Disclosure up front: I run IPYE, a company that leases IP space. It gets one short paragraph at the end; the rest is plain networking.
OSPF is the first interior gateway protocol most people learn, but IS-IS is its equal in capability, and many large service providers prefer it. It runs directly over the data-link layer instead of over IP, it carries IPv4 and IPv6 together in one process, and its design handles growth gracefully. A small network benefits from the same properties: one protocol and one adjacency per link for both address families, with no separate "v3" to run. This article explains the vocabulary, how to design levels and addressing, a working FRR configuration, and what to check. It complements the earlier OSPFv3 article and uses 2001:db8:ffff::/64 for infrastructure links, 192.0.2.0/26 for IPv4 loopbacks and links, and private AS 64496 as a reminder that IS-IS is the IGP while BGP stays separate.
How IS-IS differs from OSPF
| Aspect | OSPF | IS-IS |
|---|---|---|
| Transport | IP protocol 89 | Directly on layer 2 (CLNS) |
| Address families | OSPFv2 for IPv4, OSPFv3 for IPv6 | One process, multi-topology or single topology |
| Area boundary | On the router interface (ABR splits areas) | On the link: routers belong to an area; links are Level 1, Level 2, or both |
| Router identifier | Router ID | System ID inside a NET |
| Hierarchy | Backbone area 0 plus others | Level 2 backbone connecting Level 1 areas |
| Default timers | Hello 10 s | Hello 10 s with hold 30 s (per-implementation) |
The practical consequence of running over layer 2 is that IS-IS neighbours need no IP address to form an adjacency, so an IPv6-only link works the same as a dual-stack one. It also cannot be attacked from the internet as an IP protocol, though you should still authenticate it.
Addressing: the NET
IS-IS identifies a router by a NET (Network Entity Title), which looks unusual but is simple:
49.0001.1921.6800.1001.00
Read it as three parts: 49.0001 is the area (49 denotes a private area address, similar to RFC 1918 for NETs; 0001 is the area number), 1921.6800.1001 is the System ID, six bytes that must be unique in the routing domain, and 00 is the selector, always 00 for a router. Many operators derive the System ID from the router's loopback address, so 192.0.2.1 becomes 1920.0000.2001, padded to twelve digits in groups of three, which makes it recognisable in output. Whatever convention you choose, write it down and keep every System ID unique.
Levels in practice
IS-IS has two levels. Level 1 routers know their own area in detail and use the nearest Level 2 router for everything else. Level 2 routers form the backbone between areas. Level 1-2 routers sit on the border. A small network with fewer than a few dozen routers needs no hierarchy: make every router Level 2 only (or every router Level 1 only) and run one flat level. This avoids route leaking decisions and keeps the database simple. Only add areas when size or administrative separation requires it. Mixing levels carelessly, such as one Level 1-2 router and others Level 1 only, creates asymmetric paths and surprises.
An FRR configuration
interface lo
ip address 192.0.2.1/32
ipv6 address 2001:db8:ffff:1::1/128
ip router isis CORE
ipv6 router isis CORE
isis passive
!
interface eth1
description to-r2
ip address 192.0.2.5/31
ipv6 address 2001:db8:ffff:12::1/127
ip router isis CORE
ipv6 router isis CORE
isis network point-to-point
isis circuit-type level-2-only
isis hello-interval 3
isis hello-multiplier 3
!
router isis CORE
net 49.0001.1920.0000.2001.00
is-type level-2-only
metric-style wide
log-adjacency-changes
Notes on the choices. isis network point-to-point avoids electing a designated router on router-to-router links, giving faster adjacency and a smaller database. metric-style wide allows large metrics (the old narrow style limits a link to 63) and is required for modern features. The loopback is passive, advertised but not forming adjacencies. In FRR, interfaces on isisd also require isisd=yes in the daemons file before the process runs. Exact keywords vary slightly by version, so check your documentation, and note that these snippets were not run against production systems.
Metrics and design
Set link metrics deliberately, perhaps inversely proportional to bandwidth or reflecting latency, and keep the same convention everywhere. A flat default metric of 10 on every link makes the protocol count hops, which is rarely the intent. Use the overload bit (set-overload-bit in FRR) to take a router out of transit use before maintenance, a technique that parallels the BGP graceful shutdown article and drains traffic without a hard failure.
Authentication
Enable authentication on IS-IS adjacencies, using HMAC-SHA based keys where your software supports it, or at least a shared password on the interface or domain. It prevents accidental or hostile adjacencies from forming from a misconfigured device on a link.
Verification
show isis neighbor
show isis database
show isis route
show ipv6 route isis
show isis neighbor should list each peer in state Up, with the expected circuit type. show isis database shows each router's link-state packet; every router should appear once. If an adjacency refuses to form, check matching levels, a common area or compatible levels, matching authentication, MTU (IS-IS pads hellos to the interface MTU and will not form across an MTU mismatch), and that both ends enable the protocol on the interface.
When to pick which
IS-IS and OSPF both converge fast and scale well. Choose the one your team can operate confidently and your hardware supports. If you value one process for both address families, a quiet protocol surface, and an area model based on links, IS-IS is a strong option, even for a small network.
About IPYE
IPYE (https://my.ipye.com) leases IPv4, IPv6, and ASN space; a /48 IPv6 block is free for the first year. LOA, ROA, rDNS, and WHOIS are handled by IPYE. Locations: Los Angeles, New York, Ashburn, Salt Lake City, London, Amsterdam, and Frankfurt. Questions: ipye@turnel.com.
Disclosure: I run IPYE
Top comments (0)