Discussion

Level Adjacencies Priority Metric Hello (s) Hold (s) Designated Router
1 0 64 0 Passive
2 0 64 0 Passive
Unlike OSPF, which has a “sticky” DR, in IS-IS, if a new router with a higher priority
than the existing DR becomes active, or if the new router has an equal priority
and a higher MAC address, it becomes the new DR. In this recipe, for RouterH to
become the DR, its priority needs to be greater than 64. After changing the value,
you see that RouterH has become the Level 2 DR:
aviva@RouterG> show isis interface
IS-IS interface database:
Interface L CirID Level 1 DR Level 2 DR L1/L2 Metric
fe-0/0/1.0 3 0x2 RouterG.02 RouterH.02 10/10
fe-1/0/0.0 1 0x3 RouterA.02 Disabled 10/10
lo0.0 0 0x1 Passive Passive 0/0
Looking at RouterH, you see it has a DR priority of 65:
aviva@RouterH> show isis interface fe-0/0/1 detail
IS-IS interface database:
fe-0/0/1.0
Index: 67, State: 0x6, Circuit id: 0x2, Circuit type: 3
LSP interval: 100 ms, CSNP interval: 10 s
Level Adjacencies Priority Metric Hello (s) Hold (s) Designated Router
1 0 64 10 9.000 27
2 1 65 10 3.000 9 RouterH.02 (us)
11.7 Enabling IS-IS Authentication
Problem
You want to ensure that all IS-IS protocol traffic that your router accepts comes from
devices known to you so that only trusted routers participate in determining the contents
of the IS-IS routing database.
Solution
Configure MD5 authentication for IS-IS:
[edit protocols isis]
aviva@RouterG# set level 2 authentication-type md5
aviva@RouterG# set level 2 authentication-key $1991poPPi
Discussion
It is a good security measure to authenticate IS-IS protocol packet exchanges to
ensure that only trusted routers participate in the IS-IS network and in the exchange
of LSA packets.
This recipe shows how to configure IS-IS to use MD5 authentication for the Level 2
area. First you configure MD5 authentication for the entire area, then you set the
366 | Chapter 11: IS-IS
This is the Title of the Book, eMatter Edition
Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.