IS-IS Foundations and Design

0:00IS-IS is the interior gateway routing protocol that's primarily used in the service provider world, but we're seeing it pop up more and more within the enterprises. Why is that? Why is IS-IS now making a comeback and going through a sort of Renaissance, so to speak? Here's the spoiler. It's because of DNA Center. DNA Center deploys IS-IS as part of its underlay automation. Now if you're following along because you're going to be going for the ENSLD certification, you're going for the E-N-S-L-D playlist, you're going to learn more about DNA Center later in this playlist.

0:34Or if you're just here and you want to learn more about DNA Center and the SD-Access fabric and LAN automation, you can click that little Search button up there and search for SD-Access and that'll get you going. But what we're going to do now is introduce IS-IS. What is IS-IS, how are the very basics of IS-IS working, how does it actually perform, how does it form neighbor adjacencies, and how do we understand metrics. That's what this skill is going to be all about is just setting up the foundation of how IS-IS works, then the next skill, what we're going to talk about is how to design an IS-IS enterprise campus.

1:08So get ready because this is going to be a lot of fun as we talk about this resurging interior gateway routing protocol, IS-IS. Let's get going.

0:00Now, I did say at the beginning of this particular skill that ISIS has a lot in common with OSPF. And guess what, it does. But we first have to set up one of the most important things about ISIS, and that's the levels. This is where things do deviate from OSPF just a little bit. Because guess what? ISIS originally wasn't created for IP networks. That's right, it was created for ISO networks. So what we're going to talk about in this particular Nugget is the different levels of an ISP network. And why that's important, we'll understand as the skill progresses, because you'll learn pretty quickly that ISIS operates on different levels.

0:38So get ready as we introduce some of the key terms that come with working with an ISIS network. Let's get going. The OSI model, we all know and love the OSI model. If you're like me, a few years back you were learning about the OSI model from Keith Barker in the network plus course. Remember, please do not throw sausage pizza away, I'll never forget it. The OSI model, the entire point of the OSI model is to logically design how traffic flows up or down within one particular host. So if traffic is trying to go out of a host, we see the traffic starts at the application layer and moves its way down to the physical layer.

1:14When traffic arrives at a host, it moves its way up from the physical layer, get's de-encapsulated and goes all the way up to the application layer. The cool thing about these standards organizations is that this isn't just where describing how traffic flows stopped. In other standards organizations, they designed how traffic flows throughout a network and throughout an autonomous system. And that's what we're going to talk about here in this Nugget. Is how ISIS, and really the ISO, defined levels of how traffic gets flown throughout a network. Let's start off with the most basic form of communication, and this is going to be a level zero communication.

1:50We have a computer here. This is just going to be an endpoint, and that's actually a critical talking point, right out of the gate. Is that, within ISIS, we define endpoints as ES'. These are endpoint systems. Our devices that are performing routing could be things like layer three switches here, or routers. Within ISIS these are called, guess what? IS'. So we see that we basically have two types of devices. We're already setting up some pretty important definitions. When it comes to ISIS we have ES', which define our endpoints.

2:23And we have IS' which are intermediate systems. These are what perform the routing actions and network traffic flows within our area and autonomous system. So the entire point of defining levels is to define what kinds of traffic flows can take place. Let's pretend for a moment that this switch right here is performing layer three connectivity and routing options, like Inter-VLAN routing. When this endpoint system connects into the switch and it uses this switch as its default gateway, those communications are considered level zero communications.

2:59Whenever the switch needs to route packets to the next IS, these are considered level one communications. Now here's the cool part, there's only two more levels to go. We've already halfway there. When an endpoint system, when an end system is communicating to an IS, we then have what's called level zero. And when an IS communicates to another IS, we have level one. But there is one gotcha right there about that level one communication. We are still talking about a link state routing protocol at the end of the day.

3:30And link state routing protocols love the concepts of areas. Areas help us segment our traffic and then it allows us to scale a lot better when it comes to traffic. So for instance, my organization may be geographically large. And I may define this as my United States area, and I may have a completely different area across the world that looks very similar. We're just going to draw it up right here, but I'll use a different color to segment this right here.

4:00I know, I kind of drew off the screen. Here I'll use a different color to draw this up here. This may be a different area. So we'll say this United States area is area 10, just for fun. And we'll say over here, this is the United Kingdom. And we'll say this is going to be area 20. When communication takes place between these two IS', between different areas, we call this inter-area routing. This is going to be a level 2 communication. So to recap, we've got level zero, which is our ES communicating to its local IS, this is basically on the same subnet.

4:34We have an IS communicating to another IS, this is any network traffic that exists within one area. So we're not just talking about directly connected traffic. This could be a router communicating to a router that's 10 hops away, but they're still within the same area. That's level one. Then we go into level two communications, which is when IS' communicate within different areas. And then, as I promised, there was a third level, that was level zero. And that's when we communicate to an IS that's not even within our autonomous system.

5:07So this would be, I'm like writing way up here on top of the screen, this would be like if we're appearing with an entirely different company to share routes using ISIS. That would be a level three communication. Now, on Cisco devices they only operate ISIS on level one and level two. So really the only levels that you need to know about are ISIS level one and level two. And recall again, what we're really talking about here. ISIS level one is intra-area routing. Think about that in terms of OSPF.

5:37This is routers who are trying to communicate to each other within the same area. So if we have area 10 in OSPF, and there's 30 routers within that. If any of those routers are communicating to each other in any way, that's going to be an intra-area route. And in ISIS terms, that's a level one route. Now, if we're talking about inter-area routing, we still own these areas. We have routers that are communicating between areas, we have a level two route. Now this is where things start to differ from OSPF a little bit, is when inter-area routing comes up.

6:08And that's what we're going to talk about over the next couple of Nuggets. It's just critical to understand, right now, what level one and level two routes are all about. Because that sets up how our routers, or IS', are really going to behave when it comes time to deploy and design an ISIS network. So that sets up the IS levels, levels zero through three. Really honing in on levels one and two. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00So we've now talked about how the different levels work throughout a network. And I think that's a really cool way that we can identify the different types of traffic that could take place throughout a network, throughout an autonomous system, or between different autonomous systems. I really, really like how that is set up. So that sets up how things are different from OSPF and ISIS. Now what we need to talk about is the similarities. And what we're going to talk about here in this Nugget is how areas work within ISIS. There's a lot of things that are familiar here, but it is a little different, so let's talk about how areas work within ISIS.

0:32Let's go. So now it's time to talk about how areas work within ISIS. We talked about levels, Level 1 and Level 2, and we understand that IS's that communicate within an area, that's a Level 1 communication, and IS's that communicate between areas, that inter-area routing, that's Level 2 communication. Now when it comes to areas themselves within ISIS, it's very similar to OSPF with one key critical difference. What I'm going to do is I'm going to draw areas. Here we go. We'll call this let's just say Area 1, and over here I'll say we have Area 2.

1:05Think about OSPF for one second. What was one critical law about OSPF that must exist in order to make OSPF work or at least in a large OSPF thing? They all had to have Area 0, right? In ISIS, you do not have to have Area 0. You don't have to have really any area as mandatory at all. There's not one area that is defined as mandatory at all in ISIS. So technically there's nothing that would stop me from taking this router here, and this router here, and forming a direct adjacency.

1:41This would be a Level 2 communication. And then from within that we would have all of these routers over here and these would form Level 1 communications because they'd all be communicating within the same area. And it looks something like this. So immediately this sets up a pretty big talking point as there is no need whatsoever for a backbone within ISIS. Area 0 is not mandatory. But maybe we should still have one. It is the best design practice in order to have any sort of transit traffic, meaning traffic going from one area destined to another area.

2:15It is probably best to have a transit fabric or a transit area. So we should design an area for traffic to be transmitted through. And most importantly, all of the routers in here should be performing Level 2 operations. Why does that matter? Why does it need to be Level 2 in the transit area? That's really what the next Nugget is all about. And it was probably the biggest nuance or learning point in all of ISIS. I'm just setting up right now one of the critical things that you should know about ISIS areas.

2:46The thing that you should know is that Level 2 communications can take place between any area, but it is a best practice if there's going to be area communication to have a transit fabric or a transit area handling that. And beyond that, differing from OSPF it does not have to be Area 0. This very well could be Area 49 for all we know. So this takes our skills about knowing about the IS levels intra-area routing and inter-area routing, and it starts applying it to that design concept.

3:20If we're going to have inter-area routing, it's probably best that we have a transit area to handle it, unless our organization is particularly small and we really only need the two areas. But we also keep in mind where Level 1 communications and Level 2 communications take place. And lastly, the critical thing to understand is that our transit area does not need to be explicitly named Area 0. We can name it any area that we want. And that's where predominantly our Level 2 communications are going to take place. Now how does that really work and what does that really mean?

3:50That's what the next Nugget's it's all about. In the meantime, this is understanding how areas work within ISIS. I hope this has been informative for you and I'd like to thank you for viewing.

0:00So at this point in our journey, we have seen the IS levels themselves, which define how traffic is moving throughout an area, or between areas or autonomous systems, and we've also talked about the areas themselves-- a familiar concept from other link-state routing protocols like OSPF. How routers behave within a level and within an area in is-is is a big deal. It's honestly probably the most complicated part to all of is-is. So what we're going to do in this Nugget is break down how a router gets assigned to an area, and how it behaves within a level or between levels before we jump into the actual CLI and see it in action.

0:36So let's get going. OK, so this is where it all starts to come together, but this is also where it gets a little complicated. This is where the is-is behavior really starts to shine, and where we can really start to compare and contrast it to OSPF. What we're going to talk about now is how routers know whether they're communicating within IS level 1 or IS level 2. And this is really it. At the end of the day, when we fire up a router and we tell it, you're going to be running is-is, we tell it what kind of communications it can do.

1:07For instance, we'll enter the router is-is command on the command line. Now, no, we don't specify a process ID or any sort of autonomous system number. It's just router is-is. And then we tell it with the istype command what level it's going to operate at. This could be at level 1. This could be at level 2. Or this could be level 1-2. And it's absolutely, positively, explicitly critical to make sure that we set these when it's time to deploy our is-is network, because this will determine how neighbor adjacencies can even be formed in the first place.

1:47Let's start off by talking about when we set it to IS type level 1. When we tell router that it is IS type level 1, it will only ever form a neighbor adjacency-- absolutely critical-- it will only ever form a neighbor adjacency to other routers that are IS type level 1, and-- underlining that and-- the area number matches. This is why I set up that very first Nugget about what level 1 communications even were. Remember, level 1 communications were intra-area routing.

2:22That means that level 1 communications are only allowed to take place within the area. So our level 1 routers, when they are IS type level 1 right here-- they should never be able to perform a level 2 route. They have to be a level 1 router, and they have to know that the route-- the packet that's being transferred right now-- is existing within the same network. So if I were to circle this right here and say this is area 1, and then I, over here, create a different area-- just like this-- and on these two routers I type the command router is-is istype level-1, as long as the area numbers match on both of these devices-- let's say this is area 2-- and both of these routers believe they're in area 2, this neighbor adjacency will come to life as well.

3:14However, this communication-- the level 2 communication right here, between these areas-- this will never, ever take place. Big X right here. Level 1 routers are only allowed to route traffic at the level 1 area, at the level 1-- well, level. Intra-area routing. So this is really the first big thing you need to take away from is-is learning, is that level 1 routers will only form neighbor relationships to other level 1 routers that are in the same area.

3:45Now we're going to clean up the screen and talk about level 2. Recall, again, what was the entire point about level 2. Level 2 was interarea routing. So if I have my same router right here and it believes that it is in area 1, but instead I type the router is-is command and I say istype is level 2, then over here I have another router, and it believes it is in area 2, but similarly, I type the router is-is command and istype level 2, these two can and will form a neighbor adjacency to each other, because the entire point of level 2 is to permit this interarea routing.

4:31This is to go from one area to another area. Now, here's the quiz question for you. If I have another router down here and it is level 1 in area 1, do you think this neighbor adjacency will form? Go ahead and pause it if you need to. Just think through this one. Rewind it and watch what we said about the level 1 routers, and then come back to this and see if you can answer this question. Do you think that the level 1 router will form a connection to a level 2 router in the same area? The answer is no.

5:01It will not. A level 1 router is only explicitly allowed to form a neighbor adjacency to a level 1 router in the same area. If it sees a level 2 router, like this guy right here that has been explicitly told to operate at level 2, it thinks, then, that it may be routing traffic to an interarea router, and this violates all it knows about intra-area routing in level 1. So this begs the question, what happens, then, when an [INAUDIBLE] that's located down here needs to communicate to an [INAUDIBLE] that's down here?

5:33There's clearly a hard line, or a big wall, that separates our level 1 routers from our level 2 routers, so how do we handle this situation? Enter the level 1-2 router. So now what we're talking about is typing the router is-is command, and typing istype level-1-2. In this case, the router acts as both. And this is a critical talking point. Think about the OSPF database for one second. Every LSA that it receives, it stores in a database.

6:03Well, this is an awesome talking point about is-is. is-is also has an is-is database, and it maintains a database for each level that it knows about. So let's say I have my router here-- one more time-- that sits on the edge of area 1, and I have my router here that sits on the edge of area 2. When we've configured each of these routers for level 1 and level 2, what begins to happen is they will send out level 1 hello's as well as level to hello's.

6:38When this area here receives the level one hello from the area 2 router, it's going to say, well, I'm going to try and form a level 1 adjacency, because I prefer level 1, but I see that you are in a different area, so I cannot form a level 1 adjacency. Then it attempts to send out level 2 hello's, and the adjacency comes to life, because it allows intra-area routing. So this adjacency and all of the routes that it learns here is stored in the level 2 database. Then a similar action happens over here with my level 1 router.

7:10These two will exchange level 1 hello's, and because they're in the same area, this adjacency comes to life. And all of the routes that this router learns from level 1 will be stored in the level 1 database. Now, probably the most interesting and fascinating part about all of this is how, then, do our [INAUDIBLE] systems, like this guy over here, make its way into an interarea route? When this device recognizes that it is a level 1-2 router and it has routes within both level 1 database and level 2 database, in the level 1 area, it will then send in basically a notification that I am your exit point out of the area, and these devices-- all of the other level 1 routers-- will receive basically a default route destined for the level 1-2 router.

7:59In OSPF terms, this is almost identical to a total NSSA. The area 1 in this case would have a default route to anywhere else-- we do allow redistribution in at this point-- but it would maintain a database of all of the intra-area routes that are available within that area. So this is kind of the "nuance-y" part about learning is-is. Let's kind of break it all down. If we have level 1, area 1, forming a relationship to level 1, area 1, we get a checkmark.

8:30If we have level 1, area 1 trying to form a relationship to level 1, area 2, you get a big X. If you have level 1, area 1 trying to form a relationship to level 2, anything, you get a big X. If you have level 1, area 1 trying to form a relationship to a level 1-2 that is also represented as area 1, you get a checkmark. If you've got level 1, area 1 trying to form a relationship to level 1-2 in a different area-- like area 2-- you get a big, red X. Then lastly, if you have level 2 forming a relationship to level 2, you get a checkmark.

9:11Why does this matter? Why is it like this? This really comes down to design. And when you actually get into the next skill, when we talk about design considerations for a three-tier or a two-tier enterprise campus, this will all make a whole lot more sense. It's actually going to start to come to play in the next couple of Nuggets when we jump into a CLI and start actually building out the configuration of these devices. But then when you see it on the enterprise campus, you'll go, oh, OK, that's why is-is works the way it does, and it's actually pretty cool. It's actually really nice. So that's been explaining the IS levels and how they interact with each other, and how neighbor adjacencies can really come to life.

9:48Also keep in mind that there's separate databases for level 1 and level 2. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00So we've thrown a lot of concepts at you at this point, and there's one last concept that we're going to throw at you. But don't worry, we're going to do some CLI action and actually get our first win when it comes to configuring IS-IS on a particular router. In this Nugget, what we're going to set up is the NET-- not the internet, not the network. We're talking the Network Entity Title. This is critical for IS-IS because this is how an IS, or a router, really identifies itself as well as which area it belongs to. So let's get going talking about the NET.

0:31So the next part that we're going to be doing now is actually getting our IS-IS environment built out. You see I've got a little topology here that we can play with. It's got two areas where we can set up some intra-area routing as well as some inter-area routing, and that's what we're going to be exploring throughout the next couple Nuggets. But notice there's one important factor that we haven't talked about. We have talked about how to enable IS-IS with the router IS-IS command. We have talked about how a IS device, or a router, knows which level it's allowed to participate in with the IS-type level command.

1:04We could specify a level 1, level 2, or level 1-2. But how does a router know who the router is or what area it belongs to? This would be akin to OSPF's router ID and then area statement. Those are two separate statements that are combined together in one statement here within IS-IS. What we're talking about is the NET command. And NET stands actually for Network Entity Title. The network entity title does-- well, honestly-- a whole bunch of things within non-IP networks.

1:37This is how a device would identify not only who it is, what area it belongs to but also what kind of traffic it's carrying within a packet. Now it also varies in length. It has multiple sections or pieces that build it up. And in traditional Cisco configurations, it is broken up into six 16-bit sections. It looks something like this. The first 16-bit section traditionally is pretty much always almost 49. This is called the AFI, and you really only need to know that for trivia whenever you're out at a networking trivia thing.

2:13The next 16-bit section is the actual area itself. So if this device-- or these devices-- were in area 1, we would write 0001. Then the following three 16-bit sections are going to be something that uniquely identifies the ISs on the network. This could be something like a Mac address. A Mac address is 48 bits long, so three 16-bit, 48 bits. You could use a Mac address because it's going to be unique and it could identify this IS uniquely on the network.

2:44For simplicity's sake, for like router 1, we could do 0000.0000-- whoop, one more zero-- 0001. And then, lastly, we type 00 here. The 00 at the very end octet basically tells other devices, this is me identifying myself, otherwise we would be identifying what kind of traffic we're carrying throughout the network, and that's not what IS-IS over an IP network is all about. So breaking it down, we start off with 49, and we end with a 00.

3:17In the middle, we have our area ID followed by something that uniquely identifies our devices. So I'm just going to hide this from the screen for a moment. I'm going to bring up the console of all of these devices, so that we can configure the NET on each one of these devices. And you can see how that looks and feels as you start to deploy IS-IS in your network. So what we're going to do as a good first step to deploying IS-IS is just make sure that all of the devices have their NET configure. This is going to be a unique way to identify the devices on their network.

3:47Now I'm going to show you how to do this the easy way. And then I'm going to show you how to do this, probably, the correct way when we get to the very last router R6 here. Let's start off with R1 and get started configuring a NET within IS-IS. It's pretty straightforward. We go into configuration mode. We say router IS-IS, and then we just type the command NET followed by the actual numbers that we specified earlier. Now if I bring the actual writing here up on the screen, we see we've got 49-- that's what we're always starting with-- our area number, something to uniquely identify it for the next 48 bits, and then we end with 00.

4:21So considering R1 is in area 1, I'm going to type 49, 1, 2, 3, then area 1-- that's going to be 0001-- then something to uniquely identify this router on the network. So I'll say 0000.0000.0001 then 00, and I press Enter. I can do almost the exact same thing here for router 2. We'll say configuration terminal, router IS-IS, then we'll give it a NET, again, 49. This is still going to be in area 1, so I'll say 0001.

4:55Then we'll give it a unique address 0000.0000.0002.00. So we see that the 49 is the same, and the 0001-- the area-- is going to be the same. It's unique identifier is separated by this last little bit right here setting it to 2. I guess I should say 4 bits, but you get my point-- 2. Now R3, this is what's going to be our inter-area communicator. We're going to talk about how that's going to work later. For now, what we're going to do is we're going to be setting in the configuration one more time for router IS-IS.

5:29The NET is going to be 49. And if I look at my diagram, I see this is still within area 1. So I'll say 0001, then we'll get this unique identifier ending with a 3.00. Shifting gears a little bit, now we're moving on to R4. And we're breaking into the purple area, so we're going to be specifying a new area this time. Going into configuration mode, I'll say router IS-IS. The NET is going to be 49.0002 this time, and we'll give it a unique identifier within this area.

6:03So I could do something like 1 in this case if I wanted to because we're now specifying an identifier in a different area. But just to keep things nice and clean, I'm going to set this to be 4, so I know it's router 4. Now router 5, again, this is going to be in area 2. We'll say router IS-IS, and the NET 49.0002-- whoop, too many zeros. There we go. We'll give this a unique identifier of 05. Oh. And it tells me-- see I accidentally hit Enter too early. It says this isn't long enough for our Cisco standards of IS-IS implementation.

6:36I got to add that dot 00 on the end to press Enter. Now I did say I was going to switch it up a little bit for router 6. Here's what I'm going to do for router 6. I'm actually going to say, show interface Ethernet 0/0, and I'm going to copy this Mac address right here. That way this will probably a real way that you implement this in the real world is based on a Mac address. So with that highlighted, this Mac address up here, I'm going to go into configuration mode. I'm going to say router IS-IS. We're going to say it's going to be in area 2, but now I'm going to paste in that Mac address and end it with 00.

7:10See this is a really clean way to handle uniquely identifying a bunch of different routers that are going to be out there in the wild is by Mac address. Now it doesn't help me in the instance that I need to figure out like-- well, is this R6 or not? But IS-IS actually has that covered with neighbor adjacencies because it collects the hostname when it forms an adjacency. It's really cool, and we're going to see that in the next couple of Nuggets. So that's been understanding what the NET, the Network Entity Title, does for us and how we can configure it on the command line. In the next few Nuggets, we're going to bring this thing to life by deploying level 1, level 2, and level 1-2 neighbor adjacencies.

7:44We'll even do some packet captures to see how this adjacency comes to life. So that's been understanding the NET, I hope this has been informative for you, and I'd like to thank you for viewing.

0:00All right, we've thrown a lot of concepts out there at this point. We've talked a lot about levels. We've talked a little bit about areas. And we've talked about how routers or ISes actually behave when they're assigned to a specific type of level or within a specific type of area. Now it's time to see it in action. What we're going to do in this Nugget is form our first neighbor adjacency between two level 1 ISes. Let's get going. Now, we did a whole lot of talking about the functionality and how IS-IS really works, only to get to this point where it's time to actually implement IS-IS.

0:31And what you're going to find out is it's a little anticlimactic because there's really only two or three commands. We've got the NET command. We've got to tell it what level it's going to operate in. And then we just turn it on on the interfaces. That's really it. What we're going to do in this Nugget is we're going to actually deploy a level 1 IS-IS relationship and validate that it comes to life. We're also going to do a packet capture when it comes time to bring this IS-IS relationship to life. So here we go. I'm back here on router 1. And what you can see here is we've done router isis.

1:01And we've given it its net address. Now what we need to do is set the is-type. If I hit question mark, you can see what our options are here. We've got level 1, level 1-2, and level 2-only. So looking at my diagram, what we want is we want router 1 to be level 1 and router 2 to be level 1. And this is where we're going to be focusing right now in this Nugget. We're just going to be bringing this relationship to life. Then we'll jump over here to router 5 and router 6 and bring those level 1 relationships to life.

1:34So here we go with my is-type already typed out for me, I'm going to set this to be level 1 and press Enter. That tells R1, you are going to be a level 1 only router. And when it goes through again, all of those things that we already know about level 1 routers-- they can only form adjacencies to other level 1 routers within the same area. And we identify that area in the NET command. So we shouldn't have any issues bringing our router 2 into the IS-IS neighbor adjacency. So just like we did before, I'm going to type is-type type level-1 right here.

2:06And now both of these routers are configured with a net, an identifier identifying their area, as well as understanding what level they're allowed to participate, and ultimately, how many databases they need to store. Now what we need to do is we need to turn IS-IS on on the specific interfaces that they want to find neighbors on. I did it this way because it's actually pretty fascinating to me how IS-IS really works under the hood. I'll go into Ethernet 0 here. And the command is ip router isis. That's it.

2:37That's it. IS-IS is now advertising level 1 hello packets out this particular interface. And before I type the command here on router 2, what I'm going to do is I'm going to start a Wireshark packet capture here with an EVE-NG. I'm going to go to capture. And I'm going to capture right there on Ethernet 0, right here. That way we can see how this neighbor adjacency comes to life. I think you're going to find this pretty fascinating. Here comes the packet capture. I'm going to click OK. And now I'm going to bring my terminal back up here.

3:08And we're going to go ahead and configure exit. We're going to go into interface ethernet 0/0. And we're going to turn ip router isis on. In the background, this IS-IS neighbor relationship should be coming to life right now. In fact, if I exit out and I give it a show isis neighbors, real quick, look at that. I already see that I've got an IS-IS neighbor adjacency showing up as up. Check this out. That system ID? See, I did tell you, it's going to grab that hostname, which I think is pretty fascinating. It also figures out which interface this is on. And it tells me what circuit I belong to, too.

3:41This is router 2. So let's jump back to the packet capture real quick and see how this neighbor adjacency came to life. I'm going to hit Stop here and filter this out by IS-IS. What's the most fascinating thing you see right here on the screen right now? It's kind of grayed out. If I hover over it, maybe you can see it a little bit better. What is so fascinating about this? Look at this-- the source and the destination, if I actually expand it a little bit right there, look at this. This neighbor adjacency and all IS-IS operations take place on layer 2.

4:13That's right. We can actually form IS-IS neighbor adjacencies without an IP address. There's no multicast happening here. There's no broadcast. It's just layer 2 connectivity. And this is actually one of the key design talking points about why you would choose IS-IS over different routing protocols because neighbor adjacencies take place without IP addresses if we want it to. I have to believe this is one of the key reasons why the developers who deployed DNA Center actually chose to deploy DNA Center because that way we could actually form neighbor adjacencies between all of our different edge or border nodes or intermediate nodes.

4:49And even if something is going wrong with the IP routing at layer 3, we can still maintain IS-IS neighbor adjacencies at layer 2. So if I expand the protocol here a little bit, what you see is we have hello packets going back and forth. Hovering over, it we see that the 01 here, this is actually the MAC address of R1. And the 02 right above it, that's the MAC address of R2. We see where the hellos have now gone back and forth. And they found each other. And then enters the LSPs. Within OSPF, we have LSAs, LSUs, LSAcks, LSDBs.

5:23We have link state updates, link state. You get the idea. We've got all of these different things. Within IS-IS, there are just LSPs-- link state, which is actually PDUs, protocol data units. That's right. IS-IS is communicating these updates, again, over layer 2, using LSPs. And this adjacency came to life because we're using level 1. Again, pay very close attention to this. Because we specified that both of these devices were going to be level 1 routers, they will only send level 1 hellos.

5:55If you look in these destinations right here, they're only going to level 1 hello MAC addresses. See? IS-IS, all level 1 ISes, that's the destination. If we explore the actual LSP, you can scroll it down and you can see the different bits of data that are actually contained within the IS-IS datagram. We actually see the hostname. We see the protocols that are supported. We see the area that's given here. Beyond that, we see the IP addresses that it's connected to and their metrics associated with it.

6:27Now, what are the metrics of IS-IS? That's also another major talking point. We're going to save that as we get further along in the course because we've covered a lot right here at this point. What we're going to do now in the next Nugget is form a layer 2 adjacency, almost the exact same way we did here, but then do a packet capture to see how that layer 2 adjacency came to life as well just to differentiate those level 1 hellos versus those level 2 hellos. In the meantime, this has been how to get a level 1 adjacency brought to life. I hope this has been informative for you. And I'd like to thank you for viewing.

0:00Now let's mix things up and talk about inter-area communications and bring Level-2 into the mix. What we're going to do in this nugget is form level two adjacencies, between two different routers in this case, and see how the Level-2 interactions take place before we jump into the final concept, and that's going to be the Level-1-Level-2 routers. So now what we need to do is, we need to bring a Level-2 adjacency to life so that we can perform some inter-area routing. And this one's going to be a lot of fun, because this is where we'll get to see the subtle nuances of how those levels actually play in here for us.

0:31We're going to form a Level-2 adjacency right here, and this is going to be Level-2 only, just for this particular nugget. The reason why I'm doing Level-2 only is, first of all, I want to see what the Level 2 adjacency steps look like. Beyond that, I want to see what happens when we try to form this adjacency when we already R2 to be Level-1 only. This will prove to us that a Level-1 router, even if it's in the same area, won't form an adjacency to a Level-2 router. So let's jump on R3 and R4 real quick.

1:01Here I am on R3, and if I go give it a show run section isis, we'll see real quick I've only configured the net. So let's go into router isis, and we'll set the is-type to be Level-2 only. I'm going to perform the same action over here on R4. We'll go into config mode, router isis. We'll say is-type is Level-2 only. Now, if I look at my diagram real quick, I see this is going to be ethernet 0/1 on R3 and ethernet 0/0 on R4.

1:36So on R3, I'm going to go into ethernet 0/1, and I'm going to turn isis on. Over here on R4, I'm going to go into ethernet 0/0, but before I turn isis on, I'm going to start the packet capture one more time. Let's capture 0/0, and the packet capture's coming to life. So here I go, I'm going to turn isis on. And I should only expect to see Level-2 data going back and forth this time, as well as the updates. As I'm watching it right here, I see the hellos and the LSPs coming up, so that means the adjacency is probably brought to life.

2:08If I hit end to give it to show isis neighbors, there we go. I see I have an up state right here with this neighbor on R3. So let's stop the packet capture and take a look at what we got here. Filtering out isis one more time, I think it's really important to point out that, because we specified this is a Level-2 only, we only see the destination addresses at layer 2 destined for the Level-2 only isis address. Here we go at layer 2, and now we have a different destination MAC address, because this is only trying to communicate and form adjacencies with Level-2 addresses.

2:44Notice that this neighbor adjacency also came to life, regardless of what the area ID was. In fact, if I go back to the command line and I say show isis neighbors detail, we can now actually see, it tells us what area the neighbor is in. This says the area address is 49.0001 for our neighbor, when we, on R4, know that we are in 49.0002. So this emphasizes the point that the entire purpose of Level-2 routers is to form adjacencies between discontiguous areas, and it allows routing and neighbor adjacencies to happen between different areas.

3:22Now here's the real kicker. R3 now has a neighbor relationship right here to R3 and R4, but can it form a relationship to R2? R2 is a Level-1 router. So on R2, I'm going to go into ethernet 0/1, I'm going to turn isis on, and R3 here-- what was it? Ethernet 0/0? It sure was. I'm going to go into interface ethernet 0/0 and turn on IP router isis. If I perform the packet capture here on 0/0, and filter out by isis I see Level-1 packets coming in from router 2, and Level-2 packets going out from router 3, but that's where the buck stops.

4:03All I'm seeing are hello packets being sent back and forth here. And because they don't line up with each other, because they're not Level-1 both, these two will not form a neighbor adjacency. So if I say show isis neighbors real quick, we see I still only have one neighbor adjacency, and that's at my Level-2 route. So how do we fix this problem again? We need to have packets from one area traversing to the other area. And that's where we change our is-type to be the Level-1-Level-2 routers. And that's what we're going to do in the next nugget.

4:33In the meantime, this has been understanding the Level-2 communication and neighbor adjacency process. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00So we've got level-1 routers, and we've got level-2 routers, or I should say ISes. And they aren't able to form that neighbor adjacency to each other. That could be a problem. We actually need to perform inter-area communications inter the level-1, level-2 IS. In this Nugget, what we're going to do is break down how the level-1, level-2 IS actually works, and see how it alters the behavior within different areas. Let's get going with that. So the final piece to the puzzle is going to be bringing the inter-area communication to life.

0:30And we know that this is kind of an issue because of the limitation of level 1. Level-1 routers, or level-1 ISes, cannot form neighbor adjacencies to level-2 ISes, though the entire point of level-2 ISes is so that we can allow traffic to go between areas. That's why our routers that are sitting on the edges of our areas actually have to run both. And they have to keep databases for both level. So that's what we're going to do in this Nugget, is we're actually going to set up and change R3 and R4, which were here on our topology, to be level-1, level-2 routers.

1:04That way they can form level-1 adjacencies within their area as well as level-2 adjacencies between areas. So here we go. On R3, since this is a lab environment, I'm just going to wipe it out-- no router isis. There we go. Now I'm going to jump back into router isis. We'll give it the net command, give it 49.0001, because R3 was in area 1. We'll say 0000.0000.0003.00. Now I'll say my IS type is level-1-2, even though that's actually the default behavior.

1:36The default behavior is to be a level-1, level-2 router and maintain two databases. Now, the issue with this is a design perspective point. You don't want to run every single router as a level-1, level-2 router, because first of all, you could bring up adjacencies that you didn't mean to bring up. But second of all, now these devices are maintaining two separate databases that could be a scalable or a CPU issue, especially on older legacy devices, too. Let's do the same thing over here on R4. We'll go into config mode. We'll go into router isis.

2:06Actually, no, we're going to say no router isis. Bye, router isis. And then we'll go back into router isis. We'll give it the net 49.0002, give it the unique address of 4.00. We'll say its IS type is going to be level-1-2, just to explicitly set that. And then on its interfaces, we'll just make sure. Let's say do show run interface ethernet 0/0. It should already be there. It's not. Interesting point. When we say no router isis, it wipes that configuration off of the ethernet addresses, too.

2:41So if I check out both of these configs on either of these ethernet addresses, guess what-- the isis command is gone, so no adjacencies are being brought up right now. So let's go into interface range ethernet 0/0-1 and say ip router isis. I'll do the same thing on R3 over here. I'll go into interface range ethernet 0/0-1 and say ip router isis. It should only take a second or two for these neighbor adjacencies to come to life. So I'll say show isis neighbors, and look.

3:12Now we have a level-1 adjacency to R2 and a level-2 adjacency to R4. If I jump over here on R4, I'll say, show isis neighbors. And I see the same thing, because we set it up on the other side. We've got a level-2 adjacency to R3 and a level-1 adjacency to R5. So on R4, I can actually specify my show isis database. And look, I can even specify which database I want to look into, with the question mark. I can specify level 1 or level 2, or I can specify, give me details.

3:45You get the idea. I press Enter here, and it shows me both the level-1 link state database as well as the level-2 link state database. So R4 learns about R3 and all of the links about R3. This is another critical point, is that as traffic traverses one area to the next area, it doesn't advertise every single link or every single link state update or link state advertisement that took place in that other area. So to explain that further, here we have area 1.

4:15And there are nothing but LSPs taking place here. And R3 knows about every single link within this area. When it comes time to advertise those links to R4, it doesn't forward all of those lSPs. It's kind of like the summary LSA in OSPF. R3 just tells R4, hey, if you want to reach any of these networks, just send it to me. So R4 knows about all the networks via R3. If in fact I prove it with show ip route, look at this-- you can see the level-2 routes that were learned via the level-2 communication.

4:51And this sets up the next major, major talking point, and that's what metrics does it use? How did it know that the metric was 10, 20, 30? This is kind of a crazy thing, but it's the honest truth. Every link, by default, regardless of bandwidth, regardless of delay, regardless of anything-- on a Cisco router, every single link has a metric of 10 on an IS-IS router or an IS device within Cisco programming. That's it. That's it. So as each hop it goes, it just increments by 10. That's really it. That's how it finds the best path through IS-IS.

5:23And 10 actually meets a limitation. It can only get so big, which is why, 9 times out of 10, they introduce something called wide metrics. So when you go into router isis configuration mode, what you want to do is you want to set the metric style to wide. And you want to do this on every router, so they all know they're talking the same language. We'll say metric-style wide. And I'm just going to go ahead and do this on every router in the environment, so they're all communicating with wide metrics. And then once this is all configured, we'll talk about what those wide metrics really did for us.

5:55So now if I jump back to R1 and I give it a show ip route, we'll see, well, look, there's a few interesting things here. First of all, the metric itself didn't actually change. But when we set it to wide metrics, what we're really allowing it to do is not reach that maximum metric in case it's got to go many, many, many hops away. By default, you really just want to set your metrics to be wide. That way we could support really large metrics and then define the best path that way. Beyond that, look at this. Now we have the default route that was injected because it learned that there was a level-1, level-2 boundary.

6:30Something that's worth pointing out about this. If R3 had not formed a layer-2 adjacency, it would have just continued to operate as a level-1 router only. So this default route would have never actually been injected if R3 had not formed the level-2 adjacency. But as soon as it did form the level-2 adjacency, R3 began advertising that it was a level-1, level-2 router, and then all of the devices installed a default route. So if I look on R6 real quick and I give it a show ip interface brief, I see it has the IP address of 10.100.100.2.

7:06Can R1 ping 10.100.100.2? There we go. Round-trip traffic. So that's it. That's how we actually go about configuring and implementing inter-area routing within an IS-IS domain. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00So there you have it-- the basic foundations of IS-IS. We've covered things like what the levels really are, how we identify areas, especially within the net. And the different IS types or the different levels that an IS can participate in drastically alters its behavior within the actual IS-IS protocol or within the areas that they're communicating in. So that's been understanding the basics of getting IS-IS up and running. I hope this has been informative for you and I'd like to thank you for viewing.

0:00So with the IS-IS foundations in place, we now understand how IS-IS operates. We understand what the net does, how areas work, and most importantly, how the levels impact the behavior of a router. Now it's time to actually deploy IS-IS. And we have to make some very important decisions about how IS-IS is going to look with an enterprise infrastructure. That way, we can make sure that we set up the three key components to an enterprise network design. IS-IS needs to be secure, IS-IS needs to be stable, and IS-IS needs to be scalable.

0:32So by the end of this skill, we'll understand how to design and deploy an IS-IS network that is secure, stable, and scalable. Get ready. It's going to be a lot of fun as we get going with designing an IS-IS network. Let's go.

0:00Our first and arguably most important task when designing an IS-IS network is going to be making sure that it is secure. And lucky for us, designing the IS-IS security is actually pretty simple. But it is a little nuanced, too. Because IS-IS security can be set at three different layers. So by the end of this Nugget, what we'll understand is where and how we can configure IS-IS authentication and security. Let's get going. One of the top reasons that you would actually go with IS-IS, I argue, is the security aspects to it, because you can make neighbor adjacencies airtight as to who is allowed to come to life.

0:36Because we can apply security policies-- basically password authentication-- in three different spaces to control who is allowed to come up or bring neighbor adjacencies into our environment. Check this out. The first example we're going to do is we're going to specify a password is required for a neighbor adjacency to come up on a specific link. So what we're going to be looking at is applying a password to ethernet 0/0 here and ethernet 0/0 here. That way, R1 and R2 will only form a neighbor adjacency if a password matches on either side here.

1:12And it is worth pointing out right now that IS-IS uses HMAC-MD5 in order to encrypt the password. So that way, we have that as an option. Beyond that, we have the ability to encrypt the password within the running configuration as well, so somebody can't come along and type show run and then see the password. Now, for this case, what we're going to do is we are just going to demonstrate how we can apply a password on the interface level. And you're going to be surprised at how easy it is. Let's jump over to router 1 here. And we're going to go into configuration mode, and then interface ethernet 0/0, which is where we want to set the password.

1:46All we have to do is say isis password, and guess what-- we type in our secret password here. So let's call this password something simple like r1r2. That way we know this is the connection from router 1 to router 2. When I press Enter here, this is going to start performing the authentication attempts, and it will bring down the neighbor adjacency to R2. So what I need to do now is I need to go set that password over on R2. Just to verify real quick, let's exit out, show isis neighbors, and look, we have no neighbors. If I also do show ip route, I see that I have no level-1 routes operating within my environment.

2:21So let's jump over to R2 now, and we'll go into configuration mode. I'm going to go into interface ethernet 0/0. And I'll say isis password one more time, and we said it was r1r2. If I bring that password into play here, authentication should now be taking place. And if I give it a show isis neighbors, I see my neighbor adjacency back to R1 is back up and alive. If I jump over to R1 here, let's give it a show ip route, and there we go-- my level-1 routes are now installed back into the environment. That's really cool, because now we can control on a per-link basis who is allowed to authenticate.

2:56And this really works well within the core of our network. This is where the core of our network is going to have most of our level-1, level-2 connections, or just pure level-2 connections. And that way anybody with a different area can't just jump in and connect into our network and start injecting routes into our IS-IS topology. So controlling it at the link level is going to be important for that specific instance. But beyond that, we can control authentication within an entire area as well. So let's now demonstrate how that looks on R4 and R5 and R6.

3:29We're going to be doing this in the purple section of our topology. And that way we can see that we can control authentication throughout the entire area. Let's start off with R4 and bring the area authentication into play by going into router isis mode. And the command is just area-password. That's it. So all I have to do here to say something like area2pw is going to be the password, and I press Enter. Now, of course, the authentication is going to fail between R4 and R5, which brings down that connection. Now, we haven't set up any authentication on R5 and R6.

4:01So if I say show isis neighbors, well, it still shows both are up right now because we're waiting for that neighbor adjacency hold timer to tick away. We see it's ticking down now, slowly but surely. Eventually, it will tick down, and the neighbor adjacency between R5 and R4 will go down. Because we did see that R4 is already telling us that authentication is failing, and we're no longer receiving LSPs from R5. So let's jump into R5 real quick and set that area authentication one more time with area password. We said this was area2pw.

4:32And now we're getting authentication failed on R5, because now the adjacency to R6 is failing. So to round it out, we'll jump over to R6. We'll say router isis. We'll set the area password here as area2pw. So we're not getting any more failures at this point, because we now have authentication set throughout the entire area. Remember one more time, when we set that net, the net was 49.0002. We're basically applying authentication at this spot right here.

5:03But like I said, there is a third option, and that's where we can apply it throughout the entire domain. And that's what this number, the AFI, really represents. So anywhere that we have a neighbor adjacency that begins with 49 as the area, 49-dot in that first 16 bits, we can actually apply authentication there. So now if I want to apply authentication throughout the entire domain, my entire autonomous system, we can do that, too, with-- guess what-- just the domain-password command, again within the router isis parent configuration mode.

5:36To make this nice and snappy, here's what I'm going to do. I'm going to bring up Notepad and just type router isis. We're going to say domain-password. Oh, let's do this. And I'll call it pw49, something simple like that, so we know we're talking about domain 49. So now, on every router here-- let's start with router 1. We'll go into configuration mode, type in router isis, domain-password 49. Router 2-- router isis, domain-password 49. Router 3-- oh, there we go-- router isis, domain-password 49.

6:10Just paste it in right here-- domain-password 49. Paste it in right here-- domain-password 49, and domain-password 49. If you paid attention here, you notice one thing that's very important. The authentication is cumulative. We don't have to use just one type of authentication. We can authenticate at the link level, then the area level, then the domain level. We can control authentication at all three levels at the same time. And this, to me, is the biggest argument about why you would love IS-IS, is we can secure how our neighbor adjacencies come to life at every single level, within a link, within an area, and within a domain.

6:49So when it comes to securing your environment, keep this in mind, because you may want to run link-level authentication within your core, then area-level authentication within an entire area, and then domain-level authentication throughout your entire autonomous system. So that's been securing IS-IS. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00Now that we understand IS-IS security, it's time to move into the stable and scalable solutions within IS-IS. And scalability is really one of the big reasons why you go with IS-IS in the first place. Your first example is one of the most basic ones, and that's just a completely flat area. So let's talk about how a flat-area deployment of IS-IS will work, and some of the pros and cons of that. So our first real network design when we're talking about deploying IS-IS to our network is called the flat network. And in my opinion, it's a pretty fun one, for one specific reason.

0:30Watch this. Watch. Here's how the flat network works. See this purple area right here? Bye-bye. We're just going to get rid of it. There we go. And we're just going to extend area 1 out. We'll even delete the text right here so it's nice and clean. Yeah, that's it. That's the entire point of the flat network, is our network is small enough to where we don't need anything really complicated and sophisticated. We can just run one IS-IS domain and area throughout our entire network. I mean, with six routers, the most we could be talking about is maybe 100 routes or a couple hundred routes or something like that. And IS-IS could probably handle that just fine on its own with one area as long as we're not running really antiquated and dusty hardware.

1:08So the entire idea with this particular design, the flat network design with IS-IS, is just run one IS-IS domain and area throughout your entire network. Now, this begs the question, pros and cons-- or more specifically, which level should we operate these devices at? Well, the gut reaction is, first of all, to just run one database, because the entire network is small. But this presents a big scalability issue. If we were to run level 1 throughout the entire network, what do we know about level 1?

1:42First of all, every router here has to be running level 1, and they have to be in the same area for a neighbor adjacency to come to life. This creates a huge scalability issue, because what happens when we expand? What happens when our tiny little business hits the gold mine and we become gigantic, and next thing we know, we're worldwide? All of a sudden, we've got an issue, because we're growing and growing and growing our database. And our couple hundred routes become a couple thousand routes, and now we have no point of our network where we could perform some form of summarization.

2:18And we have no place where we could break this down into smaller areas, because again, the requirement of level 1 is that every device has to be in the same area. So let me clear the screen out a little bit here. Let's erase all this. There we go. Get rid of that area. So then our next option becomes, well, we could do level 1 and 2. That way, by default, these devices will all form level-1 connections as long as they're in the same area and they're all running level 1, level 2. That's a good idea.

2:49And without any level-2 connections, there will be no level-2 link state database. So that's a clean way to handle it, too. But the moment you start adding in other areas into the mix and we start forming level-2 connections, now all of these routers here are maintaining two databases. Again, that might not be a huge deal, depending on how many routers and how many routes you're talking about. But running two databases, and running your Dijkstra algorithm, the same algorithm that OSPF uses, across two databases could create some CPU overhead or load on your devices.

3:23It just depends on how much traffic you actually have flowing through your particular network here if you want to run two databases. And then you've got to monitor that CPU load on these devices. So perhaps, maybe, the best level for us to actually operate on is level 2. Level 2 doesn't care what area these are operating in. They don't have to be in different areas. They can be within the same area to form a level-2 adjacency. But then we have the option of bringing in level-1, level-2 routers, and then forming different areas after the fact.

3:53This creates the scalability solution for us here. And as we'll come to find out, when it comes to designing a network, especially in the next Nugget, we always design our networks starting with the center. Whatever we have, if we already have a core network, we start there. Or if this is all we have-- it's just these six routers right here-- we pretend that this is going to be the center of our network, and we want to design it with scalability in mind. Level-2 routers bring that scalability into the table. Because that way we have one database to maintain our core, but at the same time, we can form adjacencies at different areas.

4:28Keep in mind also that we can control how those adjacencies come to life with the security content that we just covered in the last Nugget. So that's been implementing a flat network, just one area, for IS-IS. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00So that flat IS-IS network was pretty basic, right? And there's not much to it. The configuration is just deploy IS-IS everywhere. What we need to do now is talk about the real world scenario there where we have a three tier hierarchy of an enterprise campus with a core, a distribution, and an access layer. How do we design IS-IS in this situation is very important when it comes to scalability. So let's fire up the topology one more time and take a look at how we could deploy an IS-IS network with a three tier enterprise architecture.

0:30So here it is, the big mama, the actual enterprise campus with three tier hierarchy that it comes to designing IS-IS. Now this is kind of a tricky thing, because IS-IS operates in two levels. And there's no real concept of a virtual link like there is in OSPF where we could link a really separated one all the way through to the backbone. Right. Here in this case, this is how we would go about designing an enterprise campus. We actually have a few different options. But option number one is really not an option at all. Start at the core. Work your way in the middle out.

1:02And always think in terms of scalability. In the core network here, this is where we want to operate at level two. Now this could be level 1-2 or just straight up level two. It's probably advisable to operate at level two. We don't really ever want level one connections or a level one database to be operating in the core because that's what these devices will prefer is a level one connection. For instance, if we had level one, level two here, and all of these are in area 0-- I know this text is really small.

1:33I kind of had to shrink all of this down. I'm just going to write area zero over here. If all of these are operating in area zero, and we set all of these IS types as level one, level two, guess what happens. These all form level one connections to each other. And then when this device here forms a level two connection here and this device here forms a level two connection here, guess what happens. They all start getting default routes. And we get suboptimal routing in the mix here, whereas if they were just level two connections only, let's just erase all of this, and we say these were level two connections even if they're in the same area zero, whenever there's a level two connection that's brought in here and it stays level two, the explicit exit points for these routes are what gets propagated throughout the core.

2:21And that's exactly what we want. Now in a real world scenario, you probably wouldn't have your internet connected straight to the core because one of the kickers is that level two does not propagate any sort of default route. It only knows about explicit routes and, as a result, our core is nothing more than a transit network. This is an actual critical thing to think about is even though a core is not required like it is in OSPF with area 0, the backbone area, when it comes to a three tier hierarchy, it's almost guaranteed that you need to have some sort of core.

2:55You need to have some sort of backbone area. And you don't have to call it area zero, but it's nice and easy to call it area zero because that's what everybody learned when we learned OSPF coming up. Right? So in this case, we have a core. And we have area zero. Now what we're going to focus in on is the distribution layer. That's what these little kind of like white blocked out shaded areas are here. These are going to be our distribution layers. And in our distribution layer, this is where we're going to be running level one, level two. So in the core, we have level two. And these are area zero.

3:25In the distribution layer, we're going to be running level one, level two. In my green section here, I've got area two. So this switch right here, and this switch right here, and this connection here, and this connection here, these will form a level two adjacency. But these adjacencies all throughout this section here, these are all going to be level one adjacencies. So my switches down here in the access layer will receive the default routes, because the level one/level two devices will advertise what is called the ATT bit.

3:57ATT bit says I am your exit point to get out of the area. The same thing happens over here in area one. Within the distribution layer here, area one will form level two adjacencies to all of the core uplinks. Then it will form level one adjacencies to all of the access layer. And each of these access layers will see the ATT bit was set by the distribution layer. And it will know that its two default exit points are going to be the devices in the distribution layer. The big thing to think about here is how desktop 25 can ping desktop 26.

4:30In the access layer, we may be running multiple VLANs so we run IS-IS on the interface VLAN. This device will communicate to its default gateway who will see a default route to either one of these distribution layers who will then have the explicit level two routes on how to get down into area two. So it'll punt it up to the core, who will route it down to the other distribution layer, who will then have a specific level one route on how to get to desktop 26. So there's a lot of writing going on the screen here. What you should really be thinking about is just looking at this at three areas at a time even though there's four on the screen.

5:06The idea, most importantly, is the area zero, the core layer, is nothing more than just a transit layer. So if area one wants to get to area three, it's just going to jump into the transit layer or core zero and then route its way up to area three. If area two wants to get to area three, it does the same thing. There's a level one route proceeded by level two routes proceeded by a level one route. So when you think about the enterprise campus and how there could be three different layers, you've got to think clearly about where are my level one, level two routers going to exist first of all.

5:41We've got level two in the core, level one, level two at the distribution, and then level one at the access layer. And communications that take place between areas are going to go through a transit campus fabric here like the area zero here. And at the border of each of my edge areas, we're going to have level one, level two, whereas in the core we're probably just going to have level two. So whether it's going from green to red, red to green, green to yellow, yellow to green, red to yellow, yellow to red, you get the idea.

6:15We're just talking about going through the steps of level one to level 1-2 to level two to level 1-2 to level one. That's how IS-IS logically flows. And this is why we have those different levels that we learned about in the previous skill. Level zero to level one to level two. And then level three if we ever need to talk outside of our domain or autonomous system. So this is how the campus design is going to work in a three tier enterprise campus hierarchy. I hope this has been informative for you. And I'd like to thank you for viewing.

0:00So that three-tier hierarchy where we have the core at level two, then the distribution layers at level one, two, and then the access layer is at level one, that's probably honestly, the best most scalable way that you could deploy an IS-IS network. But there is a situation where you're kind of in the middle. You don't need a flat network, but you don't have anything that sophisticated. Maybe you actually have a collapsed core architecture. What we can then do is use a hybrid IS-IS network. Let's talk about how the hybrid design really works. So now is the part where we get into the hybrid design, where our campus is growing and it's sophisticated, but it's not this sophisticated.

0:35We may have a collapsed core situation here, where we don't actually have a core layer at all. Our distribution layers are all connected directly to each other, and it would look something kind of like this. Watch as here's how I'm just going to redesign this little topology real quick. So with a hybrid environment, or a collapsed core, we don't have a core, and therefore we can basically just right-click on the blue section here and just wipe it out. Watch us. Bye. And here's what we're looking at when we talk about the hybrid environment. See, I'm just going to drag this up here.

1:09And if I can grab this corner-- It's kind of tough. There we go. Just like this. And I'll do the same thing with the green. And I'll drag it like this. And I'll do the same thing with the-- Oh, this is going to be a little bit tougher, isn't it? Let's grab the yellow, and drag it kind of like this. That's the idea with a collapsed core, or a hybrid network. This is how it works. Instead of just running level two throughout the entire core, what we've done is we've effectively pushed our level one, level two configs up here to what was the core.

1:41So now we run level one, level two on these devices. Here we go. And the rest of our domain is just level one, or I should say the rest of these areas are just level one throughout. So really, our distribution layer looks something more along the lines of this, and our environment now looks like this. We have a hybrid setup because there is, again, no need for a backbone or an area zero within IS-IS. We can just literally link any area together as long as there is layer two inter-area communications allowed.

2:14Now of course, this brings up pros and cons. Why do this? Why not go with the core environment? Well, of course, again, we go back to the fact that maybe we don't have a core. Maybe we only have distribution layers, and this might be the cleanest way to separate our areas from each other without having to pass through a transit fabric, or a core network, that we don't even have yet. This, of course, moves our summarization points up to these nodes, too. See, in this case, area one is 192 1681. In this case, area two is 192 1682.

2:44What we would want to do is we would want to summarize on these links, that go out of our area domains now at this point, and also this way, too. Whereas before, our summarization would have been performed at the distribution layer before it reached the core in the first place. So our core devices now are actually more like core distribution devices, and they're going to be maintaining two databases. And the level one databases will now be bigger. These devices will now hold more routes because they're going to learn about all of the routes within the level one area, as opposed to being summarized one layer down.

3:20This does offer a simpler deployment though, of course. We don't have to build out a core, but it also makes scaling and adding areas a little more complicated. Because now, what if we bring in an area over here, and an area over here? We don't have a core that they can attach right into and then spread and propagate the routes through. So the hybrid environment is going to be one of those in the middle, or in between, a flat or a three-tier hierarchy. Just keep in mind where we're pushing the level one, level two boundaries in this scenario. Given the opportunity, it's going to be best or preferable to have a transit or a core area.

3:55That way we could go from one area, through the transit to the second area, with borders of level one, level two right on the borders of those areas. That's how the preferable way, or the preferable design, for an IS-IS network would work. So that's been the hybrid IS-IS network. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00So there you have it. We have wrapped up our journey through IS-IS. We now understand not only the foundations of how IS-IS works, but also, how we can design it in different types of networks, and beyond that, secure it, which is a very important aspect. So that's been understanding how you can deploy IS-IS in a three-tier hierarchy, a flat hierarchy, a hybrid hierarchy, and secure in the mix. I hope this has been informative for you, and I'd like to thank you for viewing.