IS-IS - Intermediate System to Intermediate System

IS-IS is a link-state routing protocol that operates at Layer 2 and is widely used in datacenter and ISP networks.

Overview

IS-IS (Intermediate System to Intermediate System, ISO 10589) is a link-state routing protocol originally designed for the OSI stack and later adapted for IP.

Characteristics:

Link-state protocol using the Dijkstra SPF algorithm
Runs directly at Layer 2 (does not use IP transport)
Two-level hierarchy (Level-1 and Level-2)
Support for IPv4 and IPv6 in a single process
Fast convergence
Scalability for large networks
Used in ISP and datacenter fabric

Versions:

IS-IS for IP - support for IPv4 and IPv6
Integrated IS-IS - simultaneous routing of OSI CLNP and IP

Use cases:

ISP backbone networks
Data center leaf-spine fabric (especially with CLOS topology)
Large enterprise campus
Service provider MPLS core
Carrier Ethernet networks

Advantages:

Runs at Layer 2 (independent of IP)
IPv4 and IPv6 in a single process
No need for an area 0 as in OSPF
More flexible hierarchy
Less update overhead
Better scalability than OSPF

Disadvantages:

Harder to understand than OSPF
Less common in enterprise
Requires understanding of OSI terminology

IS-IS Architecture

Routing Levels

IS-IS uses a two-level hierarchy.

Level-1 (L1):

Routing within an area (intra-area)
L1 routers know only the topology of their own area
Similar to OSPF internal routers
Use a default route for inter-area traffic

Level-2 (L2):

Routing between areas (inter-area)
L2 routers know all L2 routes
Similar to the OSPF backbone (Area 0)
Form the backbone topology

Level-1-2 (L1/L2):

Operate on both levels simultaneously
The boundary between L1 and L2 domains
Similar to an OSPF ABR (Area Border Router)
Advertise a default route into the L1 area

Router Types

L1 Router:

All interfaces in a single area
Knows only the L1 topology
Uses the nearest L1/L2 router as the default gateway

L2 Router:

Inter-area routing only
Does not participate in L1 routing
Forms the L2 backbone

L1/L2 Router:

Participates in both L1 and L2 routing
Connects an L1 area to the L2 backbone
Advertises L1 prefixes into L2
Advertises a default route into L1

Network Entity Title (NET)

The NET is the address of an IS-IS router in OSI NSAP format.

Format:

Area-ID . System-ID . NSEL

Structure:

Area-ID - the area identifier (variable length, typically 1-13 bytes)
System-ID - the unique router ID (fixed length of 6 bytes)
NSEL - selector (always 00 for routers)

Example:

49.0001.1921.6800.1001.00

Breakdown:

49 - AFI (Authority and Format Identifier) for private addressing
0001 - Area ID
1921.6800.1001 - System ID (often derived from an IP: 192.168.0.1 → 1921.6800.1001)
00 - NSEL

Length: Typically 10, 13, or 20 bytes.

AFI codes:

39 - ISO DCC (Data Country Code)
45 - ISO ICD (International Code Designator)
47 - ISO 6523-ICD
49 - Private (the most common)

Basic Configuration

Minimal Setup

Router 1:

set interfaces loopback lo address 192.168.255.1/32

set protocols isis net 49.0001.1921.6825.5001.00

set protocols isis interface eth1
set protocols isis interface lo

commit
save

Router 2:

set interfaces loopback lo address 192.168.255.2/32

set protocols isis net 49.0001.1921.6825.5002.00

set protocols isis interface eth1
set protocols isis interface lo

commit
save

Verification:

show isis neighbor
show isis database
show ip route isis

NET Configuration

Configuring the Network Entity Title:

set protocols isis net 49.0001.1921.6800.1001.00
commit

Recommendations:

Use AFI 49 for private networks
Derive the System ID from the loopback IP
The Area ID must match for L1 neighbors
The Area ID may differ for L2 neighbors

Generating a System ID from an IP:

IP: 192.168.0.1 → System ID: 1921.6800.1001

# Conversion example
ip = "192.168.0.1"
octets = ip.split('.')
system_id = f"{int(octets[0]):02d}{int(octets[1]):02d}.{int(octets[2]):02d}{int(octets[3]):02d}.0001"
# Result: 1921.6800.1001

You can use any unique 6-byte identifier:

49.0001.0000.0000.0001.00
49.0001.0000.0000.0002.00

Hostname Mapping

Mapping a System ID to a hostname for convenience:

set protocols isis dynamic-hostname
commit

Routers will advertise their hostnames in the LSP (Link State PDU).

Interface Configuration

Enabling IS-IS on an Interface

Activate IS-IS:

set protocols isis interface eth1
commit

For all interfaces:

set protocols isis interface eth0
set protocols isis interface eth1
set protocols isis interface eth2
set protocols isis interface lo
commit

Circuit Type

The IS-IS circuit type (routing level):

set protocols isis interface eth1 circuit-type level-1
commit

Types:

level-1 - L1 adjacencies only
level-1-2 - L1 and L2 adjacencies (default)
level-2-only - L2 adjacencies only

Usage:

L1 only for internal area routers:

set protocols isis interface eth1 circuit-type level-1
commit

L2 only for backbone routers:

set protocols isis interface eth1 circuit-type level-2-only
commit

L1-2 for border routers:

set protocols isis interface eth1 circuit-type level-1-2
commit

Network Type

The IS-IS network type:

set protocols isis interface eth1 network point-to-point
commit

Types:

broadcast - Ethernet, multiple access (default)
point-to-point - serial links, VPN tunnels

Point-to-point is recommended for:

Direct connections between routers
VPN tunnels (VTI, GRE)
Point-to-point Ethernet links
Avoiding DIS (Designated IS) elections

Passive Interface

The interface advertises its networks but does not form adjacencies:

set protocols isis interface eth2 passive
commit

Usage:

Loopback interfaces
LAN interfaces without IS-IS neighbors
Preventing unauthorized adjacencies

Metric

The IS-IS interface metric:

set protocols isis interface eth1 metric 10
commit

Values: 1-16777215 (default 10).

Per level:

set protocols isis interface eth1 metric level-1 20
set protocols isis interface eth1 metric level-2 10
commit

Wide metrics:

set protocols isis metric-style wide
commit

Styles:

narrow - the legacy format (1-63)
wide - the extended format (1-16777215), recommended
transition - both formats

Priority

The priority for electing the DIS (Designated Intermediate System) on broadcast networks:

set protocols isis interface eth1 priority 64
commit

Values: 0-127 (default 64).

Per level:

set protocols isis interface eth1 priority level-1 100
set protocols isis interface eth1 priority level-2 50
commit

The router with the highest priority becomes the DIS.

Differences from the OSPF DR:

A DIS is not mandatory (preemptive election)
The DIS can be re-elected
A priority of 0 does NOT prevent selection as the DIS

Hello Timers

Hello interval (seconds):

set protocols isis interface eth1 hello-interval 3
commit

Per level:

set protocols isis interface eth1 hello-interval level-1 3
set protocols isis interface eth1 hello-interval level-2 10
commit

Hello multiplier (for the dead interval):

set protocols isis interface eth1 hello-multiplier 3
commit

Dead interval = hello-interval × hello-multiplier.

Defaults:

Broadcast: hello 10s, multiplier 3 (dead 30s)
Point-to-point: hello 3s, multiplier 3 (dead 9s)

Recommendations:

Must match between neighbors
Smaller values for faster convergence
Use BFD for sub-second failover

Authentication

Protecting IS-IS against unauthorized routers.

Area Authentication (Level-1)

Plaintext (not recommended):

set protocols isis area-password plaintext-password 'AreaPassword123'
commit

MD5:

set protocols isis area-password md5 'AreaSecurePassword!'
commit

Applied to Level-1 LSP, CSNP, and PSNP.

Domain Authentication (Level-2)

Plaintext:

set protocols isis domain-password plaintext-password 'DomainPassword123'
commit

MD5:

set protocols isis domain-password md5 'DomainSecurePassword!'
commit

Applied to Level-2 LSP, CSNP, and PSNP.

Interface Authentication

Plaintext:

set protocols isis interface eth1 password plaintext-password 'InterfacePass'
commit

Applied to Hello PDUs on a specific interface.

Recommendations:

Use MD5 for the area/domain password
Use an interface password for additional protection
Do not use plaintext in production
Passwords must match between neighbors

Full Authentication Example

# Domain (L2) authentication
set protocols isis domain-password md5 'L2-Secure-Domain-Pass!'

# Area (L1) authentication
set protocols isis area-password md5 'L1-Secure-Area-Pass!'

# Interface authentication
set protocols isis interface eth1 password plaintext-password 'Interface-Hello-Pass'
set protocols isis interface eth2 password plaintext-password 'Interface-Hello-Pass'

commit
save

Level Configuration

Level-1 Only Router

A router for intra-area routing only:

set protocols isis net 49.0001.1921.6800.1001.00

set protocols isis level level-1

set protocols isis interface eth1 circuit-type level-1
set protocols isis interface eth2 circuit-type level-1
set protocols isis interface lo

commit
save

Level-2 Only Router

A router for inter-area routing only:

set protocols isis net 49.0002.1921.6800.2001.00

set protocols isis level level-2

set protocols isis interface eth1 circuit-type level-2-only
set protocols isis interface eth2 circuit-type level-2-only
set protocols isis interface lo

commit
save

Level-1-2 Router (Border)

A router on the boundary between L1 and L2:

set protocols isis net 49.0001.1921.6800.3001.00

# Level-1-2 by default, but can be set explicitly
set protocols isis level level-1-2

set protocols isis interface eth1 circuit-type level-1
set protocols isis interface eth2 circuit-type level-2-only
set protocols isis interface lo

commit
save

Attached Bit

An L1/L2 router sets the attached bit in its L1 LSP, indicating to L1 routers the path to the L2 backbone.

Enabled by default. To disable it:

set protocols isis no-attached-bit send
commit

Route Redistribution

Importing routes from other sources into IS-IS.

Redistribution Sources

Connected routes:

set protocols isis redistribute ipv4 connected
commit

Static routes:

set protocols isis redistribute ipv4 static
commit

OSPF:

set protocols isis redistribute ipv4 ospf
commit

BGP:

set protocols isis redistribute ipv4 bgp
commit

Kernel:

set protocols isis redistribute ipv4 kernel
commit

Redistribution with a Metric

Set a metric:

set protocols isis redistribute ipv4 connected metric 100
commit

Per level:

set protocols isis redistribute ipv4 static level-1 metric 50
set protocols isis redistribute ipv4 static level-2 metric 100
commit

Route-map for Selective Redistribution

set protocols isis redistribute ipv4 static route-map STATIC-TO-ISIS
commit

Example route-map:

set policy route-map STATIC-TO-ISIS rule 10 action permit
set policy route-map STATIC-TO-ISIS rule 10 match ip address prefix-list ALLOW-NETWORKS

set policy prefix-list ALLOW-NETWORKS rule 10 action permit
set policy prefix-list ALLOW-NETWORKS rule 10 prefix 10.0.0.0/8 le 24

commit

IPv6 Redistribution

IS-IS supports IPv6 in the same process:

set protocols isis redistribute ipv6 connected
set protocols isis redistribute ipv6 static
commit

Default Route

Advertising a default route in IS-IS.

Default Information Originate

IPv4 default:

set protocols isis default-information originate ipv4
commit

IPv6 default:

set protocols isis default-information originate ipv6
commit

Per level:

IPv4 into Level-1:

set protocols isis default-information originate ipv4 level-1
commit

IPv4 into Level-2:

set protocols isis default-information originate ipv4 level-2
commit

With a metric:

set protocols isis default-information originate ipv4 level-1 metric 10
commit

With a route-map:

set protocols isis default-information originate ipv4 route-map DEFAULT-IPV4
commit

Summarization

Summarizing IP prefixes in IS-IS.

IPv4 Summary

set protocols isis summary-address ipv4 192.168.0.0/16
commit

Per level:

set protocols isis summary-address ipv4 192.168.0.0/16 level-1
commit

set protocols isis summary-address ipv4 10.0.0.0/8 level-2
commit

IPv6 Summary

set protocols isis summary-address ipv6 2001:db8::/32
commit

Per level:

set protocols isis summary-address ipv6 2001:db8::/32 level-2
commit

Advanced Parameters

SPF Timers

Controlling the frequency of SPF calculation:

set protocols isis spf-interval level-1 5
set protocols isis spf-interval level-2 5
commit

Values in seconds (1-120, default 5).

SPF delay:

set protocols isis spf-delay-ietf init-delay 50
set protocols isis spf-delay-ietf short-delay 200
set protocols isis spf-delay-ietf long-delay 5000
set protocols isis spf-delay-ietf holddown 10000
set protocols isis spf-delay-ietf time-to-learn 20000
commit

All values in milliseconds.

IETF SPF delay is an adaptive algorithm for optimizing SPF calculation.

LSP Timers

LSP generation interval:

set protocols isis lsp-gen-interval level-1 5
set protocols isis lsp-gen-interval level-2 5
commit

Values in seconds (1-120).

LSP refresh interval:

set protocols isis lsp-refresh-interval level-1 900
set protocols isis lsp-refresh-interval level-2 900
commit

Values in seconds (1-65535, default 900).

LSP lifetime:

set protocols isis max-lsp-lifetime level-1 1200
set protocols isis max-lsp-lifetime level-2 1200
commit

Values in seconds (360-65535, default 1200).

Overload Bit

Set the overload bit (the router is not used for transit):

set protocols isis overload-bit
commit

For a duration (seconds):

set protocols isis overload-bit on-startup 300
commit

The router will remain in the overload state for 300 seconds after boot.

Purge Originator

Identifying the router that purged an LSP:

set protocols isis purge-originator
commit

Useful for troubleshooting.

Log Adjacency Changes

Logging adjacency changes:

set protocols isis log-adjacency-changes
commit

IPv6 Support

IS-IS natively supports IPv4 and IPv6 in a single process.

IPv6 Configuration

Enable IPv6:

set protocols isis address-family ipv6
commit

IPv6 is enabled on an interface automatically when an IPv6 address is present.

Multi-Topology IS-IS

Separating the IPv4 and IPv6 topologies:

set protocols isis topology ipv6-unicast
commit

By default, IS-IS uses a single topology for both IPv4 and IPv6.

IPv4 and IPv6 Example

set interfaces loopback lo address 192.168.255.1/32
set interfaces loopback lo address 2001:db8::1/128

set protocols isis net 49.0001.1921.6825.5001.00

# IPv4
set protocols isis redistribute ipv4 connected

# IPv6
set protocols isis address-family ipv6
set protocols isis redistribute ipv6 connected

set protocols isis interface eth1
set protocols isis interface lo

commit
save

Verification:

show isis neighbor
show ipv6 route isis
show ip route isis

BFD Integration

Bidirectional Forwarding Detection for fast failure detection.

set protocols isis interface eth1 bfd
commit

Configuring a BFD profile:

set protocols bfd profile isis-peers interval transmit 300
set protocols bfd profile isis-peers interval receive 300
set protocols bfd profile isis-peers interval multiplier 3

set protocols isis interface eth1 bfd profile isis-peers

commit

BFD detects a link failure in sub-second time versus tens of seconds with IS-IS hello.

MPLS and Segment Routing

IS-IS is widely used in MPLS and Segment Routing networks.

LDP Synchronization

Synchronizing IS-IS and LDP:

set protocols isis interface eth1 ldp-sync
commit

IS-IS does not use the link until the LDP session is established.

Holddown time:

set protocols isis ldp-sync holddown 300
commit

Segment Routing (Experimental)

Segment Routing in IS-IS (requires FRR 7.5+):

set protocols isis segment-routing enable
set protocols isis segment-routing global-block low-label-value 16000
set protocols isis segment-routing global-block high-label-value 23999
commit

Prefix SID:

set protocols isis segment-routing prefix 192.168.255.1/32 index 1
commit

Note: Segment Routing support in VyOS may be limited depending on the FRR version.

Configuration Examples

Simple Point-to-Point Network

Router A (L1/L2):

set interfaces loopback lo address 192.168.255.1/32

set protocols isis net 49.0001.1921.6825.5001.00
set protocols isis dynamic-hostname

set protocols isis interface eth1 network point-to-point
set protocols isis interface eth1 password plaintext-password 'HelloSecret'

set protocols isis interface lo passive

set protocols isis area-password md5 'AreaPass!'
set protocols isis domain-password md5 'DomainPass!'

commit
save

Router B (L1/L2):

set interfaces loopback lo address 192.168.255.2/32

set protocols isis net 49.0001.1921.6825.5002.00
set protocols isis dynamic-hostname

set protocols isis interface eth1 network point-to-point
set protocols isis interface eth1 password plaintext-password 'HelloSecret'

set protocols isis interface lo passive

set protocols isis area-password md5 'AreaPass!'
set protocols isis domain-password md5 'DomainPass!'

commit
save

Multi-area with L1 and L2

L1 Router (Area 0001):

set interfaces loopback lo address 192.168.255.10/32

set protocols isis net 49.0001.1921.6825.5010.00
set protocols isis level level-1

set protocols isis interface eth1 circuit-type level-1
set protocols isis interface eth2 circuit-type level-1
set protocols isis interface lo

set protocols isis area-password md5 'Area0001Pass!'

commit
save

L1/L2 Border Router (between Area 0001 and L2):

set interfaces loopback lo address 192.168.255.100/32

set protocols isis net 49.0001.1921.6825.5100.00
set protocols isis level level-1-2

# L1 interface
set protocols isis interface eth1 circuit-type level-1

# L2 interface
set protocols isis interface eth2 circuit-type level-2-only

set protocols isis interface lo

set protocols isis area-password md5 'Area0001Pass!'
set protocols isis domain-password md5 'DomainL2Pass!'

commit
save

L2 Router:

set interfaces loopback lo address 192.168.255.200/32

set protocols isis net 49.0002.1921.6825.5200.00
set protocols isis level level-2

set protocols isis interface eth1 circuit-type level-2-only
set protocols isis interface eth2 circuit-type level-2-only
set protocols isis interface lo

set protocols isis domain-password md5 'DomainL2Pass!'

commit
save

IS-IS with Route Redistribution

Edge Router:

set interfaces loopback lo address 192.168.255.1/32

set protocols isis net 49.0001.1921.6825.5001.00

# Internal interfaces
set protocols isis interface eth1
set protocols isis interface lo

# LAN interfaces
set protocols isis interface eth2 passive

# Static routes for external
set protocols static route 203.0.113.0/24 next-hop 198.51.100.1

# Redistribute static into IS-IS
set protocols isis redistribute ipv4 static level-2 metric 100

# Redistribute connected
set protocols isis redistribute ipv4 connected level-1 metric 10

commit
save

IS-IS over a VPN (VTI)

Site A:

set interfaces loopback lo address 192.168.255.1/32
set interfaces vti vti0 address 172.16.0.1/30

set protocols isis net 49.0001.1921.6825.5001.00

set protocols isis interface vti0 network point-to-point
set protocols isis interface vti0 password plaintext-password 'VPN-ISIS!'

set protocols isis interface eth1 passive
set protocols isis interface lo passive

# Redistribute connected
set protocols isis redistribute ipv4 connected

commit
save

Site B:

set interfaces loopback lo address 192.168.255.2/32
set interfaces vti vti0 address 172.16.0.2/30

set protocols isis net 49.0001.1921.6825.5002.00

set protocols isis interface vti0 network point-to-point
set protocols isis interface vti0 password plaintext-password 'VPN-ISIS!'

set protocols isis interface eth1 passive
set protocols isis interface lo passive

# Redistribute connected
set protocols isis redistribute ipv4 connected

commit
save

IS-IS with BGP (Service Provider)

PE Router:

set interfaces loopback lo address 192.168.255.1/32

# IS-IS for the IGP
set protocols isis net 49.0001.1921.6825.5001.00
set protocols isis interface eth1
set protocols isis interface lo passive

# BGP for customer routes
set protocols bgp system-as 65000
set protocols bgp neighbor 192.168.255.2 remote-as 65000
set protocols bgp neighbor 192.168.255.2 update-source lo
set protocols bgp neighbor 192.168.255.2 address-family ipv4-unicast

# Customer BGP
set protocols bgp neighbor 203.0.113.1 remote-as 65001
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast

# Redistribute connected into IS-IS (infrastructure)
set protocols isis redistribute ipv4 connected metric 10

# Do not redistribute BGP into IS-IS (use BGP for customer routes)

commit
save

Datacenter Leaf-Spine Fabric

Spine Router:

set interfaces loopback lo address 10.255.255.1/32

set protocols isis net 49.0001.1025.5255.5001.00
set protocols isis level level-2
set protocols isis metric-style wide

# All interfaces toward the Leaf routers
set protocols isis interface eth1 circuit-type level-2-only
set protocols isis interface eth1 network point-to-point

set protocols isis interface eth2 circuit-type level-2-only
set protocols isis interface eth2 network point-to-point

set protocols isis interface eth3 circuit-type level-2-only
set protocols isis interface eth3 network point-to-point

set protocols isis interface eth4 circuit-type level-2-only
set protocols isis interface eth4 network point-to-point

set protocols isis interface lo passive

commit
save

Leaf Router:

set interfaces loopback lo address 10.255.255.101/32

set protocols isis net 49.0001.1025.5255.5101.00
set protocols isis level level-2
set protocols isis metric-style wide

# Uplinks to the Spine
set protocols isis interface eth1 circuit-type level-2-only
set protocols isis interface eth1 network point-to-point

set protocols isis interface eth2 circuit-type level-2-only
set protocols isis interface eth2 network point-to-point

# Server-facing interfaces
set protocols isis interface eth3 passive
set protocols isis interface eth4 passive

set protocols isis interface lo passive

# Redistribute connected (server networks)
set protocols isis redistribute ipv4 connected level-2 metric 10

commit
save

IS-IS with IPv4 and IPv6

set interfaces loopback lo address 192.168.255.1/32
set interfaces loopback lo address 2001:db8:255::1/128

set interfaces ethernet eth1 address 10.0.0.1/30
set interfaces ethernet eth1 address 2001:db8:1::1/64

set protocols isis net 49.0001.1921.6825.5001.00
set protocols isis dynamic-hostname

# IPv6 support
set protocols isis address-family ipv6

# Interfaces
set protocols isis interface eth1 network point-to-point
set protocols isis interface lo passive

# Redistribute IPv4
set protocols isis redistribute ipv4 connected

# Redistribute IPv6
set protocols isis redistribute ipv6 connected

commit
save

Yandex Cloud: IS-IS for a Datacenter Fabric

An example of using IS-IS in Yandex Cloud for a datacenter Leaf-Spine fabric.

Topology

                    Spine-1 (10.255.0.1)
                    /                  \
                   /                    \
    Leaf-1 (10.255.1.1)          Leaf-2 (10.255.1.2)
         |                              |
    Servers 10.10.1.0/24          Servers 10.10.2.0/24

Spine-1 Configuration

# Loopback for the Spine
set interfaces loopback lo address 10.255.0.1/32

# Uplinks to the Leafs
set interfaces ethernet eth1 address 10.0.0.0/31
set interfaces ethernet eth1 description 'Link to Leaf-1'

set interfaces ethernet eth2 address 10.0.0.2/31
set interfaces ethernet eth2 description 'Link to Leaf-2'

# IS-IS Process
set protocols isis net 49.0001.1025.5000.1001.00
set protocols isis level level-2
set protocols isis metric-style wide
set protocols isis dynamic-hostname

# Spine interfaces - L2 only, point-to-point
set protocols isis interface eth1 circuit-type level-2-only
set protocols isis interface eth1 network point-to-point
set protocols isis interface eth1 metric 10

set protocols isis interface eth2 circuit-type level-2-only
set protocols isis interface eth2 network point-to-point
set protocols isis interface eth2 metric 10

set protocols isis interface lo passive

# Authentication
set protocols isis domain-password md5 'YandexCloud-DC-Fabric-2025!'

# BFD for fast convergence
set protocols bfd profile dc-fabric interval transmit 300
set protocols bfd profile dc-fabric interval receive 300
set protocols bfd profile dc-fabric interval multiplier 3

set protocols isis interface eth1 bfd profile dc-fabric
set protocols isis interface eth2 bfd profile dc-fabric

commit
save

Leaf-1 Configuration

# Loopback for the Leaf
set interfaces loopback lo address 10.255.1.1/32

# Uplink to the Spine
set interfaces ethernet eth1 address 10.0.0.1/31
set interfaces ethernet eth1 description 'Uplink to Spine-1'

# Server-facing interfaces
set interfaces ethernet eth2 address 10.10.1.1/24
set interfaces ethernet eth2 description 'Servers VLAN 10'

# IS-IS Process
set protocols isis net 49.0001.1025.5001.1001.00
set protocols isis level level-2
set protocols isis metric-style wide
set protocols isis dynamic-hostname

# Uplink interface
set protocols isis interface eth1 circuit-type level-2-only
set protocols isis interface eth1 network point-to-point
set protocols isis interface eth1 metric 10

# Server interfaces - passive
set protocols isis interface eth2 passive
set protocols isis interface lo passive

# Redistribute connected (server networks)
set protocols isis redistribute ipv4 connected level-2 metric 10

# Authentication
set protocols isis domain-password md5 'YandexCloud-DC-Fabric-2025!'

# BFD for fast convergence
set protocols isis interface eth1 bfd profile dc-fabric

commit
save

Leaf-2 Configuration

# Loopback for the Leaf
set interfaces loopback lo address 10.255.1.2/32

# Uplink to the Spine
set interfaces ethernet eth1 address 10.0.0.3/31
set interfaces ethernet eth1 description 'Uplink to Spine-1'

# Server-facing interfaces
set interfaces ethernet eth2 address 10.10.2.1/24
set interfaces ethernet eth2 description 'Servers VLAN 20'

# IS-IS Process
set protocols isis net 49.0001.1025.5001.1002.00
set protocols isis level level-2
set protocols isis metric-style wide
set protocols isis dynamic-hostname

# Uplink interface
set protocols isis interface eth1 circuit-type level-2-only
set protocols isis interface eth1 network point-to-point
set protocols isis interface eth1 metric 10

# Server interfaces - passive
set protocols isis interface eth2 passive
set protocols isis interface lo passive

# Redistribute connected (server networks)
set protocols isis redistribute ipv4 connected level-2 metric 10

# Authentication
set protocols isis domain-password md5 'YandexCloud-DC-Fabric-2025!'

# BFD for fast convergence
set protocols isis interface eth1 bfd profile dc-fabric

commit
save

Verifying the Yandex Cloud Fabric

On Spine-1:

show isis neighbor
show isis database
show ip route isis

# You should see 10.10.1.0/24 and 10.10.2.0/24 from the Leafs

On Leaf-1:

show isis neighbor
show isis route

# You should see 10.255.0.1 (Spine), 10.255.1.2 (Leaf-2), 10.10.2.0/24

Testing:

# From Leaf-1 to the Leaf-2 loopback
ping 10.255.1.2 source-address 10.255.1.1

# From Leaf-1 to the Leaf-2 server network
ping 10.10.2.1 source-address 10.10.1.1

Monitoring BFD:

show bfd peers

VK Cloud: IS-IS with an MPLS Backbone

An example of using IS-IS in VK Cloud for an MPLS Service Provider backbone.

Topology

PE1 (10.255.255.1) --- P1 (10.255.255.10) --- PE2 (10.255.255.2)
         |                                           |
    Customer A                                  Customer B
    AS 65001                                    AS 65002

P1 Router (Core)

# Loopback
set interfaces loopback lo address 10.255.255.10/32

# Core links
set interfaces ethernet eth1 address 10.0.1.1/30
set interfaces ethernet eth1 description 'Link to PE1'

set interfaces ethernet eth2 address 10.0.2.1/30
set interfaces ethernet eth2 description 'Link to PE2'

# IS-IS for the IGP
set protocols isis net 49.0001.1025.5255.5010.00
set protocols isis level level-2
set protocols isis metric-style wide
set protocols isis dynamic-hostname

# Core interfaces
set protocols isis interface eth1 circuit-type level-2-only
set protocols isis interface eth1 network point-to-point
set protocols isis interface eth1 metric 10

set protocols isis interface eth2 circuit-type level-2-only
set protocols isis interface eth2 network point-to-point
set protocols isis interface eth2 metric 10

set protocols isis interface lo passive

# Authentication
set protocols isis domain-password md5 'VKCloud-MPLS-Backbone-2025!'

# LDP-ISIS synchronization
set protocols isis ldp-sync holddown 300
set protocols isis interface eth1 ldp-sync
set protocols isis interface eth2 ldp-sync

# BFD
set protocols bfd profile mpls-core interval transmit 300
set protocols bfd profile mpls-core interval receive 300
set protocols bfd profile mpls-core interval multiplier 3

set protocols isis interface eth1 bfd profile mpls-core
set protocols isis interface eth2 bfd profile mpls-core

# MPLS
set protocols mpls interface eth1
set protocols mpls interface eth2

set protocols mpls ldp interface eth1
set protocols mpls ldp interface eth2
set protocols mpls ldp router-id 10.255.255.10

commit
save

PE1 Router (Provider Edge)

# Loopback
set interfaces loopback lo address 10.255.255.1/32

# Core link
set interfaces ethernet eth1 address 10.0.1.2/30
set interfaces ethernet eth1 description 'Link to P1'

# Customer link
set interfaces ethernet eth2 address 192.168.1.1/30
set interfaces ethernet eth2 description 'Customer A CE'

# IS-IS for the IGP
set protocols isis net 49.0001.1025.5255.5001.00
set protocols isis level level-2
set protocols isis metric-style wide
set protocols isis dynamic-hostname

# Core interface
set protocols isis interface eth1 circuit-type level-2-only
set protocols isis interface eth1 network point-to-point
set protocols isis interface eth1 metric 10

set protocols isis interface lo passive

# Redistribute connected (loopback only, not customer links)
set protocols isis redistribute ipv4 connected route-map LOOPBACK-ONLY

# Route-map for selective redistribution
set policy route-map LOOPBACK-ONLY rule 10 action permit
set policy route-map LOOPBACK-ONLY rule 10 match ip address prefix-list LOOPBACKS

set policy prefix-list LOOPBACKS rule 10 action permit
set policy prefix-list LOOPBACKS rule 10 prefix 10.255.255.0/24 le 32

# Authentication
set protocols isis domain-password md5 'VKCloud-MPLS-Backbone-2025!'

# LDP-ISIS sync
set protocols isis interface eth1 ldp-sync

# BFD
set protocols isis interface eth1 bfd profile mpls-core

# MPLS
set protocols mpls interface eth1
set protocols mpls ldp interface eth1
set protocols mpls ldp router-id 10.255.255.1

# BGP for customer routes (MPLS VPN)
set protocols bgp system-as 65000
set protocols bgp neighbor 10.255.255.2 remote-as 65000
set protocols bgp neighbor 10.255.255.2 update-source lo
set protocols bgp neighbor 10.255.255.2 address-family ipv4-unicast

# Customer A BGP
set protocols bgp neighbor 192.168.1.2 remote-as 65001
set protocols bgp neighbor 192.168.1.2 address-family ipv4-unicast

commit
save

PE2 Router (Provider Edge)

# Loopback
set interfaces loopback lo address 10.255.255.2/32

# Core link
set interfaces ethernet eth1 address 10.0.2.2/30
set interfaces ethernet eth1 description 'Link to P1'

# Customer link
set interfaces ethernet eth2 address 192.168.2.1/30
set interfaces ethernet eth2 description 'Customer B CE'

# IS-IS for the IGP
set protocols isis net 49.0001.1025.5255.5002.00
set protocols isis level level-2
set protocols isis metric-style wide
set protocols isis dynamic-hostname

# Core interface
set protocols isis interface eth1 circuit-type level-2-only
set protocols isis interface eth1 network point-to-point
set protocols isis interface eth1 metric 10

set protocols isis interface lo passive

# Redistribute connected (loopback only)
set protocols isis redistribute ipv4 connected route-map LOOPBACK-ONLY

# Route-map for selective redistribution
set policy route-map LOOPBACK-ONLY rule 10 action permit
set policy route-map LOOPBACK-ONLY rule 10 match ip address prefix-list LOOPBACKS

set policy prefix-list LOOPBACKS rule 10 action permit
set policy prefix-list LOOPBACKS rule 10 prefix 10.255.255.0/24 le 32

# Authentication
set protocols isis domain-password md5 'VKCloud-MPLS-Backbone-2025!'

# LDP-ISIS sync
set protocols isis interface eth1 ldp-sync

# BFD
set protocols isis interface eth1 bfd profile mpls-core

# MPLS
set protocols mpls interface eth1
set protocols mpls ldp interface eth1
set protocols mpls ldp router-id 10.255.255.2

# BGP for customer routes (MPLS VPN)
set protocols bgp system-as 65000
set protocols bgp neighbor 10.255.255.1 remote-as 65000
set protocols bgp neighbor 10.255.255.1 update-source lo
set protocols bgp neighbor 10.255.255.1 address-family ipv4-unicast

# Customer B BGP
set protocols bgp neighbor 192.168.2.2 remote-as 65002
set protocols bgp neighbor 192.168.2.2 address-family ipv4-unicast

commit
save

Verifying the VK Cloud MPLS Backbone

IS-IS Neighbors:

show isis neighbor

IS-IS Database:

show isis database detail

MPLS LDP:

show mpls ldp neighbor
show mpls ldp binding

LDP-ISIS Sync Status:

show isis mpls ldp-sync

BGP Sessions:

show bgp summary

MPLS Trace:

traceroute mpls ipv4 10.255.255.2/32

Operational Commands

IS-IS Neighbors

Show IS-IS adjacencies:

show isis neighbor

Output:

Area Circinus:
 System Id           Interface   L  State        Holdtime SNPA
 spine-1             eth1        2  Up            27       2020.2020.2020

Details:

show isis neighbor detail

IS-IS Database

Link State Database:

show isis database

Output:

Area Circinus:
IS-IS Level-1 Link State Database:
LSP ID                  PduLen  SeqNumber   Chksum  Holdtime  ATT/P/OL
router-1.00-00            142   0x00000005  0x1234    1195    0/0/0
router-2.00-00            156   0x00000003  0x5678    1189    0/0/0

IS-IS Level-2 Link State Database:
LSP ID                  PduLen  SeqNumber   Chksum  Holdtime  ATT/P/OL
router-1.00-00            178   0x00000008  0xabcd    1195    0/0/0

Details for a specific LSP:

show isis database detail router-1.00-00

Level-specific:

show isis database level-1
show isis database level-2

IS-IS Routes

IS-IS routing table:

show isis route

Output:

Area Circinus:
IS-IS paths to level-1 routers that speak IP
Vertex               Type         Metric Next-Hop             Interface Parent
192.168.255.2        IP internal  10     10.0.0.2             eth1      (null)

IPv4 routes:

show ip route isis

IPv6 routes:

show ipv6 route isis

IS-IS Interface

Show IS-IS interfaces:

show isis interface

Output:

Interface   Circuit  Type    Level   Metric
eth1        0x1      p2p     L1L2    10
lo          0x0      loopback L1L2   0

Interface details:

show isis interface detail

A specific interface:

show isis interface eth1

IS-IS Topology

Show the topology:

show isis topology

Level-specific:

show isis topology level-1
show isis topology level-2

IS-IS Summary

General information:

show isis summary

Output:

VRF : default
Process Id      : 1
System Id       : 1921.6825.5001
Instance        : 0
IS-IS VRF       : default
Router ID       : 192.168.255.1
Hostname        : router-1
  Level-1-2 LSP MTU               : 1497 bytes
  Area address(es) :
          49.0001

Clear ISIS

Restart the IS-IS process:

restart isis

Clear a neighbor adjacency (to re-form it):

clear isis neighbor

Troubleshooting

Neighbor Does Not Form

Check the following:

Layer 2 connectivity:
```
ping <neighbor-ip>
```
NET configuration:
```
show isis summary
```
The Area ID must match for L1 neighbors.
Circuit type matches:
```
show isis interface eth1
```
An L1 router does not form an adjacency with an L2-only router.
Authentication matches:
```
show isis interface detail
```
Area password for L1, domain password for L2.
Network type matches:
```
show isis interface
```
Broadcast vs point-to-point.
MTU matches:
```
show interfaces ethernet eth1
```
IS-IS checks the MTU in the Hello PDU.
Hello interval and multiplier:
```
show isis interface detail
```

Neighbor in the Init State

Init means the router is receiving Hellos but does not see its own System ID in the neighbor’s Hello.

Check the following:

Bidirectional Layer 2 connectivity
Authentication is correct
IS-IS is enabled on the neighbor’s interface

Debug:

monitor log
# Then in another session:
configure
set protocols isis log-adjacency-changes
commit

Routes Do Not Appear

Check the following:

Adjacency is in the Up state:
```
show isis neighbor
```
LSP in the database:
```
show isis database
```
Route in the IS-IS RIB:
```
show isis route
```
Route in the IP routing table:
```
show ip route isis
```
Level configuration:
An L1 router does not see routes from L2. Make sure an L1/L2 router is advertising the default into the L1 area.
Overload bit is not set:
```
show isis database detail
```
An OL bit = 1 means the router is in overload.

High CPU Usage

Frequent IS-IS SPF calculation.

Check for interface flapping:
```
show interfaces
```

Tune the SPF timers:

set protocols isis spf-delay-ietf init-delay 100
set protocols isis spf-delay-ietf short-delay 500
set protocols isis spf-delay-ietf long-delay 5000
set protocols isis spf-delay-ietf holddown 10000
commit

Use BFD for fast failover instead of short hello intervals.
Check LSP flooding:
```
show isis database
```
High sequence numbers indicate frequent LSP updates.

LSP Database Not Synchronized

Check the MTU:
```
show interfaces ethernet eth1
```
If the MTU does not match, large LSPs may not be transmitted.
Check the timers:
```
show isis summary
```
LSP lifetime and refresh interval.
Clear the database and wait for a re-sync:
```
restart isis
```

Authentication Errors

The log will show authentication failures:

monitor log

Check the following:

Area password for L1 (on all L1 neighbors)
Domain password for L2 (on all L2 neighbors)
Interface password (on both ends of the link)
Plaintext vs MD5 matches

Routing Loops

Check the attached bit:
```
show isis database detail
```
L1/L2 routers should set the ATT bit in their L1 LSP.
Check the metric configuration:
```
show isis interface
```
Asymmetric metrics can cause suboptimal routing.
Check redistribution:
```
show running-config protocols isis
```
Mutual redistribution between IS-IS and other protocols can cause loops.

Best Practices

NET Design

AFI 49 for private addressing
System ID derived from the loopback IP for simplicity
Unique System ID within the domain
Matching Area ID for L1 neighbors in the same area

Level Hierarchy

L2 for the backbone (core routers)
L1 for access/distribution (edge routers)
L1/L2 for boundaries (border routers)
Minimize L1/L2 routers for simplicity

Area Design

Single area for small deployments (all L2)
Multiple areas for large deployments:
- Core = L2 only
- Distribution = L1/L2
- Access = L1 only
Area 49.0001 for a datacenter fabric (a single L2 domain)

Interface Configuration

Point-to-point for direct links and VPN
Passive for loopback and server-facing interfaces
Authentication on all production interfaces
Metric tuning for traffic engineering

Timers

Default timers are sufficient for most deployments
BFD for sub-second failover instead of aggressive hello timers
SPF timers tuned only when necessary

Authentication

MD5 for area and domain passwords
Unique passwords for different areas/domains
Regular password rotation
Interface passwords for additional protection

Scalability

Wide metric style for modern deployments
Summarization at L1/L2 boundaries
Passive interfaces for non-transit networks
Minimal redistribution - use BGP for external routes

Monitoring

Log adjacency changes:

set protocols isis log-adjacency-changes

Monitor neighbors:
```
show isis neighbor
```
Monitor database size:
```
show isis database
```
Monitor BFD sessions:
```
show bfd peers
```

Datacenter Fabric

L2 only (single area)
Point-to-point on all links
BFD enabled for fast failover
ECMP for load balancing (automatic with equal cost paths)
Metric the same on all links for symmetric ECMP

Security

Recommendations

MD5 Authentication:

set protocols isis domain-password md5 'SecurePassword123!'
set protocols isis area-password md5 'AreaPassword123!'

Interface passwords:

set protocols isis interface eth1 password plaintext-password 'HelloSecret'

Passive interfaces:

set protocols isis interface eth2 passive

Firewall for IS-IS (multicast 01:80:C2:00:00:14, 01:80:C2:00:00:15):
IS-IS operates at Layer 2, so the firewall must permit:
- All-IS multicast (L1): 01:80:C2:00:00:14
- All-L2-IS multicast (L2): 01:80:C2:00:00:15
Limit IS-IS interfaces to trusted links only:
Do not enable IS-IS on untrusted/external interfaces.

Log adjacency changes:

set protocols isis log-adjacency-changes

Overload bit during maintenance:
```
set protocols isis overload-bit
commit
```

Performance

Optimization

Wide metric style:

set protocols isis metric-style wide
commit

SPF optimization for unstable networks:

set protocols isis spf-delay-ietf init-delay 100
set protocols isis spf-delay-ietf short-delay 500
set protocols isis spf-delay-ietf long-delay 5000
commit

BFD for fast failover:

set protocols isis interface eth1 bfd
commit

Passive interfaces to reduce overhead:

set protocols isis interface lo passive
set protocols isis interface eth2 passive
commit

LSP refresh optimization:

set protocols isis lsp-refresh-interval level-2 900
commit

Comparison with Other Protocols

IS-IS vs OSPF

Characteristic	IS-IS	OSPF
Layer of operation	Layer 2	Layer 3 (IP)
Hierarchy	L1/L2 (flexible)	Areas + mandatory Area 0
IPv4 and IPv6	Single process	Separate processes (OSPFv2/v3)
Metric	Arbitrary (default 10)	Cost (bandwidth-based)
Convergence	Fast	Fast
Scalability	Better	Good
Complexity	Higher (OSI terminology)	Medium
Adoption	ISP, DC	Enterprise
Address overhead	Less	More

IS-IS vs EIGRP

IS-IS - an open standard, link-state. EIGRP - Cisco proprietary (now open), advanced distance-vector.

IS-IS is preferable in multi-vendor environments.

When to Use IS-IS

Use IS-IS:

ISP backbone
Datacenter leaf-spine fabric
MPLS core
Large-scale networks
Dual-stack IPv4/IPv6
Multi-vendor environment

Use OSPF:

Enterprise campus
Small to medium networks
Legacy integrations
Simpler for administrators

Use BGP:

External routing (Internet)
Multi-homing
Policy-based routing

IS-IS and BGP are often used together: IS-IS for the IGP, BGP for external/customer routes.

Next Steps

BGP - for external routing and customer routes
OSPF - an alternative IGP
Static Routes - a backup for the IGP
MPLS - for MPLS VPN
BFD - fast failure detection

Additional Resources

Reviewed by OpenNix LLC · Last updated on 29 July 2026

OSPF (Open Shortest Path First)Static Routing (Static Routes)