IS-IS

OSI IS-IS routing uses two-level hierarchical routing. A routing domain can be partitioned into areas. Level 1 routers know the topology in their area, including all routers and end systems in their area but do not know the identity of routers or destinations outside of their area. Level 1 routers forward traffic with destinations outside of their area to a level 2 router in their area.

Level 2 routers know the level 2 topology, and know which addresses are reachable by each level 2 router. Level 2 routers do not need to know the topology within any level 1 area, except to the extent that a level 2 router can also be a level 1 router within a single area. By default, only level 2 routers can exchange PDUs or routing information directly with external routers located outside the routing domain.

The two types of routers in IS-IS are described below.

• Level 1 intermediate systems

  Routing is performed based on the area ID portion of the ISO address called the Network Entity Title (NET). Level 1 systems route within an area. They recognize, based on the destination address, whether the destination is within the area. If so, they route toward the destination. If not, they route to the nearest level 2 router.

• Level 2 intermediate systems

  Routing is performed based on the area address. They route toward other areas, regardless of other area’s internal structure. A level 2 intermediate system can also be configured as a level 1 intermediate system in the same area.

The level 1 router’s area address portion is manually configured (see ISO network addressing). A level 1 router does not become a neighbor with a node that does not have a common area address. However, if a level 1 router has area addresses A, B, and C, and a neighbor has area addresses B and D, then the level 1 router accepts the other node as a neighbor, as address B is common to both routers. Level 2 adjacencies are formed with other level 2 nodes whose area addresses do not overlap. If the area addresses do not overlap, the link is considered by both routers to be level 2 only and only level 2 LSPDUs flow on the link.

Within an area, level 1 routers exchange LSPs which identify the IP addresses reachable by each router. Specifically, zero or more IP address, subnet mask, and metric combinations can be included in each LSP. Each level 1 router is manually configured with the IP address, subnet mask, and metric combinations, which are reachable on each interface. A level 1 router routes as follows:

• if a specified destination address matches an IP address, subnet mask, or metric reachable within the area; the PDU is routed via level 1 routing

• if a specified destination address does not match any IP address, subnet mask, or metric combinations listed as reachable within the area; the PDU is routed toward the nearest level 2 router

Level 2 routers include in their LSPs, a complete list of IP address, subnet mask, and metrics specifying all the IP addresses which reachable in their area. This information can be obtained from a combination of the level 1 LSPs (by level 1 routers in the same area). Level 2 routers can also report external reachability information, corresponding to addresses reachable by routers in other routing domains or autonomous systems.

• Area

  An area is a routing sub-domain which maintains detailed routing information about its own internal composition, and also maintains routing information which allows it to reach other routing sub-domains. Areas correspond to the level 1 sub-domain.

• End system

  End systems send NPDUs to other systems and receive NPDUs from other systems, but do not relay NPDUs. This International Standard does not specify any additional end system functions beyond those supplied by ISO 8473 and ISO 9542.

• Neighbor

  A neighbor is an adjacent system reachable by traversing a single sub-network by a PDU.

• Adjacency

  An adjacency is a portion of the local routing information which pertains to the reachability of a single neighboring end or intermediate system over a single circuit. Adjacencies are used as input to the decision process to form paths through the routing domain. A separate adjacency is created for each neighbor on a circuit and for each level of routing (level 1 and level 2) on a broadcast circuit.

• Circuit

  The subset of the local routing information base pertinent to a single local Subnetwork Point of Attachments (SNPAs).

• Link

  The communication path between two neighbors. A link is up when communication is possible between the two SNPAs.

• Designated IS

  The intermediate system on a LAN which is designated to perform additional duties. In particular, the designated IS generates link-state PDUs on behalf of the LAN, treating the LAN as a pseudonode.

• Pseudonode

  Where a broadcast sub-network has n connected intermediate systems, the broadcast sub-network itself is considered to be a pseudonode. The pseudonode has links to each of the n intermediate systems and each of the ISs has a single link to the pseudonode (instead of n-1 links to each of the other intermediate systems). Link-state PDUs are generated on behalf of the pseudonode by the designated IS.

• Broadcast sub-network

  A multi-access subnetwork that supports the capability of addressing a group of attached systems with a single PDU.

• General topology sub-network

  A topology that is modeled as a set of point-to-point links, each of which connects two systems. There are several generic types of general topology subnetworks, multipoint links, permanent point-to-point links, dynamic and static point-to-point links.

• Routing sub-domain

  A routing sub-domain consists of a set of intermediate systems and end systems located within the same routing domain.

• Level 2 sub-domain

  Level 2 sub-domain is the set of all level 2 intermediate systems in a routing domain.

IS-IS uses ISO network addresses. Each address identifies a point of connection to the network, such as a router interface, and is called a Network Service Access Point (NSAP).

An end system can have multiple NSAP addresses, in which case the addresses differ only by the last byte (called the n selector). Each NSAP represents a service that is available at that node. In addition to having multiple services, a single node can belong to multiple areas.

Each network entity has a special network address called a Network Entity Title (NET). Structurally, a NET is identical to an NSAP address but has an n-selector of 00. Most end systems have one NET. Intermediate systems can have up to three area IDs (area addresses).

NSAP addresses are divided into three parts. Only the area ID portion is configurable.

• Area ID

  A variable length field between 1 and 13 bytes long. This includes the Authority and Format Identifier (AFI) as the most significant byte and the area ID.

• System ID

  A six-byte system identification. This value is not configurable. The system ID is derived from the system or router ID.

• Selector ID

  A one-byte selector identification that must contain zeros when configuring a NET. This value is not configurable. The selector ID is always 00.

Of the total 20 bytes comprising the NET, only the first 13 bytes, the area ID portion, can be manually configured. As few as one byte can be entered or, at most, 13 bytes. If less than 13 bytes are entered, the rest is padded with zeros.

Routers with common area addresses form level 1 adjacencies. Routers with no common NET addresses form level 2 adjacencies, if they are capable (Using area addresses to form adjacencies).

IS-IS route summarization allows users to create aggregate IPv4 or IPv6 addresses that include multiple groups of IPv4 or IPv6 addresses for a specific IS-IS level. IPv4 and IPv6 routes redistributed from other routing protocols can also be summarized, similar to OSPF configuration using the area-range command. IS-IS IPv4 and IPv6 route summarization helps to reduce the size of the Link-State Database (LSDB) and the IPv4 or IPv6 routing table, and reduces the chance of route flapping.

IS-IS route summarization supports:

• level 1, level 1-2, and level 2

• route summarization for the IPv4 or IPv6 routes redistributed from other protocols

• the smallest metric used to advertise summary addresses of all the more specific IPv4 or IPv6 routes

• IS-IS IPv6 route summarization algorithm and SRv6 locator awareness

• full Multitopology Intermediate System to Intermediate System (MT-ISIS) MT0 and MT2 support:

  • The MT0 summary summarizes the MT0 routes and advertises them as an MT0 route.
  • The MT2 summary summarizes the MT2 routes and advertises them as an MT2 route.

• IS-IS Unreachable Prefix Announcement (UPA), as defined in draft-ietf-lsr-igp-ureach-prefix-announce-01, to assist BGP FRR for SRv6.

configure router isis summary-address advertise-unreachable match-route-tag
configure router isis summary-address advertise-unreachable advertise-route-tag
configure router isis prefix-unreachable maximum-number-upas
configure router isis prefix-unreachable process-received-upa
configure router isis prefix-unreachable upa-lifetime
configure router isis prefix-unreachable upa-metric

Multitopology IS-IS (MT-ISIS) support within SR OS allows for the creation of different topologies within IS-IS that contribute routes to specific route tables for IPv4 unicast, IPv6 unicast, IPv4 multicast, and IPv6 multicast. This capability allows for non-congruent topologies between these different routing tables. As a result, networks are able to control which links or nodes are to be used for forwarding different types of traffic.

For example, MT-ISIS could allow all links to carry IPv4 traffic, while only a subset of links can also carry IPv6 traffic.

SR OS supports the following multitopologies:

• IPv4 Unicast – MT-ID 0

• IPv6 Unicast – MT-ID 2

• IPv4 Multicast – MT-ID 3

• IPv6 Multicast – MT-ID 4

IS-IS administrative tags enable a network administrator to configure route tags to tag IS-IS route prefixes. These tags can subsequently be used to control IS-IS route redistribution or route leaking.

IS-IS route tagging can be applied to IP addresses of an interface and to administrative policies with a route map. A network administrator can tag a summary route and then use a route policy to match the tag with one or more attributes for the route.

Using these administrative policies, the operator can control how a router handles route exchanges with its IS-IS neighboring routers. Administrative policies are also used to govern the installation of routes in the routing table.

Route tags allow policies to do the following:

• redistribute routes received from other protocols in the routing table to IS-IS

• redistribute routes or SRv6 locators between levels in an IS-IS routing hierarchy

• summarize routes redistributed into IS-IS or within IS-IS by creating aggregate (summary) addresses

If the SR OS router is providing a grace period to an adjacent neighbor and the BFD session associated with that neighbor fails, the behavior is determined by the C-bit values sent by each neighbor.

• If both BFD end-points have set their C-bit value, then the graceful restart helper mode is canceled and any routes from that neighbor that are marked as stale are removed from the forwarding table.

• If either of the BFD end-points has not set their C-bit value, then the graceful restart helper mode continues.

• IS-IS must be enabled on each participating router.

• There are no default network entity titles.

• There are no default interfaces.

• By default, the routers are assigned a level 1/level 2 level capability.

For IS-IS to operate on the routers, IS-IS must be explicitly enabled, and at least one area address and interface must be configured. If IS-IS is enabled but no area address or interface is defined, the protocol is enabled but no routes are exchanged. When at least one area address and interface are configured, then adjacencies can be formed and routes exchanged.

The following example displays IS-IS default values.

[ex:/configure router "Base" isis 0]
A:admin@node-2# info detail
 ## apply-groups
 ## apply-groups-exclude
    admin-state enable
 ## authentication-keychain
 ## authentication-key
 ## authentication-type
    csnp-authentication true
    psnp-authentication true
    advertise-passive-only false
 ## advertise-router-capability
    advertise-tunnel-link false
    all-l1isis 01:80:c2:00:00:14
    all-l2isis 01:80:c2:00:00:15
    authentication-check true
 ## default-route-tag
    ldp-sync true
    hello-authentication true
    ignore-attached-bit false
    ignore-lsp-errors false
    ignore-narrow-metric false
    iid-tlv false
    ipv4-multicast-routing native
    ipv4-routing true
    ipv6-multicast-routing native
    ipv6-routing false
 ## hello-padding
    ldp-over-rsvp false
    level-capability 1/2
    lsp-lifetime 1200
 ## lsp-minimum-remaining-lifetime
    lsp-mtu-size 1492
    mru-mismatch-detection false
    overload-export-interlevel false
    overload-export-external false
    overload-include-locators false
    poi-tlv false
    prefix-attributes-tlv false
 ## reference-bandwidth
 ## router-id
    standard-multi-instance false
    strict-adjacency-check false
    suppress-attached-bit false
    system-id 0000.0000.0000
    traffic-engineering false
 ## export-policy
 ## import-policy
 ## area-address
 ## export-limit
 ## graceful-restart
    entropy-label {
        override-tunnel-elc false
    }
 ## multi-topology
    multicast-import {
        ipv4 false
        ipv6 false
    }
 ## overload
 ## overload-on-boot
 ## overload-fib-error-notify-only
 ## prefix-limit
    lsp-refresh {
        interval 600
        half-lifetime true
    }
    rib-priority {
        high {
         ## prefix-list
         ## tag
        }
    }
    timers {
        spf-wait {
            spf-max-wait 10000
            spf-initial-wait 1000
            spf-second-wait 1000
        }
        lsp-wait {
            lsp-max-wait 5000
            lsp-initial-wait 10
            lsp-second-wait 1000
        }
    }
    unicast-import {
        ipv4 true
        ipv6 true
    }
 ## loopfree-alternate
 ## database-export
    flexible-algorithms {
        admin-state disable
        advertise-admin-group prefer-ag
     ## flex-algo
    }
    prefix-unreachable {
        maximum-number-upas 32
        process-received-upa false
        upa-lifetime 180
        upa-metric 4261412865
    }
    traffic-engineering-options {
        advertise-delay false
        ipv6 false
     ## application-link-attributes
    }
    segment-routing {
     ## apply-groups
     ## apply-groups-exclude
        admin-state disable
        adj-sid-hold 15
        class-forwarding false
        entropy-label true
     ## export-tunnel-table
     ## srlb
     ## tunnel-mtu
        tunnel-table-pref 11
        adjacency-sid {
            allocate-dual-sids false
        }
     ## micro-loop-avoidance
        multi-topology {
            mt2 false
        }
     ## prefix-sid-range
        maximum-sid-depth {
         ## override-bmi
         ## override-erld
        }
     ## adjacency-set
        egress-statistics {
            adj-set false
            adj-sid false
            node-sid false
        }
        ingress-statistics {
            adj-set false
            adj-sid false
            node-sid false
        }
        mapping-server {
            admin-state disable
         ## node-sid-map
        }
    }
    segment-routing-v6 {
     ## apply-groups
     ## apply-groups-exclude
        admin-state disable
        adj-sid-hold 15
     ## locator
     ## micro-segment-locator
    }
    igp-shortcut {
     ## apply-groups
     ## apply-groups-exclude
        admin-state disable
        allow-sr-over-srte false
        tunnel-next-hop {
            family ipv4 {
             ## apply-groups
             ## apply-groups-exclude
                resolution none
                resolution-filter {
                    rsvp false
                    sr-te false
                }
            }
            family ipv6 {
             ## apply-groups
             ## apply-groups-exclude
                resolution none
                resolution-filter {
                    rsvp false
                    sr-te false
                }
            }
            family srv4 {
             ## apply-groups
             ## apply-groups-exclude
                resolution none
                resolution-filter {
                    rsvp false
                    sr-te false
                }
            }
            family srv6 {
             ## apply-groups
             ## apply-groups-exclude
                resolution none
                resolution-filter {
                    rsvp false
                    sr-te false
                }
            }
        }
    }
 ## interface
    level 1 {
     ## apply-groups
     ## apply-groups-exclude
     ## authentication-keychain
     ## authentication-key
     ## authentication-type
        csnp-authentication true
        psnp-authentication true
        advertise-router-capability true
        database-export-exclude false
        default-ipv4-multicast-metric 10
        default-ipv6-multicast-metric 10
        default-ipv6-unicast-metric 10
        default-metric 10
        external-preference 160
        hello-authentication true
     ## hello-padding
        loopfree-alternate-exclude false
        lsp-mtu-size 1492
        preference 15
        wide-metrics-only false
        bier {
            admin-state disable
         ## template
        }
    }
    level 2 {
     ## apply-groups
     ## apply-groups-exclude
     ## authentication-keychain
     ## authentication-key
     ## authentication-type
        csnp-authentication true
        psnp-authentication true
        advertise-router-capability true
        database-export-exclude false
        default-ipv4-multicast-metric 10
        default-ipv6-multicast-metric 10
        default-ipv6-unicast-metric 10
        default-metric 10
        external-preference 165
        hello-authentication true
     ## hello-padding
        loopfree-alternate-exclude false
        lsp-mtu-size 1492
        preference 18
        wide-metrics-only false
        bier {
            admin-state disable
         ## template
        }
    }
 ## link-group
    summary-address 192.1.1.1/32 {
     ## apply-groups
     ## apply-groups-exclude
        level-capability 1/2
     ## route-tag
     ## algorithm
     ## advertise-unreachable
    }

A:node-2>config>router>isis# info detail
----------------------------------------------
            no system-id
            no router-id
            level-capability level-1/2
            no standard-multi-instance
            no graceful-restart
            no auth-keychain
            no authentication-key
            no authentication-type
            authentication-check
            csnp-authentication
            no ignore-lsp-errors
            no ignore-narrow-metric
            lsp-lifetime 1200
            no lsp-minimum-remaining-lifetime
            lsp-mtu-size 1492
            lsp-refresh-interval 600 half-lifetime enable
            no mru-mismatch-detection
            no database-export
            no export-limit
            no overload
            no overload-on-boot
            no overload-export-external
            no overload-export-interlevel
            no overload-include-locators
            no overload-fib-error-notify-only
            no export
            no import
            hello-authentication
            psnp-authentication
            no traffic-engineering
            traffic-engineering-options
                no advertise-delay
                no ipv6
                no application-link-attributes
            exit
            no reference-bandwidth
            no default-route-tag
            no disable-ldp-sync
            no advertise-passive-only
            no advertise-router-capability
            no hello-padding
            no ldp-over-rsvp
            no advertise-tunnel-link
            no ignore-attached-bit
            no suppress-attached-bit
            no iid-tlv-enable
            no poi-tlv-enable
            no prefix-attributes-tlv
            no prefix-limit
            no loopfree-alternates
            no rib-priority high
            ipv4-routing
            no ipv6-routing
            ipv4-multicast-routing native
            ipv6-multicast-routing native
            no multi-topology
            no unicast-import-disable both
            no multicast-import both
            no strict-adjacency-check
            summary-address 192.1.1.1/32 level-1/2
            entropy-label
                no override-tunnel-elc
            exit
            flexible-algorithms
                shutdown
                advertise-admin-group prefer-ag
            exit
            igp-shortcut
                shutdown
                no allow-sr-over-srte
                tunnel-next-hop
                    family ipv4
                        resolution disabled
                        resolution-filter
                            no rsvp
                            no sr-te
                        exit
                    exit
                    family ipv6
                        resolution disabled
                        resolution-filter
                            no rsvp
                            no sr-te
                        exit
                    exit
                    family srv4
                        resolution disabled
                        resolution-filter
                            no rsvp
                            no sr-te
                        exit
                    exit
                    family srv6
                        resolution disabled
                        resolution-filter
                            no rsvp
                            no sr-te
                        exit
                    exit
                exit
            exit
            prefix-unreachable
                maximum-number-upas 32
                no process-received-upa
                upa-lifetime 180
                upa-metric 4261412865
            exit
            timers
                lsp-wait 5000 lsp-initial-wait 10 lsp-second-wait 1000
                spf-wait 10000 spf-initial-wait 1000 spf-second-wait 1000
            exit
            level 1
                advertise-router-capability
                no hello-padding
                no lsp-mtu-size
                no auth-keychain
                no authentication-key
                no authentication-type
                csnp-authentication
                no database-export-exclude
                external-preference 160
                hello-authentication
                no loopfree-alternate-exclude
                preference 15
                psnp-authentication
                no wide-metrics-only
                default-metric 10
                default-ipv4-multicast-metric 10
                default-ipv6-unicast-metric 10
                default-ipv6-multicast-metric 10
                bier
                    shutdown
                exit
            exit
            level 2
                advertise-router-capability
                no hello-padding
                no lsp-mtu-size
                no auth-keychain
                no authentication-key
                no authentication-type
                csnp-authentication
                no database-export-exclude
                external-preference 165
                hello-authentication
                no loopfree-alternate-exclude
                preference 18
                psnp-authentication
                no wide-metrics-only
                default-metric 10
                default-ipv4-multicast-metric 10
                default-ipv6-unicast-metric 10
                default-ipv6-multicast-metric 10
                bier
                    shutdown
                exit
            exit
            segment-routing
                shutdown
                adj-sid-hold 15
                no class-forwarding
                entropy-label enable
                no export-tunnel-table
                no micro-loop-avoidance
                no multi-topology
                no prefix-sid-range
                no srlb
                tunnel-table-pref 11
                no tunnel-mtu
                adjacency-sid
                    no allocate-dual-sids
                exit
                egress-statistics
                    no adj-set
                    no adj-sid
                    no node-sid
                exit
                ingress-statistics
                    no adj-set
                    no adj-sid
                    no node-sid
                exit
                mapping-server
                    shutdown
                exit
                maximum-sid-depth
                    no override-bmi
                    no override-erld
                exit
            exit
            segment-routing-v6
                shutdown
                adj-sid-hold 15
            exit
            no shutdown
----------------------------------------------

To implement IS-IS in your network, you must enable IS-IS on each participating router.

To assign different level to the routers and organize your network into areas, modify the level capability defaults on end systems from level 1/2 to level 1. Routers communicating to other areas can retain the level 1/2 default.

Use the CLI commands displayed in the following subsections to configure IS-IS components.

When you administratively disable the IS-IS protocol instance on the router, the configuration settings are not changed, reset, or removed. Use the following command to disable IS-IS on a router:

• MD-CLI

  configure router isis admin-state disable

• classic CLI

  configure router isis shutdown

When you remove the IS-IS protocol instance, the IS-IS configuration reverts to the default settings.

Use the following command to remove the IS-IS configuration:

• MD-CLI

  config router delete isis

• classic CLI

  configure router no isis

You can modify, disable, or remove global IS-IS configuration without administratively disabling the entities. Changes take effect immediately. Modifying the level capability on the global level causes the IS-IS protocol to restart.

You can modify, disable, or remove interface-level IS-IS configuration without administratively disabling the entities. Changes take effect immediately. Modifying the level capability on the interface causes the IS-IS protocol on the interface to restart.

Use the following command to remove an interface:

• MD-CLI

  configure router delete interface

• classic CLI

  configure router no interface

Use the following command to disable an interface:

• MD-CLI

  configure router interface admin-state disable

• classic CLI

  configure router interface shutdown

The following example displays interface IS-IS modification command usage. For specific interface configuration and modification examples also see, Configuring a level 1 area and Modifying a router’s level capability.

The use of authentication mechanism is recommended to protect against malicious attack on the communications between routing protocol neighbors. These attacks could aim to either disrupt communications or to inject incorrect routing information into the systems routing table. The use of authentication keys can help to protect the routing protocols from these types of attacks. In addition, the use of authentication keychains provides the ability to configure authentication keys and make changes to them without affecting the state of the routing protocol adjacencies.

To configure the use of an authentication keychain within IS-IS, use the following steps.

1. Use the following command to configure an authentication keychain. The configured keychain must include at least one valid key entry, using a valid authentication algorithm for the IS-IS protocol.

   • MD-CLI

     configure system security keychains

   • classic CLI

     configure system security keychain

2. Associate the configure authentication keychain with IS-IS. Authentication keychains can be used to specify the authentication at the IS-IS global and level contexts, as well as for hello authentication at the interface and interface-level context.

   • MD-CLI

     configure router isis hello-authentication-keychain

   • classic CLI

     configure router isis auth-keychain

Use the following command to establish the hello authentication association:

For a key entry to be valid, it must include a valid key, the current system clock value must be within the begin and end time of the key entry, and the algorithm specified in the key entry must be supported by the IS-IS protocol.

The IS-IS protocol supports the following algorithms:

• clear text password (RFC 5304 and RFC 5310 formats)

• HMAC-MD5 (RFC 5304 and RFC 5310 formats)

• HMAC-SHA-1 (RFC 5310 format)

• HMAC-SHA-256 (RFC 5310 format)

The IS-IS key entry may also include the option to determine how the IS-IS protocol encodes the authentication signature. The basic command option results in the use of RFC 5304 format. The default or a value of the isis-enhanced command option results in using the RFC 5310 format.

Use the following command to configure the encoding of the IS-IS protocol authentication signature:

• MD-CLI

  configure system security keychains keychain bidirectional entry option

• classic CLI

  configure system security keychain direction bi entry

The error handling is described below.

• If a keychain exists but there are no active key entries with an authentication type that is valid for the associated protocol then inbound protocol packets are not authenticated and discarded and no outbound protocol packets should be sent.

• If keychain exists, but the last key entry has expired, a log entry is raised indicating that all keychain entries have expired. The IS-IS protocol requires that the protocol not revert to an unauthenticated state and requires that the old key is not to be used, therefore, after the last key has expired, all traffic is discarded.

IS-IS allows a two-level hierarchy to route PDUs. Level 1 areas can be interconnected by a contiguous level 2 backbone. The level 1 link-state database contains information only about that area. The level 2 link-state database contains information about the level 2 system and each of the level 1 systems in the area. A level 1/2 router contains information about both level 1 and level 2 databases. A level 1/2 router advertises information about its level 1 area toward the other level 1/2 or level 2 (only) routers.

Packets with destinations outside the level 1 area are forwarded toward the closest level 1/2 router which, in turn, forwards the packets to the destination area.

Sometimes, the shortest path to an outside destination is not through the closest level 1/2 router, or, the only level 1/2 system to forward packets out of an area is not operational. Route leaking provides a mechanism to leak level 2 information to level 1 systems to provide routing information about inter-area routes. A level 1 router then has more options to forward packets.

See Configuring route leaking from level 2 to level 1 areas for information about how to configure route leaking.

IS-IS does not redistribute level 1 external routes into level 2 by default. You must explicitly apply the policy to redistribute external IS-IS routes. Use the commands in the following context to create and apply a policy to redistribute external IS-IS routes:

• MD-CLI
  Note: Use the commit command to save the configuration.

  configure policy-options prefix-list
  configure policy-options policy-statement entry

• class CLI
  Note: Use the begin command to enter edit mode for the policy-options configuration and the commit command to save the configuration.

  configure router policy-options prefix-list
  configure router policy-options policy-statement entry

See Route policies for more information about creating and using route policies.

The following example shows a policy-statement configuration.

[ex:/configure policy-options]
A:node-AC# info
    prefix-list "loops" {
        prefix 10.1.1.0/24 type longer {
        }
    }
    policy-statement "isis-ext" {
        entry 10 {
            from {
                external true
            }
            to {
                level 2
            }
            action {
                action-type accept
            }
        }
    }
    policy-statement "leak" {
        entry 10 {
            from {
                level 2
                prefix-list ["loops"]
            }
            to {
                level 1
            }
            action {
                action-type accept
            }
        }
    }

A:node-AC>config>router>policy-options# info
----------------------------------------------
            prefix-list "loops"
                    prefix 10.1.1.0/24 longer
            exit
            policy-statement "leak"
                entry 10
                    from
                        prefix-list "loops"
                        level 2
                    exit
                    to
                        level 1
                    exit
                    action accept
                    exit
                exit
            exit
            policy-statement "isis-ext"
                entry 10
                    from
                        external
                    exit
                    to
                        level 2
                    exit
                    action accept
                    exit
                exit
            exit
---------------------------------------------

Use the following commands to specify a MAC address for all L1 IS-IS routers.

configure router isis all-l1isis
configure service vprn isis all-l1isis

Use the following commands to specify the MAC address for all L2 IS-IS routers.

configure router isis all-l2isis
configure service vprn isis all-l2isis