IS-IS NSAP Addresses and the NET (System ID)

IS-IS NSAP Addresses and the NET (System ID)

IS-IS was standardised by ISO for CLNP, so even when it is used purely to carry IP routes, each router is configured with one ISO-style address. That address is an NSAP (Network Service Access Point), and the one that identifies the router itself is called the NET (Network Entity Title).

The biggest difference from an IP address is where it is attached.

What IS-IS uses to identify a node is the System ID inside the NSAP. It plays the role of the OSPF router ID, but it has nothing to do with IP addresses.

The NSAP address format

The formal format is defined in Annex A (normative) of ISO/IEC 8348, which splits the address in two (A.5.1.1). The edition referenced here is the third (2002), technically aligned with ITU-T X.213; ISO/IEC 10589:2002 normatively references the second edition (1996).

The “HO-DSP”, “ID” and “SEL” seen in practice are not ISO/IEC 8348 terms; they come from allocation policies such as GOSIP.

ISO/IEC 10589:2002 notes in Figure 4 that IDP, DSP, AFI and IDI are drawn only to show the correspondence and are not explicitly used by this protocol, and it works with the address split into three parts (7.1.1). That simplified format is what is used in practice.

A whole NSAP is at most 20 bytes (ISO/IEC 8348 A.5.4). For IP routing, the common choice is 10 bytes: 1 for the AFI, 2 for the area, 6 for the System ID and 1 for the NSEL.

49.0001.0010.0100.1001.00
\_____/ \____________/ \/
Area ID    System ID  NSEL

The Area ID is 3 bytes (the AFI 49 plus the area number 0001), the System ID 6 bytes and the NSEL 1 byte, 10 bytes in total.

The AFI and 49

The Area ID starts with the AFI, which per A.5.1.1.1 of ISO/IEC 8348 indicates four things.

1. The format of the IDI
2. The authority that allocates IDI values
3. Whether leading zeros in the IDI are significant
4. The abstract syntax of the DSP

The allocation of AFI values is given in Table A.4 of the same standard.

The rows with two values exist because of the third item (whether leading zeros are significant). A variable-length IDI is padded to its maximum length in the binary encoding, so padding zeros have to be told apart from meaningful ones: the lower value means the IDI does not start with zero, the higher value means it does (A.5.2.1.2).

49 is the Local format with a binary DSP. Local has no IDI (it is null), so the IDP is just the AFI and the DSP starts right after 49 (A.5.2.1.2.9). The maximum Local DSP in binary is 19 octets (Table A.5), which with the one AFI octet comes to exactly 20.

“Local means private use” is not the standard’s wording. The note in Table A.4 says it exists so that OSI and non-OSI address schemes can coexist. That said, no IDI means no higher authority guaranteeing uniqueness, so such addresses may well be duplicated outside one organisation. Since IS-IS is an IGP and its routes do not leave the AS, 49 is good enough for IP routing.

System ID uniqueness is per area for Level 1 and per domain for Level 2

The System ID is a 6-byte value, and 7.1.4 of ISO/IEC 10589:2002 lists three requirements.

That a)2) is per area matters. Two Level 1 routers in different areas may, as far as the standard goes, share a System ID. Level 1 LSPs never leave their area, so no identifier collides inside any single LSDB. In practice the ID is still kept unique domain-wide, because hostname displays and any future merging of areas would otherwise become confusing.

Cisco implementations use a fixed 6-byte System ID (the IOS XR configuration guide states that each router is represented by a 6-byte hexadecimal system ID). The value itself is free, but a common practice is to derive it mechanically from a loopback address.

Step 1. Pad each octet to three digits
        192.168.1.24  ->  192.168.001.024

Step 2. Split the 12 digits into three groups of four
        192168001024  ->  1921.6800.1024

Step 3. Add the Area ID and the NSEL to make a NET
        49.0001.1921.6800.1024.00

Because it comes from the same value as the BGP or MPLS-TE router ID, it is immediately clear which router an LSP in show isis database belongs to. Some use a MAC address directly, but that changes when hardware is replaced, so deriving it from a loopback is easier to operate.

The NSEL

The last byte is the NSEL (NSAP selector), which says which user of the network layer service should receive the PDU. In a NET the NSEL is always 00, which designates the node’s own network entity. IOS XR rejects a NET with anything else while parsing the command, as shown later.

Several area addresses, and merging or splitting areas

A router can be given several NETs, which is how areas are merged or split. 7.1.5 of ISO/IEC 10589:2002 permits an area to have several synonymous area addresses, and the limit is the management parameter maximumAreaAddresses (all ISs shall support a value of at least 3). That value is carried in the protocol’s PDUs and checked for agreement within an area: if it does not match, adjacencies can fail to initialise or the area can be partitioned.

How several area addresses behave, and the procedure for merging and splitting areas, are covered in IS-IS Multiple Area Addresses (Multihoming), Merging and Splitting Areas.

Dynamic hostname (TLV 137)

A System ID is hard to read, so IS-IS advertises the hostname in TLV 137 of the LSP and show output substitutes it (RFC 5301). It is enabled by default on IOS XR and the mapping is visible with show isis hostname. The TLV itself is covered in IS-IS Major TLVs.

Lab setup

Seven XRd 26.1.1 routers form three areas. The System IDs follow the loopback conversion rule.

There are two Level 1 routers in one area (R1, R5), two more in another (R4, R6), and three Level 2 routers on the backbone (R2, R3, R7), so that each of the three uniqueness requirements described above can be checked in a STEP of its own.

Overview of the STEPs

The sections below are grouped by what they show rather than by STEP order.

A Level 1 adjacency needs a matching Area ID

A Level 1 adjacency requires at least one area address in common; a Level 2 adjacency forms even when the areas differ. R2 and R3 in the initial state show both cases at once.

RP/0/RP0/CPU0:R2#show isis neighbors
Sun Sep 27 18:08:39.590 UTC

IS-IS 1 neighbors:
System Id      Interface        SNPA           State Holdtime Type IETF-NSF
R1             Gi0/0/0/0        *PtoP*         Up    28       L1   Capable 
R5             Gi0/0/0/2        *PtoP*         Up    23       L1   Capable 
R3             Gi0/0/0/1        *PtoP*         Up    26       L2   Capable 

Total neighbor count: 3

RP/0/RP0/CPU0:R3#show isis neighbors
Sun Sep 27 18:09:04.617 UTC

IS-IS 1 neighbors:
System Id      Interface        SNPA           State Holdtime Type IETF-NSF
R6             Gi0/0/0/2        *PtoP*         Up    26       L1   Capable 
R4             Gi0/0/0/1        *PtoP*         Up    21       L1   Capable 
R2             Gi0/0/0/0        *PtoP*         Up    24       L2   Capable 
R7             Gi0/0/0/3        *PtoP*         Up    27       L2   Capable 

Total neighbor count: 4

R2 is L1 with R1 and R5 in the same area and L2 with R3 in another. R3 is the same, and with the level-2-only R7 it is L2 only.

Changing R2’s Area ID to 49.0009 puts the reason in R1’s syslog.

RP/0/RP0/CPU0:Sep 27 18:11:20.558 UTC: isis[1003]: %ROUTING-ISIS-5-ADJCHANGE : ISIS (1): Adjacency to 49.0001.0020.0200.2002 (GigabitEthernet0/0/0/0) (L1) Down, Area addr/level differ 

What the IIH carries is the Area address TLV (TLV 1). Only that value changes across the edit.

    Area address(es) (t=1, l=4)
        Type: 1
        Length: 4
        Area address (3): 49.0001

    Area address(es) (t=1, l=4)
        Type: 1
        Length: 4
        Area address (3): 49.0009

No.2 of the same capture shows R2 withdrawing its own Level 1 LSP from the old area.

ISO 10589 ISIS Link State Protocol Data Unit
    PDU length: 40
    Remaining lifetime: 0
    LSP-ID: 0020.0200.2002.00-00
    Sequence number: 0x00000006
    [Checksum: [missing]]
    [Checksum Status: Not present]
    Type block(0x0b): Partition Repair:0, Attached bits:1, Overload bit:0, IS type:3
        0... .... = Partition Repair: Not supported
        .000 1... = Attachment: 1
            .0.. .... = Error metric: Not set
            ..0. .... = Expense metric: Not set
            ...0 .... = Delay metric: Not set
            0... .... = Default metric: Not set
        .... .0.. = Overload bit: Not set
        .... ..11 = Type of Intermediate System: Level 2 (3)
    Purge Originator ID (t=13, l=7)
        Type: 13
        Length: 7
        Number of System IDs: 1
        System ID: 0020.0200.2002

An LSP with Remaining lifetime: 0 is a purge. Clause 7.3.16.4 of ISO/IEC 10589:2002 says a zero-lifetime LSP propagates with only its header retained. The Purge Originator ID TLV (TLV 13) is not in the standard; it was added by RFC 6232.

What happens when System IDs collide

Results of ping (20 packets) from seven routers in each STEP. The damage is confined exactly to the scope of each requirement.

A duplicate inside one area (STEP 3)

Setting R5’s System ID to R1’s 0010.0100.1001 breaks what R2, adjacent to both, sees.

RP/0/RP0/CPU0:R2#show isis neighbors
Sun Sep 27 18:29:48.357 UTC

IS-IS 1 neighbors:
System Id      Interface        SNPA           State Holdtime Type IETF-NSF
R5             Gi0/0/0/0        *PtoP*         Up    22       L1   Capable 
R5             Gi0/0/0/2        *PtoP*         Up    21       L1   Capable 
R3             Gi0/0/0/1        *PtoP*         Up    21       L2   Capable 

Total neighbor count: 3

RP/0/RP0/CPU0:R2#show isis database
Sun Sep 27 18:29:49.297 UTC

IS-IS 1 (Level-1) Link State Database
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime/Rcvd  ATT/P/OL
R5.00-00              0x00000008   0x5c03        911  /1200         0/0/0
R2.00-00            * 0x00000004   0xa1ae        909  /*            1/0/0

 Total Level-1 LSP count: 2     Local Level-1 LSP count: 1

IS-IS 1 (Level-2) Link State Database
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime/Rcvd  ATT/P/OL
R2.00-00            * 0x0000000c   0xf720        911  /*            0/0/0
R3.00-00              0x0000000e   0xfc50        557  /1199         0/0/0
R7.00-00              0x00000005   0x163b        883  /1200         0/0/0

 Total Level-2 LSP count: 3     Local Level-2 LSP count: 1

RP/0/RP0/CPU0:R1#show isis database
Sun Sep 27 18:29:23.808 UTC

IS-IS 1 (Level-1) Link State Database
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime/Rcvd  ATT/P/OL
R1.00-00            * 0x00000007   0xdab6        583  /*            0/0/0
R2.00-00              0x00000004   0xa1ae        934  /1200         1/0/0

 Total Level-1 LSP count: 2     Local Level-1 LSP count: 1

R2’s neighbour table shows R5 as the peer on both interfaces: the hostname comes from TLV 137 in the LSP, and one System ID can only carry one name. Its Level 1 LSDB holds only R5.00-00, so R1’s LSP is gone. An LSP ID is built from the System ID, so only one LSP per ID can be held and the later arrival replaces the earlier one.

R1’s own LSDB, meanwhile, still holds R1.00-00 *, so R1 sees nothing wrong — while every packet towards R1 is dropped (the 0% above). R1’s prefixes have disappeared from the area’s LSDB, and the broken router itself cannot tell.

A Level 2 duplicate across the domain (STEP 5)

Setting R7’s System ID to R2’s does the same thing in the Level 2 subdomain. R7 and R2 are not adjacent, so the collision surfaces on R3, which is adjacent to both.

RP/0/RP0/CPU0:R3#show isis neighbors
Sun Sep 27 18:43:42.899 UTC

IS-IS 1 neighbors:
System Id      Interface        SNPA           State Holdtime Type IETF-NSF
R6             Gi0/0/0/2        *PtoP*         Up    29       L1   Capable 
R4             Gi0/0/0/1        *PtoP*         Up    29       L1   Capable 
R7             Gi0/0/0/0        *PtoP*         Up    29       L2   Capable 
R7             Gi0/0/0/3        *PtoP*         Up    27       L2   Capable 

Total neighbor count: 4

RP/0/RP0/CPU0:R3#show isis database
Sun Sep 27 18:43:43.937 UTC

IS-IS 1 (Level-1) Link State Database
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime/Rcvd  ATT/P/OL
R3.00-00            * 0x0000000b   0x8f7e        824  /*            1/0/0
R4.00-00              0x00000007   0x2aac        792  /1200         0/0/0
R6.00-00              0x00000008   0x126b        789  /1200         0/0/0

 Total Level-1 LSP count: 3     Local Level-1 LSP count: 1

IS-IS 1 (Level-2) Link State Database
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime/Rcvd  ATT/P/OL
R7.00-00              0x0000000f   0xf7f9        883  /1200         0/0/0
R3.00-00            * 0x00000010   0xb995        881  /*            0/0/0

 Total Level-2 LSP count: 2     Local Level-2 LSP count: 1

R2’s LSP disappears from the Level 2 LSDB. R2 is the only router joining area 49.0001 to the backbone, so everything crossing an area boundary fails. R1 to R5, inside the same area, stays at 100%, which shows the damage is limited to the Level 2 subdomain.

Two Level 1 routers in different areas are fine (STEP 7)

R6 (Level 1 in area 49.0002) is given the same System ID as R1 (Level 1 in area 49.0001). The requirement is per area, so this is not a violation.

RP/0/RP0/CPU0:R2#show isis hostname
Sun Sep 27 18:54:32.990 UTC

IS-IS 1 hostnames
Level  System ID      Dynamic Hostname
 1     0010.0100.1001 R1
 1,2 * 0020.0200.2002 R2
 2     0070.0700.7007 R7
 1     0050.0500.5005 R5
 2     0030.0300.3003 R3

RP/0/RP0/CPU0:R3#show isis hostname
Sun Sep 27 18:55:00.015 UTC

IS-IS 1 hostnames
Level  System ID      Dynamic Hostname
 1     0010.0100.1001 R6
 2     0020.0200.2002 R2
 2     0070.0700.7007 R7
 1,2 * 0030.0300.3003 R3
 1     0040.0400.4004 R4

The same System ID 0010.0100.1001 maps to R1 on R2 and to R6 on R3. Level 1 LSPs never leave their area, so the identifier collides in neither LSDB, and all eight ping paths stay at 100%.

The NSEL will not take anything but 00

Trying to configure a NET whose NSEL is not 00 is rejected by IOS XR while it parses the command.

RP/0/RP0/CPU0:R1(config-isis)#net 49.0001.0010.0100.1001.01

                                  ^
% Invalid input detected at '^' marker.
RP/0/RP0/CPU0:R1(config-isis)#abort

RP/0/RP0/CPU0:R1#show running-config router isis

Sun Sep 27 18:05:28.787 UTC
router isis 1
 is-type level-1
 net 49.0001.0010.0100.1001.00
 log adjacency changes

The caret (^) points at the NSEL. The show running-config router isis after abort still shows the original NET, which proves it never even entered the candidate configuration.

Configuring and checking the NET

IOS XR configures it with the net command under router isis.

RP/0/RP0/CPU0:R1#show running-config router isis
Sun Sep 27 18:08:15.829 UTC
router isis 1
 is-type level-1
 net 49.0001.0010.0100.1001.00
 log adjacency changes
 address-family ipv4 unicast
  metric-style wide
 !
 interface Loopback0
  passive
  address-family ipv4 unicast
  !
 !
 interface GigabitEthernet0/0/0/0
  point-to-point
  address-family ipv4 unicast
  !
 !
!

What was configured is visible with show isis.

RP/0/RP0/CPU0:R2#show isis
Sun Sep 27 18:08:38.882 UTC

IS-IS Router: 1
  System Id: 0020.0200.2002 
  Hostname: R2
  IS Levels: level-1-2
  Manual area address(es):
    49.0001
  Routing for area address(es):
    49.0001
  Multi-Instance Id: 0

Verification configs and show output

Collected from all seven routers in every STEP. The verification config is the ..._run.txt file (the final state is the one from STEP 8).

STEP 0: Initial state

STEP 1: R2’s Area ID changed to 49.0009

STEP 2: R2’s Area ID restored to 49.0001

STEP 3: R5’s System ID set to R1’s (duplicate inside one area)

STEP 4: R5’s System ID restored

STEP 5: R7’s System ID set to R2’s (duplicate across the domain at Level 2)

STEP 6: R7’s System ID restored

STEP 7: R6’s System ID set to R1’s (two Level 1 routers in different areas)

STEP 8: R6’s System ID restored (final state)

Packet captures were taken per STEP on three links.

References

Related articles

• What is IS-IS
• IS-IS NSAP Addresses and the NET (System ID)
• IS-IS Multiple Area Addresses (Multihoming), Merging and Splitting Areas
• IS-IS Level 1 and Level 2 (the hierarchy)
• IS-IS Packet Types and Header Format
• IS-IS Adjacency Formation and States
• IS-IS DIS and the Pseudonode
• IS-IS Network Types (broadcast / point-to-point)
• IS-IS Metrics (narrow and wide)
• IS-IS Authentication (hello-password and lsp-password)
• IS-IS LSPs and the Link-State Database
• The Main IS-IS TLVs
• IS-IS Flooding and LSDB Synchronisation
• IS-IS SPF Computation and Route Selection
• IS-IS ECMP (Equal-Cost Multipath)
• The IS-IS ATT Bit and the Level 1 Default Route
• IS-IS Route Leaking and the Up/Down Bit
• IS-IS Route Summarization
• The IS-IS Overload Bit
• IS-IS IPv6 Support and Multi-Topology (TLV 236 / MT ID 2)
• IS-IS Hello and Holding Time
• IS-IS Convergence Timers (SPF / LSP Generation)
• IS-IS Flooding Timers (LSP Interval, Retransmission, CSNP / PSNP)
• IS-IS Link Failure and Path Switchover
• IS-IS Redistribution (connected / static)
• IS-IS Redistribution of BGP Routes