Showing posts with label ISIS protocol. Show all posts
Showing posts with label ISIS protocol. Show all posts

Monday, March 16, 2015

ISIS Adjacencies filtration


Configure all router running ISIS protocol

R1#
interface Loopback0
 ip address 1.1.1.1 255.255.255.0
 ip router isis 1
!
interface FastEthernet0/0
 ip address 10.1.12.1 255.255.255.0
 ip router isis 1
!
router isis 1
 net 49.0001.0000.0000.1111.00
R2#
interface Loopback0
 ip address 2.2.2.2 255.255.255.0
!
interface FastEthernet0/0
 ip address 10.1.12.2 255.255.255.0
 ip router isis 1
!
interface FastEthernet0/1
 ip address 10.1.23.2 255.255.255.0
 ip router isis 1
!
router isis 1
 net 49.0023.0000.0000.2222.00
R3#
interface Loopback0
 ip address 3.3.3.3 255.255.255.0
 ip router isis 1
!
interface FastEthernet0/0
 ip address 10.1.23.3 255.255.255.0
 ip router isis 1
!
router isis 1
 net 49.0023.0000.0000.3333.00

Let's check neigbhor in R2:

R2#show isis ne
System Id      Type Interface   IP Address      State Holdtime Circuit Id
R1             L2   Fa0/0       10.1.12.1       UP    27       R2.01             
R3             L1   Fa0/1       10.1.23.3       UP    8        R3.01             
R3             L2   Fa0/1       10.1.23.3       UP    7        R3.01   

We can see R2 establish neighbor to R1 and R3.

Let’s config on R2, which remove neighbor to R3.

R2#
 clns filter-set AF deny 49.0023.0000.0000.3333.00          //deny only this NET address
 clns filter-set AF permit default                                            // allows any other neighbor
!
interface FastEthernet0/1
 ip address 10.1.23.2 255.255.255.0
 ip router isis 1
 isis adjacency-filter AF

Verify:

R2#show isis ne
System Id      Type Interface   IP Address      State Holdtime Circuit Id
R1             L2   Fa0/0       10.1.12.1       UP    27       R2.01             

It only establish neighbor with R1.

See debug:
R2#debug isis adj-packets
IS-IS Adjacency related packets debugging is on
*Mar  1 00:21:14.751: ISIS-Adj: Rec L2 IIH from c200.0704.0000 (FastEthernet0/0), cir type L1L2, cir id 0000.0000.2222.01, length 1497
*Mar  1 00:21:15.299: ISIS-Adj: Sending L2 LAN IIH on FastEthernet0/0, length 1497
*Mar  1 00:21:15.391: ISIS-Adj: Rec L2 IIH from c203.0bc8.0000 (FastEthernet0/1), cir type L1L2, cir id 0000.0000.3333.01, length 1497
*Mar  1 00:21:15.395: ISIS-Adj: Adjacency disallowed by filter
*Mar  1 00:21:16.775: ISIS-Adj: Rec L1 IIH from c200.0704.0000 (FastEthernet0/0), cir type L1L2, cir id 0000.0000.1111.01, length 1497
*Mar  1 00:21:16.779: ISIS-Adj: Area mismatch, level 1 IIH on FastEthernet0/0
*Mar  1 00:21:16.959: ISIS-Adj: Rec L1 IIH from c203.0bc8.0000 (FastEthernet0/1), cir type L1L2, cir id 0000.0000.3333.01, length 1497

*Mar  1 00:21:16.963: ISIS-Adj: Adjacency disallowed by filter
Posted by at No comments:
Labels:

Saturday, March 14, 2015

ISIS basic config



root@test# show
## Last changed: 2015-03-14 16:34:05 UTC
version 8.5R1.14;
interfaces {
    em0 {
        unit 0 {
            family inet {
                address 10.1.13.3/24;
            }
            family iso;
        }
    }
    lo0 {
        unit 0 {
            family inet {
                address 3.3.3.3/24;
            }
            family iso {
                address 49.0001.0000.0000.3333.00;
            }
        }
    }
}
protocols {
    isis {
        interface em0.0;
        interface lo0.0;
    }
}
R1#show run
interface Loopback0
 ip address 1.1.1.1 255.255.255.0
 ip router isis 1
!
interface FastEthernet0/0
 ip address 10.1.12.1 255.255.255.0
 ip router isis 1
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 10.1.13.1 255.255.255.0
 ip router isis 1
 duplex auto
 speed auto
!
router isis 1
 net 49.0001.0000.0000.1111.00
RP/0/0/CPU0:ios#show run router isis
Sat Mar 14 23:39:11.758 UTC
router isis 1
 net 49.0001.0000.0000.2222.00
 interface Loopback0
  address-family ipv4 unicast
  !
 !
 interface GigabitEthernet0/0/0/2
  address-family ipv4 unicast
  !
 !
!


Let's verify:
-----------------------------------------------------------------------------------------
root@test# run show isis adjacency
Interface             System         L State        Hold (secs) SNPA
em0.0                      R1             2  Up                    8  c2:0:11:64:0:1
em0.0                      R1             1  Up                    9  c2:0:11:64:0:1

root@test# run show route protocol isis
inet.0: 7 destinations, 7 routes (7 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

1.1.1.0/24         *[IS-IS/15] 00:04:20, metric 20
                    > to 10.1.13.1 via em0.0
2.2.2.0/24         *[IS-IS/15] 00:04:19, metric 30
                    > to 10.1.13.1 via em0.0
10.1.12.0/24       *[IS-IS/15] 00:04:20, metric 20
                    > to 10.1.13.1 via em0.0

__juniper_private2__.inet.0: 1 destinations, 1 routes (0 active, 0 holddown, 1 hidden)

iso.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)

[edit]
 root@test# run show isis database
IS-IS level 1 link-state database:
LSP ID                      Sequence Checksum Lifetime Attributes
R1.00-00                         0x6   0x6b3a      615 L1 L2
R1.01-00                         0x2   0x8a42      790 L1 L2
R1.03-00                         0x1   0xc2e6      611 L1 L2
0000.0000.2222.00-00             0x5    0x6f1      802 L1 L2
test.00-00                       0x2    0xab5      611 L1 L2
  5 LSPs

IS-IS level 2 link-state database:
LSP ID                      Sequence Checksum Lifetime Attributes
R1.00-00                         0x9   0x4571      619 L1 L2
R1.01-00                         0x2   0x1a3b      787 L1 L2
R1.03-00                         0x1   0x52df      611 L1 L2
0000.0000.2222.00-00             0x8   0x63da      613 L1 L2
test.00-00                       0x4   0x3daa      618 L1 L2
  5 LSPs

[edit]

-----------------------------------------------------------------------------------------
R1#show isis ne
Area 1:
System Id      Type Interface   IP Address      State Holdtime Circuit Id
0000.0000.2222 L1   Fa0/0       10.1.12.2       UP    28       R1.01
0000.0000.2222 L2   Fa0/0       10.1.12.2       UP    26       R1.01
test                       L1   Fa0/1       10.1.13.3       UP    25       R1.03
test                       L2   Fa0/1       10.1.13.3       UP    21       R1.03
R1#show ip route isis
     2.0.0.0/24 is subnetted, 1 subnets
i L1    2.2.2.0 [115/20] via 10.1.12.2, FastEthernet0/0
     3.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
i L1    3.3.3.3/32 [115/10] via 10.1.13.3, FastEthernet0/1
i L1    3.3.3.0/24 [115/10] via 10.1.13.3, FastEthernet0/1

R1#show isis da

Area 1:
IS-IS Level-1 Link State Database:
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime      ATT/P/OL
R1.00-00            * 0x00000006   0x6B3A        585               0/0/0
R1.01-00            * 0x00000002   0x8A42        762               0/0/0
R1.03-00            * 0x00000001   0xC2E6        581               0/0/0
0000.0000.2222.00-00  0x00000005   0x06F1        774               0/0/0
test.00-00            0x00000002   0x0AB5        577               0/0/0
IS-IS Level-2 Link State Database:
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime      ATT/P/OL
R1.00-00            * 0x00000009   0x4571        589               0/0/0
R1.01-00            * 0x00000002   0x1A3B        759               0/0/0
R1.03-00            * 0x00000001   0x52DF        581               0/0/0
0000.0000.2222.00-00  0x00000008   0x63DA        583               0/0/0
test.00-00            0x00000004   0x3DAA        584               0/0/0
Area null:
Area [1:

-----------------------------------------------------------------------------------------
RP/0/0/CPU0:ios#show isis adjacency
Sat Mar 14 23:43:14.751 UTC

IS-IS 1 Level-1 adjacencies:
System Id      Interface        SNPA           State Hold Changed  NSF IPv4 IPv6
                                                                       BFD  BFD
R1             Gi0/0/0/2        c200.1164.0000 Up    8    00:18:10 Yes None None

Total adjacency count: 1

IS-IS 1 Level-2 adjacencies:
System Id      Interface        SNPA           State Hold Changed  NSF IPv4 IPv6
                                                                       BFD  BFD
R1             Gi0/0/0/2        c200.1164.0000 Up    8    00:18:10 Yes None None

Total adjacency count: 1

RP/0/0/CPU0:ios#show ip route isis
Sat Mar 14 23:41:19.649 UTC

i L1 1.1.1.0/24 [115/20] via 10.1.12.1, 00:15:58, GigabitEthernet0/0/0/2
i L1 3.3.3.0/24 [115/20] via 10.1.12.1, 00:04:54, GigabitEthernet0/0/0/2
i L1 3.3.3.3/32 [115/20] via 10.1.12.1, 00:04:54, GigabitEthernet0/0/0/2

i L1 10.1.13.0/24 [115/20] via 10.1.12.1, 00:04:59, GigabitEthernet0/0/0/2


RP/0/0/CPU0:ios#show isis da
Sat Mar 14 23:47:05.595 UTC

IS-IS 1 (Level-1) Link State Database
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime  ATT/P/OL
R1.00-00              0x00000006   0x6b3a        558             0/0/0
R1.01-00              0x00000002   0x8a42        734             0/0/0
R1.03-00              0x00000001   0xc2e6        554             0/0/0
0000.0000.2222.00-00* 0x00000005   0x06f1        749             0/0/0
test.00-00            0x00000002   0x0ab5        550             0/0/0

 Total Level-1 LSP count: 5     Local Level-1 LSP count: 1

IS-IS 1 (Level-2) Link State Database
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime  ATT/P/OL
R1.00-00              0x00000009   0x4571        562             0/0/0
R1.01-00              0x00000002   0x1a3b        731             0/0/0
R1.03-00              0x00000001   0x52df        554             0/0/0
0000.0000.2222.00-00* 0x00000008   0x63da        559             0/0/0
test.00-00            0x00000004   0x3daa        557             0/0/0

 Total Level-2 LSP count: 5     Local Level-2 LSP count: 1
RP/0/0/CPU0:ios#

Posted by at No comments:
Labels:

Thursday, March 12, 2015

ISIS backdoor


R1#show is da

IS-IS Level-1 Link State Database:
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime      ATT/P/OL
R1.00-00            * 0x00000006   0x4C93          701                          0/0/0
R2.00-00              0x00000009   0xBAED        1186                        1/0/0
R2.01-00              0x00000002   0x9B0F        699                           0/0/0

Cau hinh sao cho R1 khong co default route tren bang dinh tuyen. Bang 2 cach. Cau hinh tren R1 or tren R2

  • Cau hinh R1:
router isis
 net 49.0012.0000.1111.0000.00
 is-type level-1
 ignore-attached-bit

Command tren bi an trong IOS.
R1# show ip route
     1.0.0.0/24 is subnetted, 1 subnets
C       1.1.1.0 is directly connected, Loopback0
     2.0.0.0/24 is subnetted, 1 subnets
i L1    2.2.2.0 [115/20] via 10.1.12.2, FastEthernet0/0
     10.0.0.0/24 is subnetted, 1 subnets
C       10.1.12.0 is directly connected, FastEthernet0/0
R1#show isis da

IS-IS Level-1 Link State Database:
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime      ATT/P/OL
R1.00-00            * 0x00000006   0x4C93        520               0/0/0
R2.00-00              0x00000009   0xBAED        1006              1/0/0
R2.01-00              0x00000002   0x9B0F        518               0/0/0

=> R1 van nhan ATT = 1. tuy nhien tren bang dinh tuyen khong co default-route.


  • Cau hinh R2.
router isis
 net 49.0012.0000.2222.0000.00
 is-type level-1-2 backdoor

R1#show isis da

IS-IS Level-1 Link State Database:
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime      ATT/P/OL
R1.00-00            * 0x00000007   0x4A94        1149              0/0/0
R2.00-00              0x0000000A   0xB0FE        1132               0/0/0
R2.01-00              0x00000003   0x9910        1020               0/0/0

=> R1 set gia tri ATT = 0.  khong nhan defaul-route.


  • Nhan xet:
    • Cach 1: muon filter default-route tren tung router
    • Cach 2: filtter default-route trong 1 area level 1

  • Tuy theo yeu cau, su dung cach phu hop :)
Posted by at No comments:
Labels:
Subscribe to: Posts (Atom)
Twitter Delicious Facebook Digg Stumbleupon Favorites More
RSS Feed Subscribe to Our RSS feed!
Follow Us on Twitter! Follow Us on Twitter!