IS-IS Level 1 and Level 2 (the hierarchy)

Why a hierarchy

In a link-state protocol every router holds the same LSDB and runs SPF over it (What is IS-IS). As the network grows that brings three problems.

• The LSDB grows with the size of the whole network
• Every link change anywhere makes every router receive an LSP and rerun SPF
• The cost of SPF grows with the number of nodes and links

So IS-IS divides the network into areas and routes in two levels: Level 1 inside an area and Level 2 between areas. Databases are per area, so a change in one area no longer triggers SPF in another.

The idea matches OSPF, but the hierarchy is cut in a different place.

Level 1, Level 2 and Level 1-2

Routers come in three kinds, by the levels they take part in.

The Cisco default is Level 1-2. is-type narrows it to one level. Left at the default a router keeps both databases and both adjacencies, so narrowing it to the level actually needed is the usual practice.

The area boundary runs along the link

The position of the area boundary is the easiest thing to get wrong.

An OSPF ABR belongs to several areas at once, and the boundary runs through the router.

An IS-IS router belongs to exactly one area, decided by the Area ID of its NET (IS-IS NSAP addresses and the NET; configuring several NETs merges the areas, so the membership is still one). The introduction of ISO/IEC 10589:2002 says the same: “Each system resides in exactly one area.” Routers in different areas are joined by a Level 2 adjacency, so the boundary runs along the link.

In design you ask “which link is the area boundary”.

Which one wins when the same destination is learned at both levels

A Level 1-2 router can learn the same destination both inside its own area (Level 1) and across the backbone (Level 2). ISO/IEC 10589:2002 settles the choice in 7.2.12.3 b).

a level 2 route, if it exists, shall be preferred over a level 1 route that traverses a virtual link. Otherwise, the level 1 route shall be preferred.

A virtual link belongs to partition repair (7.2.10), which stitches a partitioned area back together through Level 2. In the conformance tables of Annex A, *Partition is marked L2IS:O, an optional function of a Level 2 IS, so an implementation may leave it out. Without virtual links only the second half of the rule is left, and Level 1 always wins.

Within one level, by contrast, the metric decides. If several routes are equal cost, all of them are installed (IS-IS ECMP).

So the order of the decision is this.

The lab

Seven Cisco IOS XR routers (XRd 26.1.1), arranged so that all three kinds appear. R2-R5-R3 is the Level 2 backbone, with a Level 1 area at each end.

R5 sits in an area of its own, 49.0005. A Level 2 adjacency does not require a matching area address (ISO/IEC 10589:2002, 7.1.5; only a Level 1 adjacency does). R2 and R3 say “default” because level-1-2 is the default value and never appears in show running-config.

R6 and R7 both hold the same 172.16.0.100/32. That makes R2 learn this destination both inside its own area (Level 1 via R6) and across the backbone (Level 2 via R3), which is how the rule above is measured on real hardware.

Every link is point-to-point, and every router uses metric-style wide with a metric of 10. STEP 2 uses 1000, and the narrow metric caps at 63 (MaxLinkMetric in ISO/IEC 10589:2002), so the test cannot be reproduced without wide metrics. The configuration is in the ..._run.txt of each STEP.

Observing the preference only means something if R3 re-advertises the routes it learned inside its area into Level 2, and they reach R2. In the initial state, R3’s LSP in R2’s Level 2 database carries the prefixes of area 49.0002.

R3.00-00              0x00000007   0x7610        557  /1200         0/0/0
  Area Address:   49.0002
  LSP MTU:        1492
  NLPID:          0xcc
  IP Address:     3.3.3.3
  Hostname:       R3
  Metric: 10         IS-Extended R5.00
  Metric: 0          IP-Extended 3.3.3.3/32
    Prefix Attribute Flags: X:0 R:0 N:1 E:0 A:0
  Metric: 10         IP-Extended 4.4.4.4/32
    Prefix Attribute Flags: X:0 R:1 N:1 E:0 A:0
  Metric: 10         IP-Extended 7.7.7.7/32
    Prefix Attribute Flags: X:0 R:1 N:1 E:0 A:0
  Metric: 10         IP-Extended 10.0.34.0/24
    Prefix Attribute Flags: X:0 R:0 N:0 E:0 A:0
  Metric: 10         IP-Extended 10.0.35.0/24
    Prefix Attribute Flags: X:0 R:0 N:0 E:0 A:0
  Metric: 10         IP-Extended 10.0.37.0/24
    Prefix Attribute Flags: X:0 R:0 N:0 E:0 A:0

Had they not arrived, the result would say “there was no Level 2 route” rather than “Level 1 was preferred”, so this check runs first in every STEP.

The databases are separate per level

Level 1 and Level 2 hold independent databases, and a Level 1-2 router keeps both at once.

show isis database prints one table per level.

RP/0/RP0/CPU0:R2#show isis database
Sun Oct  4 15:04:22.453 UTC

IS-IS 1 (Level-1) Link State Database
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime/Rcvd  ATT/P/OL
R1.00-00              0x00000005   0xdeb4        537  /1200         0/0/0
R2.00-00            * 0x00000007   0xca9d        540  /*            1/0/0
R6.00-00              0x00000005   0xc5e7        537  /1200         0/0/0

 Total Level-1 LSP count: 3     Local Level-1 LSP count: 1

IS-IS 1 (Level-2) Link State Database
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime/Rcvd  ATT/P/OL
R2.00-00            * 0x00000007   0x33ba        541  /*            0/0/0
R3.00-00              0x00000007   0x7610        557  /1200         0/0/0
R5.00-00              0x00000006   0x1d96        549  /1200         0/0/0

 Total Level-2 LSP count: 3     Local Level-2 LSP count: 1

R5, which is Level 2 only, holds no Level 1 database.

RP/0/RP0/CPU0:R5#show isis database
Sun Oct  4 15:05:44.026 UTC

IS-IS 1 (Level-2) Link State Database
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime/Rcvd  ATT/P/OL
R2.00-00              0x00000007   0x33ba        459  /1200         0/0/0
R3.00-00              0x00000007   0x7610        476  /1200         0/0/0
R5.00-00            * 0x00000007   0x1b97        1165 /*            0/0/0

 Total Level-2 LSP count: 3     Local Level-2 LSP count: 1

A change inside area 49.0002 does not flow into area 49.0001, and R1 runs no SPF for it.

A Level 1 router leaves its area through a default route

A Level 1 router knows only the topology of its own area. It forwards towards other areas through a default route, which it builds from a Level 1 LSP in which a Level 1-2 router has set the ATT (Attached) bit.

RP/0/RP0/CPU0:R1#show route isis
Sun Oct  4 15:03:58.154 UTC

i*L1 0.0.0.0/0 [115/10] via 10.0.12.2, 00:10:34, GigabitEthernet0/0/0/0
i L1 2.2.2.2/32 [115/10] via 10.0.12.2, 00:10:37, GigabitEthernet0/0/0/0
i L1 6.6.6.6/32 [115/20] via 10.0.12.2, 00:10:37, GigabitEthernet0/0/0/0
i L1 10.0.25.0/24 [115/20] via 10.0.12.2, 00:10:37, GigabitEthernet0/0/0/0
i L1 10.0.26.0/24 [115/20] via 10.0.12.2, 00:10:37, GigabitEthernet0/0/0/0

That is the i*L1 0.0.0.0/0 entry, which show route labels candidate default path. The mechanism and its conditions are covered in The IS-IS ATT bit and the Level 1 default route.

Different levels: the level decides (STEP 1 to 3)

STEP 1 puts Loopback1 on R6 and R7 into IS-IS, so R2 learns the same destination at both levels. R2 chose the Level 1 route.

RP/0/RP0/CPU0:R2#show route 172.16.0.100/32
Sun Oct  4 15:10:14.926 UTC

Routing entry for 172.16.0.100/32
  Known via "isis 1", distance 115, metric 10, type level-1
  Installed Oct  4 15:07:10.258 for 00:03:04
  Routing Descriptor Blocks
    10.0.26.6, from 6.6.6.6, via GigabitEthernet0/0/0/2
      Route metric is 10
  No advertising protos. 

It is type level-1, and the next hop is R6, in the same area. Forwarding goes the same way.

RP/0/RP0/CPU0:R2#traceroute 172.16.0.100 source 2.2.2.2 timeout 1 probe 2 maxttl 5
Sun Oct  4 15:08:59.382 UTC

Type escape sequence to abort.
Tracing the route to 172.16.0.100

 1  10.0.26.6 7 msec  * 

STEP 2 sets metric 1000 on R2’s interface towards R6. Only the Level 1 route becomes a hundred times worse, and the choice does not change.

RP/0/RP0/CPU0:R2#show route 172.16.0.100/32
Sun Oct  4 15:16:03.091 UTC

Routing entry for 172.16.0.100/32
  Known via "isis 1", distance 115, metric 1000, type level-1
  Installed Oct  4 15:13:03.177 for 00:03:00
  Routing Descriptor Blocks
    10.0.26.6, from 6.6.6.6, via GigabitEthernet0/0/0/2
      Route metric is 1000
  No advertising protos. 

It stays Level 1 at metric 1000. The Level 2 route costs 30 at this point (the next STEP shows it), so a factor of 33 does not let the metric win. That is exactly what 7.2.12.3 b) prescribes: the level is decided before the metric.

STEP 3 removes Loopback1 from IS-IS on R6, and the Level 1 route disappears.

RP/0/RP0/CPU0:R2#show route 172.16.0.100/32
Sun Oct  4 15:21:45.452 UTC

Routing entry for 172.16.0.100/32
  Known via "isis 1", distance 115, metric 30, type level-2
  Installed Oct  4 15:18:43.646 for 00:03:01
  Routing Descriptor Blocks
    10.0.25.5, from 3.3.3.3, via GigabitEthernet0/0/0/1
      Route metric is 30
  No advertising protos. 

Only now is Level 2 used. It becomes type level-2, with R5 on the backbone as the next hop, and forwarding follows.

RP/0/RP0/CPU0:R2#traceroute 172.16.0.100 source 2.2.2.2 timeout 1 probe 2 maxttl 5
Sun Oct  4 15:20:27.035 UTC

Type escape sequence to abort.
Tracing the route to 172.16.0.100

 1  10.0.25.5 5 msec  5 msec 
 2  10.0.35.3 8 msec  8 msec 
 3  10.0.37.7 12 msec  * 

The Level 2 route existed all along and simply was not chosen. Its metric is 30, lower than the 1000 of the Level 1 route in STEP 2.

The same level: the metric decides (R5)

R5 is level-2-only, so it learns this destination from two directions, both at Level 2. In STEP 1 the two were equal cost.

RP/0/RP0/CPU0:R5#show route 172.16.0.100/32
Sun Oct  4 15:11:42.646 UTC

Routing entry for 172.16.0.100/32
  Known via "isis 1", distance 115, metric 20, type level-2
  Installed Oct  4 15:07:17.165 for 00:04:25
  Routing Descriptor Blocks
    10.0.25.2, from 2.2.2.2, via GigabitEthernet0/0/0/0
      Route metric is 20
    10.0.35.3, from 3.3.3.3, via GigabitEthernet0/0/0/1
      Route metric is 20
  No advertising protos. 

Two routes at metric 20 are installed, via R2 (10.0.25.2) and via R3 (10.0.35.3). Same level, equal cost, so ECMP.

Raising the metric on the R2 side in STEP 2 leaves R5 with one route.

RP/0/RP0/CPU0:R5#show route 172.16.0.100/32
Sun Oct  4 15:17:23.059 UTC

Routing entry for 172.16.0.100/32
  Known via "isis 1", distance 115, metric 20, type level-2
  Installed Oct  4 15:13:03.400 for 00:04:19
  Routing Descriptor Blocks
    10.0.35.3, from 3.3.3.3, via GigabitEthernet0/0/0/1
      Route metric is 20
  No advertising protos. 

Within one level the metric decides the choice, in contrast to the 1000 against 30 that did not move R2.

is-type and circuit-type

The level can be set at two granularities.

The Circuit type of the IIH carries it to the neighbour

The levels a router will form are carried to its neighbour in the Circuit type of the IIH.

Capturing R1-R2 and R2-R5 at the same time shows all three.

ISIS HELLO
    .... ..01 = Circuit type: Level 1 only (0x1)
    0000 00.. = Reserved: 0x00
    SystemID {Sender of PDU}: 0010.0100.1001

ISIS HELLO
    .... ..11 = Circuit type: Level 1 and 2 (0x3)
    0000 00.. = Reserved: 0x00
    SystemID {Sender of PDU}: 0020.0200.2002

ISIS HELLO
    .... ..10 = Circuit type: Level 2 only (0x2)
    0000 00.. = Reserved: 0x00
    SystemID {Sender of PDU}: 0050.0500.5005

The is-type setting is the bit in the IIH. R2 sends the same 0x3 towards R1 and towards R5, so the level comes from its own configuration, not from the neighbour.

is-type narrows the whole router (STEP 5)

Setting R2 to is-type level-2-only stops the Level 1 adjacencies with R1 and R6, which are in the same area.

RP/0/RP0/CPU0:Oct  4 15:30:12.831 UTC: isis[1003]: %ROUTING-ISIS-5-ADJCHANGE : ISIS (1): Adjacency to 49.0001.0020.0200.2002 (GigabitEthernet0/0/0/0) (L1) Down, Area addr/level differ 

The reason given is Area addr/level differ. R2 is left with only the Level 2 adjacency to R5.

RP/0/RP0/CPU0:R2#show isis neighbors
Sun Oct  4 15:35:01.715 UTC

IS-IS 1 neighbors:
System Id      Interface        SNPA           State Holdtime Type IETF-NSF
R5             Gi0/0/0/1        *PtoP*         Up    28       L2   Capable 

Total neighbor count: 1

Area 49.0001 is cut off from the outside, because R1 and R6 have only Level 1 and the area no longer holds a border router. STEP 6 restores the default and recovery follows.

circuit-type narrows a single interface (STEP 7)

STEP 7 adds circuit-type level-1 to just one interface of R2, the one facing R5. R5 forms Level 2 only, so no adjacency comes up on that link.

RP/0/RP0/CPU0:Oct  4 15:43:37.193 UTC: isis[1003]: %ROUTING-ISIS-5-ADJCHANGE : ISIS (1): Adjacency to R5 (GigabitEthernet0/0/0/1) (L2) Down, Interface state down 

The Level 2 backbone must be contiguous

The routers taking part in Level 2 make up the backbone. It is not a particular area number: it exists as the chain of routers joined by Level 2 adjacencies.

That chain must not break. In STEP 7 the backbone was split into the R2 side and the R5-R3 side. R2 lost its Level 2 reachability and cleared the ATT bit, so R1’s default route disappeared as well.

RP/0/RP0/CPU0:R1#show route isis
Sun Oct  4 15:47:50.300 UTC

i L1 2.2.2.2/32 [115/10] via 10.0.12.2, 00:09:58, GigabitEthernet0/0/0/0
i L1 6.6.6.6/32 [115/20] via 10.0.12.2, 00:09:58, GigabitEthernet0/0/0/0
i L1 10.0.25.0/24 [115/20] via 10.0.12.2, 00:09:58, GigabitEthernet0/0/0/0
i L1 10.0.26.0/24 [115/20] via 10.0.12.2, 00:09:58, GigabitEthernet0/0/0/0
i L1 172.16.0.100/32 [115/20] via 10.0.12.2, 00:09:58, GigabitEthernet0/0/0/0

i*L1 0.0.0.0/0 is gone and only the intra-area routes remain (2.2.2.2/32, 6.6.6.6/32, 172.16.0.100/32 and so on). Traffic from R1 to area 49.0002 does not get through.

RP/0/RP0/CPU0:R1#traceroute 4.4.4.4 source 1.1.1.1 timeout 1 probe 2 maxttl 5
Sun Oct  4 15:45:32.847 UTC

Type escape sequence to abort.
Tracing the route to 4.4.4.4

 1  1.1.1.1 !N  * 

Narrowing the level on a single interface stops traffic between areas. Removing circuit-type in STEP 8 returns everything to the initial state.

Most implementations do not support partition repair, so a Level 1 area has to be contiguous too. As above, the standard makes it optional.

Design guidance

Decide where to cut areas on these points.

• Keep the backbone (Level 2) contiguous. Splitting it loses connectivity between areas, as STEP 7 showed
• The area boundary falls on a link. Think about which link is the boundary, not which router
• Do not put the same prefix in several areas. Level 1 wins, so where a packet lands depends on the destination
• A Level 1 router holds no detail about other areas. Do not shut a place that needs fine route control inside Level 1
• Disable the levels you do not need. Left at the default Level 1-2, both the databases and the adjacencies double

Verification configs and show output

Every STEP collects the following from all seven routers, one file per router. The verification config is the ..._run.txt (the final state is the one from the last STEP).

R2’s router isis configuration in the final STEP is identical to the initial state. Every change was reverted by configuring a value rather than by no.

STEP 0: The initial state

STEP 1: Advertise Loopback1 on R6 and R7

STEP 2: Set metric 1000 on R2 towards R6

STEP 3: Remove Loopback1 from IS-IS on R6

STEP 4: Restore Loopback1 and the metric

STEP 5: Set R2 to is-type level-2-only

STEP 6: Set R2 back to level-1-2

STEP 7: Add circuit-type level-1 on R2 towards R5

STEP 8: Remove circuit-type (final state)

Packet captures were taken per STEP on three links.

References

Related articles

• What is IS-IS
• IS-IS NSAP Addresses and the NET (System ID)
• IS-IS Multiple Area Addresses (Multihoming), Merging and Splitting Areas
• IS-IS Level 1 and Level 2 (the hierarchy)
• IS-IS Packet Types and Header Format
• IS-IS Adjacency Formation and States
• IS-IS DIS and the Pseudonode
• IS-IS Network Types (broadcast / point-to-point)
• IS-IS Metrics (narrow and wide)
• IS-IS Authentication (hello-password and lsp-password)
• IS-IS LSPs and the Link-State Database
• The Main IS-IS TLVs
• IS-IS Flooding and LSDB Synchronisation
• IS-IS SPF Computation and Route Selection
• IS-IS ECMP (Equal-Cost Multipath)
• The IS-IS ATT Bit and the Level 1 Default Route
• IS-IS Route Leaking and the Up/Down Bit
• IS-IS Route Summarization
• The IS-IS Overload Bit
• IS-IS IPv6 Support and Multi-Topology (TLV 236 / MT ID 2)
• IS-IS Hello and Holding Time
• IS-IS Convergence Timers (SPF / LSP Generation)
• IS-IS Flooding Timers (LSP Interval, Retransmission, CSNP / PSNP)
• IS-IS Link Failure and Path Switchover
• IS-IS Redistribution (connected / static)
• IS-IS Redistribution of BGP Routes