IS-IS authentication, redistribution, summarisation, filtering and route leaking

Authentication

IS-IS can authenticate two different things, and you normally do both:

• Hello (IIH) authentication per interface, which stops unknown routers becoming neighbours.
• LSP and SNP authentication per level (area authentication for level 1, domain authentication for level 2), which stops forged link-state information spreading even through a legitimate neighbour.

Cisco IOS supports clear text and HMAC-MD5 through key chains, and newer releases also support HMAC-SHA (RFC 5310) on some platforms. Clear text should only be used in labs.

key chain ISIS-KEYS
 key 1
  key-string Backb0ne-2026
!
interface GigabitEthernet0/0
 isis authentication mode md5 level-2
 isis authentication key-chain ISIS-KEYS level-2
!
router isis CORE
 authentication mode md5 level-2
 authentication key-chain ISIS-KEYS level-2

If hello authentication fails, the adjacency does not form. If only LSP authentication fails, the adjacency comes up but the database never synchronises, which is confusing, so check show isis database as well as show isis neighbors.

Redistribution and summarisation

Static routes, other protocols or a default route are brought in with redistribute. Routes enter level 2 by default with metric 0, so set both explicitly. To advertise a default route, use default-information originate.

router isis CORE
 redistribute static ip level-2 metric 50
 default-information originate
 summary-address 10.30.0.0 255.255.0.0 level-2

Summarisation in IS-IS happens where routes move between levels, or where external routes are injected. On a level 1/2 router, summary-address ... level-2 advertises one summary into the backbone in place of the area's specific level 1 routes. As with OSPF and EIGRP, a discard route to Null0 protects against loops. Plan addressing so each area uses a contiguous block.

Filtering

As a link-state protocol, IS-IS cannot filter LSPs inside a level: every router must hold the same database. Your options are:

• A distribute-list in, which, as in OSPF, only keeps routes out of that router's own routing table.
• Filtering what is redistributed into IS-IS, with a route-map on the redistribute command.
• Controlling what passes between levels with summaries and leak policies.

Route leaking

By default a level 1 router knows only its own area and a default route to the nearest level 1/2 router. If an area has two level 1/2 routers, the nearest one may not be the best exit for a particular destination, and traffic takes a longer path. Route leaking lets a level 1/2 router copy selected level 2 prefixes into level 1, so level 1 routers can pick the best exit for those destinations.

ip prefix-list DC-ROUTES seq 5 permit 10.200.0.0/16 le 24
route-map L2-TO-L1 permit 10
 match ip address prefix-list DC-ROUTES
!
router isis CORE
 redistribute isis ip level-2 into level-1 route-map L2-TO-L1

Leaked prefixes carry the up/down bit, which marks that they came down from level 2. A level 1/2 router never advertises a prefix with that bit back up into level 2, which prevents loops. In the routing table, leaked routes appear as inter-area (ia) routes.

Real-world example: a broadband provider had two level 1/2 routers in each regional area, one in the north and one in the south of the region. Traffic from northern routers to a data centre in the south left through the northern router, because it was the nearest exit, then travelled back across the backbone. Leaking only the data centre prefixes into each level 1 area let northern routers see that the southern exit was better for those destinations, cutting latency to the data centre, while the rest of the internet still followed the default route.