router)# distribute-list 101 in

Example: Configuring Route Filtering by Next Hop (or Route Source)

The following example shows how to enable IS-IS inbound filtering using next hop or a route source:

Device(config)# ip prefix-list List2 seq 5 deny 198.51.100.31/24
Device(config)# interface fastethernet 0/0
Device(config-if)# ip router isis 125
Device(config-if)# router isis 125
Device(config-router)# distribute-list gateway List2 in

Example: Configuring Route Filtering by Route Destination Using a Prefix List

The following example shows how to filter three routes from a routing table using a prefix list.

Device(config)# ip prefix-list List1 seq 3 deny 192.0.2.1/24
Device(config)# ip prefix-list List1 seq 5 deny 192.168.4.0/24 ge 25 le 26
Device(config)# ip prefix-list List1 seq 10 permit 0.0.0.0/le 32
Device(config)# interface fastethernet 0/0
Device(config-if)# ip router isis 122
Device(config-if)# router isis 122
Device(config-router)# distribute-list prefix List1 in

Example: Configuring Route Filtering Using Tags

The following example shows how to enable IS-IS inbound filtering using a route map:

Device(config)# route-map Map1 deny 10
Device(config-route-map)# match tag 200
Device(config-route-map)# exit
Device(config)# interface fastethernet 0/0
Device(config-if)# ip router isis 150
Device(config-if)# router isis 150
Device(config-router)# distribute-list route-map Map1 in

Example: Configuring Route Filtering by IPv6 Route Destination Using a Prefix List

The following example shows how to enable IS-IS inbound filtering for routes that use standard IPv6 address prefixes:

Device(config)# ipv6 prefix-list 101 seq 5 deny 2001:DB8::/32
Device(config)# ipv6 prefix-list 102 seq 4 permit 2001:DB8::1/48 le 56
Device(config)# router isis
Device(config-router)# address-family ipv6
Device(config-router-af)# distribute-list prefix-list 101 in
Device(config-router-af)# distribute-list prefix-list 102 in ethernet 0/0

Verifying IS-IS Inbound Filtering

Perform this task to display the local Intermediate System-to-Intermediate System (IS-IS) routing information base (RIB). The show commands can be entered in any order.

SUMMARY STEPS

  1. enable
  2. show isis ip rib
  3. show isis ipv6 rib

DETAILED STEPS

Step 1

enable

Enables privileged EXEC mode.

Example:

Device> enable
Step 2

show isis ip rib

Displays the IPv4 local RIB.

Example:

Device# show isis ip rib

IPv4 local RIB for IS-IS process 

IPV4 unicast topology base (TID 0, TOPOID 0x0) =================

1.1.1.1/32
  [115/L2/20] via 30.30.30.20(Serial3/0), from 2.2.2.2, tag 0, LSP[3/3] 
  [115/L2/20] via 100.100.100.20(Ethernet0/0), from 2.2.2.2, tag 0, LSP[3/3] 

2.2.2.2/32
  [115/L1/20] via 30.30.30.20(Serial3/0), from 2.2.2.2, tag 0, LSP[4/2] -
  [115/L1/20] via 100.100.100.20(Ethernet0/0), from 2.2.2.2, tag 0, LSP[4/2] -
  [115/L2/20] via 30.30.30.20(Serial3/0), from 2.2.2.2, tag 0, LSP[3/3] -
  [115/L2/20] via 100.100.100.20(Ethernet0/0), from 2.2.2.2, tag 0, LSP[3/3] -

20.20.20.0/24
  [115/L1/20] via 30.30.30.20(Serial3/0), from 2.2.2.2, tag 0, LSP[4/2] 
  [115/L1/20] via 100.100.100.20(Ethernet0/0), from 2.2.2.2, tag 0, LSP[4/2] 
  [115/L2/20] via 30.30.30.20(Serial3/0), from 2.2.2.2, tag 0, LSP[3/3] 
  [115/L2/20] via 100.100.100.20(Ethernet0/0), from 2.2.2.2, tag 0, LSP[3/3]
Step 3

show isis ipv6 rib

Displays the IPv6 local RIB.

Example:

Device# show isis ipv6 rib

IS-IS IPv6 process , local RIB
  11::1/128
    via FE80::A8BB:CCFF:FE00:C800/Ethernet0/0, type L2  metric 20 tag 0 LSP [3/3] 
  20::/64
    via FE80::A8BB:CCFF:FE00:C800/Ethernet0/0, type L1  metric 20 tag 0 LSP [4/2] 
    via FE80::A8BB:CCFF:FE00:C800/Ethernet0/0, type L2  metric 20 tag 0 LSP [3/3] 
* 22::2/128
    via FE80::A8BB:CCFF:FE00:C800/Ethernet0/0, type L1  metric 20 tag 0 LSP [4/2] -
    via FE80::A8BB:CCFF:FE00:C800/Ethernet0/0, type L2  metric 20 tag 0 LSP [3/3] -
  2001:DB8::/64
    via FE80::A8BB:CCFF:FE00:C800/Ethernet0/0, type L1  metric 20 tag 0 LSP [4/2] 
    via FE80::A8BB:CCFF:FE00:C800/Ethernet0/0, type L2  metric 20 tag 0 LSP [3/3]

Additional References

Related Documents

Related Topic

Document Title

IS-IS commands

Cisco IOS IP Routing: IS-IS Command Reference

Cisco IOS Commands

Cisco IOS Master Command List, All Releases

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

http://www.cisco.com/cisco/web/support/index.html

Feature Information for IS-IS Inbound Filtering

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Table 1. Feature Information for IS-IS Inbound Filtering

Feature Name

Releases

Feature Information

IS-IS Inbound Filterng

15.3(3)M

The Intermediate System-to-Intermediate System (IS-IS) Inbound Filtering feature allows users to define a route map to permit or deny IS-IS routes from being added to a routing table. You can configure access lists, prefix lists, gateways, or route maps with permit or deny rules, and apply these to the routing table using the distribute-list command.

The following command was modified:

distribute-list in (IP) .