IS-IS for ISPs. ISP Workshops

Transcription

1 IS-IS for ISPs ISP Workshops These materials are licesed uder the Creative Commos Attributio-NoCommercial 4.0 Iteratioal licese ( Last updated 21 st April

2 Ackowledgemets p This material origiated from the Cisco ISP/IXP Workshop Programme developed by Philip Smith & Barry Greee p Use of these materials is ecouraged as log as the source is fully ackowledged ad this otice remais i place p Bug fixes ad improvemets are welcomed Please workshop (at) bgp4all.com Philip Smith 2

3 Cofigurig IS-IS i Cisco IOS p Startig IS-IS i Cisco IOS Where the optioal ame ca specify the ame of the ISIS process p IS-IS ame is uique to the router router isis [ame] Gives possibility of ruig multiple istaces of IS-IS o oe router IS-IS process ame is ot passed betwee routers i a AS Some ISPs cofigure the IS-IS ame to be the same as their BGP Autoomous System Number, e.g. router isis as64510

4 Cofigurig IS-IS i Cisco IOS p Oce IS-IS started, the other essetial cofiguratio uder the IS- IS process icludes: Capture adjacecy chages i the system log log-adjacecy-chages Set metric-style to wide moder & scalable metric-style wide Set IS type to level 2 oly (router-wide cofiguratio) is-type level-2-oly Set NET address et <loopback>.00 4

5 Addig iterfaces to IS-IS p To activate IS-IS o a iterface: iterface HSSI 4/0 ip router isis isp-bb p To disable IS-IS o a iterface: router isis isp-bb passive-iterface GigabitEtheret 0/0 Disables CLNS o that iterface Puts the iterface subet address ito the LSDB No eed for redistribute coected p No IS-IS cofiguratio for a iterface: No CLNS is ru o iterface, o iterface subet i the LSDB 5

6 Addig iterfaces to IS-IS p Scalig IS-IS: passive-iterface default Disables IS-IS processig o all iterfaces apart from those marked as opassive Places all IP addresses of all coected iterfaces ito IS-IS p NB. This is NOT the same behaviour as for OSPF There must be at least oe o-passive iterface: router isis isp-bb passive-iterface default o passive-iterface GigabitEtheret 0/0! iterface GigabitEtheret 0/0 ip router isis isp-bb 6

7 Origiatig a default route p IS-IS ca origiate a default route Ucoditioally (i.e. always) with: router isis isp-bb default-iformatio origiate Coditioally (for example, if BGP istalls default route ito RIB, IS-IS ca propagate this default across the backboe): router isis isp-bb default-iformatio origiate route-map DEFAULT-ORIG! ip prefix-list DEFAULT permit /0! route-map DEFAULT-ORIG permit 10 match ip address prefix-list DEFAULT NB. This is NOT the same behaviour as for OSPF 7

8 L1/L2 example L1L2 routers B C Area Area Router B iterface Loopback0 ip address ! iterface POS2/0/0 ip address ip router isis isis circuit-type level-2! iterface FastEtheret4/0/0 ip address ip router isis isis circuit-type level-1! router isis passive-iterface Loopback0 et A Router A L1routers iterface Loopback0 ip address ! iterface FastEtheret0/0 ip address ip router isis! router isis is-type level-1 passive-iterface Loopback0 et D 8

9 L1/L2 example L1L2 routers B C Area Area Router C iterface Loopback0 ip address ! iterface POS1/0/0 ip address ip router isis isis circuit-type level-2! iterface GigabitEtheret3/0 ip address ip router isis isis circuit-type level-1! router isis passive-iterface Loopback0 et A Router D L1routers iterface Loopback0 ip address ! iterface GigabitEtheret6/0 ip address ip router isis! router isis is-type level-1 passive-iterface Loopback0 et D 9

10 Status Commads i IS-IS p How to show the global CLNS status as see by the router: router1>show cls Global CLNS Iformatio: 3 Iterfaces Eabled for CLNS Cofiguratio Timer: 60, Default Holdig Timer: 300, Packet Lifetime 64 ERPDU's requested o locally geerated packets Ruig IS-IS i IP/IPv6-oly mode (CLNS forwardig ot allowed) NET:

11 Status Commads i IS-IS p How to show the eighbour adjacecies as see by the router: router1>show cls eigh Tag workshop: System Id Iterface SNPA State Holdtime Type Protocol Router2 Fa0/0 ca01.420f.0008 Up 7 L2 M-ISIS Router3 Se1/0 *HDLC* Up 29 L2 M-ISIS Router13 Fa0/1 ca0c Up 7 L2 M-ISIS p More recet IOSes replace system ID with router hostame much easier troubleshootig 11

12 Status Commads i IS-IS p How to show the CLNS status o a router iterface: router1>show cls iterface fast 0/0 FastEtheret0/0 is up, lie protocol is up Checksums eabled, MTU 1497, Ecapsulatio SAP ERPDUs eabled, mi. iterval 10 msec. CLNS fast switchig eabled CLNS SSE switchig disabled DEC compatibility mode OFF for this iterface Next ESH/ISH i 17 secods Routig Protocol: IS-IS (workshop) Circuit Type: level-2 Iterface umber 0x0, local circuit ID 0x1 Level-2 Metric: 2, Priority: 64, Circuit ID: Router2.01 DR ID: Router2.01 Level-2 IPv6 Metric: 2 Number of active level-2 adjacecies: 1 Next IS-IS LAN Level-2 Hello i 4 secods 12

13 Status Commads i IS-IS p How to display the status of the CLNS protocol o the router: router1#show cls protocol IS-IS Router: workshop System Id: IS-Type: level-2 Maual area address(es): Routig for area address(es): Iterfaces supported by IS-IS: Serial1/0 - IP - IPv6 - IPv6 FastEtheret0/1 - IP - IPv6 - IPv6 FastEtheret0/0 - IP - IPv6 - IPv6 Passive iterface: Loopback0 Redistribute: static (o by default) Distace for L2 CLNS routes: 110 Geerate wide metrics: level-2 Accept wide metrics: level-2 13

14 Other status commads p Shows CLNS traffic statistics ad activity for the etwork show cls traffic p Shows the IS-IS lik state database show isis database p Shows the IS-IS routig table show isis rib 14

15 Network Desig Issues p As i all IP etwork desigs, the key issue is the addressig lay-out p IS-IS supports a large umber of routers i a sigle area p Whe usig areas, use summary-addresses p >400 routers i the backboe (L2) is quite feasible today 15

16 Network Desig Issues p Lik cost Default o all iterface is 10 (Compare with OSPF which sets cost accordig to lik badwidth) Maually cofigured accordig to routig strategy p Summary address cost Equal to the best more specific cost Plus cost to reach eighbour of best specific p Backboe has to be cotiguous Esure cotiuity by redudacy p Area partitioig Desig so that backboe ca NOT be partitioed 16

17 Scalig Issues p Areas vs. sigle area Use areas where p Sub-optimal routig is ot a issue p Area would have oe sigle exit poit p Startig with L2-oly everywhere is a good choice Future implemetatio of level-1 areas for etwork edges will be easier Backboe cotiuity is esured from start 17

18 Narrow to Wide Metrics Trasitio p Whe migratig from arrow to wide metrics, care is required Narrow ad wide metrics are NOT compatible with each other Migratio is a two stage process, usig the trasitio keyword p Networks still usig arrow metrics should first cofigure trasitio metrics across all routers: router isis isp metric-style trasitio p Oce the whole etwork is chaged to trasitio support, the metric style ca be chaged to wide: router isis isp metric-style wide 18

19 ISP best commo practices (1) p NET address costructio p L2 Area ad loopback address Cofigure globally i IS-IS process L1-L2 ad L1 ca be used later for scalig large etworks p Wide metrics Narrow metrics are too limitig Needed for IPv6 ayway p Poit-to-poit liks usig broad-cast media Declare as poit-to-poit 19

20 ISP best commo practices (2) p Set over-load bit to wait for BGP Vital o router restart to avoid blackholig trasit traffic p Deployig IPv6 i additio to IPv4 Recommedatio: for greefield deploymets, use sigletopology (IOS default) uless a icremetal roll-out of IPv6 is iteded Multi-topology is useful (IOS-XR default) for a icremetal rollout, ad if there should be future differeces i topology betwee IPv4 ad IPv6 20

21 Advaced IS-IS Cofiguratio (for experts oly) Developed by Mark Tika & Philip Smith 21

22 Purgig the RIB o lik failure p For routig protocols that are capable of respodig to lik failures, IOS allows such routig protocols to quickly ad more efficietly delete associated routes from the RIB whe a lik, ad the iterface is removed from the routig table p Without this commad, the "less efficiet" RIB process is used to delete the associated ext-hop routes of the failed iterface, by default If this process has to work through a very large routig table, it ca use up a umber of CPU cycles ad potetially icrease covergece time. ip routig protocol purge iterface 22

23 IS-IS eighbour autheticatio p Create key chais to be used for HMAC-MD5 autheticatio for both Level-1 ad Level-2 key chai isis-level1 key 1 key-strig xxxxx! key chai isis-level2 key 1 key-strig xxxxx 23

24 Settig up Loopback Iterface p Create the Loopback iterface/router-id It will NOT have IS-IS ruig o it because it is ot a trasit iterface Disablig IS-IS o it, while aoucig the IP prefixes ito IS-IS, allows the IS-IS domai to scale because LSP/Hello packets are ot uecessarily geerated for the Loopback iterface A IS-IS metric will NOT be set, which will default the Loopback iterface's metric to zero (0) iterface loopback0 ip address ipv6 address 2001:db8::192:168:0:1/128 24

25 Level-1 Iterface Cofiguratio p Cofigure addresses ad eable IS-IS for IPv4 ad IPv6 iterface gigabitetheret0/1 ip address ipv6 address 2001:db8:192:168:1:1/112! ip router isis 1 ipv6 router isis 1 p Esure this iterface rus at Level-1 iterface gigabitetheret0/1 isis circuit-type level-1 25

26 Level-1 Iterface: Metrics & Auth p Set the costs for IPv4 ad IPv6 iterface gigabitetheret0/1 isis metric 400 level-1 isis ipv6 metric 400 level-1 p Eable HMAC-MD5 for level-1 isis autheticatio mode md5 level-1 p Associate the key-chai defied earlier isis autheticatio key-chai isis-level1 level-1 26

27 Level-1 Iterface: DIS ad BFD p Set this IS (router) to be the DIS i this Level-1 area A DIS of 126 (higher tha the default of 64) cofigured o aother IS i this area sets it up as the backup DIS iterface gigabitetheret0/1 isis priority 127 level-1 p Eable BFD for fast failure detectio BFD helps reduce the covergece times of IS-IS because lik failures will be sigalled much more quickly iterface gigabitetheret0/1 bfd iterval 250 mi_rx 250 multiplier 3 27

28 Level-2 iterface p This iterface is used for a truk lik to aother PoP formig part of your etwork-wide backboe As such it will be a Level-2 iterface, makig this router a Level- 1/Level-2 IS. Metric ad autheticatio are all cofigured for Level-2 iterface gigabitetheret0/2 ip address ipv6 address 2001:db8::192:168:2:1/126 ip router isis 1 ipv6 router isis 1 isis circuit-type level-2-oly isis metric 400 level-2 isis ipv6 metric 400 level-2 isis autheticatio mode md5 level-2 isis autheticatio key-chai isis-level2 level-2 28

29 Level 2 iterface: more details p To make this IS-IS BCP more iterestig, we will assume this truk lik is a broadcast multi-access lik, i.e., Etheret. p As this is a Etheret iterface, IS-IS will attempt to elect a DIS whe it forms a adjacecy Because it is ruig as a poit-to-poit WAN lik, with oly 2 IS's o the wire, cofigurig IS-IS to operate i "poit-to-poit mode" scales the protocol by reducig the lik failure detectio times Poit-to-poit mode improves covergece times o Etheret etworks because it: p p p Prevets the electio of a DIS o the wire, Prevets the floodig process from usig CSNP's for database sychroizatio Simplifies the SPF computatios ad reduces the IS's memory footprit due to a smaller topology database. iterface GigabitEtheret0/2 isis etwork poit-to-poit 29

30 IS-IS Process p Cofigure parameters specific to the IS-IS routig protocol This covers both IPv4 ad IPv6, as IS-IS supports both IP protocols i the same implemetatio router isis as100 30

31 IS-IS Process p Create a NET for the IS-IS process: This is made up of: p a private AFI (49) p a area part p a System ID (take from the padded Loopback iterface IP address), ad p a N-SEL of zero (0) et

32 IS-IS Process p Uder the IS-IS process eable HMAC-MD5 autheticatio: autheticatio mode md5 autheticatio key-chai isis-level1 level-1 autheticatio key-chai isis-level2 level-2 32

33 Advaced Cofiguratio p Eable ispf (icremetal SPF). This, i the log ru, reduces CPU demad because SPF calculatios are ru oly o the affected chages i the SPT. As this is a Level-1/Level-2 router, eable ispf at both levels 60 secods after the commad has bee etered ito the cofiguratio. Note that IOS oly supports ispf for IPv4. ispf level

34 Advaced Cofiguratio p Eable wide/exteded metric support for IS-IS. IOS, by default, supports arrow metrics, which meas you ca defie cost values betwee This is ot scalable. To solve this problem, eable wide metrics, which allows you to defie cost values betwee metric-style wide 34

35 Advaced Cofiguratio p Icrease IS-IS default metric Default value is 10 All iterfaces i both L1 ad L2 have this value Not useful if cofigured value is accidetally removed a low priority iterface could ed up takig full load by mistake Cofigure a very large value as default metric

36 Advaced Cofiguratio p Disable IIH paddig O high speed liks, it may strai huge buffers O low speed liks, it may waste badwidth ad affect other time sesitive applicatios, e.g., voice. Disablig IIH paddig is safe because IOS will still pad the first 5 IIH's to the full MTU to aid i the discovery of MTU mismatches o hello paddig 36

37 Advaced Cofiguratio p Allow the Loopback iterface IP address to be carried withi IS-IS, while prevetig it from beig cosidered i the floodig process passive-iterface Loopback0 p Log chages i the state of the adjacecies. log-adjacecy-chages 37

38 Advaced Cofiguratio p Tell the IS to igore LSP's with a icorrect data-lik checksum, rather tha purge them Purgig LSP's with a bad checksum causes the iitiatig IS to regeerate that LSP, which could overload the IS if perpetuated i a cycle So rather tha purge them, igore them. igore-lsp-errors 38

39 Advaced Cofiguratio p Reduce the amout of cotrol traffic, coservig CPU usage for geeratio ad refreshig of LSP's. Do this by icreasig the LSP lifetime to its limits. max-lsp-lifetime p Reduce the frequecy of periodic LSP floodig of the topology, which reduces lik utilizatio This is safe because there other mechaisms to guard agaist persistece of corrupted LSP's i the LSDB. lsp-refresh-iterval

40 Advaced Cofiguratio p Customize IS-IS throttlig of SPF calculatios. Good for whe you also use BFD for IS-IS. These are recommeded values for fast covergece. spf-iterval p Customize IS-IS throttlig of LSP geeratio. These are recommeded values for fast covergece. lsp-ge-iterval

41 Advaced Cofiguratio p Customize IS-IS throttlig of PRC calculatios. PRC calculates routes without performig a full SFP calculatio. This is doe whe a chage is sigaled by aother IS, but without a correspodig chage i the basic etwork topology, e.g., the eed to reistall a route i the IS-IS RIB. These are recommeded values for fast covergece. prc-iterval

42 Advaced Cofiguratio p Eable IS-IS fast-floodig of LSP's. This tells the IS to always flood the LSP that triggered a SPF before the router actually rus the SPF computatio. This commad used to be 'ip fast-covergece' ad has sice bee replaced from IOS 12.3(7)T. Below, we shall tell the IS to flood the first 10 LSP's which ivoke the SPF before the SPF computatio is started fast-flood 10 42

43 Advaced Cofiguratio p Eable IS-IS IETF Graceful Restart. This esures a IS goig through a cotrol plae switchover cotiues to forward traffic as if othig happeed Software ad platform support is limited, so check whether your particular platform/code supports this Also, deploy oly if it's ecessary. sf ietf 43

44 Advaced Cofiguratio p Eable BFD support for IS-IS. With BFD ruig o the iterface, a failure of the lik would sigal IS-IS immediately IS-IS will the coverge accordigly. bfd all-iterfaces 44

45 Advaced Cofiguratio p Tell IS-IS to igore the attached bit The Attached bit is set whe a L1/L2 IS lears L1 routes from other L1 routers i the same area The Attached bit causes the istallatio of a IS-IS-leared default route i the IS-IS RIB o L1 routers i the same area, as well as i the forwardig table if IS-IS is the best routig protocol from which the default route was leared this ca lead to suboptimal routig. igore-attached-bit 45

46 Advaced Cofiguratio p Wait util ibgp is ruig before providig trasit path set-overload-bit o-startup wait-for-bgp Avoids blackholig traffic o router restart Causes IS-IS to aouce its prefixes with highest possible metric util ibgp is up ad ruig Whe ibgp is ruig, ISIS metrics retur to ormal, make the path valid 46

47 Advaced Cofiguratio p Eable the IPv6 address family for i IS-IS. address-family ipv6 p Eable multi-topology support for IPv6 i IS-IS. Multi-topology support allows the IPv4 etwork topology to be idepedet of that of IPv6 multi-topology 47

48 Advaced Cofiguratio p Thigs to cosider o routers operatig as Level-1-oly IS's: IS-IS BCP techiques uder the IS-IS routig process I additio to the iterface, tell the IS-IS routig process to operate i a Level-1 area oly router isis 1 is-type level-1 48

49 Advaced Cofiguratio p Thigs to cosider o routers operatig as Level-1 ad Level-2 IS s: To prevet sub-optimal routig of traffic from L1 IS's i oe area to L1 IS's i aother area, cofigure ad eable Route Leakig o L1/L2 routers that form the backboe coectivity betwee two or more differet areas Route Leakig permits L1/L2 routers to istall L1 routes leared from oe area ito L1 IS s routig/forwardig tables i aother area This allows for reachability betwee L1 routers located behid L1/L2 routers i differet areas router isis 1 redistribute isis ip level-2 ito level-1 route-map FOO! ip prefix-list foo permit /0 le 32! route-map FOO permit 10 match ip address prefix-list foo 49

50 Advaced Cofiguratio p Doig the same for IPv6: router isis 1 address-family ipv6 redistribute isis level-2 ito level-1 route-map FOO6! ip prefix-list foo6 permit ::/0 le 128! route-map FOO6 permit 10 match ipv6 address prefix-list foo6! 50

51 Advaced Cofiguratio p Summary Best practice recommedatios are commoly implemeted o may ISP backboes Esures efficiet ad scalable operatio of IS-IS 51

52 IS-IS for ISPs ISP Workshops 52