IS-IS Foundations and Design

0:00IS-IS is the interior gateway routing protocol that's

0:03primarily used in the service provider world,

0:06but we're seeing it pop up more and more

0:08within the enterprises.

0:09Why is that?

0:10Why is IS-IS now making a comeback

0:12and going through a sort of Renaissance, so to speak?

0:15Here's the spoiler.

0:16It's because of DNA Center.

0:18DNA Center deploys IS-IS as part of its underlay automation.

0:23Now if you're following along because you're going to be

0:26going for the ENSLD certification,

0:28you're going for the E-N-S-L-D playlist,

0:31you're going to learn more about DNA Center later in this

0:33playlist.

0:34Or if you're just here and you want

0:35to learn more about DNA Center and the SD-Access fabric

0:38and LAN automation, you can click

0:40that little Search button up there and search for SD-Access

0:42and that'll get you going.

0:43But what we're going to do now is introduce IS-IS.

0:47What is IS-IS, how are the very basics of IS-IS working,

0:52how does it actually perform, how does it

0:54form neighbor adjacencies, and how do we understand metrics.

0:56That's what this skill is going to be all about

0:58is just setting up the foundation of how IS-IS works,

1:02then the next skill, what we're going to talk about

1:04is how to design an IS-IS enterprise campus.

1:08So get ready because this is going to be a lot of fun

1:10as we talk about this resurging interior gateway routing

1:14protocol, IS-IS.

1:15Let's get going.

0:00Now, I did say at the beginning of this particular skill

0:02that ISIS has a lot in common with OSPF.

0:05And guess what, it does.

0:06But we first have to set up one of the most important things

0:10about ISIS, and that's the levels.

0:12This is where things do deviate from OSPF just a little bit.

0:16Because guess what?

0:17ISIS originally wasn't created for IP networks.

0:21That's right, it was created for ISO networks.

0:24So what we're going to talk about in this particular Nugget

0:26is the different levels of an ISP network.

0:29And why that's important, we'll understand

0:32as the skill progresses, because you'll

0:33learn pretty quickly that ISIS operates on different levels.

0:38So get ready as we introduce some

0:40of the key terms that come with working with an ISIS network.

0:44Let's get going.

0:45The OSI model, we all know and love the OSI model.

0:48If you're like me, a few years back

0:49you were learning about the OSI model

0:51from Keith Barker in the network plus course.

0:53Remember, please do not throw sausage pizza away,

0:56I'll never forget it.

0:57The OSI model, the entire point of the OSI model

1:00is to logically design how traffic flows up or down

1:05within one particular host.

1:07So if traffic is trying to go out of a host,

1:10we see the traffic starts at the application layer

1:12and moves its way down to the physical layer.

1:14When traffic arrives at a host, it

1:16moves its way up from the physical layer,

1:18get's de-encapsulated and goes all the way up

1:20to the application layer.

1:22The cool thing about these standards organizations

1:24is that this isn't just where describing

1:26how traffic flows stopped.

1:28In other standards organizations,

1:30they designed how traffic flows throughout a network

1:33and throughout an autonomous system.

1:35And that's what we're going to talk about here in this Nugget.

1:37Is how ISIS, and really the ISO, defined

1:40levels of how traffic gets flown throughout a network.

1:44Let's start off with the most basic form of communication,

1:47and this is going to be a level zero communication.

1:50We have a computer here.

1:52This is just going to be an endpoint,

1:54and that's actually a critical talking point,

1:56right out of the gate.

1:57Is that, within ISIS, we define endpoints as ES'.

2:02These are endpoint systems.

2:03Our devices that are performing routing

2:06could be things like layer three switches here, or routers.

2:10Within ISIS these are called, guess what?

2:12IS'.

2:13So we see that we basically have two types of devices.

2:16We're already setting up some pretty important definitions.

2:19When it comes to ISIS we have ES',

2:21which define our endpoints.

2:23And we have IS' which are intermediate systems.

2:27These are what perform the routing actions and network

2:30traffic flows within our area and autonomous system.

2:34So the entire point of defining levels

2:36is to define what kinds of traffic flows can take place.

2:40Let's pretend for a moment that this switch right here

2:43is performing layer three connectivity

2:45and routing options, like Inter-VLAN routing.

2:48When this endpoint system connects into the switch

2:51and it uses this switch as its default gateway,

2:54those communications are considered level zero

2:58communications.

2:59Whenever the switch needs to route packets to the next IS,

3:03these are considered level one communications.

3:07Now here's the cool part, there's

3:08only two more levels to go.

3:10We've already halfway there.

3:11When an endpoint system, when an end system is communicating to

3:14an IS, we then have what's called level zero.

3:17And when an IS communicates to another IS, we have level one.

3:21But there is one gotcha right there about that level one

3:25communication.

3:25We are still talking about a link state

3:28routing protocol at the end of the day.

3:30And link state routing protocols love the concepts of areas.

3:35Areas help us segment our traffic

3:37and then it allows us to scale a lot better when

3:40it comes to traffic.

3:41So for instance, my organization may be geographically large.

3:45And I may define this as my United States area,

3:50and I may have a completely different area across the world

3:54that looks very similar.

3:56We're just going to draw it up right here,

3:57but I'll use a different color to segment this right here.

4:00I know, I kind of drew off the screen.

4:02Here I'll use a different color to draw this up here.

4:04This may be a different area.

4:06So we'll say this United States area is area 10, just for fun.

4:10And we'll say over here, this is the United Kingdom.

4:13And we'll say this is going to be area 20.

4:15When communication takes place between these two IS', between

4:20different areas, we call this inter-area routing.

4:24This is going to be a level 2 communication.

4:27So to recap, we've got level zero, which

4:29is our ES communicating to its local IS,

4:32this is basically on the same subnet.

4:34We have an IS communicating to another IS,

4:37this is any network traffic that exists within one area.

4:41So we're not just talking about directly connected traffic.

4:44This could be a router communicating

4:46to a router that's 10 hops away, but they're still

4:49within the same area.

4:51That's level one.

4:52Then we go into level two communications,

4:54which is when IS' communicate within different areas.

4:58And then, as I promised, there was a third level,

5:01that was level zero.

5:02And that's when we communicate to an IS that's not even

5:05within our autonomous system.

5:07So this would be, I'm like writing way up here

5:09on top of the screen, this would be like

5:11if we're appearing with an entirely different company

5:14to share routes using ISIS.

5:15That would be a level three communication.

5:17Now, on Cisco devices they only operate ISIS

5:21on level one and level two.

5:23So really the only levels that you need to know about

5:26are ISIS level one and level two.

5:29And recall again, what we're really talking about here.

5:32ISIS level one is intra-area routing.

5:35Think about that in terms of OSPF.

5:37This is routers who are trying to communicate to each other

5:40within the same area.

5:41So if we have area 10 in OSPF, and there's

5:4430 routers within that.

5:45If any of those routers are communicating

5:47to each other in any way, that's going

5:49to be an intra-area route.

5:50And in ISIS terms, that's a level one route.

5:53Now, if we're talking about inter-area routing,

5:56we still own these areas.

5:58We have routers that are communicating between areas,

6:01we have a level two route.

6:03Now this is where things start to differ from OSPF

6:06a little bit, is when inter-area routing comes up.

6:08And that's what we're going to talk about over the next couple

6:10of Nuggets.

6:11It's just critical to understand, right now,

6:13what level one and level two routes are all about.

6:17Because that sets up how our routers,

6:19or IS', are really going to behave when it comes time

6:23to deploy and design an ISIS network.

6:26So that sets up the IS levels, levels zero through three.

6:29Really honing in on levels one and two.

6:31I hope this has been informative for you,

6:33and I'd like to thank you for viewing.

0:00So we've now talked about how the different levels work

0:03throughout a network.

0:03And I think that's a really cool way

0:05that we can identify the different types of traffic that

0:08could take place throughout a network,

0:10throughout an autonomous system, or between different autonomous

0:13systems.

0:14I really, really like how that is set up.

0:16So that sets up how things are different from OSPF and ISIS.

0:19Now what we need to talk about is the similarities.

0:21And what we're going to talk about here in this Nugget

0:24is how areas work within ISIS.

0:26There's a lot of things that are familiar here,

0:28but it is a little different, so let's talk about how

0:31areas work within ISIS.

0:32Let's go.

0:33So now it's time to talk about how areas work within ISIS.

0:36We talked about levels, Level 1 and Level 2,

0:38and we understand that IS's that communicate

0:41within an area, that's a Level 1 communication, and IS's

0:44that communicate between areas, that inter-area routing, that's

0:48Level 2 communication.

0:49Now when it comes to areas themselves within ISIS,

0:52it's very similar to OSPF with one key critical difference.

0:56What I'm going to do is I'm going to draw areas.

0:58Here we go.

0:59We'll call this let's just say Area 1,

1:01and over here I'll say we have Area 2.

1:05Think about OSPF for one second.

1:07What was one critical law about OSPF

1:10that must exist in order to make OSPF work or at least

1:14in a large OSPF thing?

1:15They all had to have Area 0, right?

1:19In ISIS, you do not have to have Area 0.

1:22You don't have to have really any area as mandatory at all.

1:26There's not one area that is defined

1:28as mandatory at all in ISIS.

1:31So technically there's nothing that

1:33would stop me from taking this router here,

1:37and this router here, and forming a direct adjacency.

1:41This would be a Level 2 communication.

1:44And then from within that we would

1:45have all of these routers over here

1:47and these would form Level 1 communications

1:49because they'd all be communicating

1:50within the same area.

1:52And it looks something like this.

1:53So immediately this sets up a pretty big talking point

1:56as there is no need whatsoever for a backbone within ISIS.

2:01Area 0 is not mandatory.

2:03But maybe we should still have one.

2:06It is the best design practice in order

2:09to have any sort of transit traffic,

2:11meaning traffic going from one area destined to another area.

2:15It is probably best to have a transit fabric or a transit

2:19area.

2:19So we should design an area for traffic

2:22to be transmitted through.

2:24And most importantly, all of the routers in here

2:27should be performing Level 2 operations.

2:30Why does that matter?

2:32Why does it need to be Level 2 in the transit area?

2:34That's really what the next Nugget is all about.

2:36And it was probably the biggest nuance or learning

2:38point in all of ISIS.

2:40I'm just setting up right now one of the critical things

2:43that you should know about ISIS areas.

2:46The thing that you should know is that Level 2 communications

2:49can take place between any area, but it

2:52is a best practice if there's going

2:54to be area communication to have a transit fabric or a transit

2:59area handling that.

3:00And beyond that, differing from OSPF

3:04it does not have to be Area 0.

3:06This very well could be Area 49 for all we know.

3:10So this takes our skills about knowing about the IS levels

3:13intra-area routing and inter-area routing,

3:16and it starts applying it to that design concept.

3:20If we're going to have inter-area routing,

3:22it's probably best that we have a transit area to handle it,

3:25unless our organization is particularly small

3:28and we really only need the two areas.

3:30But we also keep in mind where Level 1 communications

3:33and Level 2 communications take place.

3:35And lastly, the critical thing to understand

3:37is that our transit area does not need

3:39to be explicitly named Area 0.

3:42We can name it any area that we want.

3:43And that's where predominantly our Level 2 communications

3:47are going to take place.

3:48Now how does that really work and what does that really mean?

3:50That's what the next Nugget's it's all about.

3:52In the meantime, this is understanding

3:53how areas work within ISIS.

3:55I hope this has been informative for you

3:57and I'd like to thank you for viewing.

0:00So at this point in our journey, we

0:01have seen the IS levels themselves, which

0:04define how traffic is moving throughout an area,

0:07or between areas or autonomous systems,

0:09and we've also talked about the areas themselves--

0:11a familiar concept from other link-state routing protocols

0:14like OSPF.

0:15How routers behave within a level

0:18and within an area in is-is is a big deal.

0:21It's honestly probably the most complicated part

0:23to all of is-is.

0:25So what we're going to do in this Nugget

0:27is break down how a router gets assigned to an area,

0:30and how it behaves within a level or between levels

0:33before we jump into the actual CLI and see it in action.

0:36So let's get going.

0:37OK, so this is where it all starts to come together,

0:40but this is also where it gets a little complicated.

0:42This is where the is-is behavior really starts to shine,

0:46and where we can really start to compare and contrast it

0:49to OSPF.

0:50What we're going to talk about now

0:51is how routers know whether they're communicating within IS

0:56level 1 or IS level 2.

0:58And this is really it.

0:59At the end of the day, when we fire up a router

1:01and we tell it, you're going to be running is-is,

1:04we tell it what kind of communications it can do.

1:07For instance, we'll enter the router is-is command

1:11on the command line.

1:12Now, no, we don't specify a process ID or any sort of

1:15autonomous system number.

1:16It's just router is-is.

1:18And then we tell it with the istype command what

1:23level it's going to operate at.

1:25This could be at level 1.

1:27This could be at level 2.

1:29Or this could be level 1-2.

1:33And it's absolutely, positively, explicitly

1:36critical to make sure that we set these

1:39when it's time to deploy our is-is network,

1:41because this will determine how neighbor adjacencies can even

1:46be formed in the first place.

1:47Let's start off by talking about when

1:49we set it to IS type level 1.

1:51When we tell router that it is IS type level 1,

1:54it will only ever form a neighbor adjacency--

1:58absolutely critical-- it will only ever form a neighbor

2:01adjacency to other routers that are IS type level 1, and--

2:07underlining that and-- the area number matches.

2:12This is why I set up that very first Nugget about what level 1

2:15communications even were.

2:17Remember, level 1 communications were intra-area routing.

2:22That means that level 1 communications

2:24are only allowed to take place within the area.

2:27So our level 1 routers, when they are

2:29IS type level 1 right here--

2:31they should never be able to perform a level 2 route.

2:35They have to be a level 1 router,

2:37and they have to know that the route-- the packet

2:41that's being transferred right now--

2:43is existing within the same network.

2:45So if I were to circle this right here and say this

2:49is area 1, and then I, over here, create a different area--

2:54just like this-- and on these two routers I type the command

2:58router is-is istype level-1, as long as the area numbers match

3:05on both of these devices--

3:06let's say this is area 2--

3:08and both of these routers believe they're in area 2,

3:11this neighbor adjacency will come to life as well.

3:14However, this communication-- the level 2 communication right

3:17here, between these areas--

3:19this will never, ever take place.

3:22Big X right here.

3:23Level 1 routers are only allowed to route traffic

3:27at the level 1 area, at the level 1-- well, level.

3:31Intra-area routing.

3:33So this is really the first big thing

3:35you need to take away from is-is learning,

3:37is that level 1 routers will only

3:39form neighbor relationships to other level

3:421 routers that are in the same area.

3:45Now we're going to clean up the screen and talk about level 2.

3:48Recall, again, what was the entire point about level 2.

3:51Level 2 was interarea routing.

3:55So if I have my same router right here

3:58and it believes that it is in area 1,

4:01but instead I type the router is-is command

4:04and I say istype is level 2, then over here I

4:10have another router, and it believes it is in area 2,

4:14but similarly, I type the router is-is command and istype

4:19level 2, these two can and will form a neighbor adjacency

4:24to each other, because the entire point of level 2

4:28is to permit this interarea routing.

4:31This is to go from one area to another area.

4:34Now, here's the quiz question for you.

4:36If I have another router down here

4:39and it is level 1 in area 1, do you

4:44think this neighbor adjacency will form?

4:46Go ahead and pause it if you need to.

4:48Just think through this one.

4:49Rewind it and watch what we said about the level 1 routers,

4:52and then come back to this and see if you

4:53can answer this question.

4:55Do you think that the level 1 router

4:56will form a connection to a level 2

4:58router in the same area?

5:00The answer is no.

5:01It will not.

5:02A level 1 router is only explicitly allowed

5:05to form a neighbor adjacency to a level 1

5:08router in the same area.

5:10If it sees a level 2 router, like this guy right

5:13here that has been explicitly told to operate at level 2,

5:16it thinks, then, that it may be routing traffic to an interarea

5:19router, and this violates all it knows about intra-area

5:23routing in level 1.

5:24So this begs the question, what happens, then,

5:27when an [INAUDIBLE] that's located down here

5:29needs to communicate to an [INAUDIBLE] that's down here?

5:33There's clearly a hard line, or a big wall,

5:36that separates our level 1 routers from our level 2

5:39routers, so how do we handle this situation?

5:41Enter the level 1-2 router.

5:43So now what we're talking about is

5:45typing the router is-is command, and typing istype level-1-2.

5:51In this case, the router acts as both.

5:54And this is a critical talking point.

5:56Think about the OSPF database for one second.

5:58Every LSA that it receives, it stores in a database.

6:03Well, this is an awesome talking point about is-is.

6:06is-is also has an is-is database,

6:11and it maintains a database for each level that it knows about.

6:15So let's say I have my router here-- one more time-- that

6:18sits on the edge of area 1, and I have my router here that

6:23sits on the edge of area 2.

6:26When we've configured each of these routers for level 1

6:29and level 2, what begins to happen is they will send out

6:33level 1 hello's as well as level to hello's.

6:38When this area here receives the level one hello from the area 2

6:42router, it's going to say, well, I'm going to try and form

6:45a level 1 adjacency, because I prefer level 1,

6:48but I see that you are in a different area,

6:51so I cannot form a level 1 adjacency.

6:53Then it attempts to send out level 2 hello's, and

6:56the adjacency comes to life, because it

6:57allows intra-area routing.

6:59So this adjacency and all of the routes that it learns here

7:02is stored in the level 2 database.

7:06Then a similar action happens over here

7:09with my level 1 router.

7:10These two will exchange level 1 hello's, and because they're

7:14in the same area, this adjacency comes to life.

7:17And all of the routes that this router learns from level 1

7:20will be stored in the level 1 database.

7:24Now, probably the most interesting and fascinating

7:26part about all of this is how, then,

7:28do our [INAUDIBLE] systems, like this guy over here,

7:31make its way into an interarea route?

7:34When this device recognizes that it is a level 1-2 router and it

7:39has routes within both level 1 database and level 2 database,

7:43in the level 1 area, it will then send in basically

7:47a notification that I am your exit point out of the area,

7:51and these devices--

7:53all of the other level 1 routers--

7:54will receive basically a default route destined

7:58for the level 1-2 router.

7:59In OSPF terms, this is almost identical to a total NSSA.

8:05The area 1 in this case would have a default route

8:08to anywhere else-- we do allow redistribution

8:10in at this point-- but it would maintain

8:12a database of all of the intra-area routes that

8:16are available within that area.

8:18So this is kind of the "nuance-y"

8:19part about learning is-is.

8:21Let's kind of break it all down.

8:23If we have level 1, area 1, forming a relationship to level

8:271, area 1, we get a checkmark.

8:30If we have level 1, area 1 trying

8:33to form a relationship to level 1, area 2, you get a big X.

8:38If you have level 1, area 1 trying

8:42to form a relationship to level 2, anything,

8:44you get a big X. If you have level 1, area 1 trying

8:49to form a relationship to a level

8:521-2 that is also represented as area 1, you get a checkmark.

8:56If you've got level 1, area 1 trying to form a relationship

9:01to level 1-2 in a different area--

9:04like area 2-- you get a big, red X. Then lastly,

9:07if you have level 2 forming a relationship to level 2,

9:10you get a checkmark.

9:11Why does this matter?

9:12Why is it like this?

9:13This really comes down to design.

9:15And when you actually get into the next skill,

9:17when we talk about design considerations for a three-tier

9:21or a two-tier enterprise campus, this

9:24will all make a whole lot more sense.

9:26It's actually going to start to come

9:27to play in the next couple of Nuggets when we jump into a CLI

9:30and start actually building out the configuration

9:32of these devices.

9:33But then when you see it on the enterprise campus,

9:36you'll go, oh, OK, that's why is-is works the way it does,

9:38and it's actually pretty cool.

9:40It's actually really nice.

9:41So that's been explaining the IS levels

9:43and how they interact with each other,

9:45and how neighbor adjacencies can really come to life.

9:48Also keep in mind that there's separate databases

9:50for level 1 and level 2.

9:52I hope this has been informative for you,

9:54and I'd like to thank you for viewing.

0:00So we've thrown a lot of concepts at you at this point,

0:02and there's one last concept that we're

0:04going to throw at you.

0:04But don't worry, we're going to do some CLI action

0:07and actually get our first win when it comes to configuring

0:10IS-IS on a particular router.

0:12In this Nugget, what we're going to set up

0:14is the NET-- not the internet, not the network.

0:16We're talking the Network Entity Title.

0:19This is critical for IS-IS because this

0:22is how an IS, or a router, really identifies itself

0:27as well as which area it belongs to.

0:29So let's get going talking about the NET.

0:31So the next part that we're going to be doing now

0:33is actually getting our IS-IS environment built out.

0:36You see I've got a little topology here

0:38that we can play with.

0:39It's got two areas where we can set up

0:41some intra-area routing as well as some inter-area routing,

0:44and that's what we're going to be

0:45exploring throughout the next couple Nuggets.

0:47But notice there's one important factor

0:49that we haven't talked about.

0:51We have talked about how to enable IS-IS with the router

0:55IS-IS command.

0:56We have talked about how a IS device, or a router,

0:59knows which level it's allowed to participate in

1:02with the IS-type level command.

1:04We could specify a level 1, level 2, or level 1-2.

1:08But how does a router know who the router is

1:11or what area it belongs to?

1:13This would be akin to OSPF's router ID and then area

1:17statement.

1:18Those are two separate statements

1:19that are combined together in one statement

1:22here within IS-IS.

1:23What we're talking about is the NET command.

1:27And NET stands actually for Network Entity Title.

1:32The network entity title does-- well,

1:33honestly-- a whole bunch of things within non-IP networks.

1:37This is how a device would identify not only who

1:40it is, what area it belongs to but also what kind of traffic

1:45it's carrying within a packet.

1:47Now it also varies in length.

1:49It has multiple sections or pieces that build it up.

1:52And in traditional Cisco configurations,

1:55it is broken up into six 16-bit sections.

1:59It looks something like this.

2:01The first 16-bit section traditionally

2:03is pretty much always almost 49.

2:06This is called the AFI, and you really

2:08only need to know that for trivia

2:10whenever you're out at a networking trivia thing.

2:13The next 16-bit section is the actual area itself.

2:18So if this device-- or these devices--

2:19were in area 1, we would write 0001.

2:24Then the following three 16-bit sections

2:28are going to be something that uniquely identifies

2:31the ISs on the network.

2:33This could be something like a Mac address.

2:35A Mac address is 48 bits long, so three 16-bit, 48 bits.

2:38You could use a Mac address because it's going to be unique

2:41and it could identify this IS uniquely on the network.

2:44For simplicity's sake, for like router 1,

2:46we could do 0000.0000--

2:50whoop, one more zero--

2:510001.

2:53And then, lastly, we type 00 here.

2:56The 00 at the very end octet basically tells other devices,

3:01this is me identifying myself, otherwise we would be

3:05identifying what kind of traffic we're carrying throughout

3:08the network, and that's not what IS-IS over an IP network is all

3:11about.

3:12So breaking it down, we start off with 49,

3:14and we end with a 00.

3:17In the middle, we have our area ID followed by something

3:20that uniquely identifies our devices.

3:23So I'm just going to hide this from the screen for a moment.

3:25I'm going to bring up the console of all

3:27of these devices, so that we can configure the NET

3:30on each one of these devices.

3:32And you can see how that looks and feels

3:33as you start to deploy IS-IS in your network.

3:37So what we're going to do as a good first step to deploying

3:39IS-IS is just make sure that all of the devices

3:42have their NET configure.

3:44This is going to be a unique way to identify

3:46the devices on their network.

3:47Now I'm going to show you how to do this the easy way.

3:49And then I'm going to show you how

3:50to do this, probably, the correct way when

3:52we get to the very last router R6 here.

3:54Let's start off with R1 and get started

3:56configuring a NET within IS-IS.

3:58It's pretty straightforward.

3:59We go into configuration mode.

4:01We say router IS-IS, and then we just

4:03type the command NET followed by the actual numbers

4:07that we specified earlier.

4:08Now if I bring the actual writing here up on the screen,

4:11we see we've got 49--

4:12that's what we're always starting with--

4:14our area number, something to uniquely identify it

4:17for the next 48 bits, and then we end with 00.

4:21So considering R1 is in area 1, I'm

4:23going to type 49, 1, 2, 3, then area 1--

4:27that's going to be 0001--

4:29then something to uniquely identify

4:31this router on the network.

4:32So I'll say 0000.0000.0001 then 00, and I press Enter.

4:40I can do almost the exact same thing here for router 2.

4:44We'll say configuration terminal, router IS-IS,

4:48then we'll give it a NET, again, 49.

4:50This is still going to be in area 1, so I'll say 0001.

4:55Then we'll give it a unique address 0000.0000.0002.00.

5:01So we see that the 49 is the same, and the 0001--

5:05the area-- is going to be the same.

5:08It's unique identifier is separated

5:10by this last little bit right here setting it to 2.

5:13I guess I should say 4 bits, but you get my point--

5:152.

5:16Now R3, this is what's going to be our inter-area communicator.

5:20We're going to talk about how that's going to work later.

5:22For now, what we're going to do is

5:24we're going to be setting in the configuration

5:27one more time for router IS-IS.

5:29The NET is going to be 49.

5:31And if I look at my diagram, I see

5:33this is still within area 1.

5:37So I'll say 0001, then we'll get this unique identifier ending

5:42with a 3.00.

5:43Shifting gears a little bit, now we're moving on to R4.

5:46And we're breaking into the purple area,

5:49so we're going to be specifying a new area this time.

5:52Going into configuration mode, I'll say router IS-IS.

5:55The NET is going to be 49.0002 this time,

5:59and we'll give it a unique identifier within this area.

6:03So I could do something like 1 in this case

6:05if I wanted to because we're now specifying an identifier

6:08in a different area.

6:09But just to keep things nice and clean,

6:10I'm going to set this to be 4, so I know it's router 4.

6:13Now router 5, again, this is going to be in area 2.

6:17We'll say router IS-IS, and the NET 49.0002--

6:22whoop, too many zeros.

6:23There we go.

6:23We'll give this a unique identifier of 05.

6:28Oh.

6:29And it tells me-- see I accidentally

6:30hit Enter too early.

6:31It says this isn't long enough for our Cisco standards

6:35of IS-IS implementation.

6:36I got to add that dot 00 on the end to press Enter.

6:39Now I did say I was going to switch it

6:40up a little bit for router 6.

6:42Here's what I'm going to do for router 6.

6:44I'm actually going to say, show interface Ethernet 0/0,

6:48and I'm going to copy this Mac address right here.

6:51That way this will probably a real way

6:53that you implement this in the real world

6:55is based on a Mac address.

6:57So with that highlighted, this Mac address up here,

6:59I'm going to go into configuration mode.

7:01I'm going to say router IS-IS.

7:03We're going to say it's going to be in area 2,

7:06but now I'm going to paste in that Mac address and end it

7:09with 00.

7:10See this is a really clean way to handle uniquely identifying

7:13a bunch of different routers that

7:15are going to be out there in the wild is by Mac address.

7:17Now it doesn't help me in the instance

7:19that I need to figure out like-- well, is this R6 or not?

7:21But IS-IS actually has that covered

7:23with neighbor adjacencies because it

7:25collects the hostname when it forms an adjacency.

7:27It's really cool, and we're going

7:28to see that in the next couple of Nuggets.

7:30So that's been understanding what the NET, the Network

7:33Entity Title, does for us and how we can configure it

7:36on the command line.

7:37In the next few Nuggets, we're going

7:38to bring this thing to life by deploying level 1, level 2,

7:42and level 1-2 neighbor adjacencies.

7:44We'll even do some packet captures

7:46to see how this adjacency comes to life.

7:48So that's been understanding the NET,

7:49I hope this has been informative for you,

7:51and I'd like to thank you for viewing.

0:00All right, we've thrown a lot of concepts

0:02out there at this point.

0:03We've talked a lot about levels.

0:04We've talked a little bit about areas.

0:05And we've talked about how routers or ISes actually

0:09behave when they're assigned to a specific type of level

0:12or within a specific type of area.

0:14Now it's time to see it in action.

0:16What we're going to do in this Nugget

0:17is form our first neighbor adjacency

0:19between two level 1 ISes.

0:21Let's get going.

0:22Now, we did a whole lot of talking about the functionality

0:25and how IS-IS really works, only to get to this point

0:28where it's time to actually implement IS-IS.

0:31And what you're going to find out

0:32is it's a little anticlimactic because there's really

0:34only two or three commands.

0:36We've got the NET command.

0:37We've got to tell it what level it's going to operate in.

0:40And then we just turn it on on the interfaces.

0:42That's really it.

0:43What we're going to do in this Nugget

0:45is we're going to actually deploy a level 1 IS-IS

0:48relationship and validate that it comes to life.

0:51We're also going to do a packet capture

0:53when it comes time to bring this IS-IS relationship to life.

0:56So here we go.

0:57I'm back here on router 1.

0:59And what you can see here is we've done router isis.

1:01And we've given it its net address.

1:04Now what we need to do is set the is-type.

1:08If I hit question mark, you can see what our options are here.

1:11We've got level 1, level 1-2, and level 2-only.

1:15So looking at my diagram, what we want

1:17is we want router 1 to be level 1 and router 2 to be level 1.

1:22And this is where we're going to be focusing

1:24right now in this Nugget.

1:25We're just going to be bringing this relationship to life.

1:28Then we'll jump over here to router 5

1:30and router 6 and bring those level 1 relationships to life.

1:34So here we go with my is-type already typed out for me,

1:37I'm going to set this to be level 1 and press Enter.

1:40That tells R1, you are going to be a level 1 only router.

1:44And when it goes through again, all

1:46of those things that we already know about level 1 routers--

1:48they can only form adjacencies to other level 1

1:52routers within the same area.

1:54And we identify that area in the NET command.

1:57So we shouldn't have any issues bringing our router 2

2:00into the IS-IS neighbor adjacency.

2:02So just like we did before, I'm going to type is-type type

2:05level-1 right here.

2:06And now both of these routers are

2:08configured with a net, an identifier identifying

2:10their area, as well as understanding

2:13what level they're allowed to participate,

2:15and ultimately, how many databases they need to store.

2:18Now what we need to do is we need

2:19to turn IS-IS on on the specific interfaces

2:23that they want to find neighbors on.

2:24I did it this way because it's actually

2:27pretty fascinating to me how IS-IS really

2:29works under the hood.

2:31I'll go into Ethernet 0 here.

2:33And the command is ip router isis.

2:36That's it.

2:37That's it.

2:37IS-IS is now advertising level 1 hello packets out

2:42this particular interface.

2:43And before I type the command here

2:45on router 2, what I'm going to do

2:47is I'm going to start a Wireshark packet capture here

2:49with an EVE-NG.

2:51I'm going to go to capture.

2:52And I'm going to capture right there on Ethernet 0,

2:55right here.

2:56That way we can see how this neighbor adjacency

2:58comes to life.

2:59I think you're going to find this pretty fascinating.

3:02Here comes the packet capture.

3:03I'm going to click OK.

3:05And now I'm going to bring my terminal back up here.

3:08And we're going to go ahead and configure exit.

3:10We're going to go into interface ethernet 0/0.

3:12And we're going to turn ip router isis on.

3:15In the background, this IS-IS neighbor relationship

3:18should be coming to life right now.

3:19In fact, if I exit out and I give it a show isis

3:22neighbors, real quick, look at that.

3:24I already see that I've got an IS-IS neighbor

3:27adjacency showing up as up.

3:29Check this out.

3:30That system ID?

3:31See, I did tell you, it's going to grab that hostname, which

3:33I think is pretty fascinating.

3:35It also figures out which interface this is on.

3:37And it tells me what circuit I belong to, too.

3:41This is router 2.

3:42So let's jump back to the packet capture real quick

3:44and see how this neighbor adjacency came to life.

3:47I'm going to hit Stop here and filter this out by IS-IS.

3:50What's the most fascinating thing

3:52you see right here on the screen right now?

3:54It's kind of grayed out.

3:55If I hover over it, maybe you can see it a little bit better.

3:58What is so fascinating about this?

4:00Look at this-- the source and the destination,

4:03if I actually expand it a little bit right there, look at this.

4:07This neighbor adjacency and all IS-IS operations

4:11take place on layer 2.

4:13That's right.

4:13We can actually form IS-IS neighbor adjacencies

4:17without an IP address.

4:19There's no multicast happening here.

4:21There's no broadcast.

4:22It's just layer 2 connectivity.

4:24And this is actually one of the key design talking points

4:27about why you would choose IS-IS over different routing

4:30protocols because neighbor adjacencies take place

4:32without IP addresses if we want it to.

4:35I have to believe this is one of the key reasons why

4:38the developers who deployed DNA Center actually

4:40chose to deploy DNA Center because that way we could

4:43actually form neighbor adjacencies between all

4:46of our different edge or border nodes or intermediate nodes.

4:49And even if something is going wrong with the IP

4:52routing at layer 3, we can still maintain IS-IS neighbor

4:55adjacencies at layer 2.

4:57So if I expand the protocol here a little bit, what you see

5:00is we have hello packets going back and forth.

5:03Hovering over, it we see that the 01 here,

5:05this is actually the MAC address of R1.

5:07And the 02 right above it, that's the MAC address of R2.

5:11We see where the hellos have now gone back and forth.

5:14And they found each other.

5:16And then enters the LSPs.

5:18Within OSPF, we have LSAs, LSUs, LSAcks, LSDBs.

5:23We have link state updates, link state.

5:25You get the idea.

5:26We've got all of these different things.

5:28Within IS-IS, there are just LSPs--

5:30link state, which is actually PDUs, protocol data units.

5:34That's right.

5:35IS-IS is communicating these updates, again, over layer 2,

5:39using LSPs.

5:41And this adjacency came to life because we're using level 1.

5:45Again, pay very close attention to this.

5:47Because we specified that both of these devices

5:51were going to be level 1 routers,

5:52they will only send level 1 hellos.

5:55If you look in these destinations right here,

5:57they're only going to level 1 hello MAC addresses.

6:01See?

6:02IS-IS, all level 1 ISes, that's the destination.

6:06If we explore the actual LSP, you can scroll it down

6:10and you can see the different bits

6:12of data that are actually contained within the IS-IS

6:15datagram.

6:16We actually see the hostname.

6:17We see the protocols that are supported.

6:19We see the area that's given here.

6:22Beyond that, we see the IP addresses

6:24that it's connected to and their metrics associated with it.

6:27Now, what are the metrics of IS-IS?

6:29That's also another major talking point.

6:31We're going to save that as we get further along in the course

6:33because we've covered a lot right here at this point.

6:35What we're going to do now in the next Nugget is form a layer

6:372 adjacency, almost the exact same way

6:39we did here, but then do a packet capture

6:41to see how that layer 2 adjacency came to life

6:43as well just to differentiate those level 1 hellos

6:46versus those level 2 hellos.

6:47In the meantime, this has been how

6:49to get a level 1 adjacency brought to life.

6:51I hope this has been informative for you.

6:52And I'd like to thank you for viewing.

0:00Now let's mix things up and talk about inter-area communications

0:03and bring Level-2 into the mix.

0:05What we're going to do in this nugget is form level two

0:07adjacencies, between two different routers in this case,

0:10and see how the Level-2 interactions take place before

0:14we jump into the final concept, and that's going to be

0:16the Level-1-Level-2 routers.

0:18So now what we need to do is, we need

0:19to bring a Level-2 adjacency to life so that we can perform

0:22some inter-area routing.

0:23And this one's going to be a lot of fun,

0:25because this is where we'll get to see

0:27the subtle nuances of how those levels actually

0:30play in here for us.

0:31We're going to form a Level-2 adjacency right here,

0:34and this is going to be Level-2 only, just

0:37for this particular nugget.

0:38The reason why I'm doing Level-2 only is, first of all,

0:41I want to see what the Level 2 adjacency steps look like.

0:44Beyond that, I want to see what happens

0:46when we try to form this adjacency when we already

0:49R2 to be Level-1 only.

0:52This will prove to us that a Level-1 router, even if it's

0:55in the same area, won't form an adjacency to a Level-2 router.

0:59So let's jump on R3 and R4 real quick.

1:01Here I am on R3, and if I go give it

1:05a show run section isis, we'll see real quick I've only

1:08configured the net.

1:10So let's go into router isis, and we'll set the is-type

1:15to be Level-2 only.

1:17I'm going to perform the same action over here on R4.

1:20We'll go into config mode, router isis.

1:23We'll say is-type is Level-2 only.

1:27Now, if I look at my diagram real quick,

1:29I see this is going to be ethernet 0/1 on R3

1:33and ethernet 0/0 on R4.

1:36So on R3, I'm going to go into ethernet 0/1,

1:40and I'm going to turn isis on.

1:41Over here on R4, I'm going to go into ethernet 0/0,

1:45but before I turn isis on, I'm going

1:47to start the packet capture one more time.

1:49Let's capture 0/0, and the packet capture's

1:51coming to life.

1:52So here I go, I'm going to turn isis on.

1:55And I should only expect to see Level-2 data going

1:58back and forth this time, as well as the updates.

2:01As I'm watching it right here, I see the hellos and the LSPs

2:04coming up, so that means the adjacency is probably

2:07brought to life.

2:08If I hit end to give it to show isis neighbors, there we go.

2:11I see I have an up state right here with this neighbor on R3.

2:16So let's stop the packet capture and take a look

2:18at what we got here.

2:19Filtering out isis one more time,

2:22I think it's really important to point out

2:24that, because we specified this is a Level-2 only,

2:27we only see the destination addresses

2:29at layer 2 destined for the Level-2 only isis address.

2:34Here we go at layer 2, and now we have a different destination

2:38MAC address, because this is only

2:40trying to communicate and form adjacencies

2:42with Level-2 addresses.

2:44Notice that this neighbor adjacency also

2:46came to life, regardless of what the area ID was.

2:50In fact, if I go back to the command line

2:52and I say show isis neighbors detail,

2:55we can now actually see, it tells us

2:58what area the neighbor is in.

3:00This says the area address is 49.0001

3:03for our neighbor, when we, on R4, know

3:05that we are in 49.0002.

3:08So this emphasizes the point that the entire purpose

3:11of Level-2 routers is to form adjacencies

3:14between discontiguous areas, and it allows routing and neighbor

3:18adjacencies to happen between different areas.

3:22Now here's the real kicker.

3:23R3 now has a neighbor relationship

3:25right here to R3 and R4, but can it form a relationship to R2?

3:30R2 is a Level-1 router.

3:32So on R2, I'm going to go into ethernet 0/1,

3:35I'm going to turn isis on, and R3 here-- what was it?

3:39Ethernet 0/0?

3:41It sure was.

3:42I'm going to go into interface ethernet 0/0

3:44and turn on IP router isis.

3:48If I perform the packet capture here on 0/0,

3:51and filter out by isis I see Level-1 packets coming in

3:56from router 2, and Level-2 packets going out

4:00from router 3, but that's where the buck stops.

4:03All I'm seeing are hello packets being sent back and forth here.

4:06And because they don't line up with each other,

4:08because they're not Level-1 both,

4:11these two will not form a neighbor adjacency.

4:14So if I say show isis neighbors real quick,

4:16we see I still only have one neighbor adjacency,

4:19and that's at my Level-2 route.

4:21So how do we fix this problem again?

4:23We need to have packets from one area traversing

4:26to the other area.

4:27And that's where we change our is-type to be

4:30the Level-1-Level-2 routers.

4:31And that's what we're going to do in the next nugget.

4:33In the meantime, this has been understanding the Level-2

4:36communication and neighbor adjacency process.

4:38I hope this has been informative for you,

4:40and I'd like to thank you for viewing.

0:00So we've got level-1 routers, and we've got level-2 routers,

0:03or I should say ISes.

0:05And they aren't able to form that neighbor adjacency

0:08to each other.

0:08That could be a problem.

0:10We actually need to perform inter-area communications inter

0:13the level-1, level-2 IS.

0:15In this Nugget, what we're going to do

0:17is break down how the level-1, level-2 IS actually

0:20works, and see how it alters the behavior

0:23within different areas.

0:24Let's get going with that.

0:25So the final piece to the puzzle is

0:27going to be bringing the inter-area communication

0:30to life.

0:30And we know that this is kind of an issue because

0:33of the limitation of level 1.

0:34Level-1 routers, or level-1 ISes,

0:37cannot form neighbor adjacencies to level-2 ISes,

0:41though the entire point of level-2 ISes is so that we can

0:44allow traffic to go between areas.

0:46That's why our routers that are sitting

0:48on the edges of our areas actually have to run both.

0:52And they have to keep databases for both level.

0:54So that's what we're going to do in this Nugget,

0:56is we're actually going to set up and change R3 and R4, which

0:59were here on our topology, to be level-1, level-2 routers.

1:04That way they can form level-1 adjacencies within their area

1:07as well as level-2 adjacencies between areas.

1:10So here we go.

1:11On R3, since this is a lab environment,

1:13I'm just going to wipe it out-- no router isis.

1:16There we go.

1:16Now I'm going to jump back into router isis.

1:19We'll give it the net command, give it 49.0001,

1:23because R3 was in area 1.

1:25We'll say 0000.0000.0003.00.

1:29Now I'll say my IS type is level-1-2, even though that's

1:34actually the default behavior.

1:36The default behavior is to be a level-1, level-2 router

1:39and maintain two databases.

1:41Now, the issue with this is a design perspective point.

1:44You don't want to run every single router

1:46as a level-1, level-2 router, because first of all,

1:48you could bring up adjacencies that you

1:50didn't mean to bring up.

1:51But second of all, now these devices

1:53are maintaining two separate databases

1:55that could be a scalable or a CPU issue, especially

1:58on older legacy devices, too.

2:00Let's do the same thing over here on R4.

2:02We'll go into config mode.

2:05We'll go into router isis.

2:06Actually, no, we're going to say no router isis.

2:08Bye, router isis.

2:10And then we'll go back into router isis.

2:12We'll give it the net 49.0002, give it the unique address

2:18of 4.00.

2:21We'll say its IS type is going to be level-1-2, just

2:24to explicitly set that.

2:26And then on its interfaces, we'll just make sure.

2:28Let's say do show run interface ethernet 0/0.

2:31It should already be there.

2:32It's not.

2:33Interesting point.

2:34When we say no router isis, it wipes that configuration off

2:38of the ethernet addresses, too.

2:41So if I check out both of these configs

2:43on either of these ethernet addresses,

2:45guess what-- the isis command is gone,

2:46so no adjacencies are being brought up right now.

2:48So let's go into interface range ethernet 0/0-1 and say ip

2:54router isis.

2:55I'll do the same thing on R3 over here.

2:58I'll go into interface range ethernet 0/0-1 and say ip

3:04router isis.

3:05It should only take a second or two

3:07for these neighbor adjacencies to come to life.

3:09So I'll say show isis neighbors, and look.

3:12Now we have a level-1 adjacency to R2

3:16and a level-2 adjacency to R4.

3:19If I jump over here on R4, I'll say, show isis neighbors.

3:24And I see the same thing, because we set it up

3:27on the other side.

3:28We've got a level-2 adjacency to R3 and a level-1 adjacency

3:31to R5.

3:32So on R4, I can actually specify my show isis database.

3:36And look, I can even specify which

3:39database I want to look into, with the question mark.

3:41I can specify level 1 or level 2,

3:43or I can specify, give me details.

3:45You get the idea.

3:46I press Enter here, and it shows me

3:47both the level-1 link state database as well as

3:51the level-2 link state database.

3:54So R4 learns about R3 and all of the links about R3.

3:59This is another critical point, is

4:01that as traffic traverses one area to the next area,

4:04it doesn't advertise every single link

4:06or every single link state update or link state

4:09advertisement that took place in that other area.

4:12So to explain that further, here we have area 1.

4:15And there are nothing but LSPs taking place here.

4:19And R3 knows about every single link within this area.

4:23When it comes time to advertise those links to R4,

4:26it doesn't forward all of those lSPs.

4:29It's kind of like the summary LSA in OSPF.

4:33R3 just tells R4, hey, if you want

4:35to reach any of these networks, just send it to me.

4:37So R4 knows about all the networks via R3.

4:42If in fact I prove it with show ip route, look at this--

4:45you can see the level-2 routes that were learned

4:49via the level-2 communication.

4:51And this sets up the next major, major talking point,

4:54and that's what metrics does it use?

4:57How did it know that the metric was 10, 20, 30?

5:00This is kind of a crazy thing, but it's the honest truth.

5:02Every link, by default, regardless

5:05of bandwidth, regardless of delay,

5:06regardless of anything-- on a Cisco router,

5:08every single link has a metric of 10 on an IS-IS router

5:13or an IS device within Cisco programming.

5:15That's it.

5:16That's it.

5:16So as each hop it goes, it just increments by 10.

5:20That's really it.

5:20That's how it finds the best path through IS-IS.

5:23And 10 actually meets a limitation.

5:25It can only get so big, which is why, 9 times out of 10,

5:29they introduce something called wide metrics.

5:31So when you go into router isis configuration

5:33mode, what you want to do is you want

5:35to set the metric style to wide.

5:38And you want to do this on every router,

5:41so they all know they're talking the same language.

5:43We'll say metric-style wide.

5:46And I'm just going to go ahead and do this

5:47on every router in the environment,

5:49so they're all communicating with wide metrics.

5:51And then once this is all configured,

5:53we'll talk about what those wide metrics really did for us.

5:55So now if I jump back to R1 and I give it a show ip route,

5:58we'll see, well, look, there's a few interesting things here.

6:01First of all, the metric itself didn't actually change.

6:04But when we set it to wide metrics, what we're really

6:06allowing it to do is not reach that maximum metric in case

6:10it's got to go many, many, many hops away.

6:12By default, you really just want to set your metrics to be wide.

6:15That way we could support really large metrics

6:18and then define the best path that way.

6:21Beyond that, look at this.

6:23Now we have the default route that

6:25was injected because it learned that there was

6:28a level-1, level-2 boundary.

6:30Something that's worth pointing out about this.

6:33If R3 had not formed a layer-2 adjacency,

6:38it would have just continued to operate as a level-1 router

6:41only.

6:42So this default route would have never

6:44actually been injected if R3 had not

6:47formed the level-2 adjacency.

6:48But as soon as it did form the level-2 adjacency,

6:51R3 began advertising that it was a level-1, level-2 router,

6:55and then all of the devices installed a default route.

6:58So if I look on R6 real quick and I give it a show ip

7:01interface brief, I see it has the IP address of 10.100.100.2.

7:06Can R1 ping 10.100.100.2?

7:09There we go.

7:10Round-trip traffic.

7:11So that's it.

7:12That's how we actually go about configuring and implementing

7:15inter-area routing within an IS-IS domain.

7:18I hope this has been informative for you,

7:19and I'd like to thank you for viewing.

0:00So there you have it-- the basic foundations of IS-IS.

0:03We've covered things like what the levels really are,

0:06how we identify areas, especially within the net.

0:09And the different IS types or the different levels

0:13that an IS can participate in drastically

0:15alters its behavior within the actual IS-IS protocol

0:19or within the areas that they're communicating in.

0:21So that's been understanding the basics of getting IS-IS

0:24up and running.

0:25I hope this has been informative for you

0:26and I'd like to thank you for viewing.

0:00So with the IS-IS foundations in place,

0:02we now understand how IS-IS operates.

0:04We understand what the net does, how

0:07areas work, and most importantly,

0:09how the levels impact the behavior of a router.

0:12Now it's time to actually deploy IS-IS.

0:15And we have to make some very important decisions about how

0:18IS-IS is going to look with an enterprise infrastructure.

0:21That way, we can make sure that we set up

0:23the three key components to an enterprise network design.

0:26IS-IS needs to be secure, IS-IS needs to be stable,

0:30and IS-IS needs to be scalable.

0:32So by the end of this skill, we'll

0:34understand how to design and deploy

0:36an IS-IS network that is secure, stable, and scalable.

0:39Get ready.

0:40It's going to be a lot of fun as we

0:41get going with designing an IS-IS network.

0:43Let's go.

0:00Our first and arguably most important task

0:03when designing an IS-IS network is

0:05going to be making sure that it is secure.

0:06And lucky for us, designing the IS-IS security

0:10is actually pretty simple.

0:11But it is a little nuanced, too.

0:13Because IS-IS security can be set at three different layers.

0:17So by the end of this Nugget, what we'll understand

0:19is where and how we can configure IS-IS authentication

0:23and security.

0:24Let's get going.

0:24One of the top reasons that you would actually go with IS-IS,

0:28I argue, is the security aspects to it,

0:31because you can make neighbor adjacencies airtight as to who

0:35is allowed to come to life.

0:36Because we can apply security policies-- basically

0:39password authentication-- in three different spaces

0:42to control who is allowed to come up or bring neighbor

0:45adjacencies into our environment.

0:47Check this out.

0:48The first example we're going to do

0:50is we're going to specify a password is

0:52required for a neighbor adjacency

0:54to come up on a specific link.

0:57So what we're going to be looking at

0:58is applying a password to ethernet 0/0 here and ethernet

1:020/0 here.

1:04That way, R1 and R2 will only form a neighbor adjacency

1:09if a password matches on either side here.

1:12And it is worth pointing out right now that IS-IS

1:15uses HMAC-MD5 in order to encrypt the password.

1:20So that way, we have that as an option.

1:22Beyond that, we have the ability to encrypt the password

1:24within the running configuration as well,

1:26so somebody can't come along and type show

1:27run and then see the password.

1:29Now, for this case, what we're going to do

1:30is we are just going to demonstrate

1:32how we can apply a password on the interface level.

1:35And you're going to be surprised at how easy it is.

1:38Let's jump over to router 1 here.

1:40And we're going to go into configuration mode,

1:42and then interface ethernet 0/0, which is where

1:45we want to set the password.

1:46All we have to do is say isis password,

1:49and guess what-- we type in our secret password here.

1:52So let's call this password something simple like r1r2.

1:55That way we know this is the connection from router 1

1:57to router 2.

1:58When I press Enter here, this is going

2:00to start performing the authentication attempts,

2:03and it will bring down the neighbor adjacency to R2.

2:06So what I need to do now is I need

2:07to go set that password over on R2.

2:10Just to verify real quick, let's exit out, show isis neighbors,

2:14and look, we have no neighbors.

2:15If I also do show ip route, I see

2:17that I have no level-1 routes operating

2:20within my environment.

2:21So let's jump over to R2 now, and we'll

2:23go into configuration mode.

2:24I'm going to go into interface ethernet 0/0.

2:27And I'll say isis password one more time,

2:29and we said it was r1r2.

2:31If I bring that password into play here,

2:34authentication should now be taking place.

2:36And if I give it a show isis neighbors,

2:38I see my neighbor adjacency back to R1 is back up and alive.

2:42If I jump over to R1 here, let's give it a show ip route,

2:46and there we go-- my level-1 routes are now installed back

2:49into the environment.

2:50That's really cool, because now we

2:52can control on a per-link basis who is allowed to authenticate.

2:56And this really works well within the core of our network.

3:00This is where the core of our network

3:01is going to have most of our level-1, level-2 connections,

3:04or just pure level-2 connections.

3:06And that way anybody with a different area

3:09can't just jump in and connect into our network

3:11and start injecting routes into our IS-IS topology.

3:14So controlling it at the link level

3:16is going to be important for that specific instance.

3:19But beyond that, we can control authentication

3:21within an entire area as well.

3:24So let's now demonstrate how that looks on R4 and R5 and R6.

3:29We're going to be doing this in the purple section

3:31of our topology.

3:33And that way we can see that we can control authentication

3:35throughout the entire area.

3:37Let's start off with R4 and bring the area authentication

3:40into play by going into router isis mode.

3:43And the command is just area-password.

3:46That's it.

3:46So all I have to do here to say something

3:48like area2pw is going to be the password, and I press Enter.

3:52Now, of course, the authentication

3:53is going to fail between R4 and R5, which

3:57brings down that connection.

3:58Now, we haven't set up any authentication on R5 and R6.

4:01So if I say show isis neighbors, well, it still

4:04shows both are up right now because we're

4:06waiting for that neighbor adjacency hold timer

4:09to tick away.

4:10We see it's ticking down now, slowly but surely.

4:12Eventually, it will tick down, and the neighbor adjacency

4:15between R5 and R4 will go down.

4:18Because we did see that R4 is already telling us

4:20that authentication is failing, and we're no longer

4:22receiving LSPs from R5.

4:25So let's jump into R5 real quick and set that area

4:28authentication one more time with area password.

4:30We said this was area2pw.

4:32And now we're getting authentication

4:34failed on R5, because now the adjacency to R6 is failing.

4:38So to round it out, we'll jump over to R6.

4:40We'll say router isis.

4:42We'll set the area password here as area2pw.

4:46So we're not getting any more failures at this point,

4:49because we now have authentication

4:50set throughout the entire area.

4:52Remember one more time, when we set that net,

4:54the net was 49.0002.

4:58We're basically applying authentication

5:00at this spot right here.

5:03But like I said, there is a third option,

5:05and that's where we can apply it throughout the entire domain.

5:08And that's what this number, the AFI, really represents.

5:12So anywhere that we have a neighbor adjacency that

5:14begins with 49 as the area, 49-dot in that first 16 bits,

5:19we can actually apply authentication there.

5:22So now if I want to apply authentication

5:24throughout the entire domain, my entire autonomous system,

5:28we can do that, too, with-- guess

5:29what-- just the domain-password command, again

5:33within the router isis parent configuration mode.

5:36To make this nice and snappy, here's what I'm going to do.

5:38I'm going to bring up Notepad and just type router isis.

5:41We're going to say domain-password.

5:43Oh, let's do this.

5:45And I'll call it pw49, something simple like that,

5:49so we know we're talking about domain 49.

5:50So now, on every router here-- let's start with router 1.

5:54We'll go into configuration mode, type in router isis,

5:57domain-password 49.

5:59Router 2-- router isis, domain-password 49.

6:04Router 3-- oh, there we go-- router isis,

6:08domain-password 49.

6:10Just paste it in right here-- domain-password 49.

6:13Paste it in right here-- domain-password 49,

6:15and domain-password 49.

6:17If you paid attention here, you notice one thing

6:20that's very important.

6:21The authentication is cumulative.

6:24We don't have to use just one type of authentication.

6:27We can authenticate at the link level,

6:29then the area level, then the domain level.

6:32We can control authentication at all three levels

6:35at the same time.

6:36And this, to me, is the biggest argument

6:38about why you would love IS-IS, is

6:41we can secure how our neighbor adjacencies come

6:44to life at every single level, within a link, within an area,

6:48and within a domain.

6:49So when it comes to securing your environment,

6:51keep this in mind, because you may

6:53want to run link-level authentication

6:55within your core, then area-level authentication

6:58within an entire area, and then domain-level authentication

7:02throughout your entire autonomous system.

7:04So that's been securing IS-IS.

7:06I hope this has been informative for you,

7:07and I'd like to thank you for viewing.

0:00Now that we understand IS-IS security,

0:02it's time to move into the stable and scalable solutions

0:05within IS-IS.

0:06And scalability is really one of the big reasons

0:09why you go with IS-IS in the first place.

0:11Your first example is one of the most basic ones,

0:13and that's just a completely flat area.

0:15So let's talk about how a flat-area deployment of IS-IS

0:19will work, and some of the pros and cons of that.

0:21So our first real network design when

0:23we're talking about deploying IS-IS to our network

0:26is called the flat network.

0:27And in my opinion, it's a pretty fun one, for one

0:29specific reason.

0:30Watch this.

0:31Watch.

0:31Here's how the flat network works.

0:32See this purple area right here?

0:34Bye-bye.

0:35We're just going to get rid of it.

0:36There we go.

0:36And we're just going to extend area 1 out.

0:38We'll even delete the text right here so it's nice and clean.

0:41Yeah, that's it.

0:42That's the entire point of the flat network,

0:44is our network is small enough to where we don't need

0:46anything really complicated and sophisticated.

0:49We can just run one IS-IS domain and area

0:52throughout our entire network.

0:54I mean, with six routers, the most we could be talking about

0:56is maybe 100 routes or a couple hundred routes

0:58or something like that.

0:59And IS-IS could probably handle that just fine on its own

1:03with one area as long as we're not

1:05running really antiquated and dusty hardware.

1:08So the entire idea with this particular design,

1:11the flat network design with IS-IS,

1:13is just run one IS-IS domain and area

1:16throughout your entire network.

1:18Now, this begs the question, pros and cons--

1:20or more specifically, which level

1:23should we operate these devices at?

1:26Well, the gut reaction is, first of all,

1:28to just run one database, because the entire network is

1:32small.

1:33But this presents a big scalability issue.

1:37If we were to run level 1 throughout the entire network,

1:41what do we know about level 1?

1:42First of all, every router here has to be running level 1,

1:47and they have to be in the same area for a neighbor

1:51adjacency to come to life.

1:52This creates a huge scalability issue,

1:55because what happens when we expand?

1:57What happens when our tiny little business hits

2:01the gold mine and we become gigantic, and next thing we

2:03know, we're worldwide?

2:04All of a sudden, we've got an issue,

2:06because we're growing and growing and growing

2:08our database.

2:10And our couple hundred routes become a couple thousand

2:12routes, and now we have no point of our network

2:15where we could perform some form of summarization.

2:18And we have no place where we could break this down

2:21into smaller areas, because again,

2:23the requirement of level 1 is that every device

2:26has to be in the same area.

2:28So let me clear the screen out a little bit here.

2:30Let's erase all this.

2:33There we go.

2:34Get rid of that area.

2:36So then our next option becomes, well, we

2:37could do level 1 and 2.

2:40That way, by default, these devices

2:42will all form level-1 connections

2:45as long as they're in the same area

2:46and they're all running level 1, level 2.

2:48That's a good idea.

2:49And without any level-2 connections,

2:51there will be no level-2 link state database.

2:53So that's a clean way to handle it, too.

2:55But the moment you start adding in other areas into the mix

3:00and we start forming level-2 connections, now

3:04all of these routers here are maintaining two databases.

3:08Again, that might not be a huge deal,

3:10depending on how many routers and how many routes

3:12you're talking about.

3:13But running two databases, and running your Dijkstra

3:15algorithm, the same algorithm that OSPF uses,

3:18across two databases could create some CPU overhead

3:21or load on your devices.

3:23It just depends on how much traffic you actually

3:25have flowing through your particular network

3:28here if you want to run two databases.

3:30And then you've got to monitor that CPU load on these devices.

3:34So perhaps, maybe, the best level for us

3:36to actually operate on is level 2.

3:39Level 2 doesn't care what area these are operating in.

3:41They don't have to be in different areas.

3:43They can be within the same area to form a level-2 adjacency.

3:47But then we have the option of bringing

3:49in level-1, level-2 routers, and then forming

3:51different areas after the fact.

3:53This creates the scalability solution for us here.

3:57And as we'll come to find out, when

3:58it comes to designing a network, especially in the next Nugget,

4:01we always design our networks starting with the center.

4:04Whatever we have, if we already have a core network,

4:07we start there.

4:08Or if this is all we have-- it's just these six routers right

4:11here-- we pretend that this is going

4:13to be the center of our network, and we

4:15want to design it with scalability in mind.

4:17Level-2 routers bring that scalability into the table.

4:21Because that way we have one database to maintain our core,

4:24but at the same time, we can form adjacencies

4:27at different areas.

4:28Keep in mind also that we can control

4:30how those adjacencies come to life with the security content

4:32that we just covered in the last Nugget.

4:34So that's been implementing a flat network, just one area,

4:37for IS-IS.

4:37I hope this has been informative for you,

4:39and I'd like to thank you for viewing.

0:00So that flat IS-IS network was pretty basic, right?

0:03And there's not much to it.

0:04The configuration is just deploy IS-IS everywhere.

0:06What we need to do now is talk about the real world scenario

0:09there where we have a three tier hierarchy of an enterprise

0:14campus with a core, a distribution, and an access

0:16layer.

0:17How do we design IS-IS in this situation

0:19is very important when it comes to scalability.

0:22So let's fire up the topology one more time

0:24and take a look at how we could deploy an IS-IS

0:27network with a three tier enterprise architecture.

0:30So here it is, the big mama, the actual enterprise

0:33campus with three tier hierarchy that it

0:35comes to designing IS-IS.

0:37Now this is kind of a tricky thing,

0:39because IS-IS operates in two levels.

0:41And there's no real concept of a virtual link

0:44like there is in OSPF where we could

0:46link a really separated one all the way

0:48through to the backbone.

0:49Right.

0:49Here in this case, this is how we

0:51would go about designing an enterprise campus.

0:53We actually have a few different options.

0:55But option number one is really not an option at all.

0:58Start at the core.

1:00Work your way in the middle out.

1:02And always think in terms of scalability.

1:05In the core network here, this is where we

1:07want to operate at level two.

1:09Now this could be level 1-2 or just straight up level two.

1:12It's probably advisable to operate at level two.

1:16We don't really ever want level one connections or a level one

1:20database to be operating in the core

1:23because that's what these devices will prefer is a level

1:26one connection.

1:27For instance, if we had level one, level two here,

1:29and all of these are in area 0--

1:31I know this text is really small.

1:33I kind of had to shrink all of this down.

1:35I'm just going to write area zero over here.

1:37If all of these are operating in area zero,

1:39and we set all of these IS types as level one, level two,

1:44guess what happens.

1:45These all form level one connections to each other.

1:49And then when this device here forms a level two connection

1:53here and this device here forms a level two connection here,

1:56guess what happens.

1:57They all start getting default routes.

2:00And we get suboptimal routing in the mix

2:02here, whereas if they were just level two connections only,

2:06let's just erase all of this, and we

2:08say these were level two connections

2:09even if they're in the same area zero, whenever there's a level

2:13two connection that's brought in here and it stays level two,

2:16the explicit exit points for these routes

2:19are what gets propagated throughout the core.

2:21And that's exactly what we want.

2:23Now in a real world scenario, you probably

2:25wouldn't have your internet connected straight to the core

2:29because one of the kickers is that level two does not

2:32propagate any sort of default route.

2:34It only knows about explicit routes and, as a result,

2:38our core is nothing more than a transit network.

2:41This is an actual critical thing to think

2:43about is even though a core is not required like it is in OSPF

2:47with area 0, the backbone area, when it comes to a three tier

2:51hierarchy, it's almost guaranteed

2:53that you need to have some sort of core.

2:55You need to have some sort of backbone area.

2:57And you don't have to call it area zero,

2:59but it's nice and easy to call it

3:00area zero because that's what everybody learned

3:02when we learned OSPF coming up.

3:04Right?

3:05So in this case, we have a core.

3:06And we have area zero.

3:08Now what we're going to focus in on is the distribution layer.

3:11That's what these little kind of like white blocked

3:13out shaded areas are here.

3:15These are going to be our distribution layers.

3:17And in our distribution layer, this

3:19is where we're going to be running level one, level two.

3:22So in the core, we have level two.

3:24And these are area zero.

3:25In the distribution layer, we're going

3:27to be running level one, level two.

3:28In my green section here, I've got area two.

3:31So this switch right here, and this

3:33switch right here, and this connection here,

3:36and this connection here, these will form a level two

3:39adjacency.

3:40But these adjacencies all throughout this section

3:43here, these are all going to be level one adjacencies.

3:47So my switches down here in the access layer

3:49will receive the default routes, because the level one/level two

3:54devices will advertise what is called the ATT bit.

3:57ATT bit says I am your exit point to get out of the area.

4:01The same thing happens over here in area one.

4:04Within the distribution layer here, area one

4:07will form level two adjacencies to all of the core uplinks.

4:11Then it will form level one adjacencies

4:13to all of the access layer.

4:15And each of these access layers will

4:16see the ATT bit was set by the distribution layer.

4:19And it will know that its two default exit

4:21points are going to be the devices in the distribution

4:24layer.

4:25The big thing to think about here

4:26is how desktop 25 can ping desktop 26.

4:30In the access layer, we may be running multiple VLANs

4:34so we run IS-IS on the interface VLAN.

4:36This device will communicate to its default gateway who

4:39will see a default route to either one

4:41of these distribution layers who will then

4:43have the explicit level two routes on how

4:46to get down into area two.

4:48So it'll punt it up to the core, who

4:50will route it down to the other distribution layer, who

4:52will then have a specific level one route on how

4:54to get to desktop 26.

4:56So there's a lot of writing going on the screen here.

4:58What you should really be thinking about

5:00is just looking at this at three areas at a time

5:04even though there's four on the screen.

5:06The idea, most importantly, is the area zero, the core layer,

5:10is nothing more than just a transit layer.

5:12So if area one wants to get to area three,

5:16it's just going to jump into the transit layer or core zero

5:19and then route its way up to area three.

5:22If area two wants to get to area three, it does the same thing.

5:25There's a level one route proceeded by level two routes

5:30proceeded by a level one route.

5:32So when you think about the enterprise campus

5:34and how there could be three different layers,

5:36you've got to think clearly about where are my level one,

5:39level two routers going to exist first of all.

5:41We've got level two in the core, level one,

5:44level two at the distribution, and then level one

5:47at the access layer.

5:49And communications that take place between areas

5:52are going to go through a transit campus fabric

5:55here like the area zero here.

5:57And at the border of each of my edge areas,

6:00we're going to have level one, level two, whereas in the core

6:02we're probably just going to have level two.

6:04So whether it's going from green to red,

6:07red to green, green to yellow, yellow to green, red to yellow,

6:12yellow to red, you get the idea.

6:15We're just talking about going through the steps of level one

6:17to level 1-2 to level two to level 1-2 to level one.

6:21That's how IS-IS logically flows.

6:24And this is why we have those different levels

6:26that we learned about in the previous skill.

6:28Level zero to level one to level two.

6:30And then level three if we ever need

6:31to talk outside of our domain or autonomous system.

6:35So this is how the campus design is

6:37going to work in a three tier enterprise campus hierarchy.

6:39I hope this has been informative for you.

6:41And I'd like to thank you for viewing.

0:00So that three-tier hierarchy where

0:01we have the core at level two, then the distribution layers

0:05at level one, two, and then the access layer

0:06is at level one, that's probably honestly,

0:09the best most scalable way that you

0:11could deploy an IS-IS network.

0:13But there is a situation where you're kind of in the middle.

0:15You don't need a flat network, but you don't have

0:17anything that sophisticated.

0:19Maybe you actually have a collapsed core architecture.

0:21What we can then do is use a hybrid IS-IS network.

0:25Let's talk about how the hybrid design really works.

0:28So now is the part where we get into the hybrid design,

0:30where our campus is growing and it's sophisticated,

0:33but it's not this sophisticated.

0:35We may have a collapsed core situation here,

0:38where we don't actually have a core layer at all.

0:40Our distribution layers are all connected directly

0:43to each other, and it would look something kind of like this.

0:46Watch as here's how I'm just going

0:48to redesign this little topology real quick.

0:51So with a hybrid environment, or a collapsed core,

0:53we don't have a core, and therefore we can basically just

0:57right-click on the blue section here and just wipe it out.

1:00Watch us.

1:01Bye.

1:01And here's what we're looking at when we talk

1:03about the hybrid environment.

1:05See, I'm just going to drag this up here.

1:09And if I can grab this corner--

1:10It's kind of tough.

1:11There we go.

1:12Just like this.

1:13And I'll do the same thing with the green.

1:16And I'll drag it like this.

1:19And I'll do the same thing with the--

1:20Oh, this is going to be a little bit tougher, isn't it?

1:22Let's grab the yellow, and drag it kind of like this.

1:25That's the idea with a collapsed core, or a hybrid network.

1:29This is how it works.

1:30Instead of just running level two throughout the entire core,

1:34what we've done is we've effectively

1:36pushed our level one, level two configs up here

1:39to what was the core.

1:41So now we run level one, level two on these devices.

1:45Here we go.

1:46And the rest of our domain is just level one,

1:49or I should say the rest of these areas

1:51are just level one throughout.

1:52So really, our distribution layer looks something

1:55more along the lines of this, and our environment now

1:59looks like this.

2:00We have a hybrid setup because there is, again,

2:03no need for a backbone or an area zero within IS-IS.

2:08We can just literally link any area together

2:11as long as there is layer two inter-area communications

2:13allowed.

2:14Now of course, this brings up pros and cons.

2:17Why do this?

2:17Why not go with the core environment?

2:19Well, of course, again, we go back to the fact

2:21that maybe we don't have a core.

2:23Maybe we only have distribution layers,

2:25and this might be the cleanest way

2:27to separate our areas from each other without having

2:30to pass through a transit fabric, or a core network,

2:32that we don't even have yet.

2:34This, of course, moves our summarization points up

2:37to these nodes, too.

2:39See, in this case, area one is 192 1681.

2:42In this case, area two is 192 1682.

2:44What we would want to do is we would

2:46want to summarize on these links, that

2:49go out of our area domains now at this point, and also

2:53this way, too.

2:54Whereas before, our summarization

2:56would have been performed at the distribution layer

2:58before it reached the core in the first place.

3:00So our core devices now are actually

3:02more like core distribution devices,

3:05and they're going to be maintaining two databases.

3:07And the level one databases will now be bigger.

3:10These devices will now hold more routes

3:12because they're going to learn about all of the routes

3:15within the level one area, as opposed

3:17to being summarized one layer down.

3:20This does offer a simpler deployment though, of course.

3:22We don't have to build out a core,

3:24but it also makes scaling and adding

3:26areas a little more complicated.

3:28Because now, what if we bring in an area over here,

3:30and an area over here?

3:32We don't have a core that they can attach right into and then

3:35spread and propagate the routes through.

3:38So the hybrid environment is going

3:39to be one of those in the middle, or in between,

3:41a flat or a three-tier hierarchy.

3:44Just keep in mind where we're pushing the level one,

3:46level two boundaries in this scenario.

3:48Given the opportunity, it's going

3:50to be best or preferable to have a transit or a core area.

3:55That way we could go from one area,

3:57through the transit to the second area,

3:59with borders of level one, level two right

4:01on the borders of those areas.

4:03That's how the preferable way, or the preferable design,

4:06for an IS-IS network would work.

4:08So that's been the hybrid IS-IS network.

4:10I hope this has been informative for you,

4:11and I'd like to thank you for viewing.

0:00So there you have it.

0:00We have wrapped up our journey through IS-IS.

0:03We now understand not only the foundations of how IS-IS works,

0:06but also, how we can design it in different types of networks,

0:09and beyond that, secure it, which

0:11is a very important aspect.

0:12So that's been understanding how you

0:13can deploy IS-IS in a three-tier hierarchy, a flat hierarchy,

0:17a hybrid hierarchy, and secure in the mix.

0:19I hope this has been informative for you,

0:21and I'd like to thank you for viewing.