# IS-IS - Intermediate System to Intermediate System

> Configure IS-IS on VyOS: Level-1, Level-2, NET, authentication, redistribution, link-state routing for Yandex Cloud and VK Cloud datacenter fabric

Source: https://opennix.org/en/docs/vyos/routing/vyos-isis/


IS-IS is a link-state routing protocol that operates at Layer 2 and is widely used in datacenter and ISP networks.

## Overview

IS-IS (Intermediate System to Intermediate System, ISO 10589) is a link-state routing protocol originally designed for the OSI stack and later adapted for IP.

**Characteristics**:
- Link-state protocol using the Dijkstra SPF algorithm
- Runs directly at Layer 2 (does not use IP transport)
- Two-level hierarchy (Level-1 and Level-2)
- Support for IPv4 and IPv6 in a single process
- Fast convergence
- Scalability for large networks
- Used in ISP and datacenter fabric

**Versions**:
- **IS-IS for IP** - support for IPv4 and IPv6
- **Integrated IS-IS** - simultaneous routing of OSI CLNP and IP

**Use cases**:
- ISP backbone networks
- Data center leaf-spine fabric (especially with CLOS topology)
- Large enterprise campus
- Service provider MPLS core
- Carrier Ethernet networks

**Advantages**:
- Runs at Layer 2 (independent of IP)
- IPv4 and IPv6 in a single process
- No need for an area 0 as in OSPF
- More flexible hierarchy
- Less update overhead
- Better scalability than OSPF

**Disadvantages**:
- Harder to understand than OSPF
- Less common in enterprise
- Requires understanding of OSI terminology

## IS-IS Architecture

### Routing Levels

IS-IS uses a two-level hierarchy.

**Level-1 (L1)**:
- Routing within an area (intra-area)
- L1 routers know only the topology of their own area
- Similar to OSPF internal routers
- Use a default route for inter-area traffic

**Level-2 (L2)**:
- Routing between areas (inter-area)
- L2 routers know all L2 routes
- Similar to the OSPF backbone (Area 0)
- Form the backbone topology

**Level-1-2 (L1/L2)**:
- Operate on both levels simultaneously
- The boundary between L1 and L2 domains
- Similar to an OSPF ABR (Area Border Router)
- Advertise a default route into the L1 area

### Router Types

**L1 Router**:
- All interfaces in a single area
- Knows only the L1 topology
- Uses the nearest L1/L2 router as the default gateway

**L2 Router**:
- Inter-area routing only
- Does not participate in L1 routing
- Forms the L2 backbone

**L1/L2 Router**:
- Participates in both L1 and L2 routing
- Connects an L1 area to the L2 backbone
- Advertises L1 prefixes into L2
- Advertises a default route into L1

### Network Entity Title (NET)

The NET is the address of an IS-IS router in OSI NSAP format.

**Format**:
```
Area-ID . System-ID . NSEL
```

**Structure**:
- **Area-ID** - the area identifier (variable length, typically 1-13 bytes)
- **System-ID** - the unique router ID (fixed length of 6 bytes)
- **NSEL** - selector (always 00 for routers)

**Example**:
```
49.0001.1921.6800.1001.00
```

Breakdown:
- **49** - AFI (Authority and Format Identifier) for private addressing
- **0001** - Area ID
- **1921.6800.1001** - System ID (often derived from an IP: 192.168.0.1 → 1921.6800.1001)
- **00** - NSEL

**Length**: Typically 10, 13, or 20 bytes.

**AFI codes**:
- **39** - ISO DCC (Data Country Code)
- **45** - ISO ICD (International Code Designator)
- **47** - ISO 6523-ICD
- **49** - Private (the most common)

## Basic Configuration

### Minimal Setup

**Router 1**:
```
set interfaces loopback lo address 192.168.255.1/32

set protocols isis net 49.0001.1921.6825.5001.00

set protocols isis interface eth1
set protocols isis interface lo

commit
save
```

**Router 2**:
```
set interfaces loopback lo address 192.168.255.2/32

set protocols isis net 49.0001.1921.6825.5002.00

set protocols isis interface eth1
set protocols isis interface lo

commit
save
```

**Verification**:
```
show isis neighbor
show isis database
show ip route isis
```

### NET Configuration

Configuring the Network Entity Title:

```
set protocols isis net 49.0001.1921.6800.1001.00
commit
```

**Recommendations**:
- Use AFI 49 for private networks
- Derive the System ID from the loopback IP
- The Area ID must match for L1 neighbors
- The Area ID may differ for L2 neighbors

**Generating a System ID from an IP**:

IP: 192.168.0.1 → System ID: 1921.6800.1001

```python
# Conversion example
ip = "192.168.0.1"
octets = ip.split('.')
system_id = f"{int(octets[0]):02d}{int(octets[1]):02d}.{int(octets[2]):02d}{int(octets[3]):02d}.0001"
# Result: 1921.6800.1001
```

You can use any unique 6-byte identifier:
```
49.0001.0000.0000.0001.00
49.0001.0000.0000.0002.00
```

### Hostname Mapping

Mapping a System ID to a hostname for convenience:

```
set protocols isis dynamic-hostname
commit
```

Routers will advertise their hostnames in the LSP (Link State PDU).

## Interface Configuration

### Enabling IS-IS on an Interface

Activate IS-IS:

```
set protocols isis interface eth1
commit
```

For all interfaces:
```
set protocols isis interface eth0
set protocols isis interface eth1
set protocols isis interface eth2
set protocols isis interface lo
commit
```

### Circuit Type

The IS-IS circuit type (routing level):

```
set protocols isis interface eth1 circuit-type level-1
commit
```

Types:
- **level-1** - L1 adjacencies only
- **level-1-2** - L1 and L2 adjacencies (default)
- **level-2-only** - L2 adjacencies only

**Usage**:

L1 only for internal area routers:
```
set protocols isis interface eth1 circuit-type level-1
commit
```

L2 only for backbone routers:
```
set protocols isis interface eth1 circuit-type level-2-only
commit
```

L1-2 for border routers:
```
set protocols isis interface eth1 circuit-type level-1-2
commit
```

### Network Type

The IS-IS network type:

```
set protocols isis interface eth1 network point-to-point
commit
```

Types:
- **broadcast** - Ethernet, multiple access (default)
- **point-to-point** - serial links, VPN tunnels

**Point-to-point** is recommended for:
- Direct connections between routers
- VPN tunnels (VTI, GRE)
- Point-to-point Ethernet links
- Avoiding DIS (Designated IS) elections

### Passive Interface

The interface advertises its networks but does not form adjacencies:

```
set protocols isis interface eth2 passive
commit
```

Usage:
- Loopback interfaces
- LAN interfaces without IS-IS neighbors
- Preventing unauthorized adjacencies

### Metric

The IS-IS interface metric:

```
set protocols isis interface eth1 metric 10
commit
```

Values: 1-16777215 (default 10).

Per level:
```
set protocols isis interface eth1 metric level-1 20
set protocols isis interface eth1 metric level-2 10
commit
```

**Wide metrics**:
```
set protocols isis metric-style wide
commit
```

Styles:
- **narrow** - the legacy format (1-63)
- **wide** - the extended format (1-16777215), recommended
- **transition** - both formats

### Priority

The priority for electing the DIS (Designated Intermediate System) on broadcast networks:

```
set protocols isis interface eth1 priority 64
commit
```

Values: 0-127 (default 64).

Per level:
```
set protocols isis interface eth1 priority level-1 100
set protocols isis interface eth1 priority level-2 50
commit
```

The router with the highest priority becomes the DIS.

**Differences from the OSPF DR**:
- A DIS is not mandatory (preemptive election)
- The DIS can be re-elected
- A priority of 0 does NOT prevent selection as the DIS

### Hello Timers

Hello interval (seconds):

```
set protocols isis interface eth1 hello-interval 3
commit
```

Per level:
```
set protocols isis interface eth1 hello-interval level-1 3
set protocols isis interface eth1 hello-interval level-2 10
commit
```

Hello multiplier (for the dead interval):

```
set protocols isis interface eth1 hello-multiplier 3
commit
```

Dead interval = hello-interval × hello-multiplier.

**Defaults**:
- Broadcast: hello 10s, multiplier 3 (dead 30s)
- Point-to-point: hello 3s, multiplier 3 (dead 9s)

**Recommendations**:
- Must match between neighbors
- Smaller values for faster convergence
- Use BFD for sub-second failover

## Authentication

Protecting IS-IS against unauthorized routers.

### Area Authentication (Level-1)

Plaintext (not recommended):
```
set protocols isis area-password plaintext-password 'AreaPassword123'
commit
```

MD5:
```
set protocols isis area-password md5 'AreaSecurePassword!'
commit
```

Applied to Level-1 LSP, CSNP, and PSNP.

### Domain Authentication (Level-2)

Plaintext:
```
set protocols isis domain-password plaintext-password 'DomainPassword123'
commit
```

MD5:
```
set protocols isis domain-password md5 'DomainSecurePassword!'
commit
```

Applied to Level-2 LSP, CSNP, and PSNP.

### Interface Authentication

Plaintext:
```
set protocols isis interface eth1 password plaintext-password 'InterfacePass'
commit
```

Applied to Hello PDUs on a specific interface.

**Recommendations**:
1. Use MD5 for the area/domain password
2. Use an interface password for additional protection
3. Do not use plaintext in production
4. Passwords must match between neighbors

### Full Authentication Example

```
# Domain (L2) authentication
set protocols isis domain-password md5 'L2-Secure-Domain-Pass!'

# Area (L1) authentication
set protocols isis area-password md5 'L1-Secure-Area-Pass!'

# Interface authentication
set protocols isis interface eth1 password plaintext-password 'Interface-Hello-Pass'
set protocols isis interface eth2 password plaintext-password 'Interface-Hello-Pass'

commit
save
```

## Level Configuration

### Level-1 Only Router

A router for intra-area routing only:

```
set protocols isis net 49.0001.1921.6800.1001.00

set protocols isis level level-1

set protocols isis interface eth1 circuit-type level-1
set protocols isis interface eth2 circuit-type level-1
set protocols isis interface lo

commit
save
```

### Level-2 Only Router

A router for inter-area routing only:

```
set protocols isis net 49.0002.1921.6800.2001.00

set protocols isis level level-2

set protocols isis interface eth1 circuit-type level-2-only
set protocols isis interface eth2 circuit-type level-2-only
set protocols isis interface lo

commit
save
```

### Level-1-2 Router (Border)

A router on the boundary between L1 and L2:

```
set protocols isis net 49.0001.1921.6800.3001.00

# Level-1-2 by default, but can be set explicitly
set protocols isis level level-1-2

set protocols isis interface eth1 circuit-type level-1
set protocols isis interface eth2 circuit-type level-2-only
set protocols isis interface lo

commit
save
```

### Attached Bit

An L1/L2 router sets the attached bit in its L1 LSP, indicating to L1 routers the path to the L2 backbone.

Enabled by default. To disable it:

```
set protocols isis no-attached-bit send
commit
```

## Route Redistribution

Importing routes from other sources into IS-IS.

### Redistribution Sources

Connected routes:
```
set protocols isis redistribute ipv4 connected
commit
```

Static routes:
```
set protocols isis redistribute ipv4 static
commit
```

OSPF:
```
set protocols isis redistribute ipv4 ospf
commit
```

BGP:
```
set protocols isis redistribute ipv4 bgp
commit
```

Kernel:
```
set protocols isis redistribute ipv4 kernel
commit
```

### Redistribution with a Metric

Set a metric:
```
set protocols isis redistribute ipv4 connected metric 100
commit
```

Per level:
```
set protocols isis redistribute ipv4 static level-1 metric 50
set protocols isis redistribute ipv4 static level-2 metric 100
commit
```

### Route-map for Selective Redistribution

```
set protocols isis redistribute ipv4 static route-map STATIC-TO-ISIS
commit
```

Example route-map:
```
set policy route-map STATIC-TO-ISIS rule 10 action permit
set policy route-map STATIC-TO-ISIS rule 10 match ip address prefix-list ALLOW-NETWORKS

set policy prefix-list ALLOW-NETWORKS rule 10 action permit
set policy prefix-list ALLOW-NETWORKS rule 10 prefix 10.0.0.0/8 le 24

commit
```

### IPv6 Redistribution

IS-IS supports IPv6 in the same process:

```
set protocols isis redistribute ipv6 connected
set protocols isis redistribute ipv6 static
commit
```

## Default Route

Advertising a default route in IS-IS.

### Default Information Originate

IPv4 default:
```
set protocols isis default-information originate ipv4
commit
```

IPv6 default:
```
set protocols isis default-information originate ipv6
commit
```

Per level:

IPv4 into Level-1:
```
set protocols isis default-information originate ipv4 level-1
commit
```

IPv4 into Level-2:
```
set protocols isis default-information originate ipv4 level-2
commit
```

With a metric:
```
set protocols isis default-information originate ipv4 level-1 metric 10
commit
```

With a route-map:
```
set protocols isis default-information originate ipv4 route-map DEFAULT-IPV4
commit
```

## Summarization

Summarizing IP prefixes in IS-IS.

### IPv4 Summary

```
set protocols isis summary-address ipv4 192.168.0.0/16
commit
```

Per level:
```
set protocols isis summary-address ipv4 192.168.0.0/16 level-1
commit
```

```
set protocols isis summary-address ipv4 10.0.0.0/8 level-2
commit
```

### IPv6 Summary

```
set protocols isis summary-address ipv6 2001:db8::/32
commit
```

Per level:
```
set protocols isis summary-address ipv6 2001:db8::/32 level-2
commit
```

## Advanced Parameters

### SPF Timers

Controlling the frequency of SPF calculation:

```
set protocols isis spf-interval level-1 5
set protocols isis spf-interval level-2 5
commit
```

Values in seconds (1-120, default 5).

SPF delay:
```
set protocols isis spf-delay-ietf init-delay 50
set protocols isis spf-delay-ietf short-delay 200
set protocols isis spf-delay-ietf long-delay 5000
set protocols isis spf-delay-ietf holddown 10000
set protocols isis spf-delay-ietf time-to-learn 20000
commit
```

All values in milliseconds.

**IETF SPF delay** is an adaptive algorithm for optimizing SPF calculation.

### LSP Timers

LSP generation interval:
```
set protocols isis lsp-gen-interval level-1 5
set protocols isis lsp-gen-interval level-2 5
commit
```

Values in seconds (1-120).

LSP refresh interval:
```
set protocols isis lsp-refresh-interval level-1 900
set protocols isis lsp-refresh-interval level-2 900
commit
```

Values in seconds (1-65535, default 900).

LSP lifetime:
```
set protocols isis max-lsp-lifetime level-1 1200
set protocols isis max-lsp-lifetime level-2 1200
commit
```

Values in seconds (360-65535, default 1200).

### Overload Bit

Set the overload bit (the router is not used for transit):

```
set protocols isis overload-bit
commit
```

For a duration (seconds):
```
set protocols isis overload-bit on-startup 300
commit
```

The router will remain in the overload state for 300 seconds after boot.

### Purge Originator

Identifying the router that purged an LSP:

```
set protocols isis purge-originator
commit
```

Useful for troubleshooting.

### Log Adjacency Changes

Logging adjacency changes:

```
set protocols isis log-adjacency-changes
commit
```

## IPv6 Support

IS-IS natively supports IPv4 and IPv6 in a single process.

### IPv6 Configuration

Enable IPv6:
```
set protocols isis address-family ipv6
commit
```

IPv6 is enabled on an interface automatically when an IPv6 address is present.

### Multi-Topology IS-IS

Separating the IPv4 and IPv6 topologies:

```
set protocols isis topology ipv6-unicast
commit
```

By default, IS-IS uses a single topology for both IPv4 and IPv6.

### IPv4 and IPv6 Example

```
set interfaces loopback lo address 192.168.255.1/32
set interfaces loopback lo address 2001:db8::1/128

set protocols isis net 49.0001.1921.6825.5001.00

# IPv4
set protocols isis redistribute ipv4 connected

# IPv6
set protocols isis address-family ipv6
set protocols isis redistribute ipv6 connected

set protocols isis interface eth1
set protocols isis interface lo

commit
save
```

Verification:
```
show isis neighbor
show ipv6 route isis
show ip route isis
```

## BFD Integration

Bidirectional Forwarding Detection for fast failure detection.

```
set protocols isis interface eth1 bfd
commit
```

Configuring a BFD profile:
```
set protocols bfd profile isis-peers interval transmit 300
set protocols bfd profile isis-peers interval receive 300
set protocols bfd profile isis-peers interval multiplier 3

set protocols isis interface eth1 bfd profile isis-peers

commit
```

BFD detects a link failure in sub-second time versus tens of seconds with IS-IS hello.

## MPLS and Segment Routing

IS-IS is widely used in MPLS and Segment Routing networks.

### LDP Synchronization

Synchronizing IS-IS and LDP:

```
set protocols isis interface eth1 ldp-sync
commit
```

IS-IS does not use the link until the LDP session is established.

Holddown time:
```
set protocols isis ldp-sync holddown 300
commit
```

### Segment Routing (Experimental)

Segment Routing in IS-IS (requires FRR 7.5+):

```
set protocols isis segment-routing enable
set protocols isis segment-routing global-block low-label-value 16000
set protocols isis segment-routing global-block high-label-value 23999
commit
```

Prefix SID:
```
set protocols isis segment-routing prefix 192.168.255.1/32 index 1
commit
```

**Note**: Segment Routing support in VyOS may be limited depending on the FRR version.

## Configuration Examples

### Simple Point-to-Point Network

**Router A** (L1/L2):
```
set interfaces loopback lo address 192.168.255.1/32

set protocols isis net 49.0001.1921.6825.5001.00
set protocols isis dynamic-hostname

set protocols isis interface eth1 network point-to-point
set protocols isis interface eth1 password plaintext-password 'HelloSecret'

set protocols isis interface lo passive

set protocols isis area-password md5 'AreaPass!'
set protocols isis domain-password md5 'DomainPass!'

commit
save
```

**Router B** (L1/L2):
```
set interfaces loopback lo address 192.168.255.2/32

set protocols isis net 49.0001.1921.6825.5002.00
set protocols isis dynamic-hostname

set protocols isis interface eth1 network point-to-point
set protocols isis interface eth1 password plaintext-password 'HelloSecret'

set protocols isis interface lo passive

set protocols isis area-password md5 'AreaPass!'
set protocols isis domain-password md5 'DomainPass!'

commit
save
```

### Multi-area with L1 and L2

**L1 Router** (Area 0001):
```
set interfaces loopback lo address 192.168.255.10/32

set protocols isis net 49.0001.1921.6825.5010.00
set protocols isis level level-1

set protocols isis interface eth1 circuit-type level-1
set protocols isis interface eth2 circuit-type level-1
set protocols isis interface lo

set protocols isis area-password md5 'Area0001Pass!'

commit
save
```

**L1/L2 Border Router** (between Area 0001 and L2):
```
set interfaces loopback lo address 192.168.255.100/32

set protocols isis net 49.0001.1921.6825.5100.00
set protocols isis level level-1-2

# L1 interface
set protocols isis interface eth1 circuit-type level-1

# L2 interface
set protocols isis interface eth2 circuit-type level-2-only

set protocols isis interface lo

set protocols isis area-password md5 'Area0001Pass!'
set protocols isis domain-password md5 'DomainL2Pass!'

commit
save
```

**L2 Router**:
```
set interfaces loopback lo address 192.168.255.200/32

set protocols isis net 49.0002.1921.6825.5200.00
set protocols isis level level-2

set protocols isis interface eth1 circuit-type level-2-only
set protocols isis interface eth2 circuit-type level-2-only
set protocols isis interface lo

set protocols isis domain-password md5 'DomainL2Pass!'

commit
save
```

### IS-IS with Route Redistribution

**Edge Router**:
```
set interfaces loopback lo address 192.168.255.1/32

set protocols isis net 49.0001.1921.6825.5001.00

# Internal interfaces
set protocols isis interface eth1
set protocols isis interface lo

# LAN interfaces
set protocols isis interface eth2 passive

# Static routes for external
set protocols static route 203.0.113.0/24 next-hop 198.51.100.1

# Redistribute static into IS-IS
set protocols isis redistribute ipv4 static level-2 metric 100

# Redistribute connected
set protocols isis redistribute ipv4 connected level-1 metric 10

commit
save
```

### IS-IS over a VPN (VTI)

**Site A**:
```
set interfaces loopback lo address 192.168.255.1/32
set interfaces vti vti0 address 172.16.0.1/30

set protocols isis net 49.0001.1921.6825.5001.00

set protocols isis interface vti0 network point-to-point
set protocols isis interface vti0 password plaintext-password 'VPN-ISIS!'

set protocols isis interface eth1 passive
set protocols isis interface lo passive

# Redistribute connected
set protocols isis redistribute ipv4 connected

commit
save
```

**Site B**:
```
set interfaces loopback lo address 192.168.255.2/32
set interfaces vti vti0 address 172.16.0.2/30

set protocols isis net 49.0001.1921.6825.5002.00

set protocols isis interface vti0 network point-to-point
set protocols isis interface vti0 password plaintext-password 'VPN-ISIS!'

set protocols isis interface eth1 passive
set protocols isis interface lo passive

# Redistribute connected
set protocols isis redistribute ipv4 connected

commit
save
```

### IS-IS with BGP (Service Provider)

**PE Router**:
```
set interfaces loopback lo address 192.168.255.1/32

# IS-IS for the IGP
set protocols isis net 49.0001.1921.6825.5001.00
set protocols isis interface eth1
set protocols isis interface lo passive

# BGP for customer routes
set protocols bgp system-as 65000
set protocols bgp neighbor 192.168.255.2 remote-as 65000
set protocols bgp neighbor 192.168.255.2 update-source lo
set protocols bgp neighbor 192.168.255.2 address-family ipv4-unicast

# Customer BGP
set protocols bgp neighbor 203.0.113.1 remote-as 65001
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast

# Redistribute connected into IS-IS (infrastructure)
set protocols isis redistribute ipv4 connected metric 10

# Do not redistribute BGP into IS-IS (use BGP for customer routes)

commit
save
```

### Datacenter Leaf-Spine Fabric

**Spine Router**:
```
set interfaces loopback lo address 10.255.255.1/32

set protocols isis net 49.0001.1025.5255.5001.00
set protocols isis level level-2
set protocols isis metric-style wide

# All interfaces toward the Leaf routers
set protocols isis interface eth1 circuit-type level-2-only
set protocols isis interface eth1 network point-to-point

set protocols isis interface eth2 circuit-type level-2-only
set protocols isis interface eth2 network point-to-point

set protocols isis interface eth3 circuit-type level-2-only
set protocols isis interface eth3 network point-to-point

set protocols isis interface eth4 circuit-type level-2-only
set protocols isis interface eth4 network point-to-point

set protocols isis interface lo passive

commit
save
```

**Leaf Router**:
```
set interfaces loopback lo address 10.255.255.101/32

set protocols isis net 49.0001.1025.5255.5101.00
set protocols isis level level-2
set protocols isis metric-style wide

# Uplinks to the Spine
set protocols isis interface eth1 circuit-type level-2-only
set protocols isis interface eth1 network point-to-point

set protocols isis interface eth2 circuit-type level-2-only
set protocols isis interface eth2 network point-to-point

# Server-facing interfaces
set protocols isis interface eth3 passive
set protocols isis interface eth4 passive

set protocols isis interface lo passive

# Redistribute connected (server networks)
set protocols isis redistribute ipv4 connected level-2 metric 10

commit
save
```

### IS-IS with IPv4 and IPv6

```
set interfaces loopback lo address 192.168.255.1/32
set interfaces loopback lo address 2001:db8:255::1/128

set interfaces ethernet eth1 address 10.0.0.1/30
set interfaces ethernet eth1 address 2001:db8:1::1/64

set protocols isis net 49.0001.1921.6825.5001.00
set protocols isis dynamic-hostname

# IPv6 support
set protocols isis address-family ipv6

# Interfaces
set protocols isis interface eth1 network point-to-point
set protocols isis interface lo passive

# Redistribute IPv4
set protocols isis redistribute ipv4 connected

# Redistribute IPv6
set protocols isis redistribute ipv6 connected

commit
save
```

## Yandex Cloud: IS-IS for a Datacenter Fabric

An example of using IS-IS in Yandex Cloud for a datacenter Leaf-Spine fabric.

### Topology

```
                    Spine-1 (10.255.0.1)
                    /                  \
                   /                    \
    Leaf-1 (10.255.1.1)          Leaf-2 (10.255.1.2)
         |                              |
    Servers 10.10.1.0/24          Servers 10.10.2.0/24
```

### Spine-1 Configuration

```
# Loopback for the Spine
set interfaces loopback lo address 10.255.0.1/32

# Uplinks to the Leafs
set interfaces ethernet eth1 address 10.0.0.0/31
set interfaces ethernet eth1 description 'Link to Leaf-1'

set interfaces ethernet eth2 address 10.0.0.2/31
set interfaces ethernet eth2 description 'Link to Leaf-2'

# IS-IS Process
set protocols isis net 49.0001.1025.5000.1001.00
set protocols isis level level-2
set protocols isis metric-style wide
set protocols isis dynamic-hostname

# Spine interfaces - L2 only, point-to-point
set protocols isis interface eth1 circuit-type level-2-only
set protocols isis interface eth1 network point-to-point
set protocols isis interface eth1 metric 10

set protocols isis interface eth2 circuit-type level-2-only
set protocols isis interface eth2 network point-to-point
set protocols isis interface eth2 metric 10

set protocols isis interface lo passive

# Authentication
set protocols isis domain-password md5 'YandexCloud-DC-Fabric-2025!'

# BFD for fast convergence
set protocols bfd profile dc-fabric interval transmit 300
set protocols bfd profile dc-fabric interval receive 300
set protocols bfd profile dc-fabric interval multiplier 3

set protocols isis interface eth1 bfd profile dc-fabric
set protocols isis interface eth2 bfd profile dc-fabric

commit
save
```

### Leaf-1 Configuration

```
# Loopback for the Leaf
set interfaces loopback lo address 10.255.1.1/32

# Uplink to the Spine
set interfaces ethernet eth1 address 10.0.0.1/31
set interfaces ethernet eth1 description 'Uplink to Spine-1'

# Server-facing interfaces
set interfaces ethernet eth2 address 10.10.1.1/24
set interfaces ethernet eth2 description 'Servers VLAN 10'

# IS-IS Process
set protocols isis net 49.0001.1025.5001.1001.00
set protocols isis level level-2
set protocols isis metric-style wide
set protocols isis dynamic-hostname

# Uplink interface
set protocols isis interface eth1 circuit-type level-2-only
set protocols isis interface eth1 network point-to-point
set protocols isis interface eth1 metric 10

# Server interfaces - passive
set protocols isis interface eth2 passive
set protocols isis interface lo passive

# Redistribute connected (server networks)
set protocols isis redistribute ipv4 connected level-2 metric 10

# Authentication
set protocols isis domain-password md5 'YandexCloud-DC-Fabric-2025!'

# BFD for fast convergence
set protocols isis interface eth1 bfd profile dc-fabric

commit
save
```

### Leaf-2 Configuration

```
# Loopback for the Leaf
set interfaces loopback lo address 10.255.1.2/32

# Uplink to the Spine
set interfaces ethernet eth1 address 10.0.0.3/31
set interfaces ethernet eth1 description 'Uplink to Spine-1'

# Server-facing interfaces
set interfaces ethernet eth2 address 10.10.2.1/24
set interfaces ethernet eth2 description 'Servers VLAN 20'

# IS-IS Process
set protocols isis net 49.0001.1025.5001.1002.00
set protocols isis level level-2
set protocols isis metric-style wide
set protocols isis dynamic-hostname

# Uplink interface
set protocols isis interface eth1 circuit-type level-2-only
set protocols isis interface eth1 network point-to-point
set protocols isis interface eth1 metric 10

# Server interfaces - passive
set protocols isis interface eth2 passive
set protocols isis interface lo passive

# Redistribute connected (server networks)
set protocols isis redistribute ipv4 connected level-2 metric 10

# Authentication
set protocols isis domain-password md5 'YandexCloud-DC-Fabric-2025!'

# BFD for fast convergence
set protocols isis interface eth1 bfd profile dc-fabric

commit
save
```

### Verifying the Yandex Cloud Fabric

**On Spine-1**:
```
show isis neighbor
show isis database
show ip route isis

# You should see 10.10.1.0/24 and 10.10.2.0/24 from the Leafs
```

**On Leaf-1**:
```
show isis neighbor
show isis route

# You should see 10.255.0.1 (Spine), 10.255.1.2 (Leaf-2), 10.10.2.0/24
```

**Testing**:
```
# From Leaf-1 to the Leaf-2 loopback
ping 10.255.1.2 source-address 10.255.1.1

# From Leaf-1 to the Leaf-2 server network
ping 10.10.2.1 source-address 10.10.1.1
```

**Monitoring BFD**:
```
show bfd peers
```

## VK Cloud: IS-IS with an MPLS Backbone

An example of using IS-IS in VK Cloud for an MPLS Service Provider backbone.

### Topology

```
PE1 (10.255.255.1) --- P1 (10.255.255.10) --- PE2 (10.255.255.2)
         |                                           |
    Customer A                                  Customer B
    AS 65001                                    AS 65002
```

### P1 Router (Core)

```
# Loopback
set interfaces loopback lo address 10.255.255.10/32

# Core links
set interfaces ethernet eth1 address 10.0.1.1/30
set interfaces ethernet eth1 description 'Link to PE1'

set interfaces ethernet eth2 address 10.0.2.1/30
set interfaces ethernet eth2 description 'Link to PE2'

# IS-IS for the IGP
set protocols isis net 49.0001.1025.5255.5010.00
set protocols isis level level-2
set protocols isis metric-style wide
set protocols isis dynamic-hostname

# Core interfaces
set protocols isis interface eth1 circuit-type level-2-only
set protocols isis interface eth1 network point-to-point
set protocols isis interface eth1 metric 10

set protocols isis interface eth2 circuit-type level-2-only
set protocols isis interface eth2 network point-to-point
set protocols isis interface eth2 metric 10

set protocols isis interface lo passive

# Authentication
set protocols isis domain-password md5 'VKCloud-MPLS-Backbone-2025!'

# LDP-ISIS synchronization
set protocols isis ldp-sync holddown 300
set protocols isis interface eth1 ldp-sync
set protocols isis interface eth2 ldp-sync

# BFD
set protocols bfd profile mpls-core interval transmit 300
set protocols bfd profile mpls-core interval receive 300
set protocols bfd profile mpls-core interval multiplier 3

set protocols isis interface eth1 bfd profile mpls-core
set protocols isis interface eth2 bfd profile mpls-core

# MPLS
set protocols mpls interface eth1
set protocols mpls interface eth2

set protocols mpls ldp interface eth1
set protocols mpls ldp interface eth2
set protocols mpls ldp router-id 10.255.255.10

commit
save
```

### PE1 Router (Provider Edge)

```
# Loopback
set interfaces loopback lo address 10.255.255.1/32

# Core link
set interfaces ethernet eth1 address 10.0.1.2/30
set interfaces ethernet eth1 description 'Link to P1'

# Customer link
set interfaces ethernet eth2 address 192.168.1.1/30
set interfaces ethernet eth2 description 'Customer A CE'

# IS-IS for the IGP
set protocols isis net 49.0001.1025.5255.5001.00
set protocols isis level level-2
set protocols isis metric-style wide
set protocols isis dynamic-hostname

# Core interface
set protocols isis interface eth1 circuit-type level-2-only
set protocols isis interface eth1 network point-to-point
set protocols isis interface eth1 metric 10

set protocols isis interface lo passive

# Redistribute connected (loopback only, not customer links)
set protocols isis redistribute ipv4 connected route-map LOOPBACK-ONLY

# Route-map for selective redistribution
set policy route-map LOOPBACK-ONLY rule 10 action permit
set policy route-map LOOPBACK-ONLY rule 10 match ip address prefix-list LOOPBACKS

set policy prefix-list LOOPBACKS rule 10 action permit
set policy prefix-list LOOPBACKS rule 10 prefix 10.255.255.0/24 le 32

# Authentication
set protocols isis domain-password md5 'VKCloud-MPLS-Backbone-2025!'

# LDP-ISIS sync
set protocols isis interface eth1 ldp-sync

# BFD
set protocols isis interface eth1 bfd profile mpls-core

# MPLS
set protocols mpls interface eth1
set protocols mpls ldp interface eth1
set protocols mpls ldp router-id 10.255.255.1

# BGP for customer routes (MPLS VPN)
set protocols bgp system-as 65000
set protocols bgp neighbor 10.255.255.2 remote-as 65000
set protocols bgp neighbor 10.255.255.2 update-source lo
set protocols bgp neighbor 10.255.255.2 address-family ipv4-unicast

# Customer A BGP
set protocols bgp neighbor 192.168.1.2 remote-as 65001
set protocols bgp neighbor 192.168.1.2 address-family ipv4-unicast

commit
save
```

### PE2 Router (Provider Edge)

```
# Loopback
set interfaces loopback lo address 10.255.255.2/32

# Core link
set interfaces ethernet eth1 address 10.0.2.2/30
set interfaces ethernet eth1 description 'Link to P1'

# Customer link
set interfaces ethernet eth2 address 192.168.2.1/30
set interfaces ethernet eth2 description 'Customer B CE'

# IS-IS for the IGP
set protocols isis net 49.0001.1025.5255.5002.00
set protocols isis level level-2
set protocols isis metric-style wide
set protocols isis dynamic-hostname

# Core interface
set protocols isis interface eth1 circuit-type level-2-only
set protocols isis interface eth1 network point-to-point
set protocols isis interface eth1 metric 10

set protocols isis interface lo passive

# Redistribute connected (loopback only)
set protocols isis redistribute ipv4 connected route-map LOOPBACK-ONLY

# Route-map for selective redistribution
set policy route-map LOOPBACK-ONLY rule 10 action permit
set policy route-map LOOPBACK-ONLY rule 10 match ip address prefix-list LOOPBACKS

set policy prefix-list LOOPBACKS rule 10 action permit
set policy prefix-list LOOPBACKS rule 10 prefix 10.255.255.0/24 le 32

# Authentication
set protocols isis domain-password md5 'VKCloud-MPLS-Backbone-2025!'

# LDP-ISIS sync
set protocols isis interface eth1 ldp-sync

# BFD
set protocols isis interface eth1 bfd profile mpls-core

# MPLS
set protocols mpls interface eth1
set protocols mpls ldp interface eth1
set protocols mpls ldp router-id 10.255.255.2

# BGP for customer routes (MPLS VPN)
set protocols bgp system-as 65000
set protocols bgp neighbor 10.255.255.1 remote-as 65000
set protocols bgp neighbor 10.255.255.1 update-source lo
set protocols bgp neighbor 10.255.255.1 address-family ipv4-unicast

# Customer B BGP
set protocols bgp neighbor 192.168.2.2 remote-as 65002
set protocols bgp neighbor 192.168.2.2 address-family ipv4-unicast

commit
save
```

### Verifying the VK Cloud MPLS Backbone

**IS-IS Neighbors**:
```
show isis neighbor
```

**IS-IS Database**:
```
show isis database detail
```

**MPLS LDP**:
```
show mpls ldp neighbor
show mpls ldp binding
```

**LDP-ISIS Sync Status**:
```
show isis mpls ldp-sync
```

**BGP Sessions**:
```
show bgp summary
```

**MPLS Trace**:
```
traceroute mpls ipv4 10.255.255.2/32
```

## Operational Commands

### IS-IS Neighbors

Show IS-IS adjacencies:
```
show isis neighbor
```

Output:
```
Area Circinus:
 System Id           Interface   L  State        Holdtime SNPA
 spine-1             eth1        2  Up            27       2020.2020.2020
```

Details:
```
show isis neighbor detail
```

### IS-IS Database

Link State Database:
```
show isis database
```

Output:
```
Area Circinus:
IS-IS Level-1 Link State Database:
LSP ID                  PduLen  SeqNumber   Chksum  Holdtime  ATT/P/OL
router-1.00-00            142   0x00000005  0x1234    1195    0/0/0
router-2.00-00            156   0x00000003  0x5678    1189    0/0/0

IS-IS Level-2 Link State Database:
LSP ID                  PduLen  SeqNumber   Chksum  Holdtime  ATT/P/OL
router-1.00-00            178   0x00000008  0xabcd    1195    0/0/0
```

Details for a specific LSP:
```
show isis database detail router-1.00-00
```

Level-specific:
```
show isis database level-1
show isis database level-2
```

### IS-IS Routes

IS-IS routing table:
```
show isis route
```

Output:
```
Area Circinus:
IS-IS paths to level-1 routers that speak IP
Vertex               Type         Metric Next-Hop             Interface Parent
192.168.255.2        IP internal  10     10.0.0.2             eth1      (null)
```

IPv4 routes:
```
show ip route isis
```

IPv6 routes:
```
show ipv6 route isis
```

### IS-IS Interface

Show IS-IS interfaces:
```
show isis interface
```

Output:
```
Interface   Circuit  Type    Level   Metric
eth1        0x1      p2p     L1L2    10
lo          0x0      loopback L1L2   0
```

Interface details:
```
show isis interface detail
```

A specific interface:
```
show isis interface eth1
```

### IS-IS Topology

Show the topology:
```
show isis topology
```

Level-specific:
```
show isis topology level-1
show isis topology level-2
```

### IS-IS Summary

General information:
```
show isis summary
```

Output:
```
VRF : default
Process Id      : 1
System Id       : 1921.6825.5001
Instance        : 0
IS-IS VRF       : default
Router ID       : 192.168.255.1
Hostname        : router-1
  Level-1-2 LSP MTU               : 1497 bytes
  Area address(es) :
          49.0001
```

### Clear ISIS

Restart the IS-IS process:
```
restart isis
```

Clear a neighbor adjacency (to re-form it):
```
clear isis neighbor
```

## Troubleshooting

### Neighbor Does Not Form

Check the following:

1. **Layer 2 connectivity**:
   ```
   ping <neighbor-ip>
   ```

2. **NET configuration**:
   ```
   show isis summary
   ```

   The Area ID must match for L1 neighbors.

3. **Circuit type** matches:
   ```
   show isis interface eth1
   ```

   An L1 router does not form an adjacency with an L2-only router.

4. **Authentication** matches:
   ```
   show isis interface detail
   ```

   Area password for L1, domain password for L2.

5. **Network type** matches:
   ```
   show isis interface
   ```

   Broadcast vs point-to-point.

6. **MTU** matches:
   ```
   show interfaces ethernet eth1
   ```

   IS-IS checks the MTU in the Hello PDU.

7. **Hello interval and multiplier**:
   ```
   show isis interface detail
   ```

### Neighbor in the Init State

**Init** means the router is receiving Hellos but does not see its own System ID in the neighbor's Hello.

Check the following:
- Bidirectional Layer 2 connectivity
- Authentication is correct
- IS-IS is enabled on the neighbor's interface

Debug:
```
monitor log
# Then in another session:
configure
set protocols isis log-adjacency-changes
commit
```

### Routes Do Not Appear

Check the following:

1. **Adjacency is in the Up state**:
   ```
   show isis neighbor
   ```

2. **LSP in the database**:
   ```
   show isis database
   ```

3. **Route in the IS-IS RIB**:
   ```
   show isis route
   ```

4. **Route in the IP routing table**:
   ```
   show ip route isis
   ```

5. **Level configuration**:

   An L1 router does not see routes from L2.
   Make sure an L1/L2 router is advertising the default into the L1 area.

6. **Overload bit** is not set:
   ```
   show isis database detail
   ```

   An OL bit = 1 means the router is in overload.

### High CPU Usage

Frequent IS-IS SPF calculation.

1. **Check for interface flapping**:
   ```
   show interfaces
   ```

2. **Tune the SPF timers**:
   ```
   set protocols isis spf-delay-ietf init-delay 100
   set protocols isis spf-delay-ietf short-delay 500
   set protocols isis spf-delay-ietf long-delay 5000
   set protocols isis spf-delay-ietf holddown 10000
   commit
   ```

3. **Use BFD** for fast failover instead of short hello intervals.

4. **Check LSP flooding**:
   ```
   show isis database
   ```

   High sequence numbers indicate frequent LSP updates.

### LSP Database Not Synchronized

1. **Check the MTU**:
   ```
   show interfaces ethernet eth1
   ```

   If the MTU does not match, large LSPs may not be transmitted.

2. **Check the timers**:
   ```
   show isis summary
   ```

   LSP lifetime and refresh interval.

3. **Clear the database** and wait for a re-sync:
   ```
   restart isis
   ```

### Authentication Errors

The log will show authentication failures:
```
monitor log
```

Check the following:
- Area password for L1 (on all L1 neighbors)
- Domain password for L2 (on all L2 neighbors)
- Interface password (on both ends of the link)
- Plaintext vs MD5 matches

### Routing Loops

1. **Check the attached bit**:
   ```
   show isis database detail
   ```

   L1/L2 routers should set the ATT bit in their L1 LSP.

2. **Check the metric** configuration:
   ```
   show isis interface
   ```

   Asymmetric metrics can cause suboptimal routing.

3. **Check redistribution**:
   ```
   show running-config protocols isis
   ```

   Mutual redistribution between IS-IS and other protocols can cause loops.

## Best Practices

### NET Design

1. **AFI 49** for private addressing
2. **System ID derived from the loopback IP** for simplicity
3. **Unique System ID** within the domain
4. **Matching Area ID** for L1 neighbors in the same area

### Level Hierarchy

1. **L2 for the backbone** (core routers)
2. **L1 for access/distribution** (edge routers)
3. **L1/L2 for boundaries** (border routers)
4. **Minimize L1/L2 routers** for simplicity

### Area Design

1. **Single area** for small deployments (all L2)
2. **Multiple areas** for large deployments:
   - Core = L2 only
   - Distribution = L1/L2
   - Access = L1 only
3. **Area 49.0001** for a datacenter fabric (a single L2 domain)

### Interface Configuration

1. **Point-to-point** for direct links and VPN
2. **Passive** for loopback and server-facing interfaces
3. **Authentication** on all production interfaces
4. **Metric** tuning for traffic engineering

### Timers

1. **Default timers** are sufficient for most deployments
2. **BFD** for sub-second failover instead of aggressive hello timers
3. **SPF timers** tuned only when necessary

### Authentication

1. **MD5 for area and domain passwords**
2. **Unique passwords** for different areas/domains
3. **Regular password rotation**
4. **Interface passwords** for additional protection

### Scalability

1. **Wide metric style** for modern deployments
2. **Summarization** at L1/L2 boundaries
3. **Passive interfaces** for non-transit networks
4. **Minimal redistribution** - use BGP for external routes

### Monitoring

1. **Log adjacency changes**:
   ```
   set protocols isis log-adjacency-changes
   ```

2. **Monitor neighbors**:
   ```
   show isis neighbor
   ```

3. **Monitor database size**:
   ```
   show isis database
   ```

4. **Monitor BFD sessions**:
   ```
   show bfd peers
   ```

### Datacenter Fabric

1. **L2 only** (single area)
2. **Point-to-point** on all links
3. **BFD enabled** for fast failover
4. **ECMP** for load balancing (automatic with equal cost paths)
5. **Metric** the same on all links for symmetric ECMP

## Security

### Recommendations

1. **MD5 Authentication**:
   ```
   set protocols isis domain-password md5 'SecurePassword123!'
   set protocols isis area-password md5 'AreaPassword123!'
   ```

2. **Interface passwords**:
   ```
   set protocols isis interface eth1 password plaintext-password 'HelloSecret'
   ```

3. **Passive interfaces**:
   ```
   set protocols isis interface eth2 passive
   ```

4. **Firewall for IS-IS** (multicast 01:80:C2:00:00:14, 01:80:C2:00:00:15):

   IS-IS operates at Layer 2, so the firewall must permit:
   - All-IS multicast (L1): 01:80:C2:00:00:14
   - All-L2-IS multicast (L2): 01:80:C2:00:00:15

5. **Limit IS-IS interfaces** to trusted links only:

   Do not enable IS-IS on untrusted/external interfaces.

6. **Log adjacency changes**:
   ```
   set protocols isis log-adjacency-changes
   ```

7. **Overload bit** during maintenance:
   ```
   set protocols isis overload-bit
   commit
   ```

## Performance

### Optimization

1. **Wide metric style**:
   ```
   set protocols isis metric-style wide
   commit
   ```

2. **SPF optimization** for unstable networks:
   ```
   set protocols isis spf-delay-ietf init-delay 100
   set protocols isis spf-delay-ietf short-delay 500
   set protocols isis spf-delay-ietf long-delay 5000
   commit
   ```

3. **BFD** for fast failover:
   ```
   set protocols isis interface eth1 bfd
   commit
   ```

4. **Passive interfaces** to reduce overhead:
   ```
   set protocols isis interface lo passive
   set protocols isis interface eth2 passive
   commit
   ```

5. **LSP refresh optimization**:
   ```
   set protocols isis lsp-refresh-interval level-2 900
   commit
   ```

## Comparison with Other Protocols

### IS-IS vs OSPF

| Characteristic | IS-IS | OSPF |
|---------------|-------|------|
| Layer of operation | Layer 2 | Layer 3 (IP) |
| Hierarchy | L1/L2 (flexible) | Areas + mandatory Area 0 |
| IPv4 and IPv6 | Single process | Separate processes (OSPFv2/v3) |
| Metric | Arbitrary (default 10) | Cost (bandwidth-based) |
| Convergence | Fast | Fast |
| Scalability | Better | Good |
| Complexity | Higher (OSI terminology) | Medium |
| Adoption | ISP, DC | Enterprise |
| Address overhead | Less | More |

### IS-IS vs EIGRP

**IS-IS** - an open standard, link-state.
**EIGRP** - Cisco proprietary (now open), advanced distance-vector.

IS-IS is preferable in multi-vendor environments.

### When to Use IS-IS

**Use IS-IS**:
- ISP backbone
- Datacenter leaf-spine fabric
- MPLS core
- Large-scale networks
- Dual-stack IPv4/IPv6
- Multi-vendor environment

**Use OSPF**:
- Enterprise campus
- Small to medium networks
- Legacy integrations
- Simpler for administrators

**Use BGP**:
- External routing (Internet)
- Multi-homing
- Policy-based routing

IS-IS and BGP are often used together: IS-IS for the IGP, BGP for external/customer routes.

## Next Steps

- [BGP](/docs/vyos/routing/vyos-bgp/) - for external routing and customer routes
- [OSPF](/docs/vyos/routing/vyos-ospf/) - an alternative IGP
- [Static Routes](/docs/vyos/routing/vyos-static/) - a backup for the IGP
- [MPLS](/docs/vyos/routing/vyos-mpls/) - for MPLS VPN
- [BFD](/docs/vyos/routing/vyos-bfd/) - fast failure detection

## Additional Resources

- [VyOS IS-IS Documentation](https://docs.vyos.io/en/latest/configuration/protocols/isis.html)
- [ISO 10589 Standard](https://www.iso.org/standard/30932.html)
- [RFC 1142 - OSI IS-IS Intra-domain Routing Protocol](https://tools.ietf.org/html/rfc1142)
- [RFC 5308 - Routing IPv6 with IS-IS](https://tools.ietf.org/html/rfc5308)
- [FRRouting IS-IS](https://docs.frrouting.org/en/latest/isisd.html)