RFC 8196
IS-IS Autoconfiguration
IS-IS Autoconfiguration 🎀
Okay bestie, let's get into RFC 8196 🦋 It's an IETF Standards Track document (the real deal, not a casual draft) from July 2017, with ISSN 2070-1721. The editor is B. Liu, Ed. from Huawei Technologies, and the co-authors are L. Ginsberg (Cisco Systems), B. Decraene (Orange), I. Farrer (Deutsche Telekom AG), and M. Abrahamsson (T-Systems). Its header doesn't list anything it obsoletes or updates, so it stands on its own 💅
Internet Engineering Task Force (IETF) B. Liu, Ed.
Request for Comments: 8196 Huawei Technologies
Category: Standards Track L. Ginsberg
ISSN: 2070-1721 Cisco Systems
B. Decraene
Orange
I. Farrer
Deutsche Telekom AG
M. Abrahamsson
T-Systems
July 2017Abstract
Okay so this doc is all about IS-IS autoconfiguration ✨ The main pieces are IS-IS System ID self-generation, duplication detection, and duplication resolution. These mechanisms only give you a limited set of IS-IS functions, which makes them perfect for networks where plug-and-play is the vibe 🧚
Status of This Memo
This is an Internet Standards Track document. 💜
It's a product of the Internet Engineering Task Force (IETF), so it represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). If you want the deep dive on Internet Standards, check out Section 2 of RFC 7841 🌸
For the current status, any errata, and how to send feedback, head to http://www.rfc-editor.org/info/rfc8196.
Copyright Notice
Copyright (c) 2017 IETF Trust and the persons identified as the document authors. All rights reserved. 🎀
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stand on the date it was published. Read these carefully, because they spell out your rights and restrictions for this document ⚖️ Any Code Components pulled out of this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, as the Simplified BSD License describes.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
1.1. Requirements Language . . . . . . . . . . . . . . . . . . 3
2. Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
3. Protocol Specification . . . . . . . . . . . . . . . . . . . 4
3.1. IS-IS Default Configuration . . . . . . . . . . . . . . . 4
3.2. IS-IS NET Generation . . . . . . . . . . . . . . . . . . 4
3.3. Router-Fingerprint TLV . . . . . . . . . . . . . . . . . 6
3.4. Protocol Operation . . . . . . . . . . . . . . . . . . . 7
3.4.1. Startup Mode . . . . . . . . . . . . . . . . . . . . 7
3.4.2. Adjacency Formation . . . . . . . . . . . . . . . . . 8
3.4.3. IS-IS System ID Duplication Detection . . . . . . . . 8
3.4.4. Duplicate System ID Resolution Procedures . . . . . . 8
3.4.5. System ID and Router-Fingerprint Generation
Considerations . . . . . . . . . . . . . . . . . . . 9
3.4.6. Duplication of Both System ID and Router-Fingerprint 10
3.5. Additional IS-IS TLVs Usage Guidelines . . . . . . . . . 12
3.5.1. Authentication TLV . . . . . . . . . . . . . . . . . 12
3.5.2. Metric Used in Reachability TLVs . . . . . . . . . . 12
3.5.3. Dynamic Name TLV . . . . . . . . . . . . . . . . . . 12
4. Security Considerations . . . . . . . . . . . . . . . . . . . 12
5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 13
6. References . . . . . . . . . . . . . . . . . . . . . . . . . 13
6.1. Normative References . . . . . . . . . . . . . . . . . . 13
6.2. Informative References . . . . . . . . . . . . . . . . . 14
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 14
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 151. Introduction ✨
Okay so this document specifies mechanisms that make IS-IS [RFC1195] [ISO_IEC10589] [RFC5308] autoconfiguring. 🦋 That's a huge win for the management burden of setting up a network, especially when you need plug-and-play device configuration.
IS-IS autoconfiguration has these functions:
- IS-IS default configuration
- IS-IS System ID self-generation
- System ID duplication detection and resolution
- IS-IS TLV utilization (authentication TLV, metrics in reachability advertisements, and Dynamic Name TLV)
The doc also defines mechanisms to stop autoconfigured routers from unintentionally interoperating with routers that aren't autoconfigured. Lowkey important, so check Section 3.3 🔥
1.1. Requirements Language
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" are the BCP 14 key words, and they mean what BCP 14 [RFC2119] [RFC8174] says, but only when they show up in all capitals like this. 💅 If they're lowercase or Title Case (like "should" or "Should"), they just have their normal English meanings and aren't the formal [RFC2119] key words. No drama, just vibes 🌈
2. Scope 🌸
The autoconfiguration mechanisms support both IPv4 and IPv6 deployments. Both are giving 💜
These mechanisms are aimed at simple deployment cases. The following important features are NOT supported:
- multiple IS-IS instances
- multi-area and level-2 routing
- interworking with other routing protocols
IS-IS autoconfiguration is mainly for small (like 10s of devices) and unmanaged deployments. It lets you use IS-IS without the user having to configure anything at all 🧚 It is not recommended for larger deployments, so don't try to main-character a huge network with it 💀
3. Protocol Specification 👑
3.1. IS-IS Default Configuration 🍓
This section defines the default configuration for an autoconfigured router. Here's the lineup:
- IS-IS interfaces MUST be autoconfigured to an interface type corresponding to their Layer 2 capability. For example, Ethernet interfaces will be autoconfigured as broadcast networks, and Point-to-Point Protocol (PPP) interfaces will be autoconfigured as Point-to-Point interfaces.
- IS-IS autoconfiguration instances MUST be configured as level-1 so that the interfaces operate as level-1 only.
originatingLSPBufferSizeis set to512.MaxAreaAddressesis set to3.- Extended IS reachability (TLV 22) and IP reachability (TLV 135) TLVs [RFC5305] MUST be used. That means a router in autoconfiguration mode MUST NOT use any of these TLVs:
- IIS Neighbors (TLV 2)
- IP Int. Reach (TLV 128)
- IP Ext. Address (TLV 130)
The TLVs listed above MUST be ignored on receipt. 🙈
3.2. IS-IS NET Generation 🦋
In IS-IS, a router (known as an Intermediate System) is identified by a Network Entity Title (NET), which is a type of Network Service Access Point (NSAP). The NET is the address of an instance of the IS-IS protocol running on an IS. Think of it as the router's ID card 🪪
The autoconfiguration mechanism generates the IS-IS NET like this:
- Area address
In IS-IS autoconfiguration, this field MUST be 13 octets long and set to all 0s. 🌈
- System ID
This field follows the area address field and is 6 octets long. There are two basic requirements for System ID generation:
- As the IS-IS protocol specifies, this field must be unique among all routers in the same area. 🔥
- After its initial generation, the System ID SHOULD remain stable. Things like interface enable/disable, interface connect/disconnect, device reboot, firmware update, or configuration changes SHOULD NOT cause the System ID to change. System ID change as part of the System ID collision resolution process MUST be supported. Implementations SHOULD allow the System ID to be cleared by a user-initiated system reset.
More specific considerations for System ID generation are in Section 3.4.5 💖
3.3. Router-Fingerprint TLV 🎀
The Router-Fingerprint TLV is similar to the Router-Hardware-Fingerprint TLV defined in [RFC7503]. The difference is that this TLV includes a Flags field, which lets it signal that the router is in startup mode and running in autoconfiguration mode ✨
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Flags | |
+-+-+-+-+-+-+-+-+ Router-Fingerprint (Variable) .
. .
. .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Here's the breakdown:
- Type:
15. - Length: The length, in octets, of the
FlagsandRouter-Fingerprintfields. - Flags: 1 octet.
0 1 2 3 4 5 6 7
+-+-+-+-+-+-+-+-+
|S|A| Reserved |
+-+-+-+-+-+-+-+-+- S flag: When set, the router is in "startup" mode.
- A flag: When set, the router is operating in autoconfiguration mode. This is how two routers can tell whether they're both using autoconfiguration 👀 If the A flag setting doesn't match in hellos, then no adjacency should be formed.
- Reserved: These flags MUST be set to zero and MUST be ignored by the receiver. 🫶
- Router-Fingerprint: 32 or more octets.
More specific considerations for Router-Fingerprint are in Section 3.4.5 🧚
The Router-Fingerprint TLV with the A flag set MUST be included in IS-IS Hellos (IIHs) originated by a router operating in autoconfiguration mode. An autoconfiguration mode router MUST ignore IIHs that don't contain the Router-Fingerprint TLV with the A flag set. Not me ignoring the wrong hellos 🙅♀️
The Router-Fingerprint TLV with the A flag set MUST be included in Link State PDU (LSP) #0 originated by a router operating in autoconfiguration mode. If a router in autoconfiguration mode receives an LSP #0 and the LSP either does NOT contain a Router-Fingerprint TLV, or it does contain one but the A flag is NOT set, then the LSP is flooded as normal. However, the entire LSP set originated by the sending router MUST be ignored when running the Decision Process. Main character energy for the Decision Process 💅
The Router-Fingerprint TLV MUST NOT be included in an LSP with a non-zero number, and when received, it MUST be ignored. 💀
3.4. Protocol Operation 🌈
This section describes how a router that supports autoconfiguration mode actually operates. The good stuff starts now 🫶
(Part 1 of 3. More coming, bestie! 💖)
3.4.1. Startup Mode 🌸
okay so when a router boots up in autoconfiguration mode, it's giving brand-new-here energy 🧚. Both the S and A flags MUST be set in the Router-Fingerprint TLV, and that goes in both the hellos and LSP #0. While it's in this mode, only LSP #0 gets generated, and IS or IP/IPv6 reachability TLVs MUST NOT be included in LSP #0. It's a quiet little phase 🤫.
The router stays in startup mode for a minimum period of time (recommended to be 1 minute). That time should be enough to bring up adjacencies to all the neighbors you expect 🫶. The router leaves startup mode once that minimum time has elapsed and full LSP database synchronization is achieved with all neighbors in the UP state. glow-up time ✨
When a router exits startup mode, it clears the S flag in the Router-Fingerprint TLVs it sends in hellos and LSP #0. Now it MAY advertise IS neighbor and IP/IPv6 prefix reachability in its LSPs, and it MAY generate LSPs with a non-zero number 💅.
The whole point of startup mode is to minimize System ID changes once a router is fully operational 🎯. Any System ID change during startup mode has minimal impact on a running network, because the router isn't being used to forward traffic yet. lowkey genius 🧠
3.4.2. Adjacency Formation 🦋
Routers operating in autoconfiguration mode MUST NOT form adjacencies with routers that are NOT operating in autoconfiguration mode. The Router-Fingerprint TLV with the A flag set is how you can tell a router is in autoconfiguration mode. That's the vibe check, bestie 💅.
NOTE: The use of the special area address of all 0s makes it unlikely that a router that is not operating in autoconfiguration mode will be in the same area as a router operating in autoconfiguration mode. However, the check for the Router-Fingerprint TLV with the A flag set provides additional protection 🛡️.
3.4.3. IS-IS System ID Duplication Detection 🔍
The System ID of each node MUST be unique 💖. As Section 3.4.5 explains, the System ID gets generated from entropies (for example, a Media Access Control (MAC) address) that are usually expected to be unique. But resources can be limited, so duplicates are still possible. This section defines how IS-IS detects and resolves System ID duplication. A duplicate system ID may show up between neighbors, or between routers in the same area that aren't neighbors.
A duplicate system ID with a neighbor is detected when the System ID received in an IIH is identical to the local System ID and the Router-Fingerprint in the received Router-Fingerprint TLV does NOT match the locally generated Router-Fingerprint.
A duplicate system ID with a non-neighbor is detected when an LSP #0 is received, the System ID of the originator is identical to the local System ID, and the Router-Fingerprint in the Router-Fingerprint TLV does NOT match the locally generated Router-Fingerprint 👀.
3.4.4. Duplicate System ID Resolution Procedures 🛠️
When a duplicate system ID is detected, one of the systems MUST assign itself a different System ID and perform a protocol restart. The resolution procedure tries to minimize disruption to a running network by choosing, whenever possible, to restart a router that's in startup mode 🫧.
The contents of the Router-Fingerprint TLVs for the two routers with duplicate system IDs get compared.
If one TLV has the S flag set (the router is in startup mode) and one TLV has the S flag clear (the router is NOT in startup mode), the router in startup mode MUST generate a new System ID and restart the protocol.
If both TLVs have the S flag set (both routers are in startup mode) or both TLVs have the S flag clear (neither router is in startup mode), then the router with the numerically smaller Router-Fingerprint MUST generate a new System ID and restart the protocol.
Fingerprint comparison is performed octet by octet, starting from the first received octet, until a difference is detected. If the fingerprints have different lengths and all octets up to the shortest length are identical, then the fingerprint with the smaller length is considered smaller on the whole.
If the fingerprints are identical in both content and length (and the state of the S flag is identical), and the duplication is detected in hellos, then both routers MUST generate a new System ID and restart the protocol.
If fingerprints are identical in both content and length, and the duplication is detected in LSP #0, then the procedures defined in Section 3.4.6 MUST be followed. plot twist: this one's the tricky case 😭
3.4.5. System ID and Router-Fingerprint Generation Considerations 🧩
As specified in this document, there are two distinguishing items that need to be self-generated: the System ID and the Router-Fingerprint. In a network device, there are usually some resources that can give an extremely high probability of uniqueness (some examples below). These resources can be used as seeds to derive identifiers:
- MAC address(es)
- Configured IP address(es)
- Hardware IDs (e.g., CPU ID)
- Device serial number(s)
- System clock at a certain, specific time
- Arbitrary received packet(s) on an interface(s)
This document recommends using an IEEE 802 48-bit MAC address associated with the router as the initial System ID. This document does not specify a particular method to regenerate the System ID when duplication happens. This document also does not specify a method to generate the Router-Fingerprint 🤷♀️.
There's an important concern here. The seeds listed above (except the MAC address) might not be available in some small devices, like home routers. That's because of hardware and software limitations, plus there aren't many communication packets at the initial stage when home routers are doing IS-IS autoconfiguration. In this case, this document suggests using the MAC address as the System ID and generating a pseudorandom number from another seed (such as the memory address of a certain variable in the program) as the Router-Fingerprint. The pseudorandom number might not have a very high probability of uniqueness in this solution, but it should be sufficient in home network scenarios 🏠.
The System ID stability considerations from Section 3.2 also need to be applied, so don't forget them 💜.
3.4.6. Duplication of Both System ID and Router-Fingerprint 👯
As described above, the resources for generating a System ID / Router-Fingerprint might be very constrained during the initial stages. Hence, duplication of both the System ID and the Router-Fingerprint needs to be considered. In such a case, it's possible that a router will receive an LSP with a System ID and Router-Fingerprint identical to its local values, but the LSP is NOT identical to the locally generated copy. That means the sequence number is newer, or the sequence number is the same but the LSP has a valid checksum that does not match. The term DD-LSP (Duplication Detection LSP) is used to describe such an LSP 📛.
In a benign case, this happens if a router restarts and receives copies of its own LSPs from its previous incarnation. This benign case needs to be told apart from the pathological case, where there are two different routers with the same System ID and the same Router-Fingerprint 🙈.
In the benign case, the restarting router will generate a new version of its own LSP with a higher sequence number and flood the new LSP version. This will cause other routers in the network to update their LSP Database (LSPDB), and synchronization will be achieved ✅.
In the pathological case, generating a new version of an LSP by one of the "twins" will cause the other twin to generate the same LSP with a higher sequence number -- and the oscillation will continue without achieving LSPDB synchronization. this is the chaos scenario 💀
Note that a comparison of the S flag in the Router-Fingerprint TLV cannot be performed, because in the benign case the S flag is expected to be clear. Also note that the conditions for detecting a duplicate system ID will NOT be satisfied, because both the System ID and the Router-Fingerprint will be identical.
The following procedure is defined:
DD-state is a boolean that indicates if a
DD-LSP #0 has been received.
DD-count is the count of the number of occurrences
of reception of a DD-LSP.
DD-timer is a timer associated with reception of
DD-LSPs; the recommended value is 60 seconds.
DD-max is the maximum number of DD-LSPs allowed
to be received in DD-timer interval;
the recommended value is 3.
When a DD-LSP is received:
If DD-state is FALSE:
DD-state is set to TRUE.
DD-timer is started.
DD-count is initialized to 1.
If DD-state is TRUE:
DD-count is incremented.
If DD-count is >= DD-max:
The local system MUST generate a new System ID
and Router-Fingerprint and restart the protocol.
DD-state is (re)initialized to FALSE and
DD-timer is canceled.
If DD-timer expires:
DD-state is set to FALSE.Note that to minimize the likelihood of duplication of both the System ID and the Router-Fingerprint reoccurring, routers SHOULD have more entropies available. One simple way to achieve this is to add the LSP sequence number of the next LSP it will send to the Router-Fingerprint 🍓.
3.5. Additional IS-IS TLVs Usage Guidelines 🎀
This section describes the behavior of selected TLVs when used by a router supporting IS-IS autoconfiguration.
3.5.1. Authentication TLV 🔐
It is RECOMMENDED that IS-IS routers supporting this specification offer an option to explicitly configure a single password for HMAC-MD5 authentication, as specified in [RFC5304].
3.5.2. Metric Used in Reachability TLVs 📏
It is RECOMMENDED that IS-IS autoconfiguration routers use a high metric value (e.g., 100000) as the default, so that manually configured adjacencies are preferred over autoconfigured ones 👑.
3.5.3. Dynamic Name TLV 🏷️
IS-IS autoconfiguration routers MAY advertise their Dynamic Name TLV (TLV 137 [RFC5301]). The hostname could be provisioned by an IT system, or it could just use the name of the vendor, device type, or serial number, etc.
To guarantee the uniqueness of the hostname, the System ID SHOULD be appended as a suffix in the names 🌈.
4. Security Considerations 💀
⚠️ Lowkey dramatic, but this part matters. Read it fully, bestie.
In the absence of cryptographic authentication, it's possible for an attacker to inject a PDU falsely indicating there is a duplicate system ID. This may trigger an automatic restart of the protocol using the duplicate-id resolution procedures defined in this document 😱.
Note that the use of authentication is incompatible with autoconfiguration, as it requires some manual configuration 🙅♀️.
For wired deployment, the wired connection itself could be considered an implicit authentication, since unwanted routers are usually not able to connect (i.e., there is some kind of physical security in place preventing the connection of rogue devices). For wireless deployment, the authentication could be achieved at the lower wireless link layer 📡.
5. IANA Considerations 📋
This document details a new IS-IS TLV reflected in the "IS-IS TLV Codepoints" registry:
Value Name IIH LSP SNP Purge
---- ------------ --- --- --- -----
15 Router-Fingerprint Y Y N Y6. References 📚
6.1. Normative References 📚
okay bestie, these are the ones you HAVE to read to get the full picture 🤓
- [ISO_IEC10589] International Organization for Standardization, "Information technology -- Telecommunications and information exchange between systems -- Intermediate System to Intermediate System intra-domain routeing information exchange protocol for use in conjunction with the protocol for providing the connectionless-mode network service (ISO 8473)", ISO/IEC 10589:2002, Second Edition, November 2002.
- [RFC1195] Callon, R., "Use of OSI IS-IS for routing in TCP/IP and dual environments", RFC 1195, DOI 10.17487/RFC1195, December 1990,
http://www.rfc-editor.org/info/rfc1195. - [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997,
http://www.rfc-editor.org/info/rfc2119. - [RFC5301] McPherson, D. and N. Shen, "Dynamic Hostname Exchange Mechanism for IS-IS", RFC 5301, DOI 10.17487/RFC5301, October 2008,
http://www.rfc-editor.org/info/rfc5301. - [RFC5304] Li, T. and R. Atkinson, "IS-IS Cryptographic Authentication", RFC 5304, DOI 10.17487/RFC5304, October 2008,
http://www.rfc-editor.org/info/rfc5304. - [RFC5305] Li, T. and H. Smit, "IS-IS Extensions for Traffic Engineering", RFC 5305, DOI 10.17487/RFC5305, October 2008,
http://www.rfc-editor.org/info/rfc5305. - [RFC5308] Hopps, C., "Routing IPv6 with IS-IS", RFC 5308, DOI 10.17487/RFC5308, October 2008,
http://www.rfc-editor.org/info/rfc5308. - [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017,
http://www.rfc-editor.org/info/rfc8174.
6.2. Informative References 🌸
these one's just extra reading if you're curious, not required 💅
- [RFC7503] Lindem, A. and J. Arkko, "OSPFv3 Autoconfiguration", RFC 7503, DOI 10.17487/RFC7503, April 2015,
http://www.rfc-editor.org/info/rfc7503.
Acknowledgements 🫶
okay the people who made this doc way better, we love them 💖
This document was heavily inspired by [RFC7503]. 🧚
Martin Winter, Christian Franke, and David Lamparter gave essential feedback to improve the technical design based on their implementation experience. 🔥
Many useful comments were made by Acee Lindem, Karsten Thomann, Hannes Gredler, Peter Lothberg, Uma Chundury, Qin Wu, Sheng Jiang, and Nan Wu, etc. 🌈
Authors' Addresses ✨
meet the squad who wrote it 👑
Bing Liu (editor)
Huawei Technologies
Q10, Huawei Campus, No.156 Beiqing Road
Hai-Dian District, Beijing, 100095
P.R. China
Email: leo.liubing@huawei.com
Les Ginsberg
Cisco Systems
821 Alder Drive
Milpitas CA 95035
United States of America
Email: ginsberg@cisco.com
Bruno Decraene
Orange
France
Email: bruno.decraene@orange.com
Ian Farrer
Deutsche Telekom AG
Bonn
Germany
Email: ian.farrer@telekom.de
Mikael Abrahamsson
T-Systems
Stockholm
Sweden
Email: mikael.abrahamsson@t-systems.se📦 where this page comes from
- ietf: rfc8196 2017-07
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms