JNCIE-SP Notes: ISIS IGP SP Core Routing

You’ll need to configure the interfaces used for family iso, add a net address to the loopback interface, and configure the protocol itself. The NET (Network Entity Title) address uniquely identifies the router in the ISIS domain.

Configure ISIS Globally and on Interfaces

set interfaces lo0 unit 0 family iso address 49.0001.1921.6800.1001.00
set interfaces lo0 unit 0 family inet address 192.168.1.1/32
set interfaces ge-0/0/0 unit 0 family iso
set interfaces ge-0/0/1 unit 0 family iso

set protocols isis level 1 disable
set protocols isis level 2 wide-metrics-only
set protocols isis interface ge-0/0/0.0
set protocols isis interface ge-0/0/1.0
set protocols isis interface lo0.0 passive

NET Address Format: 49.0001.1921.6800.1001.00

• 49 = Private AFI
• 0001 = Area ID
• 1921.6800.1001 = System ID (typically derived from router ID/loopback)
• 00 = NSEL (always 00 for routers)

Verification:

show isis interface
show isis adjacency
show isis database
show route protocol isis

ISIS operates at Level 1 (intra-area), Level 2 (inter-area/backbone), or both. Configure levels globally and per-interface.

Configure an interface as point to point (guaranteed to see on the exam)

set protocols isis interface ge-0/0/1.0 point-to-point

Configure Level 2 Only (Typical for SP Core)

set protocols isis level 1 disable

Configure Level 1/Level 2 (Border Router), optionally enable wide metrics for only a specific level

set protocols isis level 1 wide-metrics-only
set protocols isis level 2 wide-metrics-only
set protocols isis interface ge-0/0/2.0 level 1 metric 50
set protocols isis interface ge-0/0/2.0 level 2 disable

Verification:

show isis interface detail
show isis adjacency detail

Wide metrics support larger values (up to 16,777,215) compared to narrow metrics (max 63). Modern networks should use wide metrics, you will more than likely see this requirement on the exam.

Configure Wide Metrics

set protocols isis level 2 wide-metrics-only

Configure Different Metrics per Level and interface

set protocols isis interface ge-0/0/1.0 level 1 metric 100
set protocols isis interface ge-0/0/1.0 level 2 metric 200
set protocols isis interface ge-0/0/2.0 level 1 metric 1000
set protocols isis interface ge-0/0/2.0 level 2 metric 2000

Verification:

show isis interface detail
show isis database extensive

ISIS supports authentication at multiple levels: set on the interface (hellos) and set on the isis level (LSPs/SNPs). You can use MD5 or simple passwords, and can also use key-chains.

Configure Interface Authentication (Hello Packets)

set protocols isis interface ge-0/0/0.0 level 2 hello-authentication-key "$9$abc123def456"
set protocols isis interface ge-0/0/0.0 level 2 hello-authentication-type md5

Configure Level Authentication (LSP/SNP Packets)

set protocols isis level 2 authentication-key "$9$xyz789ghi012"
set protocols isis level 2 authentication-type md5

Configure Authentication with key-chains

set security authentication-key-chains key-chain isis-auth key 1 secret "$9$secure123"
set security authentication-key-chains key-chain isis-auth key 1 start-time "2024-01-01.00:00:00 +0000"

set protocols isis level 2 authentication-key-chain isis-auth
set protocols isis interface ge-0/0/0.0 level 2 hello-authentication-key-chain isis-auth

Verification:

show isis authentication
show security authentication-key-chains

Tune ISIS convergence by adjusting hello intervals, hold times, and SPF calculation timers. Although I’m not sure how likely it is to need these for the exam (I usually try not to change them in the real world), I want to include it just incase and for reference.

Configure Hello and Hold Timers

set protocols isis interface ge-0/0/0.0 level 2 hello-interval 3
set protocols isis interface ge-0/0/0.0 level 2 hold-time 9

Configure SPF Timers

set protocols isis spf-options delay 50
set protocols isis spf-options holddown 5000
set protocols isis spf-options rapid-runs 3

Verification:

show isis interface detail

Set the overload bit to signal that the router should not be used for transit traffic (useful during maintenance or startup).

Configure Overload Bit

set protocols isis overload

Configure Overload with Timeout

set protocols isis overload timeout 300

Configure Overload on Startup

set protocols isis overload timeout 180

Verification:

show isis overview
show isis database detail

Disable the attached bit so that a L1 area doesn’t receive a default route

Configure the attached bit to be ignored

set protocol isis ignore-attached-bit

Verification:

show route

Leak routes between ISIS levels (typically L2 to L1) to enable connectivity across areas (this is almost guaranteed to be on the exam).

Configure L2 to L1 Route Leaking

set policy-options policy-statement leak-to-l1 term 1 from protocol isis
set policy-options policy-statement leak-to-l1 term 1 from level 2
set policy-options policy-statement leak-to-l1 term 1 to level 1
set policy-options policy-statement leak-to-l1 term 1 then accept

set protocols isis export leak-to-l1

Verification:

show route protocol isis
show isis database level 1 extensive

Control route redistribution and filtering with export and import policies, can mix with the above to control what routes are leaked (leak only loopback addresses to L1?).

Redistribute Static Routes into ISIS

set policy-options policy-statement static-to-isis term 1 from protocol static
set policy-options policy-statement static-to-isis term 1 then accept

set protocols isis export static-to-isis

Inject Default Route into ISIS

set policy-options policy-statement default-route term 1 from route-filter 0.0.0.0/0 exact
set policy-options policy-statement default-route term 1 then accept

set protocols isis export default-route

Filter ISIS Routes

set policy-options policy-statement filter-isis term 1 from protocol isis
set policy-options policy-statement filter-isis term 1 from route-filter 192.168.0.0/16 orlonger
set policy-options policy-statement filter-isis term 1 then reject
set policy-options policy-statement filter-isis term 2 then accept

set protocols isis import filter-isis

Verification:

show route protocol isis
show policy policy-name

Configure multi-topology ISIS to support both IPv4 and IPv6 in a single ISIS instance.

Configure IPv6 Support

set interfaces lo0 unit 0 family inet6 address 2001:db8::1/128

set interfaces ge-0/0/0 unit 0 family inet6 address 2001:db8:12::1/64

set protocols isis interface ge-0/0/0.0 family inet6
set protocols isis interface lo0.0 family inet6

set protocols isis topologies ipv6-unicast

Verification:

show isis interface
show isis database
show route table inet6.0 protocol isis

Enable BFD (Bidirectional Forwarding Detection) for sub-second failure detection with ISIS, instead of messing with the protocol timers, this is my preferred method of enabling faster failover! BFD is a must know.

Configure BFD

set protocols isis interface ge-0/0/0.0 level 2 bfd-liveness-detection minimum-interval 300
set protocols isis interface ge-0/0/0.0 level 2 bfd-liveness-detection multiplier 3

Verification:

show bfd session
show isis interface detail

Enable detailed logging for ISIS troubleshooting.

Configure Traceoptions

set protocols isis traceoptions file isis-trace size 10m files 5
set protocols isis traceoptions flag adjacency
set protocols isis traceoptions flag hello
set protocols isis traceoptions flag lsp
set protocols isis traceoptions flag route
set protocols isis traceoptions flag spf

Verification:

show log isis-trace
monitor start isis-trace

show isis overview
show isis adjacency
show isis adjacency detail
show isis interface
show isis interface detail
show isis database
show isis database detail
show isis database extensive
show isis hostname
show isis route
show isis spf log
show route protocol isis
show route protocol isis table inet.0
show route protocol isis table inet6.0