Category Archives: Cisco

Integrated IS-IS IPv6 Configuration

November 1, 2017Cisco, Integrated IS-IS, IPv6, Service ProviderIntegrated IS-IS, IS-IS, ISIS for IPv4, ISIS for IPv6Amolak

Integrated IS-IS IPv6 Configuration

We will cover following topics:

Multiple IS-IS Areas
IS-IS Metric Styles – Narrow and Wide
IS-IS Single/Multi Topology
Route Leak between Areas
Route Summarization
Redistribution between IS-IS and other routing protocol

Network Topology

You can find Integrated IS-IS IPv4 configuration for same topology at http://www.amolak.net/integrated-is-is-ipv4-configuration/

Tasks

Configure IS-IS Area 49.0001 on R1, R2, R3 & R4.
Configure IS-IS Area 49.0002 on R5, R6 & R7.
Configure IS-IS Area 49.0003 on R8 & R9.
Configure OSPF Area 0 between R1 Fa0/1 and R10 Fa0/1.
Configure R1, R2 & R3 as IS-IS Router type Level-2 only.
Configure all interfaces of R4 as IS-IS circuit type Level-2 only.
R5, R6 & R8 would work in default IS-IS router type, which is L1/L2.
Configure R7 & R9 as IS-IS Router type Level-1.
Configure mutual redistribution between OSPF and IS-IS on R1.
Configure R8 to Leak Level-2 area routes into Level-1 area.
Configure R8 to send summary route 2001:172:16::/48 instead of more specific routes from 2001:172:16:xx network, into Level-1 area.

Configuration

R1

hostname R1
!
ip cef
ipv6 unicast-routing
ipv6 cef
!
interface Loopback0
 ip address 192.168.1.1 255.255.255.255
 ipv6 address 2001:192:168:1::1/128
!
interface FastEthernet0/0
 ip address 10.1.123.1 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:123::1/64
 ipv6 router isis 1
!
interface FastEthernet0/1
 ip address 172.16.110.1 255.255.255.0
 ipv6 address 2001:172:16:110::1/64
 ipv6 ospf 100 area 0
!
router ospf 1
 redistribute isis 1 level-1-2 subnets
 passive-interface default
 no passive-interface FastEthernet0/1
 network 172.16.110.1 0.0.0.0 area 0
 network 192.168.1.1 0.0.0.0 area 0
!
router isis 1
 net 49.0001.1921.6800.1001.00
 is-type level-2-only
 redistribute ospf 1 match internal external 1 external 2
 passive-interface Loopback0
 !
 address-family ipv6
 redistribute ospf 100 match internal external 1 external 2
 exit-address-family
!
ipv6 router ospf 100
 redistribute isis 1 level-1-2
!

R2

hostname R2
!
ip cef
ipv6 unicast-routing
ipv6 cef
!
interface Loopback0
 ip address 192.168.1.2 255.255.255.255
 ipv6 address 2001:192:168:1::2/128
!
interface FastEthernet0/0
 ip address 10.1.123.2 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:123::2/64
 ipv6 router isis 1
!
interface FastEthernet0/1
 ip address 10.1.25.2 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:25::2/64
 ipv6 router isis 1
!
interface FastEthernet1/0
 ip address 10.1.24.2 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:24::2/64
 ipv6 router isis 1
!
router isis 1
 net 49.0001.1921.6800.1002.00
 is-type level-2-only
 passive-interface Loopback0
!

R3

hostname R3
!
ip cef
ipv6 unicast-routing
ipv6 cef
!
interface Loopback0
 ip address 192.168.1.3 255.255.255.255
 ipv6 address 2001:192:168:1::3/128
!
interface FastEthernet0/0
 ip address 10.1.123.3 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:123::3/64
 ipv6 router isis 1
!
interface FastEthernet0/1
 ip address 10.1.38.3 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:38::3/64
 ipv6 router isis 1
!
interface FastEthernet1/0
 ip address 10.1.34.3 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:34::3/64
 ipv6 router isis 1
!
router isis 1
 net 49.0001.1921.6800.1003.00
 is-type level-2-only
 passive-interface Loopback0
!

R4

hostname R4
!
ip cef
ipv6 unicast-routing
ipv6 cef
!
interface Loopback0
 ip address 192.168.1.4 255.255.255.255
 ipv6 address 2001:192:168:1::4/128
!
interface FastEthernet0/0
 ip address 10.1.34.4 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:34::4/64
 ipv6 router isis 1
 isis circuit-type level-2-only
!
interface FastEthernet0/1
 ip address 10.1.46.4 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:46::4/64
 ipv6 router isis 1
 isis circuit-type level-2-only
!
interface FastEthernet1/0
 ip address 10.1.24.4 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:24::4/64
 ipv6 router isis 1
 isis circuit-type level-2-only
!
router isis 1
 net 49.0001.1921.6800.1004.00
 passive-interface Loopback0
!

R5

hostname R5
!
ip cef
ipv6 unicast-routing
ipv6 cef
!
interface Loopback0
 ip address 192.168.1.5 255.255.255.255
 ipv6 address 2001:192:168:1::5/128
!
interface FastEthernet0/0
 ip address 10.1.57.5 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:57::5/64
 ipv6 router isis 1
 isis network point-to-point 
!
interface FastEthernet0/1
 ip address 10.1.25.5 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:25::5/64
 ipv6 router isis 1
!
interface FastEthernet1/0
 ip address 10.1.56.5 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:56::5/64
 ipv6 router isis 1
!
router isis 1
 net 49.0002.1921.6800.1005.00
 passive-interface Loopback0
!

R6

hostname R6
!
ip cef
ipv6 unicast-routing
ipv6 cef
!
interface Loopback0
 ip address 192.168.1.6 255.255.255.255
 ipv6 address 2001:192:168:1::6/128
!
interface FastEthernet0/0
 ip address 10.1.67.6 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:67::6/64
 ipv6 router isis 1
!
interface FastEthernet0/1
 ip address 10.1.46.6 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:46::6/64
 ipv6 router isis 1
!
interface FastEthernet1/0
 ip address 10.1.56.6 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:56::6/64
 ipv6 router isis 1
!
router isis 1
 net 49.0002.1921.6800.1006.00
 passive-interface Loopback0
!

R7

hostname R7
!
ip cef
ipv6 unicast-routing
ipv6 cef
!
interface Loopback0
 ip address 192.168.1.7 255.255.255.255
 ipv6 address 2001:192:168:1::7/128
!
interface FastEthernet0/0
 ip address 10.1.57.7 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:57::7/64
 ipv6 router isis 1
 isis network point-to-point 
 isis ipv6 metric 20
!
interface FastEthernet0/1
 ip address 10.1.67.7 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:67::7/64
 ipv6 router isis 1
 isis metric 20
!
router isis 1
 net 49.0002.1921.6800.1007.00
 is-type level-1
 passive-interface Loopback0
!

R8

hostname R8
!
ip cef
ipv6 unicast-routing
ipv6 cef
!
interface Loopback0
 ip address 192.168.1.8 255.255.255.255
 ipv6 address 2001:192:168:1::8/128
!
interface FastEthernet0/0
 ip address 10.1.89.8 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:89::8/64
 ipv6 router isis 1
!
interface FastEthernet0/1
 ip address 10.1.38.8 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:38::8/64
 ipv6 router isis 1
!
router isis 1
 net 49.0003.1921.6800.1008.00
 summary-address 172.16.0.0 255.255.252.0 level-1
 redistribute isis ip level-2 into level-1 distribute-list 100
 passive-interface Loopback0
 !
 address-family ipv6
 summary-prefix 2001:172:16::/48 level-1
 redistribute isis level-2 into level-1 distribute-list IPv6_L2_PREFIXES
 exit-address-family
!
access-list 100 permit ip any any
!
ipv6 prefix-list IPv6_L2_PREFIXES seq 5 permit ::/0 le 128
!

R9

hostname R9
!
ip cef
ipv6 unicast-routing
ipv6 cef
!
interface Loopback0
 ip address 192.168.1.9 255.255.255.255
 ipv6 address 2001:192:168:1::9/128
!
interface FastEthernet0/0
 ip address 10.1.89.9 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:89::9/64
 ipv6 router isis 1
!
router isis 1
 net 49.0003.1921.6800.1009.00
 is-type level-1
 passive-interface Loopback0
!

R10

hostname R10
!
ip cef
ipv6 unicast-routing
ipv6 cef
!
interface Loopback0
 ip address 192.168.1.10 255.255.255.255
 ipv6 address 2001:192:168:1::10/128
 ipv6 ospf 100 area 0
!
interface Loopback1
 ip address 172.16.0.1 255.255.255.0
 ip ospf network point-to-point
 ipv6 address 2001:172:16::1/64
 ipv6 ospf 100 area 0
 ipv6 ospf network point-to-point
!
interface Loopback2
 ip address 172.16.1.1 255.255.255.0
 ip ospf network point-to-point
 ipv6 address 2001:172:16:1::1/64
 ipv6 ospf 100 area 0
 ipv6 ospf network point-to-point
!
interface Loopback3
 ip address 172.16.2.1 255.255.255.0
 ip ospf network point-to-point
 ipv6 address 2001:172:16:2::1/64
 ipv6 ospf 100 area 0
 ipv6 ospf network point-to-point
!
interface Loopback4
 ip address 172.16.3.1 255.255.255.0
 ip ospf network point-to-point
 ipv6 address 2001:172:16:3::1/64
 ipv6 ospf 100 area 0
 ipv6 ospf network point-to-point
!
interface FastEthernet0/1
 ip address 172.16.110.10 255.255.255.0
 ipv6 address 2001:172:16:110::10/64
 ipv6 ospf 100 area 0
!
router ospf 1
 network 0.0.0.0 255.255.255.255 area 0
!
ipv6 router ospf 100
!

Task Specific Configuration Explanation

Task 1 – 3

To enable Integrated IS-IS routing for IPv6, first we need to enable “ipv6 unicast-routing” in global configuration and then configure “ipv6 router isis x” under interfaces, which are configured for IPv6 networks.

Task 4

Configure OSPFv3 for IPv6:

Configure OSPFv3 process ID for IPv6 – ipv6 router ospf 100
Configure IPv6 OSPF process id and area under interfaces – ipv6 ospf 100 area 0

Task 9

OSPF to IS-IS Redistribution

We need to define which OSPF routes need to be redistributed into IS-IS in address-family IPv6. Here we have matched all OSPF route types – internal, external type 1 (E1), external type 2 (E2)

router isis 1
 !
 address-family ipv6
 redistribute ospf 100 match internal external 1 external 2
 exit-address-family

IS-IS to OSPF Redistribution

We need to define which IS-IS routes need to be redistributed into OSPF. Here we have matched both level1 and level2 routes with their actual subnet mask.

ipv6 router ospf 100
 redistribute isis 1 level-1-2

Task 10 – Route Leak

IS-IS level1 area is like OSPF totally stubby area, which receives default route from Area Border Router to reach all destinations outside of its own area. Let’s check routing table on R9 (Level-1 Router) before leaking level2 routes into level1 area.

R9#sh ipv6 route
IPv6 Routing Table - default - 7 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
 B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP
 H - NHRP, I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea
 IS - ISIS summary, D - EIGRP, EX - EIGRP external, NM - NEMO
 ND - ND Default, NDp - ND Prefix, DCE - Destination, NDr - Redirect
 O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
 ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2, l - LISP
I1 ::/0 [115/10]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
I1 2001:10:1:38::/64 [115/20]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
C 2001:10:1:89::/64 [0/0]
 via FastEthernet0/0, directly connected
L 2001:10:1:89::9/128 [0/0]
 via FastEthernet0/0, receive
I1 2001:192:168:1::8/128 [115/10]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
LC 2001:192:168:1::9/128 [0/0]
 via Loopback0, receive
L FF00::/8 [0/0]
 via Null0, receive

Let’s configure route leak level2 routes into level1 on R8. We can create IPv6 prefix-list to match IPv6 routes, which we want to leak from level2 into level1.

R8#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R8(config)#ipv6 prefix-list IPv6_L2_PREFIXES seq 5 permit ::/0 le 128
R8(config)#router isis 1
R8(config-router)#address-family ipv6
R8(config-router)#redistribute isis level-2 into level-1 distribute-list IPv6_L2_PREFIXES 
R8(config-router)#end
R8#

Now check routing on R9(Level1 Router)

R9#sh ipv6 route
IPv6 Routing Table - default - 27 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
 B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP
 H - NHRP, I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea
 IS - ISIS summary, D - EIGRP, EX - EIGRP external, NM - NEMO
 ND - ND Default, NDp - ND Prefix, DCE - Destination, NDr - Redirect
 O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
 ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2, l - LISP
I1 ::/0 [115/10]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:10:1:24::/64 [115/40]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:10:1:25::/64 [115/40]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:10:1:34::/64 [115/30]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
I1 2001:10:1:38::/64 [115/20]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:10:1:46::/64 [115/40]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:10:1:56::/64 [115/50]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:10:1:57::/64 [115/50]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:10:1:67::/64 [115/50]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
C 2001:10:1:89::/64 [0/0]
 via FastEthernet0/0, directly connected
L 2001:10:1:89::9/128 [0/0]
 via FastEthernet0/0, receive
IA 2001:10:1:123::/64 [115/30]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:172:16::/64 [115/30]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:172:16:1::/64 [115/30]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:172:16:2::/64 [115/30]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:172:16:3::/64 [115/30]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:192:168:1::1/128 [115/30]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:192:168:1::2/128 [115/30]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:192:168:1::3/128 [115/20]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:192:168:1::4/128 [115/30]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:192:168:1::5/128 [115/40]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:192:168:1::6/128 [115/40]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:192:168:1::7/128 [115/50]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
I1 2001:192:168:1::8/128 [115/10]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
LC 2001:192:168:1::9/128 [0/0]
 via Loopback0, receive
IA 2001:192:168:1::10/128 [115/30]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
L FF00::/8 [0/0]
 via Null0, receive
R9#

Task 11 – Route Summarization

As we have seen in previous routing table on R9, it has received below four routes from R8.

2001:172:16::/64
2001:172:16:1::/64
2001:172:16:2::/64
2001:172:16:3::/64

which can be summarized into 2001:172:16::/48.

R8#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R8(config)#router isis 1 
R8(config-router)#address-family ipv6 
R8(config-router-af)#summary-prefix 2001:172:16::/48 level-1
R8(config-router-af)#
R8(config-router-af)#end 
R8#

!! -- When doing manual summarization the router will add a local --!!
!!-- summary route to null 0. This feature is in place to prevent --!! 
!! -- routing loops. --!!

R8#sh ipv6 route
IPv6 Routing Table - default - 28 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
 B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP
 H - NHRP, I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea
 IS - ISIS summary, D - EIGRP, EX - EIGRP external, NM - NEMO
 ND - ND Default, NDp - ND Prefix, DCE - Destination, NDr - Redirect
 O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
 ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2, l - LISP
I2 2001:10:1:24::/64 [115/30]
 via FE80::C807:1EFF:FE84:6, FastEthernet0/1
I2 2001:10:1:25::/64 [115/30]
 via FE80::C807:1EFF:FE84:6, FastEthernet0/1
I2 2001:10:1:34::/64 [115/20]
 via FE80::C807:1EFF:FE84:6, FastEthernet0/1
C 2001:10:1:38::/64 [0/0]
 via FastEthernet0/1, directly connected
L 2001:10:1:38::8/128 [0/0]
 via FastEthernet0/1, receive
I2 2001:10:1:46::/64 [115/30]
 via FE80::C807:1EFF:FE84:6, FastEthernet0/1
I2 2001:10:1:56::/64 [115/40]
 via FE80::C807:1EFF:FE84:6, FastEthernet0/1
I2 2001:10:1:57::/64 [115/40]
 via FE80::C807:1EFF:FE84:6, FastEthernet0/1
I2 2001:10:1:67::/64 [115/40]
 via FE80::C807:1EFF:FE84:6, FastEthernet0/1
C 2001:10:1:89::/64 [0/0]
 via FastEthernet0/0, directly connected
L 2001:10:1:89::8/128 [0/0]
 via FastEthernet0/0, receive
I2 2001:10:1:123::/64 [115/20]
 via FE80::C807:1EFF:FE84:6, FastEthernet0/1
IS 2001:172:16::/48 [115/20]
 via Null0, directly connected
I2 2001:172:16::/64 [115/20]
 via FE80::C807:1EFF:FE84:6, FastEthernet0/1
I2 2001:172:16:1::/64 [115/20]
 via FE80::C807:1EFF:FE84:6, FastEthernet0/1
I2 2001:172:16:2::/64 [115/20]
 via FE80::C807:1EFF:FE84:6, FastEthernet0/1
I2 2001:172:16:3::/64 [115/20]
 via FE80::C807:1EFF:FE84:6, FastEthernet0/1
I2 2001:192:168:1::1/128 [115/20]
 via FE80::C807:1EFF:FE84:6, FastEthernet0/1
I2 2001:192:168:1::2/128 [115/20]
 via FE80::C807:1EFF:FE84:6, FastEthernet0/1
I2 2001:192:168:1::3/128 [115/10]
 via FE80::C807:1EFF:FE84:6, FastEthernet0/1
I2 2001:192:168:1::4/128 [115/20]
 via FE80::C807:1EFF:FE84:6, FastEthernet0/1
I2 2001:192:168:1::5/128 [115/30]
 via FE80::C807:1EFF:FE84:6, FastEthernet0/1
I2 2001:192:168:1::6/128 [115/30]
 via FE80::C807:1EFF:FE84:6, FastEthernet0/1
I2 2001:192:168:1::7/128 [115/40]
 via FE80::C807:1EFF:FE84:6, FastEthernet0/1
LC 2001:192:168:1::8/128 [0/0]
 via Loopback0, receive
I1 2001:192:168:1::9/128 [115/10]
 via FE80::C808:33FF:FE70:8, FastEthernet0/0
I2 2001:192:168:1::10/128 [115/20]
 via FE80::C807:1EFF:FE84:6, FastEthernet0/1
L FF00::/8 [0/0]
 via Null0, receive
R8#

!! -- Now check routing table on R9. -- !!

R9#sh ipv6 route
IPv6 Routing Table - default - 24 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
 B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP
 H - NHRP, I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea
 IS - ISIS summary, D - EIGRP, EX - EIGRP external, NM - NEMO
 ND - ND Default, NDp - ND Prefix, DCE - Destination, NDr - Redirect
 O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
 ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2, l - LISP
I1 ::/0 [115/10]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:10:1:24::/64 [115/40]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:10:1:25::/64 [115/40]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:10:1:34::/64 [115/30]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
I1 2001:10:1:38::/64 [115/20]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:10:1:46::/64 [115/40]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:10:1:56::/64 [115/50]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:10:1:57::/64 [115/50]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:10:1:67::/64 [115/50]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
C 2001:10:1:89::/64 [0/0]
 via FastEthernet0/0, directly connected
L 2001:10:1:89::9/128 [0/0]
 via FastEthernet0/0, receive
IA 2001:10:1:123::/64 [115/30]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:172:16::/48 [115/30]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:192:168:1::1/128 [115/30]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:192:168:1::2/128 [115/30]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:192:168:1::3/128 [115/20]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:192:168:1::4/128 [115/30]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:192:168:1::5/128 [115/40]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:192:168:1::6/128 [115/40]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
IA 2001:192:168:1::7/128 [115/50]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
I1 2001:192:168:1::8/128 [115/10]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
LC 2001:192:168:1::9/128 [0/0]
 via Loopback0, receive
IA 2001:192:168:1::10/128 [115/30]
 via FE80::C803:29FF:FE90:8, FastEthernet0/0
L FF00::/8 [0/0]
 via Null0, receive
R9#

Verification and Testing

!! -- "show clns protocol" output shows that all interfaces are -- !! 
!! -- running both IP (IPv4) and IPv6 address family. --!!

R1#show clns protocol

IS-IS Router: 1
 System Id: 1921.6800.1001.00 IS-Type: level-2
 Manual area address(es): 
 49.0001
 Routing for area address(es): 
 49.0001
 Interfaces supported by IS-IS:
 FastEthernet0/0 - IP - IPv6
 Passive interface: 
 Loopback0
 Redistribute:
 static (on by default)
 Distance for L2 CLNS routes: 110
 RRR level: none
 Generate narrow metrics: level-1-2
 Accept narrow metrics: level-1-2
 Generate wide metrics: none
 Accept wide metrics: none

R2#show clns protocol

IS-IS Router: 1
 System Id: 1921.6800.1002.00 IS-Type: level-2
 Manual area address(es): 
 49.0001
 Routing for area address(es): 
 49.0001
 Interfaces supported by IS-IS:
 FastEthernet1/0 - IP - IPv6
 FastEthernet0/1 - IP - IPv6
 FastEthernet0/0 - IP - IPv6
 Passive interface: 
 Loopback0
 Redistribute:
 static (on by default)
 Distance for L2 CLNS routes: 110
 RRR level: none
 Generate narrow metrics: level-1-2
 Accept narrow metrics: level-1-2
 Generate wide metrics: none
 Accept wide metrics: none

R3#show clns protocol

IS-IS Router: 1
 System Id: 1921.6800.1003.00 IS-Type: level-2
 Manual area address(es): 
 49.0001
 Routing for area address(es): 
 49.0001
 Interfaces supported by IS-IS:
 FastEthernet1/0 - IP - IPv6
 FastEthernet0/1 - IP - IPv6
 FastEthernet0/0 - IP - IPv6
 Passive interface: 
 Loopback0
 Redistribute:
 static (on by default)
 Distance for L2 CLNS routes: 110
 RRR level: none
 Generate narrow metrics: level-1-2
 Accept narrow metrics: level-1-2
 Generate wide metrics: none
 Accept wide metrics: none

R4#show clns protocol

IS-IS Router: 1
 System Id: 1921.6800.1004.00 IS-Type: level-1-2
 Manual area address(es): 
 49.0001
 Routing for area address(es): 
 49.0001
 Interfaces supported by IS-IS:
 FastEthernet1/0 - IP - IPv6
 FastEthernet0/1 - IP - IPv6
 FastEthernet0/0 - IP - IPv6
 Passive interface: 
 Loopback0
 Redistribute:
 static (on by default)
 Distance for L2 CLNS routes: 110
 RRR level: none
 Generate narrow metrics: level-1-2
 Accept narrow metrics: level-1-2
 Generate wide metrics: none
 Accept wide metrics: none

R5#show clns protocol

IS-IS Router: 1
 System Id: 1921.6800.1005.00 IS-Type: level-1-2
 Manual area address(es): 
 49.0002
 Routing for area address(es): 
 49.0002
 Interfaces supported by IS-IS:
 FastEthernet1/0 - IP - IPv6
 FastEthernet0/1 - IP - IPv6
 FastEthernet0/0 - IP - IPv6
 Passive interface: 
 Loopback0
 Redistribute:
 static (on by default)
 Distance for L2 CLNS routes: 110
 RRR level: none
 Generate narrow metrics: level-1-2
 Accept narrow metrics: level-1-2
 Generate wide metrics: none
 Accept wide metrics: none

R6#show clns protocol

IS-IS Router: 1
 System Id: 1921.6800.1006.00 IS-Type: level-1-2
 Manual area address(es): 
 49.0002
 Routing for area address(es): 
 49.0002
 Interfaces supported by IS-IS:
 FastEthernet1/0 - IP - IPv6
 FastEthernet0/1 - IP - IPv6
 FastEthernet0/0 - IP - IPv6
 Passive interface: 
 Loopback0
 Redistribute:
 static (on by default)
 Distance for L2 CLNS routes: 110
 RRR level: none
 Generate narrow metrics: level-1-2
 Accept narrow metrics: level-1-2
 Generate wide metrics: none
 Accept wide metrics: none

R7#show clns protocol

IS-IS Router: 1
 System Id: 1921.6800.1007.00 IS-Type: level-1
 Manual area address(es): 
 49.0002
 Routing for area address(es): 
 49.0002
 Interfaces supported by IS-IS:
 FastEthernet0/1 - IP - IPv6
 FastEthernet0/0 - IP - IPv6
 Passive interface: 
 Loopback0
 Redistribute:
 static (on by default)
 Distance for L2 CLNS routes: 110
 RRR level: none
 Generate narrow metrics: level-1-2
 Accept narrow metrics: level-1-2
 Generate wide metrics: none
 Accept wide metrics: none

R8#show clns protocol

IS-IS Router: 1
 System Id: 1921.6800.1008.00 IS-Type: level-1-2
 Manual area address(es): 
 49.0003
 Routing for area address(es): 
 49.0003
 Interfaces supported by IS-IS:
 FastEthernet0/1 - IP - IPv6
 FastEthernet0/0 - IP - IPv6
 Passive interface: 
 Loopback0
 Redistribute:
 static (on by default)
 Distance for L2 CLNS routes: 110
 TID 0: Inter-area IP routes from L2 into L1 enabled with list 100
 RRR level: none
 Generate narrow metrics: level-1-2
 Accept narrow metrics: level-1-2
 Generate wide metrics: none
 Accept wide metrics: none

R9#show clns protocol

IS-IS Router: 1
 System Id: 1921.6800.1009.00 IS-Type: level-1
 Manual area address(es): 
 49.0003
 Routing for area address(es): 
 49.0003
 Interfaces supported by IS-IS:
 FastEthernet0/0 - IP - IPv6
 Passive interface: 
 Loopback0
 Redistribute:
 static (on by default)
 Distance for L2 CLNS routes: 110
 RRR level: none
 Generate narrow metrics: level-1-2
 Accept narrow metrics: level-1-2
 Generate wide metrics: none
 Accept wide metrics: none

Routing

R1#show ipv6 route
IPv6 Routing Table - default - 28 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
 B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP
 H - NHRP, I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea
 IS - ISIS summary, D - EIGRP, EX - EIGRP external, NM - NEMO
 ND - ND Default, NDp - ND Prefix, DCE - Destination, NDr - Redirect
 O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
 ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2, l - LISP
I2 2001:10:1:24::/64 [115/20]
 via FE80::C805:30FF:FE9C:8, FastEthernet0/0
I2 2001:10:1:25::/64 [115/20]
 via FE80::C805:30FF:FE9C:8, FastEthernet0/0
I2 2001:10:1:34::/64 [115/20]
 via FE80::C807:8FF:FE08:8, FastEthernet0/0
I2 2001:10:1:38::/64 [115/20]
 via FE80::C807:8FF:FE08:8, FastEthernet0/0
I2 2001:10:1:46::/64 [115/30]
 via FE80::C805:30FF:FE9C:8, FastEthernet0/0
 via FE80::C807:8FF:FE08:8, FastEthernet0/0
I2 2001:10:1:56::/64 [115/30]
 via FE80::C805:30FF:FE9C:8, FastEthernet0/0
I2 2001:10:1:57::/64 [115/30]
 via FE80::C805:30FF:FE9C:8, FastEthernet0/0
I2 2001:10:1:67::/64 [115/40]
 via FE80::C805:30FF:FE9C:8, FastEthernet0/0
 via FE80::C807:8FF:FE08:8, FastEthernet0/0
I2 2001:10:1:89::/64 [115/30]
 via FE80::C807:8FF:FE08:8, FastEthernet0/0
C 2001:10:1:123::/64 [0/0]
 via FastEthernet0/0, directly connected
L 2001:10:1:123::1/128 [0/0]
 via FastEthernet0/0, receive
O 2001:172:16::/64 [110/2]
 via FE80::C809:1DFF:FED4:6, FastEthernet0/1
O 2001:172:16:1::/64 [110/2]
 via FE80::C809:1DFF:FED4:6, FastEthernet0/1
O 2001:172:16:2::/64 [110/2]
 via FE80::C809:1DFF:FED4:6, FastEthernet0/1
O 2001:172:16:3::/64 [110/2]
 via FE80::C809:1DFF:FED4:6, FastEthernet0/1
C 2001:172:16:110::/64 [0/0]
 via FastEthernet0/1, directly connected
L 2001:172:16:110::1/128 [0/0]
 via FastEthernet0/1, receive
LC 2001:192:168:1::1/128 [0/0]
 via Loopback0, receive
I2 2001:192:168:1::2/128 [115/10]
 via FE80::C805:30FF:FE9C:8, FastEthernet0/0
I2 2001:192:168:1::3/128 [115/10]
 via FE80::C807:8FF:FE08:8, FastEthernet0/0
I2 2001:192:168:1::4/128 [115/20]
 via FE80::C805:30FF:FE9C:8, FastEthernet0/0
 via FE80::C807:8FF:FE08:8, FastEthernet0/0
I2 2001:192:168:1::5/128 [115/20]
 via FE80::C805:30FF:FE9C:8, FastEthernet0/0
I2 2001:192:168:1::6/128 [115/30]
 via FE80::C805:30FF:FE9C:8, FastEthernet0/0
 via FE80::C807:8FF:FE08:8, FastEthernet0/0
I2 2001:192:168:1::7/128 [115/30]
 via FE80::C805:30FF:FE9C:8, FastEthernet0/0
I2 2001:192:168:1::8/128 [115/20]
 via FE80::C807:8FF:FE08:8, FastEthernet0/0
I2 2001:192:168:1::9/128 [115/30]
 via FE80::C807:8FF:FE08:8, FastEthernet0/0
O 2001:192:168:1::10/128 [110/1]
 via FE80::C809:1DFF:FED4:6, FastEthernet0/1
L FF00::/8 [0/0]
 via Null0, receive
 
R2#show ipv6 route
IPv6 Routing Table - default - 28 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
 B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP
 H - NHRP, I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea
 IS - ISIS summary, D - EIGRP, EX - EIGRP external, NM - NEMO
 ND - ND Default, NDp - ND Prefix, DCE - Destination, NDr - Redirect
 O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
 ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2, l - LISP
C 2001:10:1:24::/64 [0/0]
 via FastEthernet1/0, directly connected
L 2001:10:1:24::2/128 [0/0]
 via FastEthernet1/0, receive
C 2001:10:1:25::/64 [0/0]
 via FastEthernet0/1, directly connected
L 2001:10:1:25::2/128 [0/0]
 via FastEthernet0/1, receive
I2 2001:10:1:34::/64 [115/20]
 via FE80::C807:8FF:FE08:8, FastEthernet0/0
 via FE80::C806:8FF:FE08:1C, FastEthernet1/0
I2 2001:10:1:38::/64 [115/20]
 via FE80::C807:8FF:FE08:8, FastEthernet0/0
I2 2001:10:1:46::/64 [115/20]
 via FE80::C806:8FF:FE08:1C, FastEthernet1/0
I2 2001:10:1:56::/64 [115/20]
 via FE80::C800:11FF:FEB0:6, FastEthernet0/1
I2 2001:10:1:57::/64 [115/20]
 via FE80::C800:11FF:FEB0:6, FastEthernet0/1
I2 2001:10:1:67::/64 [115/30]
 via FE80::C800:11FF:FEB0:6, FastEthernet0/1
 via FE80::C806:8FF:FE08:1C, FastEthernet1/0
I2 2001:10:1:89::/64 [115/30]
 via FE80::C807:8FF:FE08:8, FastEthernet0/0
C 2001:10:1:123::/64 [0/0]
 via FastEthernet0/0, directly connected
L 2001:10:1:123::2/128 [0/0]
 via FastEthernet0/0, receive
I2 2001:172:16::/64 [115/10]
 via FE80::C804:30FF:FE9C:8, FastEthernet0/0
I2 2001:172:16:1::/64 [115/10]
 via FE80::C804:30FF:FE9C:8, FastEthernet0/0
I2 2001:172:16:2::/64 [115/10]
 via FE80::C804:30FF:FE9C:8, FastEthernet0/0
I2 2001:172:16:3::/64 [115/10]
 via FE80::C804:30FF:FE9C:8, FastEthernet0/0
I2 2001:192:168:1::1/128 [115/10]
 via FE80::C804:30FF:FE9C:8, FastEthernet0/0
LC 2001:192:168:1::2/128 [0/0]
 via Loopback0, receive
I2 2001:192:168:1::3/128 [115/10]
 via FE80::C807:8FF:FE08:8, FastEthernet0/0
I2 2001:192:168:1::4/128 [115/10]
 via FE80::C806:8FF:FE08:1C, FastEthernet1/0
I2 2001:192:168:1::5/128 [115/10]
 via FE80::C800:11FF:FEB0:6, FastEthernet0/1
I2 2001:192:168:1::6/128 [115/20]
 via FE80::C800:11FF:FEB0:6, FastEthernet0/1
 via FE80::C806:8FF:FE08:1C, FastEthernet1/0
I2 2001:192:168:1::7/128 [115/20]
 via FE80::C800:11FF:FEB0:6, FastEthernet0/1
I2 2001:192:168:1::8/128 [115/20]
 via FE80::C807:8FF:FE08:8, FastEthernet0/0
I2 2001:192:168:1::9/128 [115/30]
 via FE80::C807:8FF:FE08:8, FastEthernet0/0
I2 2001:192:168:1::10/128 [115/10]
 via FE80::C804:30FF:FE9C:8, FastEthernet0/0
L FF00::/8 [0/0]
 via Null0, receive

R3#show ipv6 route
IPv6 Routing Table - default - 28 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
 B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP
 H - NHRP, I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea
 IS - ISIS summary, D - EIGRP, EX - EIGRP external, NM - NEMO
 ND - ND Default, NDp - ND Prefix, DCE - Destination, NDr - Redirect
 O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
 ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2, l - LISP
I2 2001:10:1:24::/64 [115/20]
 via FE80::C806:8FF:FE08:8, FastEthernet1/0
 via FE80::C805:30FF:FE9C:8, FastEthernet0/0
I2 2001:10:1:25::/64 [115/20]
 via FE80::C805:30FF:FE9C:8, FastEthernet0/0
C 2001:10:1:34::/64 [0/0]
 via FastEthernet1/0, directly connected
L 2001:10:1:34::3/128 [0/0]
 via FastEthernet1/0, receive
C 2001:10:1:38::/64 [0/0]
 via FastEthernet0/1, directly connected
L 2001:10:1:38::3/128 [0/0]
 via FastEthernet0/1, receive
I2 2001:10:1:46::/64 [115/20]
 via FE80::C806:8FF:FE08:8, FastEthernet1/0
I2 2001:10:1:56::/64 [115/30]
 via FE80::C806:8FF:FE08:8, FastEthernet1/0
 via FE80::C805:30FF:FE9C:8, FastEthernet0/0
I2 2001:10:1:57::/64 [115/30]
 via FE80::C805:30FF:FE9C:8, FastEthernet0/0
I2 2001:10:1:67::/64 [115/30]
 via FE80::C806:8FF:FE08:8, FastEthernet1/0
I2 2001:10:1:89::/64 [115/20]
 via FE80::C803:19FF:FE84:6, FastEthernet0/1
C 2001:10:1:123::/64 [0/0]
 via FastEthernet0/0, directly connected
L 2001:10:1:123::3/128 [0/0]
 via FastEthernet0/0, receive
I2 2001:172:16::/64 [115/10]
 via FE80::C804:30FF:FE9C:8, FastEthernet0/0
I2 2001:172:16:1::/64 [115/10]
 via FE80::C804:30FF:FE9C:8, FastEthernet0/0
I2 2001:172:16:2::/64 [115/10]
 via FE80::C804:30FF:FE9C:8, FastEthernet0/0
I2 2001:172:16:3::/64 [115/10]
 via FE80::C804:30FF:FE9C:8, FastEthernet0/0
I2 2001:192:168:1::1/128 [115/10]
 via FE80::C804:30FF:FE9C:8, FastEthernet0/0
I2 2001:192:168:1::2/128 [115/10]
 via FE80::C805:30FF:FE9C:8, FastEthernet0/0
LC 2001:192:168:1::3/128 [0/0]
 via Loopback0, receive
I2 2001:192:168:1::4/128 [115/10]
 via FE80::C806:8FF:FE08:8, FastEthernet1/0
I2 2001:192:168:1::5/128 [115/20]
 via FE80::C805:30FF:FE9C:8, FastEthernet0/0
I2 2001:192:168:1::6/128 [115/20]
 via FE80::C806:8FF:FE08:8, FastEthernet1/0
I2 2001:192:168:1::7/128 [115/30]
 via FE80::C805:30FF:FE9C:8, FastEthernet0/0
 via FE80::C806:8FF:FE08:8, FastEthernet1/0
I2 2001:192:168:1::8/128 [115/10]
 via FE80::C803:19FF:FE84:6, FastEthernet0/1
I2 2001:192:168:1::9/128 [115/20]
 via FE80::C803:19FF:FE84:6, FastEthernet0/1
I2 2001:192:168:1::10/128 [115/10]
 via FE80::C804:30FF:FE9C:8, FastEthernet0/0
L FF00::/8 [0/0]
 via Null0, receive

R4#show ipv6 route
IPv6 Routing Table - default - 28 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
 B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP
 H - NHRP, I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea
 IS - ISIS summary, D - EIGRP, EX - EIGRP external, NM - NEMO
 ND - ND Default, NDp - ND Prefix, DCE - Destination, NDr - Redirect
 O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
 ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2, l - LISP
C 2001:10:1:24::/64 [0/0]
 via FastEthernet1/0, directly connected
L 2001:10:1:24::4/128 [0/0]
 via FastEthernet1/0, receive
I2 2001:10:1:25::/64 [115/20]
 via FE80::C805:30FF:FE9C:1C, FastEthernet1/0
C 2001:10:1:34::/64 [0/0]
 via FastEthernet0/0, directly connected
L 2001:10:1:34::4/128 [0/0]
 via FastEthernet0/0, receive
I2 2001:10:1:38::/64 [115/20]
 via FE80::C807:8FF:FE08:1C, FastEthernet0/0
C 2001:10:1:46::/64 [0/0]
 via FastEthernet0/1, directly connected
L 2001:10:1:46::4/128 [0/0]
 via FastEthernet0/1, receive
I2 2001:10:1:56::/64 [115/20]
 via FE80::C801:11FF:FEB0:6, FastEthernet0/1
I2 2001:10:1:57::/64 [115/30]
 via FE80::C801:11FF:FEB0:6, FastEthernet0/1
 via FE80::C805:30FF:FE9C:1C, FastEthernet1/0
I2 2001:10:1:67::/64 [115/20]
 via FE80::C801:11FF:FEB0:6, FastEthernet0/1
I2 2001:10:1:89::/64 [115/30]
 via FE80::C807:8FF:FE08:1C, FastEthernet0/0
I2 2001:10:1:123::/64 [115/20]
 via FE80::C807:8FF:FE08:1C, FastEthernet0/0
 via FE80::C805:30FF:FE9C:1C, FastEthernet1/0
I2 2001:172:16::/64 [115/20]
 via FE80::C805:30FF:FE9C:1C, FastEthernet1/0
 via FE80::C807:8FF:FE08:1C, FastEthernet0/0
I2 2001:172:16:1::/64 [115/20]
 via FE80::C805:30FF:FE9C:1C, FastEthernet1/0
 via FE80::C807:8FF:FE08:1C, FastEthernet0/0
I2 2001:172:16:2::/64 [115/20]
 via FE80::C805:30FF:FE9C:1C, FastEthernet1/0
 via FE80::C807:8FF:FE08:1C, FastEthernet0/0
I2 2001:172:16:3::/64 [115/20]
 via FE80::C805:30FF:FE9C:1C, FastEthernet1/0
 via FE80::C807:8FF:FE08:1C, FastEthernet0/0
I2 2001:192:168:1::1/128 [115/20]
 via FE80::C807:8FF:FE08:1C, FastEthernet0/0
 via FE80::C805:30FF:FE9C:1C, FastEthernet1/0
I2 2001:192:168:1::2/128 [115/10]
 via FE80::C805:30FF:FE9C:1C, FastEthernet1/0
I2 2001:192:168:1::3/128 [115/10]
 via FE80::C807:8FF:FE08:1C, FastEthernet0/0
LC 2001:192:168:1::4/128 [0/0]
 via Loopback0, receive
I2 2001:192:168:1::5/128 [115/20]
 via FE80::C801:11FF:FEB0:6, FastEthernet0/1
 via FE80::C805:30FF:FE9C:1C, FastEthernet1/0
I2 2001:192:168:1::6/128 [115/10]
 via FE80::C801:11FF:FEB0:6, FastEthernet0/1
I2 2001:192:168:1::7/128 [115/20]
 via FE80::C801:11FF:FEB0:6, FastEthernet0/1
I2 2001:192:168:1::8/128 [115/20]
 via FE80::C807:8FF:FE08:1C, FastEthernet0/0
I2 2001:192:168:1::9/128 [115/30]
 via FE80::C807:8FF:FE08:1C, FastEthernet0/0
I2 2001:192:168:1::10/128 [115/20]
 via FE80::C805:30FF:FE9C:1C, FastEthernet1/0
 via FE80::C807:8FF:FE08:1C, FastEthernet0/0
L FF00::/8 [0/0]
 via Null0, receive

R5#show ipv6 route
IPv6 Routing Table - default - 28 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
 B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP
 H - NHRP, I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea
 IS - ISIS summary, D - EIGRP, EX - EIGRP external, NM - NEMO
 ND - ND Default, NDp - ND Prefix, DCE - Destination, NDr - Redirect
 O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
 ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2, l - LISP
I2 2001:10:1:24::/64 [115/20]
 via FE80::C805:30FF:FE9C:6, FastEthernet0/1
C 2001:10:1:25::/64 [0/0]
 via FastEthernet0/1, directly connected
L 2001:10:1:25::5/128 [0/0]
 via FastEthernet0/1, receive
I2 2001:10:1:34::/64 [115/30]
 via FE80::C805:30FF:FE9C:6, FastEthernet0/1
 via FE80::C801:11FF:FEB0:1C, FastEthernet1/0
I2 2001:10:1:38::/64 [115/30]
 via FE80::C805:30FF:FE9C:6, FastEthernet0/1
I1 2001:10:1:46::/64 [115/20]
 via FE80::C801:11FF:FEB0:1C, FastEthernet1/0
C 2001:10:1:56::/64 [0/0]
 via FastEthernet1/0, directly connected
L 2001:10:1:56::5/128 [0/0]
 via FastEthernet1/0, receive
C 2001:10:1:57::/64 [0/0]
 via FastEthernet0/0, directly connected
L 2001:10:1:57::5/128 [0/0]
 via FastEthernet0/0, receive
I1 2001:10:1:67::/64 [115/20]
 via FE80::C801:11FF:FEB0:1C, FastEthernet1/0
I2 2001:10:1:89::/64 [115/40]
 via FE80::C805:30FF:FE9C:6, FastEthernet0/1
I2 2001:10:1:123::/64 [115/20]
 via FE80::C805:30FF:FE9C:6, FastEthernet0/1
I2 2001:172:16::/64 [115/20]
 via FE80::C805:30FF:FE9C:6, FastEthernet0/1
I2 2001:172:16:1::/64 [115/20]
 via FE80::C805:30FF:FE9C:6, FastEthernet0/1
I2 2001:172:16:2::/64 [115/20]
 via FE80::C805:30FF:FE9C:6, FastEthernet0/1
I2 2001:172:16:3::/64 [115/20]
 via FE80::C805:30FF:FE9C:6, FastEthernet0/1
I2 2001:192:168:1::1/128 [115/20]
 via FE80::C805:30FF:FE9C:6, FastEthernet0/1
I2 2001:192:168:1::2/128 [115/10]
 via FE80::C805:30FF:FE9C:6, FastEthernet0/1
I2 2001:192:168:1::3/128 [115/20]
 via FE80::C805:30FF:FE9C:6, FastEthernet0/1
I2 2001:192:168:1::4/128 [115/20]
 via FE80::C805:30FF:FE9C:6, FastEthernet0/1
 via FE80::C801:11FF:FEB0:1C, FastEthernet1/0
LC 2001:192:168:1::5/128 [0/0]
 via Loopback0, receive
I1 2001:192:168:1::6/128 [115/10]
 via FE80::C801:11FF:FEB0:1C, FastEthernet1/0
I1 2001:192:168:1::7/128 [115/10]
 via FE80::C802:19FF:FE84:8, FastEthernet0/0
I2 2001:192:168:1::8/128 [115/30]
 via FE80::C805:30FF:FE9C:6, FastEthernet0/1
I2 2001:192:168:1::9/128 [115/40]
 via FE80::C805:30FF:FE9C:6, FastEthernet0/1
I2 2001:192:168:1::10/128 [115/20]
 via FE80::C805:30FF:FE9C:6, FastEthernet0/1
L FF00::/8 [0/0]
 via Null0, receive

R6#show ipv6 route
IPv6 Routing Table - default - 28 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
 B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP
 H - NHRP, I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea
 IS - ISIS summary, D - EIGRP, EX - EIGRP external, NM - NEMO
 ND - ND Default, NDp - ND Prefix, DCE - Destination, NDr - Redirect
 O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
 ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2, l - LISP
I2 2001:10:1:24::/64 [115/20]
 via FE80::C806:8FF:FE08:6, FastEthernet0/1
I1 2001:10:1:25::/64 [115/20]
 via FE80::C800:11FF:FEB0:1C, FastEthernet1/0
I2 2001:10:1:34::/64 [115/20]
 via FE80::C806:8FF:FE08:6, FastEthernet0/1
I2 2001:10:1:38::/64 [115/30]
 via FE80::C806:8FF:FE08:6, FastEthernet0/1
C 2001:10:1:46::/64 [0/0]
 via FastEthernet0/1, directly connected
L 2001:10:1:46::6/128 [0/0]
 via FastEthernet0/1, receive
C 2001:10:1:56::/64 [0/0]
 via FastEthernet1/0, directly connected
L 2001:10:1:56::6/128 [0/0]
 via FastEthernet1/0, receive
I1 2001:10:1:57::/64 [115/20]
 via FE80::C800:11FF:FEB0:1C, FastEthernet1/0
 via FE80::C802:19FF:FE84:6, FastEthernet0/0
C 2001:10:1:67::/64 [0/0]
 via FastEthernet0/0, directly connected
L 2001:10:1:67::6/128 [0/0]
 via FastEthernet0/0, receive
I2 2001:10:1:89::/64 [115/40]
 via FE80::C806:8FF:FE08:6, FastEthernet0/1
I2 2001:10:1:123::/64 [115/30]
 via FE80::C800:11FF:FEB0:1C, FastEthernet1/0
 via FE80::C806:8FF:FE08:6, FastEthernet0/1
I2 2001:172:16::/64 [115/30]
 via FE80::C806:8FF:FE08:6, FastEthernet0/1
 via FE80::C800:11FF:FEB0:1C, FastEthernet1/0
I2 2001:172:16:1::/64 [115/30]
 via FE80::C806:8FF:FE08:6, FastEthernet0/1
 via FE80::C800:11FF:FEB0:1C, FastEthernet1/0
I2 2001:172:16:2::/64 [115/30]
 via FE80::C806:8FF:FE08:6, FastEthernet0/1
 via FE80::C800:11FF:FEB0:1C, FastEthernet1/0
I2 2001:172:16:3::/64 [115/30]
 via FE80::C806:8FF:FE08:6, FastEthernet0/1
 via FE80::C800:11FF:FEB0:1C, FastEthernet1/0
I2 2001:192:168:1::1/128 [115/30]
 via FE80::C800:11FF:FEB0:1C, FastEthernet1/0
 via FE80::C806:8FF:FE08:6, FastEthernet0/1
I2 2001:192:168:1::2/128 [115/20]
 via FE80::C800:11FF:FEB0:1C, FastEthernet1/0
 via FE80::C806:8FF:FE08:6, FastEthernet0/1
I2 2001:192:168:1::3/128 [115/20]
 via FE80::C806:8FF:FE08:6, FastEthernet0/1
I2 2001:192:168:1::4/128 [115/10]
 via FE80::C806:8FF:FE08:6, FastEthernet0/1
I1 2001:192:168:1::5/128 [115/10]
 via FE80::C800:11FF:FEB0:1C, FastEthernet1/0
LC 2001:192:168:1::6/128 [0/0]
 via Loopback0, receive
I1 2001:192:168:1::7/128 [115/10]
 via FE80::C802:19FF:FE84:6, FastEthernet0/0
I2 2001:192:168:1::8/128 [115/30]
 via FE80::C806:8FF:FE08:6, FastEthernet0/1
I2 2001:192:168:1::9/128 [115/40]
 via FE80::C806:8FF:FE08:6, FastEthernet0/1
I2 2001:192:168:1::10/128 [115/30]
 via FE80::C806:8FF:FE08:6, FastEthernet0/1
 via FE80::C800:11FF:FEB0:1C, FastEthernet1/0
L FF00::/8 [0/0]
 via Null0, receive

R7#show ipv6 route
IPv6 Routing Table - default - 12 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
 B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP
 H - NHRP, I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea
 IS - ISIS summary, D - EIGRP, EX - EIGRP external, NM - NEMO
 ND - ND Default, NDp - ND Prefix, DCE - Destination, NDr - Redirect
 O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
 ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2, l - LISP
I1 ::/0 [115/10]
 via FE80::C800:11FF:FEB0:8, FastEthernet0/0
I1 2001:10:1:25::/64 [115/20]
 via FE80::C800:11FF:FEB0:8, FastEthernet0/0
I1 2001:10:1:46::/64 [115/30]
 via FE80::C800:11FF:FEB0:8, FastEthernet0/0
 via FE80::C801:11FF:FEB0:8, FastEthernet0/1
I1 2001:10:1:56::/64 [115/20]
 via FE80::C800:11FF:FEB0:8, FastEthernet0/0
C 2001:10:1:57::/64 [0/0]
 via FastEthernet0/0, directly connected
L 2001:10:1:57::7/128 [0/0]
 via FastEthernet0/0, receive
C 2001:10:1:67::/64 [0/0]
 via FastEthernet0/1, directly connected
L 2001:10:1:67::7/128 [0/0]
 via FastEthernet0/1, receive
I1 2001:192:168:1::5/128 [115/10]
 via FE80::C800:11FF:FEB0:8, FastEthernet0/0
I1 2001:192:168:1::6/128 [115/20]
 via FE80::C800:11FF:FEB0:8, FastEthernet0/0
 via FE80::C801:11FF:FEB0:8, FastEthernet0/1
LC 2001:192:168:1::7/128 [0/0]
 via Loopback0, receive
L FF00::/8 [0/0]
 via Null0, receive

R8#show ipv6 route
IPv6 Routing Table - default - 28 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
 B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP
 H - NHRP, I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea
 IS - ISIS summary, D - EIGRP, EX - EIGRP external, NM - NEMO
 ND - ND Default, NDp - ND Prefix, DCE - Destination, NDr - Redirect
 O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
 ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2, l - LISP
I2 2001:10:1:24::/64 [115/30]
 via FE80::C807:8FF:FE08:6, FastEthernet0/1
I2 2001:10:1:25::/64 [115/30]
 via FE80::C807:8FF:FE08:6, FastEthernet0/1
I2 2001:10:1:34::/64 [115/20]
 via FE80::C807:8FF:FE08:6, FastEthernet0/1
C 2001:10:1:38::/64 [0/0]
 via FastEthernet0/1, directly connected
L 2001:10:1:38::8/128 [0/0]
 via FastEthernet0/1, receive
I2 2001:10:1:46::/64 [115/30]
 via FE80::C807:8FF:FE08:6, FastEthernet0/1
I2 2001:10:1:56::/64 [115/40]
 via FE80::C807:8FF:FE08:6, FastEthernet0/1
I2 2001:10:1:57::/64 [115/40]
 via FE80::C807:8FF:FE08:6, FastEthernet0/1
I2 2001:10:1:67::/64 [115/40]
 via FE80::C807:8FF:FE08:6, FastEthernet0/1
C 2001:10:1:89::/64 [0/0]
 via FastEthernet0/0, directly connected
L 2001:10:1:89::8/128 [0/0]
 via FastEthernet0/0, receive
I2 2001:10:1:123::/64 [115/20]
 via FE80::C807:8FF:FE08:6, FastEthernet0/1
IS 2001:172:16::/48 [115/20]
 via Null0, directly connected
I2 2001:172:16::/64 [115/20]
 via FE80::C807:8FF:FE08:6, FastEthernet0/1
I2 2001:172:16:1::/64 [115/20]
 via FE80::C807:8FF:FE08:6, FastEthernet0/1
I2 2001:172:16:2::/64 [115/20]
 via FE80::C807:8FF:FE08:6, FastEthernet0/1
I2 2001:172:16:3::/64 [115/20]
 via FE80::C807:8FF:FE08:6, FastEthernet0/1
I2 2001:192:168:1::1/128 [115/20]
 via FE80::C807:8FF:FE08:6, FastEthernet0/1
I2 2001:192:168:1::2/128 [115/20]
 via FE80::C807:8FF:FE08:6, FastEthernet0/1
I2 2001:192:168:1::3/128 [115/10]
 via FE80::C807:8FF:FE08:6, FastEthernet0/1
I2 2001:192:168:1::4/128 [115/20]
 via FE80::C807:8FF:FE08:6, FastEthernet0/1
I2 2001:192:168:1::5/128 [115/30]
 via FE80::C807:8FF:FE08:6, FastEthernet0/1
I2 2001:192:168:1::6/128 [115/30]
 via FE80::C807:8FF:FE08:6, FastEthernet0/1
I2 2001:192:168:1::7/128 [115/40]
 via FE80::C807:8FF:FE08:6, FastEthernet0/1
LC 2001:192:168:1::8/128 [0/0]
 via Loopback0, receive
I1 2001:192:168:1::9/128 [115/10]
 via FE80::C808:1DFF:FED4:8, FastEthernet0/0
I2 2001:192:168:1::10/128 [115/20]
 via FE80::C807:8FF:FE08:6, FastEthernet0/1
L FF00::/8 [0/0]
 via Null0, receive

R8#show isis database detail

Tag 1:
IS-IS Level-1 Link State Database:
LSPID LSP Seq Num LSP Checksum LSP Holdtime ATT/P/OL
R8.00-00 * 0x00000006 0x37C1 668 1/0/0
 Area Address: 49.0003
 NLPID: 0xCC 0x8E 
 Hostname: R8
 IP Address: 192.168.1.8
 Metric: 10 IP 10.1.89.0 255.255.255.0
 Metric: 10 IP 10.1.38.0 255.255.255.0
 Metric: 0 IP 192.168.1.8 255.255.255.255
 IPv6 Address: 2001:192:168:1::8
 Metric: 10 IPv6 2001:10:1:89::/64
 Metric: 10 IPv6 2001:10:1:38::/64
 Metric: 0 IPv6 2001:192:168:1::8/128
 Metric: 10 IS R9.01
 Metric: 158 IP-Interarea 10.1.24.0 255.255.255.0
 Metric: 158 IP-Interarea 10.1.25.0 255.255.255.0
 Metric: 148 IP-Interarea 10.1.34.0 255.255.255.0
 Metric: 158 IP-Interarea 10.1.46.0 255.255.255.0
 Metric: 168 IP-Interarea 10.1.56.0 255.255.255.0
 Metric: 168 IP-Interarea 10.1.57.0 255.255.255.0
 Metric: 168 IP-Interarea 10.1.67.0 255.255.255.0
 Metric: 148 IP-Interarea 10.1.123.0 255.255.255.0
 Metric: 148 IP-Interarea 172.16.110.0 255.255.255.0
 Metric: 148 IP-Interarea 192.168.1.1 255.255.255.255
 Metric: 148 IP-Interarea 192.168.1.2 255.255.255.255
 Metric: 138 IP-Interarea 192.168.1.3 255.255.255.255
 Metric: 148 IP-Interarea 192.168.1.4 255.255.255.255
 Metric: 158 IP-Interarea 192.168.1.5 255.255.255.255
 Metric: 158 IP-Interarea 192.168.1.6 255.255.255.255
 Metric: 168 IP-Interarea 192.168.1.7 255.255.255.255
 Metric: 148 IP-Interarea 192.168.1.10 255.255.255.255
 Metric: 148 IP-Interarea 172.16.0.0 255.255.252.0
 Metric: 30 IPv6-Interarea 2001:10:1:24::/64
 Metric: 30 IPv6-Interarea 2001:10:1:25::/64
 Metric: 20 IPv6-Interarea 2001:10:1:34::/64
 Metric: 30 IPv6-Interarea 2001:10:1:46::/64
 Metric: 40 IPv6-Interarea 2001:10:1:56::/64
 Metric: 40 IPv6-Interarea 2001:10:1:57::/64
 Metric: 40 IPv6-Interarea 2001:10:1:67::/64
 Metric: 20 IPv6-Interarea 2001:10:1:123::/64
 Metric: 20 IPv6-Interarea 2001:192:168:1::1/128
 Metric: 20 IPv6-Interarea 2001:192:168:1::2/128
 Metric: 10 IPv6-Interarea 2001:192:168:1::3/128
 Metric: 20 IPv6-Interarea 2001:192:168:1::4/128
 Metric: 30 IPv6-Interarea 2001:192:168:1::5/128
 Metric: 30 IPv6-Interarea 2001:192:168:1::6/128
 Metric: 40 IPv6-Interarea 2001:192:168:1::7/128
 Metric: 20 IPv6-Interarea 2001:192:168:1::10/128
 Metric: 20 IPv6-Interarea 2001:172:16::/48
R9.00-00 0x00000002 0x81C4 623 0/0/0
 Area Address: 49.0003
 NLPID: 0xCC 0x8E 
 Hostname: R9
 IP Address: 192.168.1.9
 Metric: 10 IP 10.1.89.0 255.255.255.0
 Metric: 0 IP 192.168.1.9 255.255.255.255
 IPv6 Address: 2001:192:168:1::9
 Metric: 10 IPv6 2001:10:1:89::/64
 Metric: 0 IPv6 2001:192:168:1::9/128
 Metric: 10 IS R9.01
R9.01-00 0x00000001 0x180E 624 0/0/0
 Metric: 0 IS R9.00
 Metric: 0 IS R8.00
IS-IS Level-2 Link State Database:
LSPID LSP Seq Num LSP Checksum LSP Holdtime ATT/P/OL
R1.00-00 0x00000006 0xBEDD 662 0/0/0
 Area Address: 49.0001
 NLPID: 0xCC 0x8E 
 Hostname: R1
 IP Address: 192.168.1.1
 IPv6 Address: 2001:192:168:1::1
 Metric: 10 IS R3.01
 Metric: 10 IP 10.1.123.0 255.255.255.0
 Metric: 0 IP-External 172.16.0.0 255.255.255.0
 Metric: 0 IP-External 172.16.1.0 255.255.255.0
 Metric: 0 IP-External 172.16.2.0 255.255.255.0
 Metric: 0 IP-External 172.16.3.0 255.255.255.0
 Metric: 0 IP-External 172.16.110.0 255.255.255.0
 Metric: 0 IP 192.168.1.1 255.255.255.255
 Metric: 0 IP-External 192.168.1.10 255.255.255.255
 Metric: 10 IPv6 2001:10:1:123::/64
 Metric: 0 IPv6 2001:192:168:1::1/128
 Metric: 0 IPv6 2001:172:16::/64
 Metric: 0 IPv6 2001:172:16:1::/64
 Metric: 0 IPv6 2001:172:16:2::/64
 Metric: 0 IPv6 2001:172:16:3::/64
 Metric: 0 IPv6 2001:192:168:1::10/128
R2.00-00 0x00000005 0xB98A 634 0/0/0
 Area Address: 49.0001
 NLPID: 0xCC 0x8E 
 Hostname: R2
 IP Address: 192.168.1.2
 IPv6 Address: 2001:192:168:1::2
 Metric: 10 IS R2.02
 Metric: 10 IS R3.01
 Metric: 10 IS R4.03
 Metric: 10 IP 10.1.24.0 255.255.255.0
 Metric: 10 IP 10.1.25.0 255.255.255.0
 Metric: 10 IP 10.1.123.0 255.255.255.0
 Metric: 0 IP 192.168.1.2 255.255.255.255
 Metric: 10 IPv6 2001:10:1:123::/64
 Metric: 10 IPv6 2001:10:1:25::/64
 Metric: 10 IPv6 2001:10:1:24::/64
 Metric: 0 IPv6 2001:192:168:1::2/128
R2.02-00 0x00000001 0x2D8F 624 0/0/0
 Metric: 0 IS R2.00
 Metric: 0 IS R5.00
R3.00-00 0x00000003 0x5AAB 634 0/0/0
 Area Address: 49.0001
 NLPID: 0xCC 0x8E 
 Hostname: R3
 IP Address: 192.168.1.3
 IPv6 Address: 2001:192:168:1::3
 Metric: 10 IS R3.03
 Metric: 10 IS R3.02
 Metric: 10 IS R3.01
 Metric: 10 IP 10.1.34.0 255.255.255.0
 Metric: 10 IP 10.1.38.0 255.255.255.0
 Metric: 10 IP 10.1.123.0 255.255.255.0
 Metric: 0 IP 192.168.1.3 255.255.255.255
 Metric: 10 IPv6 2001:10:1:123::/64
 Metric: 10 IPv6 2001:10:1:38::/64
 Metric: 10 IPv6 2001:10:1:34::/64
 Metric: 0 IPv6 2001:192:168:1::3/128
R3.01-00 0x00000001 0xC0BD 631 0/0/0
 Metric: 0 IS R3.00
 Metric: 0 IS R1.00
 Metric: 0 IS R2.00
R3.02-00 0x00000001 0x7E39 634 0/0/0
 Metric: 0 IS R3.00
 Metric: 0 IS R8.00
R3.03-00 0x00000001 0x13A7 625 0/0/0
 Metric: 0 IS R3.00
 Metric: 0 IS R4.00
R4.00-00 0x00000003 0x3D9E 632 0/0/0
 Area Address: 49.0001
 NLPID: 0xCC 0x8E 
 Hostname: R4
 IP Address: 192.168.1.4
 Metric: 10 IP 10.1.34.0 255.255.255.0
 Metric: 10 IP 10.1.46.0 255.255.255.0
 Metric: 10 IP 10.1.24.0 255.255.255.0
 IPv6 Address: 2001:192:168:1::4
 Metric: 10 IPv6 2001:10:1:34::/64
 Metric: 10 IPv6 2001:10:1:46::/64
 Metric: 10 IPv6 2001:10:1:24::/64
 Metric: 10 IS R4.03
 Metric: 10 IS R4.02
 Metric: 10 IS R3.03
 Metric: 0 IP 192.168.1.4 255.255.255.255
 Metric: 0 IPv6 2001:192:168:1::4/128
R4.02-00 0x00000001 0x5265 630 0/0/0
 Metric: 0 IS R4.00
 Metric: 0 IS R6.00
R4.03-00 0x00000001 0xE6D3 631 0/0/0
 Metric: 0 IS R4.00
 Metric: 0 IS R2.00
R5.00-00 0x00000003 0xBC3F 631 0/0/0
 Area Address: 49.0002
 NLPID: 0xCC 0x8E 
 Hostname: R5
 IP Address: 192.168.1.5
 IPv6 Address: 2001:192:168:1::5
 Metric: 10 IS R2.02
 Metric: 10 IS R6.03
 Metric: 10 IP 10.1.25.0 255.255.255.0
 Metric: 20 IP 10.1.46.0 255.255.255.0
 Metric: 10 IP 10.1.56.0 255.255.255.0
 Metric: 10 IP 10.1.57.0 255.255.255.0
 Metric: 20 IP 10.1.67.0 255.255.255.0
 Metric: 0 IP 192.168.1.5 255.255.255.255
 Metric: 10 IP 192.168.1.6 255.255.255.255
 Metric: 10 IP 192.168.1.7 255.255.255.255
 Metric: 10 IPv6 2001:10:1:57::/64
 Metric: 10 IPv6 2001:10:1:25::/64
 Metric: 10 IPv6 2001:10:1:56::/64
 Metric: 0 IPv6 2001:192:168:1::5/128
 Metric: 20 IPv6 2001:10:1:46::/64
 Metric: 20 IPv6 2001:10:1:67::/64
 Metric: 10 IPv6 2001:192:168:1::6/128
 Metric: 10 IPv6 2001:192:168:1::7/128
R6.00-00 0x00000005 0x4AA9 633 0/0/0
 Area Address: 49.0002
 NLPID: 0xCC 0x8E 
 Hostname: R6
 IP Address: 192.168.1.6
 IPv6 Address: 2001:192:168:1::6
 Metric: 10 IS R6.03
 Metric: 10 IS R4.02
 Metric: 20 IP 10.1.25.0 255.255.255.0
 Metric: 10 IP 10.1.46.0 255.255.255.0
 Metric: 10 IP 10.1.56.0 255.255.255.0
 Metric: 20 IP 10.1.57.0 255.255.255.0
 Metric: 10 IP 10.1.67.0 255.255.255.0
 Metric: 10 IP 192.168.1.5 255.255.255.255
 Metric: 0 IP 192.168.1.6 255.255.255.255
 Metric: 10 IP 192.168.1.7 255.255.255.255
 Metric: 10 IPv6 2001:10:1:67::/64
 Metric: 10 IPv6 2001:10:1:46::/64
 Metric: 10 IPv6 2001:10:1:56::/64
 Metric: 0 IPv6 2001:192:168:1::6/128
 Metric: 20 IPv6 2001:10:1:25::/64
 Metric: 20 IPv6 2001:10:1:57::/64
 Metric: 10 IPv6 2001:192:168:1::5/128
 Metric: 10 IPv6 2001:192:168:1::7/128
R6.03-00 0x00000001 0x3E75 619 0/0/0
 Metric: 0 IS R6.00
 Metric: 0 IS R5.00
R8.00-00 * 0x00000003 0x27C7 636 0/0/0
 Area Address: 49.0003
 NLPID: 0xCC 0x8E 
 Hostname: R8
 IP Address: 192.168.1.8
 IPv6 Address: 2001:192:168:1::8
 Metric: 10 IS R3.02
 Metric: 10 IP 10.1.38.0 255.255.255.0
 Metric: 10 IP 10.1.89.0 255.255.255.0
 Metric: 0 IP 192.168.1.8 255.255.255.255
 Metric: 10 IP 192.168.1.9 255.255.255.255
 Metric: 10 IPv6 2001:10:1:89::/64
 Metric: 10 IPv6 2001:10:1:38::/64
 Metric: 0 IPv6 2001:192:168:1::8/128
 Metric: 10 IPv6 2001:192:168:1::9/128
 
R9#show ipv6 route
IPv6 Routing Table - default - 24 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
 B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP
 H - NHRP, I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea
 IS - ISIS summary, D - EIGRP, EX - EIGRP external, NM - NEMO
 ND - ND Default, NDp - ND Prefix, DCE - Destination, NDr - Redirect
 O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
 ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2, l - LISP
I1 ::/0 [115/10]
 via FE80::C803:19FF:FE84:8, FastEthernet0/0
IA 2001:10:1:24::/64 [115/40]
 via FE80::C803:19FF:FE84:8, FastEthernet0/0
IA 2001:10:1:25::/64 [115/40]
 via FE80::C803:19FF:FE84:8, FastEthernet0/0
IA 2001:10:1:34::/64 [115/30]
 via FE80::C803:19FF:FE84:8, FastEthernet0/0
I1 2001:10:1:38::/64 [115/20]
 via FE80::C803:19FF:FE84:8, FastEthernet0/0
IA 2001:10:1:46::/64 [115/40]
 via FE80::C803:19FF:FE84:8, FastEthernet0/0
IA 2001:10:1:56::/64 [115/50]
 via FE80::C803:19FF:FE84:8, FastEthernet0/0
IA 2001:10:1:57::/64 [115/50]
 via FE80::C803:19FF:FE84:8, FastEthernet0/0
IA 2001:10:1:67::/64 [115/50]
 via FE80::C803:19FF:FE84:8, FastEthernet0/0
C 2001:10:1:89::/64 [0/0]
 via FastEthernet0/0, directly connected
L 2001:10:1:89::9/128 [0/0]
 via FastEthernet0/0, receive
IA 2001:10:1:123::/64 [115/30]
 via FE80::C803:19FF:FE84:8, FastEthernet0/0
IA 2001:172:16::/48 [115/30]
 via FE80::C803:19FF:FE84:8, FastEthernet0/0
IA 2001:192:168:1::1/128 [115/30]
 via FE80::C803:19FF:FE84:8, FastEthernet0/0
IA 2001:192:168:1::2/128 [115/30]
 via FE80::C803:19FF:FE84:8, FastEthernet0/0
IA 2001:192:168:1::3/128 [115/20]
 via FE80::C803:19FF:FE84:8, FastEthernet0/0
IA 2001:192:168:1::4/128 [115/30]
 via FE80::C803:19FF:FE84:8, FastEthernet0/0
IA 2001:192:168:1::5/128 [115/40]
 via FE80::C803:19FF:FE84:8, FastEthernet0/0
IA 2001:192:168:1::6/128 [115/40]
 via FE80::C803:19FF:FE84:8, FastEthernet0/0
IA 2001:192:168:1::7/128 [115/50]
 via FE80::C803:19FF:FE84:8, FastEthernet0/0
I1 2001:192:168:1::8/128 [115/10]
 via FE80::C803:19FF:FE84:8, FastEthernet0/0
LC 2001:192:168:1::9/128 [0/0]
 via Loopback0, receive
IA 2001:192:168:1::10/128 [115/30]
 via FE80::C803:19FF:FE84:8, FastEthernet0/0
L FF00::/8 [0/0]
 via Null0, receive

R10#show ipv6 route
IPv6 Routing Table - default - 29 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
 B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP
 H - NHRP, I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea
 IS - ISIS summary, D - EIGRP, EX - EIGRP external, NM - NEMO
 ND - ND Default, NDp - ND Prefix, DCE - Destination, NDr - Redirect
 O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
 ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2, l - LISP
OE2 2001:10:1:24::/64 [110/20]
 via FE80::C804:30FF:FE9C:6, FastEthernet0/1
OE2 2001:10:1:25::/64 [110/20]
 via FE80::C804:30FF:FE9C:6, FastEthernet0/1
OE2 2001:10:1:34::/64 [110/20]
 via FE80::C804:30FF:FE9C:6, FastEthernet0/1
OE2 2001:10:1:38::/64 [110/20]
 via FE80::C804:30FF:FE9C:6, FastEthernet0/1
OE2 2001:10:1:46::/64 [110/20]
 via FE80::C804:30FF:FE9C:6, FastEthernet0/1
OE2 2001:10:1:56::/64 [110/20]
 via FE80::C804:30FF:FE9C:6, FastEthernet0/1
OE2 2001:10:1:57::/64 [110/20]
 via FE80::C804:30FF:FE9C:6, FastEthernet0/1
OE2 2001:10:1:67::/64 [110/20]
 via FE80::C804:30FF:FE9C:6, FastEthernet0/1
OE2 2001:10:1:89::/64 [110/20]
 via FE80::C804:30FF:FE9C:6, FastEthernet0/1
C 2001:172:16::/64 [0/0]
 via Loopback1, directly connected
L 2001:172:16::1/128 [0/0]
 via Loopback1, receive
C 2001:172:16:1::/64 [0/0]
 via Loopback2, directly connected
L 2001:172:16:1::1/128 [0/0]
 via Loopback2, receive
C 2001:172:16:2::/64 [0/0]
 via Loopback3, directly connected
L 2001:172:16:2::1/128 [0/0]
 via Loopback3, receive
C 2001:172:16:3::/64 [0/0]
 via Loopback4, directly connected
L 2001:172:16:3::1/128 [0/0]
 via Loopback4, receive
C 2001:172:16:110::/64 [0/0]
 via FastEthernet0/1, directly connected
L 2001:172:16:110::10/128 [0/0]
 via FastEthernet0/1, receive
OE2 2001:192:168:1::2/128 [110/20]
 via FE80::C804:30FF:FE9C:6, FastEthernet0/1
OE2 2001:192:168:1::3/128 [110/20]
 via FE80::C804:30FF:FE9C:6, FastEthernet0/1
OE2 2001:192:168:1::4/128 [110/20]
 via FE80::C804:30FF:FE9C:6, FastEthernet0/1
OE2 2001:192:168:1::5/128 [110/20]
 via FE80::C804:30FF:FE9C:6, FastEthernet0/1
OE2 2001:192:168:1::6/128 [110/20]
 via FE80::C804:30FF:FE9C:6, FastEthernet0/1
OE2 2001:192:168:1::7/128 [110/20]
 via FE80::C804:30FF:FE9C:6, FastEthernet0/1
OE2 2001:192:168:1::8/128 [110/20]
 via FE80::C804:30FF:FE9C:6, FastEthernet0/1
OE2 2001:192:168:1::9/128 [110/20]
 via FE80::C804:30FF:FE9C:6, FastEthernet0/1
LC 2001:192:168:1::10/128 [0/0]
 via Loopback0, receive
L FF00::/8 [0/0]
 via Null0, receive

Ping and Traceroute

!!-- Ping R10 network from R7 --!!

R7#ping 2001:172:16:1::1 source loopback 0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:172:16:1::1, timeout is 2 seconds:
Packet sent with a source address of 2001:192:168:1::7
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 124/132/144 ms

!!-- Traceroute R10 network from R7 --!!

R7#traceroute ipv6
Target IPv6 address: 2001:172:16:1::1
Source address: 2001:192:168:1::7
Insert source routing header? [no]: 
Numeric display? [no]: 
Timeout in seconds [3]: 
Probe count [3]: 
Minimum Time to Live [1]: 
Maximum Time to Live [30]: 
Priority [0]: 
Port Number [0]: 
Type escape sequence to abort.
Tracing the route to 2001:172:16:1::1

1 2001:10:1:57::5 64 msec 48 msec 36 msec
 2 2001:10:1:25::2 76 msec 76 msec 60 msec
 3 2001:10:1:123::1 108 msec 108 msec 92 msec
 4 2001:172:16:110::10 164 msec 144 msec 144 msec
 
!!-- Ping R9 from R7 --!!

R7#ping 2001:192:168:1::9 source loopback 0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:192:168:1::9, timeout is 2 seconds:
Packet sent with a source address of 2001:192:168:1::7
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 140/164/188 ms

!!-- Traceroute R9 from R7 --!!

R7#traceroute ipv6
Target IPv6 address: 2001:192:168:1::9
Source address: 2001:192:168:1::7
Insert source routing header? [no]: 
Numeric display? [no]: 
Timeout in seconds [3]: 
Probe count [3]: 
Minimum Time to Live [1]: 
Maximum Time to Live [30]: 
Priority [0]: 
Port Number [0]: 
Type escape sequence to abort.
Tracing the route to 2001:192:168:1::9

1 2001:10:1:57::5 76 msec 48 msec 36 msec
 2 2001:10:1:25::2 76 msec 64 msec 76 msec
 3 2001:10:1:123::3 124 msec 148 msec 108 msec
 4 2001:10:1:38::8 152 msec 148 msec 152 msec
 5 2001:10:1:89::9 176 msec 196 msec 156 msec

!!-- Ping R10 network from R9 --!!

R9#ping 2001:172:16:1::1 source loopback 0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:172:16:1::1, timeout is 2 seconds:
Packet sent with a source address of 2001:192:168:1::9
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 128/139/152 ms

!!-- Traceroute R10 network from R9 --!!

R9#traceroute ipv6
Target IPv6 address: 2001:172:16:1::1
Source address: 2001:192:168:1::9
Insert source routing header? [no]: 
Numeric display? [no]: 
Timeout in seconds [3]: 
Probe count [3]: 
Minimum Time to Live [1]: 
Maximum Time to Live [30]: 
Priority [0]: 
Port Number [0]: 
Type escape sequence to abort.
Tracing the route to 2001:172:16:1::1

1 2001:10:1:89::8 84 msec 52 msec 32 msec
 2 2001:10:1:38::3 104 msec 76 msec 84 msec
 3 2001:10:1:123::1 132 msec 112 msec 112 msec
 4 2001:172:16:110::10 160 msec 164 msec 120 msec

Currently, we are using single IS-IS topology, entire network is dual stacked and using the same database structure for IPv4 and IPv6 routing.

!! -- We have configured different metric for IPv4 and IPv6 -- !!
!! -- As we are using the IS-IS Single Topology, which is using --!!
!! -- same database structure for both IPv4 and IPv6 routing --!!

!! -- We have increased IS-IS metric for IPv4 on interface Fa0/1 -- !!
!! -- to make low cost path via Fa0/0 -- !!

!! -- We have increased IS-IS metric for IPv6 on interface Fa0/0 -- !!
!! -- to make low cost path via Fa0/1 -- !!

!! -- But because of IS-IS single topology for both IPv4 and IPv6 --!!
!! -- Fa0/0 becomes low cost/preferred path for both IPv4 and IPv6-!!



R7#
interface FastEthernet0/0
 ip address 10.1.57.7 255.255.255.0
 ip router isis 1
 duplex full
 speed 100
 ipv6 address 2001:10:1:57::7/64
 ipv6 router isis 1
 isis network point-to-point 
 isis ipv6 metric 20
!
interface FastEthernet0/1
 ip address 10.1.67.7 255.255.255.0
 ip router isis 1
 duplex full
 speed 100
 ipv6 address 2001:10:1:67::7/64
 ipv6 router isis 1
 isis metric 20

R7#sh isis database detail
<snip>
R7.00-00 * 0x00000003 0xB5AC 894 0/0/0
 Area Address: 49.0002
 NLPID: 0xCC 0x8E 
 Hostname: R7
 IP Address: 192.168.1.7
 Metric: 10 IP 10.1.57.0 255.255.255.0
 Metric: 20 IP 10.1.67.0 255.255.255.0
 Metric: 0 IP 192.168.1.7 255.255.255.255
 IPv6 Address: 2001:192:168:1::7
 Metric: 10 IPv6 2001:10:1:57::/64
 Metric: 20 IPv6 2001:10:1:67::/64
 Metric: 0 IPv6 2001:192:168:1::7/128
 Metric: 20 IS R7.01
 Metric: 10 IS R5.00
R7.01-00 * 0x00000002 0xD753 841 0/0/0
 Metric: 0 IS R7.00
 Metric: 0 IS R6.00

R7# show ip route 0.0.0.0
Routing entry for 0.0.0.0/0, supernet
 Known via "isis", distance 115, metric 10, candidate default path, type level-1
 Redistributing via isis 1
 Last update from 10.1.57.5 on FastEthernet0/0, 00:21:21 ago
 Routing Descriptor Blocks:
 * 10.1.57.5, from 192.168.1.5, 00:21:21 ago, via FastEthernet0/0
 Route metric is 10, traffic share count is 1

R7#show ipv6 route ::/0
Routing entry for ::/0
 Known via "isis 1", distance 115, metric 10, type level-1
 Route count is 1/1, share count 0
 Routing paths:
 FE80::C800:11FF:FEB0:8, FastEthernet0/0
 Last updated 00:21:36 ago

We need to configure IS-IS Multi Topology to create different routing topologies for IPv4 and IPv6 address family. Wide metric is also required for Multi topology configuration.

ISIS Multi Topology Configuration

R1

hostname R1
!
no ip domain lookup
ip cef
ipv6 unicast-routing
ipv6 cef
!
interface Loopback0
 ip address 192.168.1.1 255.255.255.255
 ipv6 address 2001:192:168:1::1/128
!
interface FastEthernet0/0
 ip address 10.1.123.1 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:123::1/64
 ipv6 router isis 1
!
interface FastEthernet0/1
 ip address 172.16.110.1 255.255.255.0
 ipv6 address 2001:172:16:110::1/64
 ipv6 ospf 100 area 0
!
router ospf 1
 redistribute isis 1 level-1-2 subnets
 passive-interface default
 no passive-interface FastEthernet0/1
 network 172.16.110.1 0.0.0.0 area 0
 network 192.168.1.1 0.0.0.0 area 0
!
router isis 1
 net 49.0001.1921.6800.1001.00
 is-type level-2-only
 metric-style wide
 redistribute ospf 1 match internal external 1 external 2
 passive-interface Loopback0
 !
 address-family ipv6
 multi-topology
 redistribute ospf 100 match internal external 1 external 2
 exit-address-family
!
ipv6 router ospf 100
 redistribute isis 1 level-1-2
!

R2

hostname R2
!
no ip domain lookup
ip cef
ipv6 unicast-routing
ipv6 cef
!
interface Loopback0
 ip address 192.168.1.2 255.255.255.255
 ipv6 address 2001:192:168:1::2/128
!
interface FastEthernet0/0
 ip address 10.1.123.2 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:123::2/64
 ipv6 router isis 1
!
interface FastEthernet0/1
 ip address 10.1.25.2 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:25::2/64
 ipv6 router isis 1
!
interface FastEthernet1/0
 ip address 10.1.24.2 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:24::2/64
 ipv6 router isis 1
!
router isis 1
 net 49.0001.1921.6800.1002.00
 is-type level-2-only
 metric-style wide
 passive-interface Loopback0
 !
 address-family ipv6
 multi-topology
 exit-address-family
!

R3

hostname R3
!
no ip domain lookup
ip cef
ipv6 unicast-routing
ipv6 cef
!
interface Loopback0
 ip address 192.168.1.3 255.255.255.255
 ipv6 address 2001:192:168:1::3/128
!
interface FastEthernet0/0
 ip address 10.1.123.3 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:123::3/64
 ipv6 router isis 1
!
interface FastEthernet0/1
 ip address 10.1.38.3 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:38::3/64
 ipv6 router isis 1
!
interface FastEthernet1/0
 ip address 10.1.34.3 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:34::3/64
 ipv6 router isis 1
!
router isis 1
 net 49.0001.1921.6800.1003.00
 is-type level-2-only
 metric-style wide
 passive-interface Loopback0
 !
 address-family ipv6
 multi-topology 
 exit-address-family
!

R4

hostname R4
!
no ip domain lookup
ip cef
ipv6 unicast-routing
ipv6 cef
!
interface Loopback0
 ip address 192.168.1.4 255.255.255.255
 ipv6 address 2001:192:168:1::4/128
!
interface FastEthernet0/0
 ip address 10.1.34.4 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:34::4/64
 ipv6 router isis 1
 isis circuit-type level-2-only
!
interface FastEthernet0/1
 ip address 10.1.46.4 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:46::4/64
 ipv6 router isis 1
 isis circuit-type level-2-only
!
interface FastEthernet1/0
 ip address 10.1.24.4 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:24::4/64
 ipv6 router isis 1
 isis circuit-type level-2-only
!
router isis 1
 net 49.0001.1921.6800.1004.00
 metric-style wide
 passive-interface Loopback0
 !
 address-family ipv6
 multi-topology
 exit-address-family
!

R5

hostname R5
!
no ip domain lookup
ip cef
ipv6 unicast-routing
ipv6 cef
!
interface Loopback0
 ip address 192.168.1.5 255.255.255.255
 ipv6 address 2001:192:168:1::5/128
!
interface FastEthernet0/0
 ip address 10.1.57.5 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:57::5/64
 ipv6 router isis 1
 isis network point-to-point 
!
interface FastEthernet0/1
 ip address 10.1.25.5 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:25::5/64
 ipv6 router isis 1
!
interface FastEthernet1/0
 ip address 10.1.56.5 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:56::5/64
 ipv6 router isis 1
!
router isis 1
 net 49.0002.1921.6800.1005.00
 metric-style wide
 passive-interface Loopback0
 !
 address-family ipv6
 multi-topology
 exit-address-family
!

R6

hostname R6
!
no ip domain lookup
ip cef
ipv6 unicast-routing
ipv6 cef
!
interface Loopback0
 ip address 192.168.1.6 255.255.255.255
 ipv6 address 2001:192:168:1::6/128
!
interface FastEthernet0/0
 ip address 10.1.67.6 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:67::6/64
 ipv6 router isis 1
!
interface FastEthernet0/1
 ip address 10.1.46.6 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:46::6/64
 ipv6 router isis 1
!
interface FastEthernet1/0
 ip address 10.1.56.6 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:56::6/64
 ipv6 router isis 1
!
router isis 1
 net 49.0002.1921.6800.1006.00
 metric-style wide
 passive-interface Loopback0
 !
 address-family ipv6
 multi-topology
 exit-address-family
!

R7

hostname R7
!
no ip domain lookup
ip cef
ipv6 unicast-routing
ipv6 cef
!
interface Loopback0
 ip address 192.168.1.7 255.255.255.255
 ipv6 address 2001:192:168:1::7/128
!
interface FastEthernet0/0
 ip address 10.1.57.7 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:57::7/64
 ipv6 router isis 1
 isis network point-to-point 
 isis ipv6 metric 20
!
interface FastEthernet0/1
 ip address 10.1.67.7 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:67::7/64
 ipv6 router isis 1
 isis metric 20
!
router isis 1
 net 49.0002.1921.6800.1007.00
 is-type level-1
 metric-style wide
 passive-interface Loopback0
 !
 address-family ipv6
 multi-topology
 exit-address-family
!

R8

hostname R8
!
no ip domain lookup
ip cef
ipv6 unicast-routing
ipv6 cef
!
interface Loopback0
 ip address 192.168.1.8 255.255.255.255
 ipv6 address 2001:192:168:1::8/128
!
interface FastEthernet0/0
 ip address 10.1.89.8 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:89::8/64
 ipv6 router isis 1
!
interface FastEthernet0/1
 ip address 10.1.38.8 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:38::8/64
 ipv6 router isis 1
!
router isis 1
 net 49.0003.1921.6800.1008.00
 metric-style wide
 summary-address 172.16.0.0 255.255.252.0 level-1
 redistribute isis ip level-2 into level-1 distribute-list 100
 passive-interface Loopback0
 !
 address-family ipv6
 multi-topology
 summary-prefix 2001:172:16::/48 level-1
 redistribute isis level-2 into level-1 distribute-list IPv6_L2_PREFIXES
 exit-address-family
!
access-list 100 permit ip any any
!
ipv6 prefix-list IPv6_L2_PREFIXES seq 5 permit ::/0 le 128
!

R9

hostname R9
!
no ip domain lookup
ip cef
ipv6 unicast-routing
ipv6 cef
!
interface Loopback0
 ip address 192.168.1.9 255.255.255.255
 ipv6 address 2001:192:168:1::9/128
!
interface FastEthernet0/0
 ip address 10.1.89.9 255.255.255.0
 ip router isis 1
 ipv6 address 2001:10:1:89::9/64
 ipv6 router isis 1
!
router isis 1
 net 49.0003.1921.6800.1009.00
 is-type level-1
 metric-style wide
 passive-interface Loopback0
 !
 address-family ipv6
 multi-topology
 exit-address-family
!

R10

hostname R10
!
no ip domain lookup
ip cef
ipv6 unicast-routing
ipv6 cef
!
interface Loopback0
 ip address 192.168.1.10 255.255.255.255
 ipv6 address 2001:192:168:1::10/128
 ipv6 ospf 100 area 0
!
interface Loopback1
 ip address 172.16.0.1 255.255.255.0
 ip ospf network point-to-point
 ipv6 address 2001:172:16::1/64
 ipv6 ospf 100 area 0
 ipv6 ospf network point-to-point
!
interface Loopback2
 ip address 172.16.1.1 255.255.255.0
 ip ospf network point-to-point
 ipv6 address 2001:172:16:1::1/64
 ipv6 ospf 100 area 0
 ipv6 ospf network point-to-point
!
interface Loopback3
 ip address 172.16.2.1 255.255.255.0
 ip ospf network point-to-point
 ipv6 address 2001:172:16:2::1/64
 ipv6 ospf 100 area 0
 ipv6 ospf network point-to-point
!
interface Loopback4
 ip address 172.16.3.1 255.255.255.0
 ip ospf network point-to-point
 ipv6 address 2001:172:16:3::1/64
 ipv6 ospf 100 area 0
 ipv6 ospf network point-to-point
!
interface FastEthernet0/1
 ip address 172.16.110.10 255.255.255.0
 ipv6 address 2001:172:16:110::10/64
 ipv6 ospf 100 area 0
!
router ospf 1
 network 0.0.0.0 255.255.255.255 area 0
!
ipv6 router ospf 100
!

Verification and Testing

!! -- Below output shows that wide metric is used now -- !!

R7#show clns protocol

IS-IS Router: 1
 System Id: 1921.6800.1007.00 IS-Type: level-1
 Manual area address(es): 
 49.0002
 Routing for area address(es): 
 49.0002
 Interfaces supported by IS-IS:
 FastEthernet0/1 - IP - IPv6
 FastEthernet0/0 - IP - IPv6
 Passive interface: 
 Loopback0
 Redistribute:
 static (on by default)
 Distance for L2 CLNS routes: 110
 RRR level: none
 Generate narrow metrics: none
 Accept narrow metrics: none
 Generate wide metrics: level-1-2
 Accept wide metrics: level-1-2
 
!! -- MT-IPv6 shows that Multi Topology is in use now -- !!
!! -- Which is different topology for IPv4 and IPv6 -- !!

R7#show isis database detail

Tag 1:
IS-IS Level-1 Link State Database:
LSPID LSP Seq Num LSP Checksum LSP Holdtime ATT/P/OL
R5.00-00 0x00000003 0xB859 936 1/0/0
 Area Address: 49.0002
 Topology: IPv4 (0x0) 
 IPv6 (0x4002 ATT) 
 NLPID: 0xCC 0x8E 
 Hostname: R5
 IP Address: 192.168.1.5
 Metric: 10 IP 10.1.57.0/24
 Metric: 10 IP 10.1.25.0/24
 Metric: 10 IP 10.1.56.0/24
 Metric: 0 IP 192.168.1.5/32
 IPv6 Address: 2001:192:168:1::5
 Metric: 10 IPv6 (MT-IPv6) 2001:10:1:57::/64
 Metric: 10 IPv6 (MT-IPv6) 2001:10:1:25::/64
 Metric: 10 IPv6 (MT-IPv6) 2001:10:1:56::/64
 Metric: 0 IPv6 (MT-IPv6) 2001:192:168:1::5/128
 Metric: 10 IS-Extended R6.03
 Metric: 10 IS-Extended R7.00
 Metric: 10 IS (MT-IPv6) R6.03
 Metric: 10 IS (MT-IPv6) R7.00
R6.00-00 0x00000005 0x387F 943 1/0/0
 Area Address: 49.0002
 Topology: IPv4 (0x0) 
 IPv6 (0x4002 ATT) 
 NLPID: 0xCC 0x8E 
 Hostname: R6
 IP Address: 192.168.1.6
 Metric: 10 IP 10.1.67.0/24
 Metric: 10 IP 10.1.46.0/24
 Metric: 10 IP 10.1.56.0/24
 Metric: 0 IP 192.168.1.6/32
 IPv6 Address: 2001:192:168:1::6
 Metric: 10 IPv6 (MT-IPv6) 2001:10:1:67::/64
 Metric: 10 IPv6 (MT-IPv6) 2001:10:1:46::/64
 Metric: 10 IPv6 (MT-IPv6) 2001:10:1:56::/64
 Metric: 0 IPv6 (MT-IPv6) 2001:192:168:1::6/128
 Metric: 10 IS-Extended R6.03
 Metric: 10 IS-Extended R7.01
 Metric: 10 IS (MT-IPv6) R6.03
 Metric: 10 IS (MT-IPv6) R7.01
R6.03-00 0x00000001 0x73A7 929 0/0/0
 Metric: 0 IS-Extended R6.00
 Metric: 0 IS-Extended R5.00
R7.00-00 * 0x00000003 0x66A9 930 0/0/0
 Area Address: 49.0002
 Topology: IPv4 (0x0) 
 IPv6 (0x2) 
 NLPID: 0xCC 0x8E 
 Hostname: R7
 IP Address: 192.168.1.7
 Metric: 10 IP 10.1.57.0/24
 Metric: 20 IP 10.1.67.0/24
 Metric: 0 IP 192.168.1.7/32
 IPv6 Address: 2001:192:168:1::7
 Metric: 20 IPv6 (MT-IPv6) 2001:10:1:57::/64
 Metric: 10 IPv6 (MT-IPv6) 2001:10:1:67::/64
 Metric: 0 IPv6 (MT-IPv6) 2001:192:168:1::7/128
 Metric: 20 IS-Extended R7.01
 Metric: 10 IS-Extended R5.00
 Metric: 10 IS (MT-IPv6) R7.01
 Metric: 20 IS (MT-IPv6) R5.00
R7.01-00 * 0x00000001 0x9487 927 0/0/0
 Metric: 0 IS-Extended R7.00
 Metric: 0 IS-Extended R6.00

Ping and Traceroute

!! -- Now IPv4 routing is preferred via Fa0/0 -- !!
!! -- And IPv6 routing is preferred via Fa0/1 -- !!

R7#show ip route 
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
 D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
 N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
 E1 - OSPF external type 1, E2 - OSPF external type 2
 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
 ia - IS-IS inter area, * - candidate default, U - per-user static route
 o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
 + - replicated route, % - next hop override

Gateway of last resort is 10.1.57.5 to network 0.0.0.0

i*L1 0.0.0.0/0 [115/10] via 10.1.57.5, 00:08:09, FastEthernet0/0
 10.0.0.0/8 is variably subnetted, 7 subnets, 2 masks
i L1 10.1.25.0/24 [115/20] via 10.1.57.5, 00:08:19, FastEthernet0/0
i L1 10.1.46.0/24 [115/30] via 10.1.67.6, 00:08:19, FastEthernet0/1
 [115/30] via 10.1.57.5, 00:08:19, FastEthernet0/0
i L1 10.1.56.0/24 [115/20] via 10.1.57.5, 00:08:19, FastEthernet0/0
C 10.1.57.0/24 is directly connected, FastEthernet0/0
L 10.1.57.7/32 is directly connected, FastEthernet0/0
C 10.1.67.0/24 is directly connected, FastEthernet0/1
L 10.1.67.7/32 is directly connected, FastEthernet0/1
 192.168.1.0/32 is subnetted, 3 subnets
i L1 192.168.1.5 [115/10] via 10.1.57.5, 00:08:19, FastEthernet0/0
i L1 192.168.1.6 [115/20] via 10.1.67.6, 00:08:19, FastEthernet0/1
 [115/20] via 10.1.57.5, 00:08:19, FastEthernet0/0
C 192.168.1.7 is directly connected, Loopback0

R7#show ipv6 route
IPv6 Routing Table - default - 12 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
 B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP
 H - NHRP, I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea
 IS - ISIS summary, D - EIGRP, EX - EIGRP external, NM - NEMO
 ND - ND Default, NDp - ND Prefix, DCE - Destination, NDr - Redirect
 O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
 ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2, l - LISP
I1 ::/0 [115/10]
 via FE80::C801:11FF:FEB0:8, FastEthernet0/1
I1 2001:10:1:25::/64 [115/30]
 via FE80::C800:11FF:FEB0:8, FastEthernet0/0
 via FE80::C801:11FF:FEB0:8, FastEthernet0/1
I1 2001:10:1:46::/64 [115/20]
 via FE80::C801:11FF:FEB0:8, FastEthernet0/1
I1 2001:10:1:56::/64 [115/20]
 via FE80::C801:11FF:FEB0:8, FastEthernet0/1
C 2001:10:1:57::/64 [0/0]
 via FastEthernet0/0, directly connected
L 2001:10:1:57::7/128 [0/0]
 via FastEthernet0/0, receive
C 2001:10:1:67::/64 [0/0]
 via FastEthernet0/1, directly connected
L 2001:10:1:67::7/128 [0/0]
 via FastEthernet0/1, receive
I1 2001:192:168:1::5/128 [115/20]
 via FE80::C800:11FF:FEB0:8, FastEthernet0/0
 via FE80::C801:11FF:FEB0:8, FastEthernet0/1
I1 2001:192:168:1::6/128 [115/10]
 via FE80::C801:11FF:FEB0:8, FastEthernet0/1
LC 2001:192:168:1::7/128 [0/0]
 via Loopback0, receive
L FF00::/8 [0/0]
 via Null0, receive
 
R7#
interface FastEthernet0/0
 ip address 10.1.57.7 255.255.255.0
 ip router isis 1
 duplex full
 speed 100
 ipv6 address 2001:10:1:57::7/64
 ipv6 router isis 1
 isis network point-to-point 
 isis ipv6 metric 20
!
interface FastEthernet0/1
 ip address 10.1.67.7 255.255.255.0
 ip router isis 1
 duplex full
 speed 100
 ipv6 address 2001:10:1:67::7/64
 ipv6 router isis 1
 isis metric 20
!

R7#show ip route 0.0.0.0
Routing entry for 0.0.0.0/0, supernet
 Known via "isis", distance 115, metric 10, candidate default path, type level-1
 Redistributing via isis 1
 Last update from 10.1.57.5 on FastEthernet0/0, 00:09:02 ago
 Routing Descriptor Blocks:
 * 10.1.57.5, from 192.168.1.5, 00:09:02 ago, via FastEthernet0/0
 Route metric is 10, traffic share count is 1
 
R7#show ipv6 route ::/0
Routing entry for ::/0
 Known via "isis 1", distance 115, metric 10, type level-1
 Route count is 1/1, share count 0
 Routing paths:
 FE80::C801:11FF:FEB0:8, FastEthernet0/1
 Last updated 00:09:08 ago

!!-- Ping R10 IPv4 network from R7 --!!

R7#ping 172.16.1.1 source loopback 0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.1.7 
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 96/106/116 ms

!!-- Traceroute R10 IPv4 network from R7 --!!

R7#traceroute 172.16.1.1 source loopback 0
Type escape sequence to abort.
Tracing the route to 172.16.1.1
VRF info: (vrf in name/id, vrf out name/id)
 1 10.1.57.5 40 msec 48 msec 56 msec
 2 10.1.25.2 56 msec 56 msec 44 msec
 3 10.1.123.1 84 msec 76 msec 96 msec
 4 172.16.110.10 100 msec * 104 msec
 
!!-- Ping R10 IPv6 network from R7 --!!
 
R7#ping 2001:172:16::1 source loopback 0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:172:16::1, timeout is 2 seconds:
Packet sent with a source address of 2001:192:168:1::7
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 80/100/124 ms

!!-- Traceroute R10 IPv6 network from R7 --!!

R7#traceroute ipv6
Target IPv6 address: 2001:172:16::1
Source address: 2001:192:168:1::7
Insert source routing header? [no]: 
Numeric display? [no]: 
Timeout in seconds [3]: 
Probe count [3]: 
Minimum Time to Live [1]: 
Maximum Time to Live [30]: 
Priority [0]: 
Port Number [0]: 
Type escape sequence to abort.
Tracing the route to 2001:172:16::1

1 2001:10:1:67::6 88 msec 52 msec 24 msec
 2 2001:10:1:56::5 40 msec 40 msec 48 msec
 3 2001:10:1:25::2 72 msec 60 msec 76 msec
 4 2001:10:1:123::1 96 msec 96 msec 92 msec
 5 2001:172:16:110::10 104 msec 120 msec 104 msec

Cisco Site-to-Site VPN Technologies Comparison

October 17, 2017Cisco, Security, VPNVPNAmolak

Cisco Site-to-Site VPN Technologies Comparison

Reference: www.cisco.com

Integrated IS-IS IPv4 Configuration

September 18, 2017Cisco, Integrated IS-IS, Service ProviderIntegrated IS-IS, IS-IS, ISIS for IPv4Amolak

Integrated IS-IS for IPv4 Configuration

We will cover following topics:

Multiple IS-IS Areas
IS-IS Circuit Types
IS-IS Network Types
IS-IS Path Manipulation
Authentication
Route Leak between Areas
Route Summarization
Redistribution between IS-IS and other routing protocol

Network Topology

Tasks

Configure IS-IS Area 49.0001 on R1, R2, R3 & R4.
Configure IS-IS Area 49.0002 on R5, R6 & R7.
Configure IS-IS Area 49.0003 on R8 & R9.
Configure OSPF Area 0 between R1 Fa0/1 and R10 Fa0/1.
Configure R1, R2 & R3 as IS-IS Router type Level-2 only.
Configure all interfaces of R4 as IS-IS circuit type Level-2 only.
R5, R6 & R8 would work in default IS-IS router type, which is L1/L2.
Configure R7 & R9 as IS-IS Router type Level-1.
Configure mutual redistribution between OSPF and IS-IS on R1.
R7 has two equal cost default route to reach networks outside its own IS-IS Area. Increase the IS-IS link cost between R7 & R6 so that it would prefer path via R7 & R5.
Configure R8 to Leak Level-2 area routes into Level-1 area.
Configure R8 to send summary route 172.16.0.0/22 instead of more specific routes from 172.16.x.x network, into Level-1 area.
Configure IS-IS link type point-to-point between R5 & R7.
Configure IS-IS clear text authentication on link between R2 & R5.
Configure IS-IS MD5 authentication on link between R4 & R6.

Configuration

R1:

hostname R1
!
ip cef
!
interface Loopback0
 ip address 192.168.1.1 255.255.255.255
!
interface FastEthernet0/0
 ip address 10.1.123.1 255.255.255.0
 ip router isis 1
!
interface FastEthernet0/1
 ip address 172.16.110.1 255.255.255.0
!
router ospf 1
 redistribute isis 1 level-1-2 subnets
 passive-interface default
 no passive-interface FastEthernet0/1
 network 172.16.110.1 0.0.0.0 area 0
 network 192.168.1.1 0.0.0.0 area 0
!
router isis 1
 net 49.0001.1921.6800.1001.00
 is-type level-2-only
 redistribute ospf 1 match internal external 1 external 2
 passive-interface Loopback0
!

R2:

hostname R2
!
ip cef
!
key chain CLEAR-TEXT-KC
 key 1
 key-string UNENCRYPTEDKEY
!
interface Loopback0
 ip address 192.168.1.2 255.255.255.255
!
interface FastEthernet0/0
 ip address 10.1.123.2 255.255.255.0
 ip router isis 1
!
interface FastEthernet0/1
 ip address 10.1.25.2 255.255.255.0
 ip router isis 1
 isis authentication mode text
 isis authentication key-chain CLEAR-TEXT-KC
!
interface FastEthernet1/0
 ip address 10.1.24.2 255.255.255.0
 ip router isis 1
!
router isis 1
 net 49.0001.1921.6800.1002.00
 is-type level-2-only
 passive-interface Loopback0
!

R3:

hostname R3
!
ip cef
!
interface Loopback0
 ip address 192.168.1.3 255.255.255.255
!
interface FastEthernet0/0
 ip address 10.1.123.3 255.255.255.0
 ip router isis 1
!
interface FastEthernet0/1
 ip address 10.1.38.3 255.255.255.0
 ip router isis 1
!
interface FastEthernet1/0
 ip address 10.1.34.3 255.255.255.0
 ip router isis 1
!
router isis 1
 net 49.0001.1921.6800.1003.00
 is-type level-2-only
 passive-interface Loopback0
!

R4:

hostname R4
!
ip cef
!
key chain MD5-SECURED-KC
 key 1
 key-string ENCRYPTEDKEY
!
interface Loopback0
 ip address 192.168.1.4 255.255.255.255
!
interface FastEthernet0/0
 ip address 10.1.34.4 255.255.255.0
 ip router isis 1
 isis circuit-type level-2-only
!
interface FastEthernet0/1
 ip address 10.1.46.4 255.255.255.0
 ip router isis 1
 isis circuit-type level-2-only
 isis authentication mode md5
 isis authentication key-chain MD5-SECURED-KC
!
interface FastEthernet1/0
 ip address 10.1.24.4 255.255.255.0
 ip router isis 1
 isis circuit-type level-2-only
!
router isis 1
 net 49.0001.1921.6800.1004.00
 passive-interface Loopback0
!

R5:

hostname R5
!
ip cef
!
key chain CLEAR-TEXT-KC
 key 1
 key-string UNENCRYPTEDKEY
!
interface Loopback0
 ip address 192.168.1.5 255.255.255.255
!
interface FastEthernet0/0
 ip address 10.1.57.5 255.255.255.0
 ip router isis 1
 isis network point-to-point 
!
interface FastEthernet0/1
 ip address 10.1.25.5 255.255.255.0
 ip router isis 1
 isis authentication mode text
 isis authentication key-chain CLEAR-TEXT-KC
!
interface FastEthernet1/0
 ip address 10.1.56.5 255.255.255.0
 ip router isis 1
!
router isis 1
 net 49.0002.1921.6800.1005.00
 passive-interface Loopback0
!

R6:

hostname R6
!
ip cef
!
key chain MD5-SECURED-KC
 key 1
 key-string ENCRYPTEDKEY
!
interface Loopback0
 ip address 192.168.1.6 255.255.255.255
!
interface FastEthernet0/0
 ip address 10.1.67.6 255.255.255.0
 ip router isis 1
!
interface FastEthernet0/1
 ip address 10.1.46.6 255.255.255.0
 ip router isis 1
 isis authentication mode md5
 isis authentication key-chain MD5-SECURED-KC
!
interface FastEthernet1/0
 ip address 10.1.56.6 255.255.255.0
 ip router isis 1
!
router isis 1
 net 49.0002.1921.6800.1006.00
 passive-interface Loopback0
!

R7:

hostname R7
!
ip cef
!
interface Loopback0
 ip address 192.168.1.7 255.255.255.255
!
interface FastEthernet0/0
 ip address 10.1.57.7 255.255.255.0
 ip router isis 1
 isis network point-to-point 
!
interface FastEthernet0/1
 ip address 10.1.67.7 255.255.255.0
 ip router isis 1
 isis metric 20
!
router isis 1
 net 49.0002.1921.6800.1007.00
 is-type level-1
 passive-interface Loopback0
!

R8:

hostname R8
!
ip cef
!
interface Loopback0
 ip address 192.168.1.8 255.255.255.255
!
interface FastEthernet0/0
 ip address 10.1.89.8 255.255.255.0
 ip router isis 1
!
interface FastEthernet0/1
 ip address 10.1.38.8 255.255.255.0
 ip router isis 1
!
router isis 1
 net 49.0003.1921.6800.1008.00
 summary-address 172.16.0.0 255.255.252.0 level-1
 redistribute isis ip level-2 into level-1 distribute-list 100
 passive-interface Loopback0
!

R9:

hostname R9
!
ip cef
!
interface Loopback0
 ip address 192.168.1.9 255.255.255.255
!
interface FastEthernet0/0
 ip address 10.1.89.9 255.255.255.0
 ip router isis 1
!
router isis 1
 net 49.0003.1921.6800.1009.00
 is-type level-1
 passive-interface Loopback0
!

R10:

hostname R10
!
ip cef
!
interface Loopback0
 ip address 192.168.1.10 255.255.255.255
!
interface Loopback1
 ip address 172.16.0.1 255.255.255.0
 ip ospf network point-to-point
!
interface Loopback2
 ip address 172.16.1.1 255.255.255.0
 ip ospf network point-to-point
!
interface Loopback3
 ip address 172.16.2.1 255.255.255.0
 ip ospf network point-to-point
!
interface Loopback4
 ip address 172.16.3.1 255.255.255.0
 ip ospf network point-to-point
!
interface FastEthernet0/1
 ip address 172.16.110.10 255.255.255.0
!
router ospf 1
 network 0.0.0.0 255.255.255.255 area 0
!

Task Specific Configuration Explanation

Task 1 – 3

We can configure router isis with or without tag. Tag is similar to OSPF process ID.

Without tag:

router isis
net xxxxxxxxx
interface x/y
ip router isis

With Tag:

router isis 1
net xxxxxxxxx
interface x/y
ip router isis 1

“passive-interface Loopback0” means the IP network configured under loopback will be advertised to IS-IS neighbors but no neighborship adjacency will be attempted.

Task 5

By default, IS-IS routes acts as Level1 and Level2 router. We can change it with “is-type” command under “router isis” configuration.

Example:
R1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#router isis 1
R1(config-router)#is-type ?
 level-1      Act as a station router only
 level-1-2    Act as both a station router and an area router
 level-2-only Act as an area router only

Task 6

By default, IS-IS router acting as Level1 and Level2 router, will try to establish adjacencies for both Level1 and Level2. We can change the default behavior at interface level also.

Example:
R1(config-if)#int f0/0 
R1(config-if)#isis circuit-type ?
 level-1      Level-1 only adjacencies are formed
 level-1-2    Level-1-2 adjacencies are formed
 level-2-only Level-2 only adjacencies are formed
 <cr>

Task 9

OSPF to IS-IS Redistribution

We need to define which OSPF routes need to be redistributed into IS-IS. Here we have matched all OSPF route types – internal, external type 1 (E1), external type 2 (E2)

router isis 1
 redistribute ospf 1 match internal external 1 external 2

IS-IS to OSPF Redistribution

We need to define which IS-IS routes need to be redistributed into OSPF. Here we have matched both level1 and level2 routes with their actual subnet mask.

router ospf 1
 redistribute isis 1 level-1-2 subnets

Task 10

R7 has two equal cost default route to send traffic out of area as both the links Fa0/0 & Fa0/1 have same metric 10, which is default.

R7#sh ip route 0.0.0.0
Routing entry for 0.0.0.0/0, supernet
 Known via "isis", distance 115, metric 10, candidate default path, type level-1
 Redistributing via isis 1
 Last update from 10.1.67.6 on FastEthernet0/1, 00:00:15 ago
 Routing Descriptor Blocks:
 10.1.67.6, from 192.168.1.6, 00:00:15 ago, via FastEthernet0/1
 Route metric is 10, traffic share count is 1
 * 10.1.57.5, from 192.168.1.5, 00:00:15 ago, via FastEthernet0/0
 Route metric is 10, traffic share count is 1

Let’s configure metric value 20 on link Fa0/1.

R7#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R7(config)#int f0/1
R7(config-if)#isis metric 20
R7(config-if)#end 

R7#sh ip route 0.0.0.0
Routing entry for 0.0.0.0/0, supernet
 Known via "isis", distance 115, metric 10, candidate default path, type level-1
 Redistributing via isis 1
 Last update from 10.1.57.5 on FastEthernet0/0, 00:00:19 ago
 Routing Descriptor Blocks:
 * 10.1.57.5, from 192.168.1.5, 00:00:19 ago, via FastEthernet0/0
 Route metric is 10, traffic share count is 1

R7#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R7(config)#int f0/0
R7(config-if)#shut
R7(config-if)#
*Sep 12 22:37:25.343: %LINK-5-CHANGED: Interface FastEthernet0/0, changed state to administratively down
*Sep 12 22:37:26.343: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to down
R7(config-if)#do sh ip route 0.0.0.0
Routing entry for 0.0.0.0/0, supernet
 Known via "isis", distance 115, metric 20, candidate default path, type level-1
 Redistributing via isis 1
 Last update from 10.1.67.6 on FastEthernet0/1, 00:00:06 ago
 Routing Descriptor Blocks:
 * 10.1.67.6, from 192.168.1.6, 00:00:06 ago, via FastEthernet0/1
 Route metric is 20, traffic share count is 1
R7(config-if)#no shut
R7(config-if)#
*Sep 12 22:37:49.991: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up
R7(config-if)#
*Sep 12 22:37:50.991: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up
R7(config-if)#do sh ip route 0.0.0.0
Routing entry for 0.0.0.0/0, supernet
 Known via "isis", distance 115, metric 10, candidate default path, type level-1
 Redistributing via isis 1
 Last update from 10.1.57.5 on FastEthernet0/0, 00:00:15 ago
 Routing Descriptor Blocks:
 * 10.1.57.5, from 192.168.1.5, 00:00:15 ago, via FastEthernet0/0
 Route metric is 10, traffic share count is 1

Task 11

We can say IS-IS level1 area is like OSPF totally stubby area, which receives default route from ABR router to reach all destinations outside of its own area. Let’s check routing table on R9 (Level-1 Router) before leaking level2 routes into level1 area.

R9#sh ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
 D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
 N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
 E1 - OSPF external type 1, E2 - OSPF external type 2
 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
 ia - IS-IS inter area, * - candidate default, U - per-user static route
 o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
 + - replicated route, % - next hop override

Gateway of last resort is 10.1.89.8 to network 0.0.0.0

i*L1 0.0.0.0/0 [115/10] via 10.1.89.8, 00:59:01, FastEthernet0/0
 10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks
i L1 10.1.38.0/24 [115/20] via 10.1.89.8, 00:59:01, FastEthernet0/0
C 10.1.89.0/24 is directly connected, FastEthernet0/0
L 10.1.89.9/32 is directly connected, FastEthernet0/0
 192.168.1.0/32 is subnetted, 2 subnets
i L1 192.168.1.8 [115/10] via 10.1.89.8, 00:59:01, FastEthernet0/0
C 192.168.1.9 is directly connected, Loopback0

Let’s configure route leak level2 routes into level1 on R8. We can use extended access-list or route-map to match routes, which we want to leak from level2 into level1. Here we used access-list 100 to match all level2 routes.

R8#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R8(config)#access-list 100 permit ip any any
R8(config)#router isis 1
R8(config-router)#redistribute isis ip level-2 into level-1 distribute-list 100 
R8(config-router)#end
R8#

Now check routing on R9(Level1 Router)

R9#show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
 D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
 N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
 E1 - OSPF external type 1, E2 - OSPF external type 2
 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
 ia - IS-IS inter area, * - candidate default, U - per-user static route
 o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
 + - replicated route, % - next hop override

Gateway of last resort is 10.1.89.8 to network 0.0.0.0

i*L1 0.0.0.0/0 [115/10] via 10.1.89.8, 01:08:13, FastEthernet0/0
 10.0.0.0/8 is variably subnetted, 11 subnets, 2 masks
i ia 10.1.24.0/24 [115/168] via 10.1.89.8, 00:02:50, FastEthernet0/0
i ia 10.1.25.0/24 [115/168] via 10.1.89.8, 00:02:50, FastEthernet0/0
i ia 10.1.34.0/24 [115/158] via 10.1.89.8, 00:02:50, FastEthernet0/0
i L1 10.1.38.0/24 [115/20] via 10.1.89.8, 01:08:13, FastEthernet0/0
i ia 10.1.46.0/24 [115/168] via 10.1.89.8, 00:02:50, FastEthernet0/0
i ia 10.1.56.0/24 [115/178] via 10.1.89.8, 00:02:50, FastEthernet0/0
i ia 10.1.57.0/24 [115/178] via 10.1.89.8, 00:02:50, FastEthernet0/0
i ia 10.1.67.0/24 [115/178] via 10.1.89.8, 00:02:50, FastEthernet0/0
C 10.1.89.0/24 is directly connected, FastEthernet0/0
L 10.1.89.9/32 is directly connected, FastEthernet0/0
i ia 10.1.123.0/24 [115/158] via 10.1.89.8, 00:02:50, FastEthernet0/0
 172.16.0.0/24 is subnetted, 5 subnets
i ia 172.16.0.0 [115/158] via 10.1.89.8, 00:02:50, FastEthernet0/0
i ia 172.16.1.0 [115/158] via 10.1.89.8, 00:02:50, FastEthernet0/0
i ia 172.16.2.0 [115/158] via 10.1.89.8, 00:02:50, FastEthernet0/0
i ia 172.16.3.0 [115/158] via 10.1.89.8, 00:02:50, FastEthernet0/0
i ia 172.16.110.0 [115/158] via 10.1.89.8, 00:02:50, FastEthernet0/0
 192.168.1.0/32 is subnetted, 10 subnets
i ia 192.168.1.1 [115/158] via 10.1.89.8, 00:02:50, FastEthernet0/0
i ia 192.168.1.2 [115/158] via 10.1.89.8, 00:02:50, FastEthernet0/0
i ia 192.168.1.3 [115/148] via 10.1.89.8, 00:02:50, FastEthernet0/0
i ia 192.168.1.4 [115/158] via 10.1.89.8, 00:02:50, FastEthernet0/0
i ia 192.168.1.5 [115/168] via 10.1.89.8, 00:02:50, FastEthernet0/0
i ia 192.168.1.6 [115/168] via 10.1.89.8, 00:02:50, FastEthernet0/0
i ia 192.168.1.7 [115/178] via 10.1.89.8, 00:02:50, FastEthernet0/0
i L1 192.168.1.8 [115/10] via 10.1.89.8, 01:08:13, FastEthernet0/0
C 192.168.1.9 is directly connected, Loopback0
i ia 192.168.1.10 [115/158] via 10.1.89.8, 00:02:50, FastEthernet0/0
R9#

Task 12

As we have seen in previous routing table on R9, it has received four routes from 172.16.x.x network, which can be summarized into 172.16.0.0/22.

Let’s configure route summarization on R8, which is advertising these routes to R9 via route leaking.

R8#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R8(config)#router isis 1 
R8(config-router)#summary-address 172.16.0.0 255.255.252.0 ? 
 level-1   Summarize into level-1 area
 level-1-2 Summarize into both area and sub-domain
 level-2   Summarize into level-2 sub-domain
 metric    Set metric for summay route
 tag       Set tag
 <cr>

R8(config-router)#summary-address 172.16.0.0 255.255.252.0 level-1
R8(config-router)#end
R8#


!! -- When doing manual summarization the router will add a local --!!
!!-- summary route to null 0. This feature is in place to prevent --!! 
!! -- routing loops. --!!

R8#sh ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
 D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
 N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
 E1 - OSPF external type 1, E2 - OSPF external type 2
 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
 ia - IS-IS inter area, * - candidate default, U - per-user static route
 o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
 + - replicated route, % - next hop override

Gateway of last resort is not set

10.0.0.0/8 is variably subnetted, 12 subnets, 2 masks
i L2 10.1.24.0/24 [115/30] via 10.1.38.3, 01:16:28, FastEthernet0/1
i L2 10.1.25.0/24 [115/30] via 10.1.38.3, 01:16:28, FastEthernet0/1
i L2 10.1.34.0/24 [115/20] via 10.1.38.3, 01:16:28, FastEthernet0/1
C 10.1.38.0/24 is directly connected, FastEthernet0/1
L 10.1.38.8/32 is directly connected, FastEthernet0/1
i L2 10.1.46.0/24 [115/30] via 10.1.38.3, 01:16:28, FastEthernet0/1
i L2 10.1.56.0/24 [115/40] via 10.1.38.3, 01:16:18, FastEthernet0/1
i L2 10.1.57.0/24 [115/40] via 10.1.38.3, 01:16:28, FastEthernet0/1
i L2 10.1.67.0/24 [115/40] via 10.1.38.3, 01:16:18, FastEthernet0/1
C 10.1.89.0/24 is directly connected, FastEthernet0/0
L 10.1.89.8/32 is directly connected, FastEthernet0/0
i L2 10.1.123.0/24 [115/20] via 10.1.38.3, 01:16:28, FastEthernet0/1
 172.16.0.0/16 is variably subnetted, 6 subnets, 2 masks
i su 172.16.0.0/22 [115/20] via 0.0.0.0, 00:03:02, Null0
i L2 172.16.0.0/24 [115/20] via 10.1.38.3, 01:15:46, FastEthernet0/1
i L2 172.16.1.0/24 [115/20] via 10.1.38.3, 01:15:46, FastEthernet0/1
i L2 172.16.2.0/24 [115/20] via 10.1.38.3, 01:15:46, FastEthernet0/1
i L2 172.16.3.0/24 [115/20] via 10.1.38.3, 01:15:46, FastEthernet0/1
i L2 172.16.110.0/24 [115/20] via 10.1.38.3, 01:16:18, FastEthernet0/1
 192.168.1.0/32 is subnetted, 10 subnets
i L2 192.168.1.1 [115/20] via 10.1.38.3, 01:16:18, FastEthernet0/1
i L2 192.168.1.2 [115/20] via 10.1.38.3, 01:16:28, FastEthernet0/1
i L2 192.168.1.3 [115/10] via 10.1.38.3, 01:16:28, FastEthernet0/1
i L2 192.168.1.4 [115/20] via 10.1.38.3, 01:16:28, FastEthernet0/1
i L2 192.168.1.5 [115/30] via 10.1.38.3, 01:16:28, FastEthernet0/1
i L2 192.168.1.6 [115/30] via 10.1.38.3, 01:16:18, FastEthernet0/1
i L2 192.168.1.7 [115/40] via 10.1.38.3, 00:20:48, FastEthernet0/1
C 192.168.1.8 is directly connected, Loopback0
i L1 192.168.1.9 [115/10] via 10.1.89.9, 01:16:28, FastEthernet0/0
i L2 192.168.1.10 [115/20] via 10.1.38.3, 01:15:46, FastEthernet0/1
R8#


!! -- Now check routing table on R9. -- !!

R9#show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
 D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
 N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
 E1 - OSPF external type 1, E2 - OSPF external type 2
 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
 ia - IS-IS inter area, * - candidate default, U - per-user static route
 o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
 + - replicated route, % - next hop override

Gateway of last resort is 10.1.89.8 to network 0.0.0.0

i*L1 0.0.0.0/0 [115/10] via 10.1.89.8, 01:14:25, FastEthernet0/0
 10.0.0.0/8 is variably subnetted, 11 subnets, 2 masks
i ia 10.1.24.0/24 [115/168] via 10.1.89.8, 00:09:02, FastEthernet0/0
i ia 10.1.25.0/24 [115/168] via 10.1.89.8, 00:09:02, FastEthernet0/0
i ia 10.1.34.0/24 [115/158] via 10.1.89.8, 00:09:02, FastEthernet0/0
i L1 10.1.38.0/24 [115/20] via 10.1.89.8, 01:14:25, FastEthernet0/0
i ia 10.1.46.0/24 [115/168] via 10.1.89.8, 00:09:02, FastEthernet0/0
i ia 10.1.56.0/24 [115/178] via 10.1.89.8, 00:09:02, FastEthernet0/0
i ia 10.1.57.0/24 [115/178] via 10.1.89.8, 00:09:02, FastEthernet0/0
i ia 10.1.67.0/24 [115/178] via 10.1.89.8, 00:09:02, FastEthernet0/0
C 10.1.89.0/24 is directly connected, FastEthernet0/0
L 10.1.89.9/32 is directly connected, FastEthernet0/0
i ia 10.1.123.0/24 [115/158] via 10.1.89.8, 00:09:02, FastEthernet0/0
 172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
i ia 172.16.0.0/22 [115/158] via 10.1.89.8, 00:00:58, FastEthernet0/0
i ia 172.16.110.0/24 [115/158] via 10.1.89.8, 00:09:02, FastEthernet0/0
 192.168.1.0/32 is subnetted, 10 subnets
i ia 192.168.1.1 [115/158] via 10.1.89.8, 00:09:02, FastEthernet0/0
i ia 192.168.1.2 [115/158] via 10.1.89.8, 00:09:02, FastEthernet0/0
i ia 192.168.1.3 [115/148] via 10.1.89.8, 00:09:02, FastEthernet0/0
i ia 192.168.1.4 [115/158] via 10.1.89.8, 00:09:02, FastEthernet0/0
i ia 192.168.1.5 [115/168] via 10.1.89.8, 00:09:02, FastEthernet0/0
i ia 192.168.1.6 [115/168] via 10.1.89.8, 00:09:02, FastEthernet0/0
i ia 192.168.1.7 [115/178] via 10.1.89.8, 00:09:02, FastEthernet0/0
i L1 192.168.1.8 [115/10] via 10.1.89.8, 01:14:25, FastEthernet0/0
C 192.168.1.9 is directly connected, Loopback0
i ia 192.168.1.10 [115/158] via 10.1.89.8, 00:09:02, FastEthernet0/0
R9#

Task 13 – 15 are self explanatory.

Final Verification and Testing

IS-IS Neighborship

“Type” column shows neighrborship type – L1, L2.
“Circuit Id” column shows the circuit id of DIS system on the link. Circtuit Id value would be Zero “00” on point-to-point link as there would not be any DIS on point-to-point link.

OSPF Neighborship between R1 and R10

CLNS Protocol and Interfaces

R1#show clns protocol

IS-IS Router: 1
 System Id: 1921.6800.1001.00 IS-Type: level-2
 Manual area address(es): 
 49.0001
 Routing for area address(es): 
 49.0001
 Interfaces supported by IS-IS:
 FastEthernet0/0 - IP
 Passive interface: 
 Loopback0
 Redistribute:
 static (on by default)
 Distance for L2 CLNS routes: 110
 RRR level: none
 Generate narrow metrics: level-1-2
 Accept narrow metrics: level-1-2
 Generate wide metrics: none
 Accept wide metrics: none

R1#show clns interface 
FastEthernet0/0 is up, line protocol is up
 Checksums enabled, MTU 1497, Encapsulation SAP
 ERPDUs enabled, min. interval 10 msec.
 CLNS fast switching enabled
 CLNS SSE switching disabled
 DEC compatibility mode OFF for this interface
 Next ESH/ISH in 14 seconds
 Routing Protocol: IS-IS
 Circuit Type: level-1-2
 Interface number 0x0, local circuit ID 0x1
 Level-2 Metric: 10, Priority: 64, Circuit ID: R3.01
 DR ID: R3.01
 Level-2 IPv6 Metric: 10
 Number of active level-2 adjacencies: 2
 Next IS-IS LAN Level-2 Hello in 649 milliseconds

R2#show clns protocol

IS-IS Router: 1
 System Id: 1921.6800.1002.00 IS-Type: level-2
 Manual area address(es): 
 49.0001
 Routing for area address(es): 
 49.0001
 Interfaces supported by IS-IS:
 FastEthernet1/0 - IP
 FastEthernet0/1 - IP
 FastEthernet0/0 - IP
 Passive interface: 
 Loopback0
 Redistribute:
 static (on by default)
 Distance for L2 CLNS routes: 110
 RRR level: none
 Generate narrow metrics: level-1-2
 Accept narrow metrics: level-1-2
 Generate wide metrics: none
 Accept wide metrics: none

R2#show clns interface
FastEthernet0/0 is up, line protocol is up
 Checksums enabled, MTU 1497, Encapsulation SAP
 ERPDUs enabled, min. interval 10 msec.
 CLNS fast switching enabled
 CLNS SSE switching disabled
 DEC compatibility mode OFF for this interface
 Next ESH/ISH in 15 seconds
 Routing Protocol: IS-IS
 Circuit Type: level-1-2
 Interface number 0x0, local circuit ID 0x1
 Level-2 Metric: 10, Priority: 64, Circuit ID: R3.01
 DR ID: R3.01
 Level-2 IPv6 Metric: 10
 Number of active level-2 adjacencies: 2
 Next IS-IS LAN Level-2 Hello in 1 seconds
FastEthernet0/1 is up, line protocol is up
 Checksums enabled, MTU 1497, Encapsulation SAP
 ERPDUs enabled, min. interval 10 msec.
 CLNS fast switching enabled
 CLNS SSE switching disabled
 DEC compatibility mode OFF for this interface
 Next ESH/ISH in 37 seconds
 Routing Protocol: IS-IS
 Circuit Type: level-1-2
 Interface number 0x1, local circuit ID 0x2
 Level-2 Metric: 10, Priority: 64, Circuit ID: R2.02
 DR ID: R2.02
 Level-2 IPv6 Metric: 10
 Number of active level-2 adjacencies: 1
 Next IS-IS LAN Level-2 Hello in 2 seconds
FastEthernet1/0 is up, line protocol is up
 Checksums enabled, MTU 1497, Encapsulation SAP
 ERPDUs enabled, min. interval 10 msec.
 CLNS fast switching enabled
 CLNS SSE switching disabled
 DEC compatibility mode OFF for this interface
 Next ESH/ISH in 47 seconds
 Routing Protocol: IS-IS
 Circuit Type: level-1-2
 Interface number 0x2, local circuit ID 0x3
 Level-2 Metric: 10, Priority: 64, Circuit ID: R4.03
 DR ID: R4.03
 Level-2 IPv6 Metric: 10
 Number of active level-2 adjacencies: 1
 Next IS-IS LAN Level-2 Hello in 1 seconds

R3#show clns protocol

IS-IS Router: 1
 System Id: 1921.6800.1003.00 IS-Type: level-2
 Manual area address(es): 
 49.0001
 Routing for area address(es): 
 49.0001
 Interfaces supported by IS-IS:
 FastEthernet1/0 - IP
 FastEthernet0/1 - IP
 FastEthernet0/0 - IP
 Passive interface: 
 Loopback0
 Redistribute:
 static (on by default)
 Distance for L2 CLNS routes: 110
 RRR level: none
 Generate narrow metrics: level-1-2
 Accept narrow metrics: level-1-2
 Generate wide metrics: none
 Accept wide metrics: none

R3#show clns interface
FastEthernet0/0 is up, line protocol is up
 Checksums enabled, MTU 1497, Encapsulation SAP
 ERPDUs enabled, min. interval 10 msec.
 CLNS fast switching enabled
 CLNS SSE switching disabled
 DEC compatibility mode OFF for this interface
 Next ESH/ISH in 19 seconds
 Routing Protocol: IS-IS
 Circuit Type: level-1-2
 Interface number 0x0, local circuit ID 0x1
 Level-2 Metric: 10, Priority: 64, Circuit ID: R3.01
 DR ID: R3.01
 Level-2 IPv6 Metric: 10
 Number of active level-2 adjacencies: 2
 Next IS-IS LAN Level-2 Hello in 734 milliseconds
FastEthernet0/1 is up, line protocol is up
 Checksums enabled, MTU 1497, Encapsulation SAP
 ERPDUs enabled, min. interval 10 msec.
 CLNS fast switching enabled
 CLNS SSE switching disabled
 DEC compatibility mode OFF for this interface
 Next ESH/ISH in 21 seconds
 Routing Protocol: IS-IS
 Circuit Type: level-1-2
 Interface number 0x1, local circuit ID 0x2
 Level-2 Metric: 10, Priority: 64, Circuit ID: R3.02
 DR ID: R3.02
 Level-2 IPv6 Metric: 10
 Number of active level-2 adjacencies: 1
 Next IS-IS LAN Level-2 Hello in 1 seconds
FastEthernet1/0 is up, line protocol is up
 Checksums enabled, MTU 1497, Encapsulation SAP
 ERPDUs enabled, min. interval 10 msec.
 CLNS fast switching enabled
 CLNS SSE switching disabled
 DEC compatibility mode OFF for this interface
 Next ESH/ISH in 19 seconds
 Routing Protocol: IS-IS
 Circuit Type: level-1-2
 Interface number 0x2, local circuit ID 0x3
 Level-2 Metric: 10, Priority: 64, Circuit ID: R3.03
 DR ID: R3.03
 Level-2 IPv6 Metric: 10
 Number of active level-2 adjacencies: 1
 Next IS-IS LAN Level-2 Hello in 1 seconds

R4#show clns protocol

IS-IS Router: 1
 System Id: 1921.6800.1004.00 IS-Type: level-1-2
 Manual area address(es): 
 49.0001
 Routing for area address(es): 
 49.0001
 Interfaces supported by IS-IS:
 FastEthernet1/0 - IP
 FastEthernet0/1 - IP
 FastEthernet0/0 - IP
 Passive interface: 
 Loopback0
 Redistribute:
 static (on by default)
 Distance for L2 CLNS routes: 110
 RRR level: none
 Generate narrow metrics: level-1-2
 Accept narrow metrics: level-1-2
 Generate wide metrics: none
 Accept wide metrics: none

R4#show clns interface
FastEthernet0/0 is up, line protocol is up
 Checksums enabled, MTU 1497, Encapsulation SAP
 ERPDUs enabled, min. interval 10 msec.
 CLNS fast switching enabled
 CLNS SSE switching disabled
 DEC compatibility mode OFF for this interface
 Next ESH/ISH in 46 seconds
 Routing Protocol: IS-IS
 Circuit Type: level-2
 Interface number 0x0, local circuit ID 0x1
 Level-2 Metric: 10, Priority: 64, Circuit ID: R3.03
 DR ID: R3.03
 Level-2 IPv6 Metric: 10
 Number of active level-2 adjacencies: 1
 Next IS-IS LAN Level-2 Hello in 8 seconds
FastEthernet0/1 is up, line protocol is up
 Checksums enabled, MTU 1497, Encapsulation SAP
 ERPDUs enabled, min. interval 10 msec.
 CLNS fast switching enabled
 CLNS SSE switching disabled
 DEC compatibility mode OFF for this interface
 Next ESH/ISH in 30 seconds
 Routing Protocol: IS-IS
 Circuit Type: level-2
 Interface number 0x1, local circuit ID 0x2
 Level-2 Metric: 10, Priority: 64, Circuit ID: R4.02
 DR ID: R4.02
 Level-2 IPv6 Metric: 10
 Number of active level-2 adjacencies: 1
 Next IS-IS LAN Level-2 Hello in 1 seconds
FastEthernet1/0 is up, line protocol is up
 Checksums enabled, MTU 1497, Encapsulation SAP
 ERPDUs enabled, min. interval 10 msec.
 CLNS fast switching enabled
 CLNS SSE switching disabled
 DEC compatibility mode OFF for this interface
 Next ESH/ISH in 5 seconds
 Routing Protocol: IS-IS
 Circuit Type: level-2
 Interface number 0x2, local circuit ID 0x3
 Level-2 Metric: 10, Priority: 64, Circuit ID: R4.03
 DR ID: R4.03
 Level-2 IPv6 Metric: 10
 Number of active level-2 adjacencies: 1
 Next IS-IS LAN Level-2 Hello in 1 seconds

R5#show clns protocol

IS-IS Router: 1
 System Id: 1921.6800.1005.00 IS-Type: level-1-2
 Manual area address(es): 
 49.0002
 Routing for area address(es): 
 49.0002
 Interfaces supported by IS-IS:
 FastEthernet1/0 - IP
 FastEthernet0/1 - IP
 FastEthernet0/0 - IP
 Passive interface: 
 Loopback0
 Redistribute:
 static (on by default)
 Distance for L2 CLNS routes: 110
 RRR level: none
 Generate narrow metrics: level-1-2
 Accept narrow metrics: level-1-2
 Generate wide metrics: none
 Accept wide metrics: none

R5#show clns interface
FastEthernet0/0 is up, line protocol is up
 Checksums enabled, MTU 1497, Encapsulation SAP
 ERPDUs enabled, min. interval 10 msec.
 CLNS fast switching enabled
 CLNS SSE switching disabled
 DEC compatibility mode OFF for this interface
 Next ESH/ISH in 47 seconds
 Routing Protocol: IS-IS
 Circuit Type: level-1-2
 Interface number 0x0, local circuit ID 0x100
 Neighbor System-ID: R7    <<<< Point-to-point link, no DIS
 Level-1 Metric: 10, Priority: 64, Circuit ID: R7.00
 Level-1 IPv6 Metric: 10
 Number of active level-1 adjacencies: 1
 Level-2 Metric: 10, Priority: 64, Circuit ID: R7.00
 Level-2 IPv6 Metric: 10
 Number of active level-2 adjacencies: 0
 Next IS-IS Hello in 1 seconds
 if state UP
FastEthernet0/1 is up, line protocol is up
 Checksums enabled, MTU 1497, Encapsulation SAP
 ERPDUs enabled, min. interval 10 msec.
 CLNS fast switching enabled
 CLNS SSE switching disabled
 DEC compatibility mode OFF for this interface
 Next ESH/ISH in 16 seconds
 Routing Protocol: IS-IS
 Circuit Type: level-1-2
 Interface number 0x1, local circuit ID 0x1
 Level-1 Metric: 10, Priority: 64, Circuit ID: R5.01
 DR ID: 0000.0000.0000.00      <<<< No L1 Adjacency
 Level-1 IPv6 Metric: 10
 Number of active level-1 adjacencies: 0
 Level-2 Metric: 10, Priority: 64, Circuit ID: R2.02
 DR ID: R2.02
 Level-2 IPv6 Metric: 10
 Number of active level-2 adjacencies: 1
 Next IS-IS LAN Level-1 Hello in 5 seconds
 Next IS-IS LAN Level-2 Hello in 7 seconds
FastEthernet1/0 is up, line protocol is up
 Checksums enabled, MTU 1497, Encapsulation SAP
 ERPDUs enabled, min. interval 10 msec.
 CLNS fast switching enabled
 CLNS SSE switching disabled
 DEC compatibility mode OFF for this interface
 Next ESH/ISH in 41 seconds
 Routing Protocol: IS-IS
 Circuit Type: level-1-2
 Interface number 0x2, local circuit ID 0x2
 Level-1 Metric: 10, Priority: 64, Circuit ID: R6.03
 DR ID: R6.03
 Level-1 IPv6 Metric: 10
 Number of active level-1 adjacencies: 1
 Level-2 Metric: 10, Priority: 64, Circuit ID: R6.03
 DR ID: R6.03
 Level-2 IPv6 Metric: 10
 Number of active level-2 adjacencies: 1
 Next IS-IS LAN Level-1 Hello in 7 seconds
 Next IS-IS LAN Level-2 Hello in 9 seconds


R6#show clns protocol

IS-IS Router: 1
 System Id: 1921.6800.1006.00 IS-Type: level-1-2
 Manual area address(es): 
 49.0002
 Routing for area address(es): 
 49.0002
 Interfaces supported by IS-IS:
 FastEthernet1/0 - IP
 FastEthernet0/1 - IP
 FastEthernet0/0 - IP
 Passive interface: 
 Loopback0
 Redistribute:
 static (on by default)
 Distance for L2 CLNS routes: 110
 RRR level: none
 Generate narrow metrics: level-1-2
 Accept narrow metrics: level-1-2
 Generate wide metrics: none
 Accept wide metrics: none

R6#show clns interface
FastEthernet0/0 is up, line protocol is up
 Checksums enabled, MTU 1497, Encapsulation SAP
 ERPDUs enabled, min. interval 10 msec.
 CLNS fast switching enabled
 CLNS SSE switching disabled
 DEC compatibility mode OFF for this interface
 Next ESH/ISH in 4 seconds
 Routing Protocol: IS-IS
 Circuit Type: level-1-2
 Interface number 0x0, local circuit ID 0x1
 Level-1 Metric: 10, Priority: 64, Circuit ID: R7.01
 DR ID: R7.01
 Level-1 IPv6 Metric: 10
 Number of active level-1 adjacencies: 1
 Level-2 Metric: 10, Priority: 64, Circuit ID: R6.01
 DR ID: 0000.0000.0000.00   <<<< No L2 Adjacency
 Level-2 IPv6 Metric: 10
 Number of active level-2 adjacencies: 0
 Next IS-IS LAN Level-1 Hello in 984 milliseconds
 Next IS-IS LAN Level-2 Hello in 1 seconds
FastEthernet0/1 is up, line protocol is up
 Checksums enabled, MTU 1497, Encapsulation SAP
 ERPDUs enabled, min. interval 10 msec.
 CLNS fast switching enabled
 CLNS SSE switching disabled
 DEC compatibility mode OFF for this interface
 Next ESH/ISH in 38 seconds
 Routing Protocol: IS-IS
 Circuit Type: level-1-2
 Interface number 0x1, local circuit ID 0x2
 Level-1 Metric: 10, Priority: 64, Circuit ID: R6.02
 DR ID: 0000.0000.0000.00     <<<< No L1 Adjacency
 Level-1 IPv6 Metric: 10
 Number of active level-1 adjacencies: 0
 Level-2 Metric: 10, Priority: 64, Circuit ID: R4.02
 DR ID: R4.02
 Level-2 IPv6 Metric: 10
 Number of active level-2 adjacencies: 1
 Next IS-IS LAN Level-1 Hello in 6 seconds
 Next IS-IS LAN Level-2 Hello in 575 milliseconds
FastEthernet1/0 is up, line protocol is up
 Checksums enabled, MTU 1497, Encapsulation SAP
 ERPDUs enabled, min. interval 10 msec.
 CLNS fast switching enabled
 CLNS SSE switching disabled
 DEC compatibility mode OFF for this interface
 Next ESH/ISH in 30 seconds
 Routing Protocol: IS-IS
 Circuit Type: level-1-2
 Interface number 0x2, local circuit ID 0x3
 Level-1 Metric: 10, Priority: 64, Circuit ID: R6.03
 DR ID: R6.03
 Level-1 IPv6 Metric: 10
 Number of active level-1 adjacencies: 1
 Level-2 Metric: 10, Priority: 64, Circuit ID: R6.03
 DR ID: R6.03
 Level-2 IPv6 Metric: 10
 Number of active level-2 adjacencies: 1
 Next IS-IS LAN Level-1 Hello in 1 seconds
 Next IS-IS LAN Level-2 Hello in 1 seconds

R7#show clns protocol

IS-IS Router: 1
 System Id: 1921.6800.1007.00 IS-Type: level-1
 Manual area address(es): 
 49.0002
 Routing for area address(es): 
 49.0002
 Interfaces supported by IS-IS:
 FastEthernet0/1 - IP
 FastEthernet0/0 - IP
 Passive interface: 
 Loopback0
 Redistribute:
 static (on by default)
 Distance for L2 CLNS routes: 110
 RRR level: none
 Generate narrow metrics: level-1-2
 Accept narrow metrics: level-1-2
 Generate wide metrics: none
 Accept wide metrics: none

!! -- We are using default metric (10) on Fa0/0 and defined metric--!! 
!! -- value 20 on Fa0/1. Router will prefer path via lowest metric--!!

R7#
!
interface FastEthernet0/0
 ip address 10.1.57.7 255.255.255.0
 ip router isis 1
!
interface FastEthernet0/1
 ip address 10.1.67.7 255.255.255.0
 ip router isis 1
 isis metric 20
!

R7#show clns interface
FastEthernet0/0 is up, line protocol is up
 Checksums enabled, MTU 1497, Encapsulation SAP
 ERPDUs enabled, min. interval 10 msec.
 CLNS fast switching enabled
 CLNS SSE switching disabled
 DEC compatibility mode OFF for this interface
 Next ESH/ISH in 31 seconds
 Routing Protocol: IS-IS
 Circuit Type: level-1-2
 Interface number 0x0, local circuit ID 0x100
 Neighbor System-ID: R5     <<<< Point-to-point link
 Level-1 Metric: 10, Priority: 64, Circuit ID: R7.00
 Level-1 IPv6 Metric: 10
 Number of active level-1 adjacencies: 1
 Next IS-IS Hello in 431 milliseconds
 if state UP
FastEthernet0/1 is up, line protocol is up
 Checksums enabled, MTU 1497, Encapsulation SAP
 ERPDUs enabled, min. interval 10 msec.
 CLNS fast switching enabled
 CLNS SSE switching disabled
 DEC compatibility mode OFF for this interface
 Next ESH/ISH in 26 seconds
 Routing Protocol: IS-IS
 Circuit Type: level-1-2
 Interface number 0x1, local circuit ID 0x1
 Level-1 Metric: 20, Priority: 64, Circuit ID: R7.01  
 DR ID: R7.01
 Level-1 IPv6 Metric: 10
 Number of active level-1 adjacencies: 1
 Next IS-IS LAN Level-1 Hello in 2 seconds

R8#show clns protocol

IS-IS Router: 1
 System Id: 1921.6800.1008.00 IS-Type: level-1-2
 Manual area address(es): 
 49.0003
 Routing for area address(es): 
 49.0003
 Interfaces supported by IS-IS:
 FastEthernet0/1 - IP
 FastEthernet0/0 - IP
 Passive interface: 
 Loopback0
 Redistribute:
 static (on by default)
 Distance for L2 CLNS routes: 110
 TID 0: Inter-area IP routes from L2 into L1 enabled with list 100
 RRR level: none
 Generate narrow metrics: level-1-2
 Accept narrow metrics: level-1-2
 Generate wide metrics: none
 Accept wide metrics: none

R8#show clns interface
FastEthernet0/0 is up, line protocol is up
 Checksums enabled, MTU 1497, Encapsulation SAP
 ERPDUs enabled, min. interval 10 msec.
 CLNS fast switching enabled
 CLNS SSE switching disabled
 DEC compatibility mode OFF for this interface
 Next ESH/ISH in 26 seconds
 Routing Protocol: IS-IS
 Circuit Type: level-1-2
 Interface number 0x0, local circuit ID 0x1
 Level-1 Metric: 10, Priority: 64, Circuit ID: R9.01
 DR ID: R9.01
 Level-1 IPv6 Metric: 10
 Number of active level-1 adjacencies: 1
 Level-2 Metric: 10, Priority: 64, Circuit ID: R8.01
 DR ID: 0000.0000.0000.00
 Level-2 IPv6 Metric: 10
 Number of active level-2 adjacencies: 0
 Next IS-IS LAN Level-1 Hello in 1 seconds
 Next IS-IS LAN Level-2 Hello in 1 seconds
FastEthernet0/1 is up, line protocol is up
 Checksums enabled, MTU 1497, Encapsulation SAP
 ERPDUs enabled, min. interval 10 msec.
 CLNS fast switching enabled
 CLNS SSE switching disabled
 DEC compatibility mode OFF for this interface
 Next ESH/ISH in 22 seconds
 Routing Protocol: IS-IS
 Circuit Type: level-1-2
 Interface number 0x1, local circuit ID 0x2
 Level-1 Metric: 10, Priority: 64, Circuit ID: R8.02
 DR ID: 0000.0000.0000.00
 Level-1 IPv6 Metric: 10
 Number of active level-1 adjacencies: 0
 Level-2 Metric: 10, Priority: 64, Circuit ID: R3.02
 DR ID: R3.02
 Level-2 IPv6 Metric: 10
 Number of active level-2 adjacencies: 1
 Next IS-IS LAN Level-1 Hello in 991 milliseconds
 Next IS-IS LAN Level-2 Hello in 7 seconds

R9#show clns protocol

IS-IS Router: 1
 System Id: 1921.6800.1009.00 IS-Type: level-1
 Manual area address(es): 
 49.0003
 Routing for area address(es): 
 49.0003
 Interfaces supported by IS-IS:
 FastEthernet0/0 - IP
 Passive interface: 
 Loopback0
 Redistribute:
 static (on by default)
 Distance for L2 CLNS routes: 110
 RRR level: none
 Generate narrow metrics: level-1-2
 Accept narrow metrics: level-1-2
 Generate wide metrics: none
 Accept wide metrics: none

R9#show clns interface
FastEthernet0/0 is up, line protocol is up
 Checksums enabled, MTU 1497, Encapsulation SAP
 ERPDUs enabled, min. interval 10 msec.
 CLNS fast switching enabled
 CLNS SSE switching disabled
 DEC compatibility mode OFF for this interface
 Next ESH/ISH in 20 seconds
 Routing Protocol: IS-IS
 Circuit Type: level-1-2
 Interface number 0x0, local circuit ID 0x1
 Level-1 Metric: 10, Priority: 64, Circuit ID: R9.01
 DR ID: R9.01
 Level-1 IPv6 Metric: 10
 Number of active level-1 adjacencies: 1
 Next IS-IS LAN Level-1 Hello in 2 seconds

Routing

R5, R6 and R8 are L1/L2 router and setting ATT bit to advertise default route to their respective L1 neighbor routers.

R1#show ip route 

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
 D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
 N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
 E1 - OSPF external type 1, E2 - OSPF external type 2
 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
 ia - IS-IS inter area, * - candidate default, U - per-user static route
 o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
 + - replicated route, % - next hop override

Gateway of last resort is not set

10.0.0.0/8 is variably subnetted, 11 subnets, 2 masks
i L2 10.1.24.0/24 [115/20] via 10.1.123.2, 02:14:25, FastEthernet0/0
i L2 10.1.25.0/24 [115/20] via 10.1.123.2, 02:14:25, FastEthernet0/0
i L2 10.1.34.0/24 [115/20] via 10.1.123.3, 02:14:12, FastEthernet0/0
i L2 10.1.38.0/24 [115/20] via 10.1.123.3, 02:14:12, FastEthernet0/0
i L2 10.1.46.0/24 [115/30] via 10.1.123.3, 02:14:12, FastEthernet0/0
 [115/30] via 10.1.123.2, 02:14:12, FastEthernet0/0
i L2 10.1.56.0/24 [115/30] via 10.1.123.2, 02:14:12, FastEthernet0/0
i L2 10.1.57.0/24 [115/30] via 10.1.123.2, 02:14:12, FastEthernet0/0
i L2 10.1.67.0/24 [115/40] via 10.1.123.3, 02:14:02, FastEthernet0/0
 [115/40] via 10.1.123.2, 02:14:02, FastEthernet0/0
i L2 10.1.89.0/24 [115/30] via 10.1.123.3, 02:14:12, FastEthernet0/0
C 10.1.123.0/24 is directly connected, FastEthernet0/0
L 10.1.123.1/32 is directly connected, FastEthernet0/0
 172.16.0.0/16 is variably subnetted, 6 subnets, 2 masks
O 172.16.0.0/24 [110/2] via 172.16.110.10, 02:13:36, FastEthernet0/1
O 172.16.1.0/24 [110/2] via 172.16.110.10, 02:13:36, FastEthernet0/1
O 172.16.2.0/24 [110/2] via 172.16.110.10, 02:13:36, FastEthernet0/1
O 172.16.3.0/24 [110/2] via 172.16.110.10, 02:13:36, FastEthernet0/1
C 172.16.110.0/24 is directly connected, FastEthernet0/1
L 172.16.110.1/32 is directly connected, FastEthernet0/1
 192.168.1.0/32 is subnetted, 10 subnets
C 192.168.1.1 is directly connected, Loopback0
i L2 192.168.1.2 [115/10] via 10.1.123.2, 02:14:25, FastEthernet0/0
i L2 192.168.1.3 [115/10] via 10.1.123.3, 02:14:12, FastEthernet0/0
i L2 192.168.1.4 [115/20] via 10.1.123.3, 02:14:12, FastEthernet0/0
 [115/20] via 10.1.123.2, 02:14:12, FastEthernet0/0
i L2 192.168.1.5 [115/20] via 10.1.123.2, 02:14:12, FastEthernet0/0
i L2 192.168.1.6 [115/30] via 10.1.123.3, 02:14:02, FastEthernet0/0
 [115/30] via 10.1.123.2, 02:14:02, FastEthernet0/0
i L2 192.168.1.7 [115/30] via 10.1.123.2, 02:14:12, FastEthernet0/0
i L2 192.168.1.8 [115/20] via 10.1.123.3, 02:14:12, FastEthernet0/0
i L2 192.168.1.9 [115/30] via 10.1.123.3, 02:14:02, FastEthernet0/0
O 192.168.1.10 [110/2] via 172.16.110.10, 02:13:36, FastEthernet0/1


R2#show ip route | beg Gate
Gateway of last resort is not set

10.0.0.0/8 is variably subnetted, 13 subnets, 2 masks
C 10.1.24.0/24 is directly connected, FastEthernet1/0
L 10.1.24.2/32 is directly connected, FastEthernet1/0
C 10.1.25.0/24 is directly connected, FastEthernet0/1
L 10.1.25.2/32 is directly connected, FastEthernet0/1
i L2 10.1.34.0/24 [115/20] via 10.1.123.3, 02:14:10, FastEthernet0/0
 [115/20] via 10.1.24.4, 02:14:10, FastEthernet1/0
i L2 10.1.38.0/24 [115/20] via 10.1.123.3, 02:14:10, FastEthernet0/0
i L2 10.1.46.0/24 [115/20] via 10.1.24.4, 02:14:10, FastEthernet1/0
i L2 10.1.56.0/24 [115/20] via 10.1.25.5, 02:14:10, FastEthernet0/1
i L2 10.1.57.0/24 [115/20] via 10.1.25.5, 02:14:10, FastEthernet0/1
i L2 10.1.67.0/24 [115/30] via 10.1.25.5, 02:14:00, FastEthernet0/1
 [115/30] via 10.1.24.4, 02:14:00, FastEthernet1/0
i L2 10.1.89.0/24 [115/30] via 10.1.123.3, 02:14:10, FastEthernet0/0
C 10.1.123.0/24 is directly connected, FastEthernet0/0
L 10.1.123.2/32 is directly connected, FastEthernet0/0
 172.16.0.0/24 is subnetted, 5 subnets
i L2 172.16.0.0 [115/10] via 10.1.123.1, 02:13:35, FastEthernet0/0
i L2 172.16.1.0 [115/10] via 10.1.123.1, 02:13:35, FastEthernet0/0
i L2 172.16.2.0 [115/10] via 10.1.123.1, 02:13:35, FastEthernet0/0
i L2 172.16.3.0 [115/10] via 10.1.123.1, 02:13:35, FastEthernet0/0
i L2 172.16.110.0 [115/10] via 10.1.123.1, 02:14:20, FastEthernet0/0
 192.168.1.0/32 is subnetted, 10 subnets
i L2 192.168.1.1 [115/10] via 10.1.123.1, 02:14:20, FastEthernet0/0
C 192.168.1.2 is directly connected, Loopback0
i L2 192.168.1.3 [115/10] via 10.1.123.3, 02:14:10, FastEthernet0/0
i L2 192.168.1.4 [115/10] via 10.1.24.4, 02:14:10, FastEthernet1/0
i L2 192.168.1.5 [115/10] via 10.1.25.5, 02:14:10, FastEthernet0/1
i L2 192.168.1.6 [115/20] via 10.1.25.5, 02:14:00, FastEthernet0/1
 [115/20] via 10.1.24.4, 02:14:00, FastEthernet1/0
i L2 192.168.1.7 [115/20] via 10.1.25.5, 02:14:10, FastEthernet0/1
i L2 192.168.1.8 [115/20] via 10.1.123.3, 02:14:10, FastEthernet0/0
i L2 192.168.1.9 [115/30] via 10.1.123.3, 02:14:00, FastEthernet0/0
i L2 192.168.1.10 [115/10] via 10.1.123.1, 02:13:35, FastEthernet0/0


R3#show ip route | beg Gate
Gateway of last resort is not set

10.0.0.0/8 is variably subnetted, 13 subnets, 2 masks
i L2 10.1.24.0/24 [115/20] via 10.1.123.2, 02:14:14, FastEthernet0/0
 [115/20] via 10.1.34.4, 02:14:14, FastEthernet1/0
i L2 10.1.25.0/24 [115/20] via 10.1.123.2, 02:14:14, FastEthernet0/0
C 10.1.34.0/24 is directly connected, FastEthernet1/0
L 10.1.34.3/32 is directly connected, FastEthernet1/0
C 10.1.38.0/24 is directly connected, FastEthernet0/1
L 10.1.38.3/32 is directly connected, FastEthernet0/1
i L2 10.1.46.0/24 [115/20] via 10.1.34.4, 02:14:14, FastEthernet1/0
i L2 10.1.56.0/24 [115/30] via 10.1.123.2, 02:14:14, FastEthernet0/0
 [115/30] via 10.1.34.4, 02:14:14, FastEthernet1/0
i L2 10.1.57.0/24 [115/30] via 10.1.123.2, 02:14:14, FastEthernet0/0
i L2 10.1.67.0/24 [115/30] via 10.1.34.4, 02:14:14, FastEthernet1/0
i L2 10.1.89.0/24 [115/20] via 10.1.38.8, 02:14:14, FastEthernet0/1
C 10.1.123.0/24 is directly connected, FastEthernet0/0
L 10.1.123.3/32 is directly connected, FastEthernet0/0
 172.16.0.0/24 is subnetted, 5 subnets
i L2 172.16.0.0 [115/10] via 10.1.123.1, 02:13:35, FastEthernet0/0
i L2 172.16.1.0 [115/10] via 10.1.123.1, 02:13:35, FastEthernet0/0
i L2 172.16.2.0 [115/10] via 10.1.123.1, 02:13:35, FastEthernet0/0
i L2 172.16.3.0 [115/10] via 10.1.123.1, 02:13:35, FastEthernet0/0
i L2 172.16.110.0 [115/10] via 10.1.123.1, 02:14:14, FastEthernet0/0
 192.168.1.0/32 is subnetted, 10 subnets
i L2 192.168.1.1 [115/10] via 10.1.123.1, 02:14:14, FastEthernet0/0
i L2 192.168.1.2 [115/10] via 10.1.123.2, 02:14:14, FastEthernet0/0
C 192.168.1.3 is directly connected, Loopback0
i L2 192.168.1.4 [115/10] via 10.1.34.4, 02:14:14, FastEthernet1/0
i L2 192.168.1.5 [115/20] via 10.1.123.2, 02:14:14, FastEthernet0/0
i L2 192.168.1.6 [115/20] via 10.1.34.4, 02:14:14, FastEthernet1/0
i L2 192.168.1.7 [115/30] via 10.1.123.2, 02:14:14, FastEthernet0/0
 [115/30] via 10.1.34.4, 02:14:14, FastEthernet1/0
i L2 192.168.1.8 [115/10] via 10.1.38.8, 02:14:14, FastEthernet0/1
i L2 192.168.1.9 [115/20] via 10.1.38.8, 02:14:04, FastEthernet0/1
i L2 192.168.1.10 [115/10] via 10.1.123.1, 02:13:35, FastEthernet0/0


R4#show ip route | beg Gate
Gateway of last resort is not set

10.0.0.0/8 is variably subnetted, 13 subnets, 2 masks
C 10.1.24.0/24 is directly connected, FastEthernet1/0
L 10.1.24.4/32 is directly connected, FastEthernet1/0
i L2 10.1.25.0/24 [115/20] via 10.1.24.2, 02:14:16, FastEthernet1/0
C 10.1.34.0/24 is directly connected, FastEthernet0/0
L 10.1.34.4/32 is directly connected, FastEthernet0/0
i L2 10.1.38.0/24 [115/20] via 10.1.34.3, 02:14:06, FastEthernet0/0
C 10.1.46.0/24 is directly connected, FastEthernet0/1
L 10.1.46.4/32 is directly connected, FastEthernet0/1
i L2 10.1.56.0/24 [115/20] via 10.1.46.6, 02:14:06, FastEthernet0/1
i L2 10.1.57.0/24 [115/30] via 10.1.46.6, 02:14:06, FastEthernet0/1
 [115/30] via 10.1.24.2, 02:14:06, FastEthernet1/0
i L2 10.1.67.0/24 [115/20] via 10.1.46.6, 02:14:06, FastEthernet0/1
i L2 10.1.89.0/24 [115/30] via 10.1.34.3, 02:14:06, FastEthernet0/0
i L2 10.1.123.0/24 [115/20] via 10.1.34.3, 02:14:06, FastEthernet0/0
 [115/20] via 10.1.24.2, 02:14:06, FastEthernet1/0
 172.16.0.0/24 is subnetted, 5 subnets
i L2 172.16.0.0 [115/20] via 10.1.34.3, 02:13:35, FastEthernet0/0
 [115/20] via 10.1.24.2, 02:13:35, FastEthernet1/0
i L2 172.16.1.0 [115/20] via 10.1.34.3, 02:13:35, FastEthernet0/0
 [115/20] via 10.1.24.2, 02:13:35, FastEthernet1/0
i L2 172.16.2.0 [115/20] via 10.1.34.3, 02:13:35, FastEthernet0/0
 [115/20] via 10.1.24.2, 02:13:35, FastEthernet1/0
i L2 172.16.3.0 [115/20] via 10.1.34.3, 02:13:35, FastEthernet0/0
 [115/20] via 10.1.24.2, 02:13:35, FastEthernet1/0
i L2 172.16.110.0 [115/20] via 10.1.34.3, 02:14:06, FastEthernet0/0
 [115/20] via 10.1.24.2, 02:14:06, FastEthernet1/0
 192.168.1.0/32 is subnetted, 10 subnets
i L2 192.168.1.1 [115/20] via 10.1.34.3, 02:14:06, FastEthernet0/0
 [115/20] via 10.1.24.2, 02:14:06, FastEthernet1/0
i L2 192.168.1.2 [115/10] via 10.1.24.2, 02:14:16, FastEthernet1/0
i L2 192.168.1.3 [115/10] via 10.1.34.3, 02:14:06, FastEthernet0/0
C 192.168.1.4 is directly connected, Loopback0
i L2 192.168.1.5 [115/20] via 10.1.46.6, 02:14:06, FastEthernet0/1
 [115/20] via 10.1.24.2, 02:14:06, FastEthernet1/0
i L2 192.168.1.6 [115/10] via 10.1.46.6, 02:14:06, FastEthernet0/1
i L2 192.168.1.7 [115/20] via 10.1.46.6, 02:14:06, FastEthernet0/1
i L2 192.168.1.8 [115/20] via 10.1.34.3, 02:14:06, FastEthernet0/0
i L2 192.168.1.9 [115/30] via 10.1.34.3, 02:14:06, FastEthernet0/0
i L2 192.168.1.10 [115/20] via 10.1.34.3, 02:13:35, FastEthernet0/0
 [115/20] via 10.1.24.2, 02:13:35, FastEthernet1/0

R5#show ip route | beg Gate
Gateway of last resort is not set

10.0.0.0/8 is variably subnetted, 13 subnets, 2 masks
i L2 10.1.24.0/24 [115/20] via 10.1.25.2, 02:14:16, FastEthernet0/1
C 10.1.25.0/24 is directly connected, FastEthernet0/1
L 10.1.25.5/32 is directly connected, FastEthernet0/1
i L2 10.1.34.0/24 [115/30] via 10.1.56.6, 02:14:06, FastEthernet1/0
 [115/30] via 10.1.25.2, 02:14:06, FastEthernet0/1
i L2 10.1.38.0/24 [115/30] via 10.1.25.2, 02:14:06, FastEthernet0/1
i L1 10.1.46.0/24 [115/20] via 10.1.56.6, 02:14:06, FastEthernet1/0
C 10.1.56.0/24 is directly connected, FastEthernet1/0
L 10.1.56.5/32 is directly connected, FastEthernet1/0
C 10.1.57.0/24 is directly connected, FastEthernet0/0
L 10.1.57.5/32 is directly connected, FastEthernet0/0
i L1 10.1.67.0/24 [115/20] via 10.1.56.6, 02:14:06, FastEthernet1/0
i L2 10.1.89.0/24 [115/40] via 10.1.25.2, 02:14:06, FastEthernet0/1
i L2 10.1.123.0/24 [115/20] via 10.1.25.2, 02:14:16, FastEthernet0/1
 172.16.0.0/24 is subnetted, 5 subnets
i L2 172.16.0.0 [115/20] via 10.1.25.2, 02:13:34, FastEthernet0/1
i L2 172.16.1.0 [115/20] via 10.1.25.2, 02:13:34, FastEthernet0/1
i L2 172.16.2.0 [115/20] via 10.1.25.2, 02:13:34, FastEthernet0/1
i L2 172.16.3.0 [115/20] via 10.1.25.2, 02:13:34, FastEthernet0/1
i L2 172.16.110.0 [115/20] via 10.1.25.2, 02:14:16, FastEthernet0/1
 192.168.1.0/32 is subnetted, 10 subnets
i L2 192.168.1.1 [115/20] via 10.1.25.2, 02:14:16, FastEthernet0/1
i L2 192.168.1.2 [115/10] via 10.1.25.2, 02:14:16, FastEthernet0/1
i L2 192.168.1.3 [115/20] via 10.1.25.2, 02:14:06, FastEthernet0/1
i L2 192.168.1.4 [115/20] via 10.1.56.6, 02:14:06, FastEthernet1/0
 [115/20] via 10.1.25.2, 02:14:06, FastEthernet0/1
C 192.168.1.5 is directly connected, Loopback0
i L1 192.168.1.6 [115/10] via 10.1.56.6, 02:14:06, FastEthernet1/0
i L1 192.168.1.7 [115/10] via 10.1.57.7, 02:14:16, FastEthernet0/0
i L2 192.168.1.8 [115/30] via 10.1.25.2, 02:14:06, FastEthernet0/1
i L2 192.168.1.9 [115/40] via 10.1.25.2, 02:14:06, FastEthernet0/1
i L2 192.168.1.10 [115/20] via 10.1.25.2, 02:13:34, FastEthernet0/1

R6#show ip route | beg Gate
Gateway of last resort is not set

10.0.0.0/8 is variably subnetted, 13 subnets, 2 masks
i L2 10.1.24.0/24 [115/20] via 10.1.46.4, 02:14:14, FastEthernet0/1
i L1 10.1.25.0/24 [115/20] via 10.1.56.5, 02:14:14, FastEthernet1/0
i L2 10.1.34.0/24 [115/20] via 10.1.46.4, 02:14:14, FastEthernet0/1
i L2 10.1.38.0/24 [115/30] via 10.1.46.4, 02:14:04, FastEthernet0/1
C 10.1.46.0/24 is directly connected, FastEthernet0/1
L 10.1.46.6/32 is directly connected, FastEthernet0/1
C 10.1.56.0/24 is directly connected, FastEthernet1/0
L 10.1.56.6/32 is directly connected, FastEthernet1/0
i L1 10.1.57.0/24 [115/20] via 10.1.67.7, 02:14:14, FastEthernet0/0
 [115/20] via 10.1.56.5, 02:14:14, FastEthernet1/0
C 10.1.67.0/24 is directly connected, FastEthernet0/0
L 10.1.67.6/32 is directly connected, FastEthernet0/0
i L2 10.1.89.0/24 [115/40] via 10.1.46.4, 02:14:04, FastEthernet0/1
i L2 10.1.123.0/24 [115/30] via 10.1.56.5, 02:14:04, FastEthernet1/0
 [115/30] via 10.1.46.4, 02:14:04, FastEthernet0/1
 172.16.0.0/24 is subnetted, 5 subnets
i L2 172.16.0.0 [115/30] via 10.1.56.5, 02:13:35, FastEthernet1/0
 [115/30] via 10.1.46.4, 02:13:35, FastEthernet0/1
i L2 172.16.1.0 [115/30] via 10.1.56.5, 02:13:35, FastEthernet1/0
 [115/30] via 10.1.46.4, 02:13:35, FastEthernet0/1
i L2 172.16.2.0 [115/30] via 10.1.56.5, 02:13:35, FastEthernet1/0
 [115/30] via 10.1.46.4, 02:13:35, FastEthernet0/1
i L2 172.16.3.0 [115/30] via 10.1.56.5, 02:13:35, FastEthernet1/0
 [115/30] via 10.1.46.4, 02:13:35, FastEthernet0/1
i L2 172.16.110.0 [115/30] via 10.1.56.5, 02:14:04, FastEthernet1/0
 [115/30] via 10.1.46.4, 02:14:04, FastEthernet0/1
 192.168.1.0/32 is subnetted, 10 subnets
i L2 192.168.1.1 [115/30] via 10.1.56.5, 02:14:04, FastEthernet1/0
 [115/30] via 10.1.46.4, 02:14:04, FastEthernet0/1
i L2 192.168.1.2 [115/20] via 10.1.56.5, 02:14:04, FastEthernet1/0
 [115/20] via 10.1.46.4, 02:14:04, FastEthernet0/1
i L2 192.168.1.3 [115/20] via 10.1.46.4, 02:14:04, FastEthernet0/1
i L2 192.168.1.4 [115/10] via 10.1.46.4, 02:14:14, FastEthernet0/1
i L1 192.168.1.5 [115/10] via 10.1.56.5, 02:14:14, FastEthernet1/0
C 192.168.1.6 is directly connected, Loopback0
i L1 192.168.1.7 [115/10] via 10.1.67.7, 02:14:14, FastEthernet0/0
i L2 192.168.1.8 [115/30] via 10.1.46.4, 02:14:04, FastEthernet0/1
i L2 192.168.1.9 [115/40] via 10.1.46.4, 02:14:04, FastEthernet0/1
i L2 192.168.1.10 [115/30] via 10.1.56.5, 02:13:35, FastEthernet1/0
 [115/30] via 10.1.46.4, 02:13:35, FastEthernet0/1


R7#show ip route | beg Gate
Gateway of last resort is 10.1.57.5 to network 0.0.0.0

i*L1 0.0.0.0/0 [115/10] via 10.1.57.5, 02:14:15, FastEthernet0/0
 10.0.0.0/8 is variably subnetted, 7 subnets, 2 masks
i L1 10.1.25.0/24 [115/20] via 10.1.57.5, 02:14:15, FastEthernet0/0
i L1 10.1.46.0/24 [115/30] via 10.1.67.6, 02:14:05, FastEthernet0/1
 [115/30] via 10.1.57.5, 02:14:05, FastEthernet0/0
i L1 10.1.56.0/24 [115/20] via 10.1.57.5, 02:14:15, FastEthernet0/0
C 10.1.57.0/24 is directly connected, FastEthernet0/0
L 10.1.57.7/32 is directly connected, FastEthernet0/0
C 10.1.67.0/24 is directly connected, FastEthernet0/1
L 10.1.67.7/32 is directly connected, FastEthernet0/1
 192.168.1.0/32 is subnetted, 3 subnets
i L1 192.168.1.5 [115/10] via 10.1.57.5, 02:14:15, FastEthernet0/0
i L1 192.168.1.6 [115/20] via 10.1.67.6, 02:14:05, FastEthernet0/1
 [115/20] via 10.1.57.5, 02:14:05, FastEthernet0/0
C 192.168.1.7 is directly connected, Loopback0


R8#show ip route | beg Gate
Gateway of last resort is not set

10.0.0.0/8 is variably subnetted, 12 subnets, 2 masks
i L2 10.1.24.0/24 [115/30] via 10.1.38.3, 02:14:08, FastEthernet0/1
i L2 10.1.25.0/24 [115/30] via 10.1.38.3, 02:14:08, FastEthernet0/1
i L2 10.1.34.0/24 [115/20] via 10.1.38.3, 02:14:08, FastEthernet0/1
C 10.1.38.0/24 is directly connected, FastEthernet0/1
L 10.1.38.8/32 is directly connected, FastEthernet0/1
i L2 10.1.46.0/24 [115/30] via 10.1.38.3, 02:14:08, FastEthernet0/1
i L2 10.1.56.0/24 [115/40] via 10.1.38.3, 02:14:08, FastEthernet0/1
i L2 10.1.57.0/24 [115/40] via 10.1.38.3, 02:14:08, FastEthernet0/1
i L2 10.1.67.0/24 [115/40] via 10.1.38.3, 02:14:08, FastEthernet0/1
C 10.1.89.0/24 is directly connected, FastEthernet0/0
L 10.1.89.8/32 is directly connected, FastEthernet0/0
i L2 10.1.123.0/24 [115/20] via 10.1.38.3, 02:14:08, FastEthernet0/1
 172.16.0.0/16 is variably subnetted, 6 subnets, 2 masks
i su 172.16.0.0/22 [115/20] via 0.0.0.0, 02:13:35, Null0 << Summary
i L2 172.16.0.0/24 [115/20] via 10.1.38.3, 02:13:35, FastEthernet0/1
i L2 172.16.1.0/24 [115/20] via 10.1.38.3, 02:13:35, FastEthernet0/1
i L2 172.16.2.0/24 [115/20] via 10.1.38.3, 02:13:35, FastEthernet0/1
i L2 172.16.3.0/24 [115/20] via 10.1.38.3, 02:13:35, FastEthernet0/1
i L2 172.16.110.0/24 [115/20] via 10.1.38.3, 02:14:08, FastEthernet0/1
 192.168.1.0/32 is subnetted, 10 subnets
i L2 192.168.1.1 [115/20] via 10.1.38.3, 02:14:08, FastEthernet0/1
i L2 192.168.1.2 [115/20] via 10.1.38.3, 02:14:08, FastEthernet0/1
i L2 192.168.1.3 [115/10] via 10.1.38.3, 02:14:08, FastEthernet0/1
i L2 192.168.1.4 [115/20] via 10.1.38.3, 02:14:08, FastEthernet0/1
i L2 192.168.1.5 [115/30] via 10.1.38.3, 02:14:08, FastEthernet0/1
i L2 192.168.1.6 [115/30] via 10.1.38.3, 02:14:08, FastEthernet0/1
i L2 192.168.1.7 [115/40] via 10.1.38.3, 02:14:08, FastEthernet0/1
C 192.168.1.8 is directly connected, Loopback0
i L1 192.168.1.9 [115/10] via 10.1.89.9, 02:14:08, FastEthernet0/0
i L2 192.168.1.10 [115/20] via 10.1.38.3, 02:13:35, FastEthernet0/1


R8#sh isis database detail

Tag 1:
IS-IS Level-1 Link State Database:
LSPID LSP Seq Num LSP Checksum LSP Holdtime ATT/P/OL
R8.00-00 * 0x0000000E 0x1EF5 756 1/0/0
 Area Address: 49.0003
 NLPID: 0xCC 
 Hostname: R8
 IP Address: 192.168.1.8
 Metric: 10 IP 10.1.89.0 255.255.255.0
 Metric: 10 IP 10.1.38.0 255.255.255.0
 Metric: 0 IP 192.168.1.8 255.255.255.255
 Metric: 10 IS R9.01
 Metric: 158 IP-Interarea 10.1.24.0 255.255.255.0
 Metric: 158 IP-Interarea 10.1.25.0 255.255.255.0
 Metric: 148 IP-Interarea 10.1.34.0 255.255.255.0
 Metric: 158 IP-Interarea 10.1.46.0 255.255.255.0
 Metric: 168 IP-Interarea 10.1.56.0 255.255.255.0
 Metric: 168 IP-Interarea 10.1.57.0 255.255.255.0
 Metric: 168 IP-Interarea 10.1.67.0 255.255.255.0
 Metric: 148 IP-Interarea 10.1.123.0 255.255.255.0
 Metric: 148 IP-Interarea 172.16.110.0 255.255.255.0
 Metric: 148 IP-Interarea 192.168.1.1 255.255.255.255
 Metric: 148 IP-Interarea 192.168.1.2 255.255.255.255
 Metric: 138 IP-Interarea 192.168.1.3 255.255.255.255
 Metric: 148 IP-Interarea 192.168.1.4 255.255.255.255
 Metric: 158 IP-Interarea 192.168.1.5 255.255.255.255
 Metric: 158 IP-Interarea 192.168.1.6 255.255.255.255
 Metric: 168 IP-Interarea 192.168.1.7 255.255.255.255
 Metric: 148 IP-Interarea 192.168.1.10 255.255.255.255
 Metric: 148 IP-Interarea 172.16.0.0 255.255.252.0
R9.00-00 0x0000000D 0xD6D4 1140 0/0/0
 Area Address: 49.0003
 NLPID: 0xCC 
 Hostname: R9
 IP Address: 192.168.1.9
 Metric: 10 IP 10.1.89.0 255.255.255.0
 Metric: 0 IP 192.168.1.9 255.255.255.255
 Metric: 10 IS R9.01
R9.01-00 0x0000000B 0x0418 469 0/0/0
 Metric: 0 IS R9.00
 Metric: 0 IS R8.00
IS-IS Level-2 Link State Database:
LSPID LSP Seq Num LSP Checksum LSP Holdtime ATT/P/OL
R1.00-00 0x0000000E 0x69D5 668 0/0/0
 Area Address: 49.0001
 NLPID: 0xCC 
 Hostname: R1
 IP Address: 192.168.1.1
 Metric: 10 IS R3.01
 Metric: 10 IP 10.1.123.0 255.255.255.0
 Metric: 0 IP-External 172.16.0.0 255.255.255.0
 Metric: 0 IP-External 172.16.1.0 255.255.255.0
 Metric: 0 IP-External 172.16.2.0 255.255.255.0
 Metric: 0 IP-External 172.16.3.0 255.255.255.0
 Metric: 0 IP-External 172.16.110.0 255.255.255.0
 Metric: 0 IP 192.168.1.1 255.255.255.255
 Metric: 0 IP-External 192.168.1.10 255.255.255.255
R2.00-00 0x0000000E 0x7B1B 473 0/0/0
 Area Address: 49.0001
 NLPID: 0xCC 
 Hostname: R2
 IP Address: 192.168.1.2
 Metric: 10 IS R2.02
 Metric: 10 IS R3.01
 Metric: 10 IS R4.03
 Metric: 10 IP 10.1.24.0 255.255.255.0
 Metric: 10 IP 10.1.25.0 255.255.255.0
 Metric: 10 IP 10.1.123.0 255.255.255.0
 Metric: 0 IP 192.168.1.2 255.255.255.255
R2.02-00 0x0000000B 0x1999 388 0/0/0
 Metric: 0 IS R2.00
 Metric: 0 IS R5.00
R3.00-00 0x0000000C 0x423B 964 0/0/0
 Area Address: 49.0001
 NLPID: 0xCC 
 Hostname: R3
 IP Address: 192.168.1.3
 Metric: 10 IS R3.03
 Metric: 10 IS R3.02
 Metric: 10 IS R3.01
 Metric: 10 IP 10.1.34.0 255.255.255.0
 Metric: 10 IP 10.1.38.0 255.255.255.0
 Metric: 10 IP 10.1.123.0 255.255.255.0
 Metric: 0 IP 192.168.1.3 255.255.255.255
R3.01-00 0x0000000B 0xACC7 528 0/0/0
 Metric: 0 IS R3.00
 Metric: 0 IS R1.00
 Metric: 0 IS R2.00
R3.02-00 0x0000000B 0x6A43 674 0/0/0
 Metric: 0 IS R3.00
 Metric: 0 IS R8.00
R3.03-00 0x0000000B 0xFEB1 678 0/0/0
 Metric: 0 IS R3.00
 Metric: 0 IS R4.00
R4.00-00 0x0000000E 0x3F0F 599 0/0/0
 Area Address: 49.0001
 NLPID: 0xCC 
 Hostname: R4
 IP Address: 192.168.1.4
 Metric: 10 IP 10.1.34.0 255.255.255.0
 Metric: 10 IP 10.1.46.0 255.255.255.0
 Metric: 10 IP 10.1.24.0 255.255.255.0
 Metric: 10 IS R4.03
 Metric: 10 IS R4.02
 Metric: 10 IS R3.03
 Metric: 0 IP 192.168.1.4 255.255.255.255
R4.02-00 0x0000000B 0x3E6F 597 0/0/0
 Metric: 0 IS R4.00
 Metric: 0 IS R6.00
R4.03-00 0x0000000C 0xD0DE 817 0/0/0
 Metric: 0 IS R4.00
 Metric: 0 IS R2.00
R5.00-00 0x0000000F 0xEE2B 589 0/0/0
 Area Address: 49.0002
 NLPID: 0xCC 
 Hostname: R5
 IP Address: 192.168.1.5
 Metric: 10 IS R2.02
 Metric: 10 IS R6.03
 Metric: 10 IP 10.1.25.0 255.255.255.0
 Metric: 20 IP 10.1.46.0 255.255.255.0
 Metric: 10 IP 10.1.56.0 255.255.255.0
 Metric: 10 IP 10.1.57.0 255.255.255.0
 Metric: 20 IP 10.1.67.0 255.255.255.0
 Metric: 0 IP 192.168.1.5 255.255.255.255
 Metric: 10 IP 192.168.1.6 255.255.255.255
 Metric: 10 IP 192.168.1.7 255.255.255.255
R6.00-00 0x0000000E 0xC253 712 0/0/0
 Area Address: 49.0002
 NLPID: 0xCC 
 Hostname: R6
 IP Address: 192.168.1.6
 Metric: 10 IS R6.03
 Metric: 10 IS R4.02
 Metric: 20 IP 10.1.25.0 255.255.255.0
 Metric: 10 IP 10.1.46.0 255.255.255.0
 Metric: 10 IP 10.1.56.0 255.255.255.0
 Metric: 20 IP 10.1.57.0 255.255.255.0
 Metric: 10 IP 10.1.67.0 255.255.255.0
 Metric: 10 IP 192.168.1.5 255.255.255.255
 Metric: 0 IP 192.168.1.6 255.255.255.255
 Metric: 10 IP 192.168.1.7 255.255.255.255
R6.03-00 0x0000000C 0x2880 993 0/0/0
 Metric: 0 IS R6.00
 Metric: 0 IS R5.00
R8.00-00 * 0x0000000E 0xB32A 983 0/0/0
 Area Address: 49.0003
 NLPID: 0xCC 
 Hostname: R8
 IP Address: 192.168.1.8
 Metric: 10 IS R3.02
 Metric: 10 IP 10.1.38.0 255.255.255.0
 Metric: 10 IP 10.1.89.0 255.255.255.0
 Metric: 0 IP 192.168.1.8 255.255.255.255
 Metric: 10 IP 192.168.1.9 255.255.255.255


R9#show ip route | beg Gate
Gateway of last resort is 10.1.89.8 to network 0.0.0.0

i*L1 0.0.0.0/0 [115/10] via 10.1.89.8, 02:14:01, FastEthernet0/0
 10.0.0.0/8 is variably subnetted, 11 subnets, 2 masks
i ia 10.1.24.0/24 [115/168] via 10.1.89.8, 02:14:01, FastEthernet0/0
i ia 10.1.25.0/24 [115/168] via 10.1.89.8, 02:14:01, FastEthernet0/0
i ia 10.1.34.0/24 [115/158] via 10.1.89.8, 02:14:01, FastEthernet0/0
i L1 10.1.38.0/24 [115/20] via 10.1.89.8, 02:14:18, FastEthernet0/0
i ia 10.1.46.0/24 [115/168] via 10.1.89.8, 02:14:01, FastEthernet0/0
i ia 10.1.56.0/24 [115/178] via 10.1.89.8, 02:14:01, FastEthernet0/0
i ia 10.1.57.0/24 [115/178] via 10.1.89.8, 02:14:01, FastEthernet0/0
i ia 10.1.67.0/24 [115/178] via 10.1.89.8, 02:14:01, FastEthernet0/0
C 10.1.89.0/24 is directly connected, FastEthernet0/0
L 10.1.89.9/32 is directly connected, FastEthernet0/0
i ia 10.1.123.0/24 [115/158] via 10.1.89.8, 02:14:01, FastEthernet0/0
 172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
i ia 172.16.0.0/22 [115/158] via 10.1.89.8, 02:13:32, FastEthernet0/0
i ia 172.16.110.0/24 [115/158] via 10.1.89.8, 02:14:01, FastEthernet0/0
 192.168.1.0/32 is subnetted, 10 subnets
i ia 192.168.1.1 [115/158] via 10.1.89.8, 02:14:01, FastEthernet0/0
i ia 192.168.1.2 [115/158] via 10.1.89.8, 02:14:01, FastEthernet0/0
i ia 192.168.1.3 [115/148] via 10.1.89.8, 02:14:01, FastEthernet0/0
i ia 192.168.1.4 [115/158] via 10.1.89.8, 02:14:01, FastEthernet0/0
i ia 192.168.1.5 [115/168] via 10.1.89.8, 02:14:01, FastEthernet0/0
i ia 192.168.1.6 [115/168] via 10.1.89.8, 02:14:01, FastEthernet0/0
i ia 192.168.1.7 [115/178] via 10.1.89.8, 02:14:01, FastEthernet0/0
i L1 192.168.1.8 [115/10] via 10.1.89.8, 02:14:18, FastEthernet0/0
C 192.168.1.9 is directly connected, Loopback0
i ia 192.168.1.10 [115/158] via 10.1.89.8, 02:13:32, FastEthernet0/0


R10#show ip route | beg Gate
Gateway of last resort is not set

10.0.0.0/24 is subnetted, 9 subnets
O E2 10.1.24.0 [110/20] via 172.16.110.1, 02:13:37, FastEthernet0/1
O E2 10.1.25.0 [110/20] via 172.16.110.1, 02:13:37, FastEthernet0/1
O E2 10.1.34.0 [110/20] via 172.16.110.1, 02:13:37, FastEthernet0/1
O E2 10.1.38.0 [110/20] via 172.16.110.1, 02:13:37, FastEthernet0/1
O E2 10.1.46.0 [110/20] via 172.16.110.1, 02:13:37, FastEthernet0/1
O E2 10.1.56.0 [110/20] via 172.16.110.1, 02:13:37, FastEthernet0/1
O E2 10.1.57.0 [110/20] via 172.16.110.1, 02:13:37, FastEthernet0/1
O E2 10.1.67.0 [110/20] via 172.16.110.1, 02:13:37, FastEthernet0/1
O E2 10.1.89.0 [110/20] via 172.16.110.1, 02:13:37, FastEthernet0/1
 172.16.0.0/16 is variably subnetted, 10 subnets, 2 masks
C 172.16.0.0/24 is directly connected, Loopback1
L 172.16.0.1/32 is directly connected, Loopback1
C 172.16.1.0/24 is directly connected, Loopback2
L 172.16.1.1/32 is directly connected, Loopback2
C 172.16.2.0/24 is directly connected, Loopback3
L 172.16.2.1/32 is directly connected, Loopback3
C 172.16.3.0/24 is directly connected, Loopback4
L 172.16.3.1/32 is directly connected, Loopback4
C 172.16.110.0/24 is directly connected, FastEthernet0/1
L 172.16.110.10/32 is directly connected, FastEthernet0/1
 192.168.1.0/32 is subnetted, 10 subnets
O 192.168.1.1 [110/2] via 172.16.110.1, 02:13:37, FastEthernet0/1
O E2 192.168.1.2 [110/20] via 172.16.110.1, 02:13:37, FastEthernet0/1
O E2 192.168.1.3 [110/20] via 172.16.110.1, 02:13:37, FastEthernet0/1
O E2 192.168.1.4 [110/20] via 172.16.110.1, 02:13:37, FastEthernet0/1
O E2 192.168.1.5 [110/20] via 172.16.110.1, 02:13:37, FastEthernet0/1
O E2 192.168.1.6 [110/20] via 172.16.110.1, 02:13:37, FastEthernet0/1
O E2 192.168.1.7 [110/20] via 172.16.110.1, 02:13:37, FastEthernet0/1
O E2 192.168.1.8 [110/20] via 172.16.110.1, 02:13:37, FastEthernet0/1
O E2 192.168.1.9 [110/20] via 172.16.110.1, 02:13:37, FastEthernet0/1
C 192.168.1.10 is directly connected, Loopback0

Ping and Traceroute

!!-- Ping R10 network from R7 --!!

R7#ping 172.16.0.1 source loopback 0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.0.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.1.7 
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 128/144/168 ms

!!-- Traceroute R10 network from R7 --!!

R7#traceroute 172.16.0.1 source loopback 0
Type escape sequence to abort.
Tracing the route to 172.16.0.1
VRF info: (vrf in name/id, vrf out name/id)
 1 10.1.57.5 24 msec 68 msec 48 msec
 2 10.1.25.2 80 msec 88 msec 76 msec
 3 10.1.123.1 132 msec 116 msec 108 msec
 4 172.16.110.10 156 msec * 148 msec

!!-- Ping R9 from R7 --!!

R7#ping 192.168.1.9 source loopback 0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.9, timeout is 2 seconds:
Packet sent with a source address of 192.168.1.7 
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 180/190/204 ms

!!-- Traceroute R9 from R7 --!!

R7#traceroute 192.168.1.9 source loopback 0
Type escape sequence to abort.
Tracing the route to 192.168.1.9
VRF info: (vrf in name/id, vrf out name/id)
 1 10.1.57.5 32 msec 60 msec 32 msec
 2 10.1.25.2 96 msec 76 msec 76 msec
 3 10.1.123.3 100 msec 124 msec 128 msec
 4 10.1.38.8 164 msec 160 msec 160 msec
 5 10.1.89.9 192 msec * 176 msec

!!-- Ping R10 network from R9 --!!

R9#ping 172.16.1.1 source loopback 0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.1.9 
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 156/164/172 ms

!!-- Traceroute R10 network from R9 --!!

R9#traceroute 172.16.1.1 source loopback 0
Type escape sequence to abort.
Tracing the route to 172.16.1.1
VRF info: (vrf in name/id, vrf out name/id)
 1 10.1.89.8 52 msec 36 msec 44 msec
 2 10.1.38.3 100 msec 72 msec 88 msec
 3 10.1.123.1 120 msec 108 msec 124 msec
 4 172.16.110.10 156 msec * 160 msec

!!-- Ping R7 from R9 --!!

R9#ping 192.168.1.7 source loopback 0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.7, timeout is 2 seconds:
Packet sent with a source address of 192.168.1.9 
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 188/193/200 ms

!!-- Traceroute R7 from R9 --!!

R9#traceroute 192.168.1.7 source loopback 0
Type escape sequence to abort.
Tracing the route to 192.168.1.7
VRF info: (vrf in name/id, vrf out name/id)
 1 10.1.89.8 44 msec 48 msec 28 msec
 2 10.1.38.3 100 msec 60 msec 92 msec
 3 10.1.34.4 128 msec 108 msec 116 msec
 4 10.1.46.6 172 msec 164 msec 164 msec
 5 10.1.67.7 192 msec * 196 msec

Integrated IS-IS Basics

September 9, 2017Cisco, Integrated IS-IS, Service ProviderIntegrated IS-IS, Intermediate System to Intermediate System, IS-ISAmolak

Intermediate System to Intermediate System (IS-IS)

Intermediate System-to-Intermediate System (IS-IS) Protocol is an intra-domain Open System Interconnection (OSI) dynamic routing protocol specified in International Organization for Standardization (ISO) 10589. The protocol is designed to operate in OSI Connectionless Network Service (CLNS).

Connectionless Network Service (CLNS)

OSI CLNS is a network layer service similar to bare IP service. A CLNS entity communicates over Connectionless Network Protocol (CLNP) with its peer CLNS entity.

Integrated IS-IS

IS-IS was originally designed for use as a dynamic routing protocol for ISO CLNP and later adapted to carry IP prefixes in addition to CLNP (known as Integrated or Dual IS-IS) as described in RFC 1195.

IS-IS Terminology

CLNP – Connection-Less Network Protocol (ISO 8473, the OSI connectionless network layer protocol, very similar to IP)
ES – End System (The OSI term for a host)
ES-IS – End System to Intermediate System Routeing Exchange Protocol (ISO 9542 – OSI protocol between routers and end systems)
IS – Intermediate System (The OSI term for a router)
IS-IS – Intermediate System to Intermediate System Routeing Exchange Protocol (The ISO protocol for routing within a single routing domain)
IP – Internetwork Protocol (an Internet Standard Network Layer Protocol)
IS-IS Hello – An Hello packet defined by the IS-IS protocol (a type of packet used by the IS-IS protocol)
ISH – An Hello packet defined by ISO 9542 (ES-IS protocol). Not the same as IS-IS Hello.
LSP – Link State Packet (a type of packet used by the IS-IS protocol)
NSAP – Network Service Access Point (a conceptual interface point at which the network service is made available)
SEL – NSAP Selector (the last octet of NSAP addresses, also called NSEL)

IS-IS and OSPF

Both Link State Protocols use the Dijkstra SPF Algorithm to calculate loop-free routes. OSPF is used purely within the TCP/IP environment and used in both Enterprise and ISP environment. IS-IS is predominantly used in ISP environment.

OSPF uses IP protocol 89 as transport.
IS-IS is directly encapsulated in Layer 2.

IS-IS Network Types

Broadcast

It is used on multi-access interfaces like Ethernet.
Designated Intermediate System is elected (DIS) within a brodacast network, similar to OSPF DR but there is no backup DIS is elected in IS-IS.
DIS is elected based on Highest priority and Highest SNPA (MAC) address.
DIS election is preemptive.
DIS performs flooding of LSA updates to a multicast address. That address is different depending on the Level:
- 01-80-C2-00-00-15 for Level 2 adjacencies
- 01-80-C2-00-00-14 for Level 1 adjacencies
Flooded LSP are not ACK in a broadcast network. The DIS periodically sends out the CNSP (Complete) update. By default it’s 10 seconds and can be changed using the command isis csnp-interval.

Point-to-Point

Used where two routers are connected in point-to-point fashion i.e Serial link. It can be used on an Ethernet link also when only two routers are connected.
Cisco recommends using point to point type for better convergence.
Each LSP has to be ACKed by PSNP. If one is not ACKed, the retransmit timer will trigger a retransmit.
L1 and L2 LSPs are directly sent to the neighbor.
No DIS election is done on point to point.

IS-IS Areas

Both IS-IS and OSPF use areas to create a hierarchical topology, but there is a fundamental difference exists in the way in which the two protocols define their areas. OSPF area borders are marked by routers where some interfaces of a router are in one area, and other interfaces are in another area. When an OSPF router has interfaces in more than one area, it is an Area Border Router (ABR).

With IS-IS, an individual router is in only one area, and the border between areas is on the link that connects two routers that are in different areas. This is in contrast to OSPF, in which the area borders are within the Area Border Routers (ABRs). The reason for this difference is that an IS-IS router generally has one network service access point (NSAP) address, and an IP router generally has multiple IP addresses.

An intermediate system can be a level 1 (L1) router, a level 2 (L2) router, or both (L1/L2). L1 routers are analogous to OSPF nonbackbone Internal Routers, L2 routers are analogous to OSPF backbone routers, and L1/L2 routers are analogous to OSPF ABRs.

With OSPF, inter-area traffic must traverse Backbone Area (Area 0) to prevent inter-area routing loops. All routers in the area maintain an identical link-state database for their own Area and Area Border Routers (ABRs) advertise LSA (Links State Advertisement) for destinations outside of its own area.

With ISIS, Every L1 router within an area (including the area’s L1/L2 routers) maintains an identical link-state database. Unlike OSPF ABRs, L1/L2 routers do not by default advertise L2 routes to L1 routers. Therefore, an L1 router has no knowledge of destinations outside of its own area. In this sense, an L1 area is similar to an OSPF totally stubby area. To route a packet to another area, an L1 router must forward the packet to an L1/L2 router. When an L1/L2 router sends its level 1 LSP into an area, it signals other L1 routers that it can reach another area by setting a bit known as the Attached (ATT) bit in the LSP.

Network Entity Title

IS-IS can be used to route TCP/IP, but IS-IS is still an ISO CLNP protocol. The packets by which IS-IS communicates with its peers are CLNS PDUs, which in turn means that even in an IP-only environment, an IS-IS router must have an ISO address. The ISO address is a network address, known as Network Entity Title (NET). While IP addresses are 32 bits long and are normally written in dotted quad notation (such as 192.168.1.1), NETs can be 8 to 20 bytes long, but are generally 10 bytes long and are written as shown in this example:

49.0001.1921.6800.1001.00

The NET address consists of three parts:

Area identifier: The first three bytes are the area ID. The first byte of this example — 49 is the address family identifier (AFI) of the authority, which is equivalent to the IP address space that is assigned to an autonomous system. The AFI value 49 is what IS-IS uses for private addressing, which is the equivalent of RFC 1918 address space for IP protocols.

The second two bytes of the area ID – 0001 represent the IS-IS area number. In this example, the area number is 1.

System identifier: The next six bytes identify the node (that is, the router) on the network. Although you can choose any value for the system identifier, a commonly used method is to use binary-coded decimal (BCD) which involves taking the router’s IP address (the address you assigned to the loopback interface), filling in all leading zeros, and then re-positioning the decimal points to form three two-byte numbers.

In this example, if you pad the IP address 192.168.1.1 with zeros, the result is 192.168.001.001. Rearranging the decimal points gives you 1921.6800.1001.

NET selector: The final two bytes are the NET selector (NSEL). For IS-IS, they must always be 00, to indicate “this system.”

Neighbors and Adjacencies

IS-IS routers discover neighbors and form adjacencies by exchanging IS-IS Hello PDUs. The type of router (L1-only, L2-only, or L1/L2) influences the type of adjacency that is formed, and the area IDs configured on the two neighbors in question.
The following rules apply:

Two L1-only routers form an L1 adjacency only if their AIDs match.
Two L2-only routers form an L2 adjacency, even if their AIDs are different.
An L1-only router forms an L1 adjacency with an L1/L2 router only if their AIDs match.
An L2-only router forms an L2 adjacency with an L1/L2 router even if their AIDs are different.
Two L1/L2 routers form both L1 and L2 adjacencies if their AIDs match.
Two L1/L2 routers form only an L2 adjacency if their AIDs do not match.

IS-IS Metric

IS-IS supports four different metric values – Default Metric, Delay, Expense, Error. Cisco IOS supports only default metric which has a default value of 10. The default metric is always set to 10 irrespective of the interface type (GigE or Serial etc.).

IS-IS Metric Styles

Narrow

Default metric type.
Metric default is 10 for each interface.
Range for narrow metric range for an interface is 1 to 63 (6 bits).
The maximum total value of all hops can be 1023 (10 bits)

Wide

Wide metric type expands the metric to use 24 bits for TLV-22.
The new metric style, link metrics can have a maximum value of 16,777,215 with a total path metric of 4,261,412,864.
Cisco recommends running the wide metric style.
If there is a mismatch between metric styles, the adjacency will be maintained, but routes will not be accepted with different metric style.
Wide metric is required for MPLS TE and Multi topology configuration.

Transitional

One way to transition to a different metric-style is by configuring all routers to metric-style transitional.
Once all routers are sent you can change to either narrow or wide style.
During the transitional phase, both types will be recognized.

IS-IS Topology Types

Single Topology – Single Topology IS-IS is used when multiple protocol stacks, such as IPv4 and IPv6, are configured in an identical 1:1 basis on all interfaces in the topology. It allows a single SPF calculation to apply to both protocol stacks at the same time, simplifying the database calculation and protocol overhead of IS-IS. By default, IS-IS instances runs in Single Topology mode with regular Cisco IOS, and Multi Topology mode with Cisco IOS XR. These modes are not compatible with each other and must be configured to match, or to run in transition mode.

Multi Topology – This method is used when transitioning to IPv6 or when different routing topologies are necessary for IPv4 and IPv6 address family. Each protocol stack maintain separate database structures and use separate SPF runs, which means that one topology is independent of another.

IS-IS Authentication

Clear Text
MD5

Cisco Group Encrypted Transport VPN – GET VPN

April 20, 2017Cisco, IPSEC, Security, VPNCisco Group Encrypted Transport VPN, GDOI, GET VPNAmolak

Cisco Group Encrypted Transport VPN

GET VPN is a Cisco solution to encrypt the traffic across private WAN. In recent years government regulations, such as Health Insurance Portability and Accountability Act (HIPAA), Gramm-Leach-Bliley Act (GLBA), and Payment Card Industry Data Security Standard (PCI DSS), mandate encryption even over private IP networks. GET VPN is common deployed over private WAN topologies such as MPLS VPN.

Cisco IOS offers several IP security (IPsec) tunnel-based encryption solutions (for example, Site to Site IPsec, IPsec/GRE, and Dynamic Multipoint VPN (DMVPN) that can be deployed over an MPLS VPN, VPLS or shared IP networks. Traditional tunnel-based encryption solutions are point-to-point.

GET VPN uses IPSec to encrypt the traffic but the main concept of GET VPN is to use group security association (SA) as opposed to the standard LAN to LAN tunnels where the SA is created in a point to point fashion.

Traditional point-to-point IPsec tunneling solutions suffer from multicast replication issues because multicast replication must be performed before tunnel encapsulation and encryption at the IPsec CE (customer edge) router closest to the multicast source. Multicast replication cannot be performed in the provider network because encapsulated multicasts appear to the core network as unicast data.

GET VPN provides a tunnel-less VPN solution. It is tunnel-less as it retains the original IP header of the packet and encrypts only the data payload. To retain the original IP header, the original header is copied and placed before the IPSEC header. GET VPN does not rely on a point-to-point VPN mechanism and can further expand with the capability of scaling any-to-any intersite VPN connectivity. It takes advantage of underlying IP VPN routing infrastructure and does not require an overlay routing control plane.

Cisco’s Group Encrypted Transport VPN (GET VPN) introduces the concept of a trusted group to eliminate point-to-point tunnels and their associated overlay routing. All group members (GMs) share a common security association (SA), also known as a group SA. This enables GMs to decrypt traffic that was encrypted by any other GM. The CE router acts as a GM. In GET VPN networks, there is no need to negotiate point-to- point IPsec tunnels between the members of a group, because GET VPN is “tunnel-less.”

GET VPN Comparison

GET VPN Components

Group Domain of Interpretation – GDOI

The GDOI group key management protocol is used to provide a set of cryptographic keys and policies to a group of devices. In a GET VPN network, GDOI is used to distribute common IPsec keys to a group of enterprise VPN gateways that must communicate securely. These keys are periodically refreshed and are updated on all the VPN gateways using a process called “rekey.” GDOI protocol uses UDP port 848. GDOI is documented in RFC3547.

The GDOI protocol is protected by a Phase 1 Internet Key Exchange (IKE) SA. The participating VPN gateways authenticate themselves to the device providing keys using IKE. Authentication can be performed with a pre-shared key (PSK) or through a public key infrastructure (PKI). After the VPN gateways have been authenticated and provided with the appropriate security keys via the IKE SA, the IKE SA will expire and GDOI is then used to update the GMs in a more scalable and efficient manner.

Key Server – KS

A key server (KS) is an IOS device responsible for creating and maintaining the GET VPN control plane. All encryption policies, such as interesting traffic, encryption protocols, security association, rekey timers, and so on, are centrally defined on the KS and are pushed down to all GMs at registration time. The KS sends two types of keys:

Traffic Encryption Key – TEK
Key Encryption Key – KEK

The TEK becomes the IPsec SA, which is used to communicate with group members within the same group.

The KEK is used to encrypt the rekey messages and is used by the group members (GMs) to decrypt the incoming rekey messages from the key server (KS).

Cooperative Key Servers – COOP KSs

The KS is the most important entity in the GET VPN network because the KS maintains the control plane. Therefore, a single KS is a single point of failure for an entire GET VPN network. Because redundancy is an important consideration for KSs, GET VPN supports multiple KSs, called cooperative (COOP) KSs, to ensure seamless fault recovery if a KS fails or becomes unreachable.

A GM can be configured to register to any available KS from a list of all COOP KSs. GM configuration determines the registration order. The KS defined first is contacted first, followed by the second defined KS, and so on.

When COOP KSs boot, all KSs assume a “secondary” role and begin an election process. One KS, typically the one having the highest priority, is elected as a “primary” KS. The other KSs remain in the secondary state. The primary KS is responsible for creating and distributing group policies to all GMs, and to periodically synchronize the COOP KSs.

Group Member – GM

The group member (GM) is the router that registers with the key server (KS) to get the IPsec SA to communicate with other devices in the group.

Group SA

Unlike traditional IPsec encryption solutions, GET VPN uses the concept of group SA. All members in the GET VPN group can communicate with each other using a common encryption policy and a shared SA. With a common encryption policy and a shared SA, there is no need to negotiate IPsec between GMs.

Group Member ACL

Traffic that requires encryption is statically defined on the key server (KS) through an access control list (ACL). This policy is defined for both unicast and multicast traffic. This information is sent to all authenticated group members (GMs) to create a trusted domain of communication.

It is a best practice to summarize interesting traffic to as few permit entries as possible, and to build symmetric policies. For example, an enterprise network is using subnets from a class A major IP network 10.0.0.0/8 for all LAN interfaces behind the group members. You can define one ACL permit statement “access-list 101 permit ip 10.0.0.0 0.255.255.255 10.0.0.0 0.255.255.255” to represent all the subnets in your network.

Unicast Rekey

The KS will generate a rekey message and send multiple copies of this message, one copy to each GM. The GM will then ACK this rekey message to the KS. The ACK mechanism keeps the list of GMs at the KS current and ensures that the rekey message is only sent to active GMs.

A KS can be configured to re-transmit rekey messages to overcome reachability issues in the network. If a GM does not send an ACK for three consecutive rekey messages, the KS will remove the GM from the active GM database and stop sending rekey messages to that GM.

Multicast Rekey

In the multicast rekey process, a single copy of the rekey message is sent to a multicast group which the GMs will have joined. Each GM joins this multicast group at registration, each GM will therefore receive this rekey message.

The multicast rekey process does not have an ACK mechanism and the KS does not keep a list of active GMs. The KS can be configured to retransmit rekey messages. The CPU overhead is a lot less with multicast rekeying since only a single messages needs to be sent compared to having to replicating it in unicast mode to potentially hundreds of routers.

Multicast must be enabled in the core network for multicast rekey to work in the GET VPN control plane.

Time Based Anti-Replay

Traditional IPSec solutions have anti replay capabilities to prevent a malicious third party from capturing IPSec packets and relaying those packets at a later time to perform an attack against the IPSec endpoints. This is normally done by having a counter based sliding window where the sender sends a packet with a sequence number and the receiver will use the sliding window to determine if the packet is acceptable or if it has arrived out of sequence and outside the window of acceptable packets.

This mechanism is not useful in GET VPN because it uses a group SA. GET VPN therefore uses a time based anti replay function where the KS uses a pseudo time clock. Because the KS uses a pseudo time clock, there is no need to synchronize the time with NTP for this reason.

The primary KS will keep this pseudo time synchronized on all GMs with rekey updates. Every GM will include its pseudo time as a time stamp in the data packets. The receiving VPN gateway will then compare the time stamp of the received packet with the GM reference pseudo time clock it maintains for the group. If the packet is too late it will be dropped.

How GET VPN works

GET VPN uses the keying protocol GDOI combined with IPsec standards encryption to encrypt and decrypt the packets, thereby providing an efficient mechanism to secure native (non-tunneled) IP unicast and multicast traffic.
Each group member (GM) sends a registration request to the key server (KS). Using the GDOI protocol, the key server authenticates and authorizes the group member and sends the IPsec policy and the keys, which are required to encrypt and decrypt IP unicast and multicast packets.
After the group member is registered with the IPsec SA, and upon receiving the respective keys, group members can directly exchange encrypted IP unicast and multicast packets with each other, bypassing the key server.
As needed, the key server sends a rekey message to all the group members within the group. The rekey message contains the new IPsec policy and keys that are used when the outdated IPsec SA expires.

Implementing Cisco GET VPN

We will use following topology for GET VPN implementation.

Configurations

MPLS Provider Network Configuration

R1 - PE Router

hostname R1
!
vrf definition CUST-A
 rd 100:1
 !
 address-family ipv4
  route-target export 100:1
  route-target import 100:1
 exit-address-family
!
ip cef
!
interface Loopback0
 ip address 10.1.0.1 255.255.255.255
 ip ospf 1 area 0
!
interface FastEthernet0/0
 ip address 10.1.15.1 255.255.255.0
 ip ospf network point-to-point
 ip ospf 1 area 0
 mpls ip
!
interface FastEthernet0/1
 vrf forwarding CUST-A
 ip address 172.16.16.1 255.255.255.0
!
router ospf 1
 router-id 10.1.0.1
!
router bgp 100
 bgp router-id 10.1.0.1
 bgp log-neighbor-changes
 no bgp default ipv4-unicast
 neighbor 10.1.0.5 remote-as 100
 neighbor 10.1.0.5 update-source Loopback0
 !
 address-family ipv4
 exit-address-family
 !
 address-family vpnv4
  neighbor 10.1.0.5 activate
  neighbor 10.1.0.5 send-community extended
 exit-address-family
 !
 address-family ipv4 vrf CUST-A
  redistribute connected
  neighbor 172.16.16.6 remote-as 65001
  neighbor 172.16.16.6 activate
  neighbor 172.16.16.6 as-override
 exit-address-family
!

R2 - PE Router

hostname R2
!
vrf definition CUST-A
 rd 100:1
 !
 address-family ipv4
  route-target export 100:1
  route-target import 100:1
 exit-address-family
!
ip cef
!
interface Loopback0
 ip address 10.1.0.2 255.255.255.255
 ip ospf 1 area 0
!
interface FastEthernet0/0
 ip address 10.1.25.2 255.255.255.0
 ip ospf network point-to-point
 ip ospf 1 area 0
 mpls ip
!
interface FastEthernet0/1
 vrf forwarding CUST-A
 ip address 172.16.27.2 255.255.255.0
!
router ospf 1
 router-id 10.1.0.2
!
router bgp 100
 bgp router-id 10.1.0.2
 bgp log-neighbor-changes
 no bgp default ipv4-unicast
 neighbor 10.1.0.5 remote-as 100
 neighbor 10.1.0.5 update-source Loopback0
 !
 address-family ipv4
 exit-address-family
 !
 address-family vpnv4
  neighbor 10.1.0.5 activate
  neighbor 10.1.0.5 send-community extended
 exit-address-family
 !
 address-family ipv4 vrf CUST-A
  redistribute connected
  neighbor 172.16.27.7 remote-as 65001
  neighbor 172.16.27.7 activate
  neighbor 172.16.27.7 as-override
 exit-address-family
!

R3 - PE Router

hostname R3
!
vrf definition CUST-A
 rd 100:1
 !
 address-family ipv4
  route-target export 100:1
  route-target import 100:1
 exit-address-family
!
ip cef
!
interface Loopback0
 ip address 10.1.0.3 255.255.255.255
 ip ospf 1 area 0
!
interface FastEthernet0/0
 ip address 10.1.35.3 255.255.255.0
 ip ospf network point-to-point
 ip ospf 1 area 0
 mpls ip
!
interface FastEthernet0/1
 vrf forwarding CUST-A
 ip address 172.16.38.3 255.255.255.0
!
router ospf 1
 router-id 10.1.0.3
!
router bgp 100
 bgp router-id 10.1.0.3
 bgp log-neighbor-changes
 no bgp default ipv4-unicast
 neighbor 10.1.0.5 remote-as 100
 neighbor 10.1.0.5 update-source Loopback0
 !
 address-family ipv4
 exit-address-family
 !
 address-family vpnv4
  neighbor 10.1.0.5 activate
  neighbor 10.1.0.5 send-community extended
 exit-address-family
 !
 address-family ipv4 vrf CUST-A
  redistribute connected
  neighbor 172.16.38.8 remote-as 65001
  neighbor 172.16.38.8 activate
  neighbor 172.16.38.8 as-override
 exit-address-family
!

R4 - PE Router

hostname R4
!
vrf definition CUST-A
 rd 100:1
 !
 address-family ipv4
  route-target export 100:1
  route-target import 100:1
 exit-address-family
!
ip cef
!
interface Loopback0
 ip address 10.1.0.4 255.255.255.255
 ip ospf 1 area 0
!
interface FastEthernet0/0
 ip address 10.1.45.4 255.255.255.0
 ip ospf network point-to-point
 ip ospf 1 area 0
 mpls ip
!
interface FastEthernet0/1
 vrf forwarding CUST-A
 ip address 172.16.49.4 255.255.255.0
!
router ospf 1
 router-id 10.1.0.4
!
router bgp 100
 bgp router-id 10.1.0.4
 bgp log-neighbor-changes
 no bgp default ipv4-unicast
 neighbor 10.1.0.5 remote-as 100
 neighbor 10.1.0.5 update-source Loopback0
 !
 address-family ipv4
 exit-address-family
 !
 address-family vpnv4
  neighbor 10.1.0.5 activate
  neighbor 10.1.0.5 send-community extended
 exit-address-family
 !
 address-family ipv4 vrf CUST-A
  redistribute connected
  neighbor 172.16.49.9 remote-as 65001
  neighbor 172.16.49.9 activate
  neighbor 172.16.49.9 as-override
 exit-address-family
!

R5 - P Router

hostname R5
!
ip cef
!
interface Loopback0
 ip address 10.1.0.5 255.255.255.255
 ip ospf 1 area 0
!
interface FastEthernet0/0
 ip address 10.1.15.5 255.255.255.0
 ip ospf network point-to-point
 ip ospf 1 area 0
 mpls ip
!
interface FastEthernet0/1
 ip address 10.1.25.5 255.255.255.0
 ip ospf network point-to-point
 ip ospf 1 area 0
 mpls ip
!
interface FastEthernet1/0
 ip address 10.1.35.5 255.255.255.0
 ip ospf network point-to-point
 ip ospf 1 area 0
 mpls ip
!
interface FastEthernet1/1
 ip address 10.1.45.5 255.255.255.0
 ip ospf network point-to-point
 ip ospf 1 area 0
 mpls ip
!
router ospf 1
 router-id 10.1.0.5
!
router bgp 100
 bgp router-id 10.1.0.5
 bgp log-neighbor-changes
 no bgp default ipv4-unicast
 neighbor PE-ROUTERS peer-group
 neighbor PE-ROUTERS remote-as 100
 neighbor PE-ROUTERS update-source Loopback0
 neighbor 10.1.0.1 peer-group PE-ROUTERS
 neighbor 10.1.0.2 peer-group PE-ROUTERS
 neighbor 10.1.0.3 peer-group PE-ROUTERS
 neighbor 10.1.0.4 peer-group PE-ROUTERS
 !
 address-family ipv4
 exit-address-family
 !
 address-family vpnv4
  neighbor PE-ROUTERS send-community extended
  neighbor PE-ROUTERS route-reflector-client
  neighbor 10.1.0.1 activate
  neighbor 10.1.0.2 activate
  neighbor 10.1.0.3 activate
  neighbor 10.1.0.4 activate
 exit-address-family
!

Customer Sites Configuration

We need to generate RSA key before key server (KS) configurations. RSA keys must be generated on any KS. All KSs must share the same keys, so these keys must be generated with an “exportable” tag. The keys are then imported on the remaining KSs. These keys do not need to be imported on the GMs.

!! -- Generate RSA key on Primary Key Server Router R10 -- !!

R10-Primary-KS#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R10-Primary-KS(config)#crypto key generate rsa general-keys label getvpn-export-general modulus 1024 exportable        
The name for the keys will be: getvpn-export-general

% The key modulus size is 1024 bits
% Generating 1024 bit RSA keys, keys will be exportable...
[OK] (elapsed time was 1 seconds)

R10-Primary-KS(config)#

!! -- Export this key to the terminal -- !!

R10-Primary-KS(config)#crypto key export rsa getvpn-export-general pem terminal 3des myrsakeypasswd
% Key name: getvpn-export-general
   Usage: General Purpose Key
   Key data:
-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC0W2WX/cvI41mAJ+AbDgOMpRbi
l6FPtOIiw6SDYa3z4GixsYqem5pt7SLk/spxLeHFNsYaD7XqzRAj/hmDWpfrHOmE
IANfiCwfhnh4/Ep1a0+dBKCqK7C90qtQQswdDJfdX8Eunbp93E73caSws4Qkpwqs
iEigKWoAauIvFlDV6QIDAQAB
-----END PUBLIC KEY-----
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,DAAC1EB9DAA8FA6D

HqkzonxyuD6bXNJZD6+Zblyscwuvbfskhs9mLnYo1CflKMUxHv1XU/5Ctdvmirp2
AVzlWFgR/FFriVYofQoT1BbCtoCJXsT4nPbF07K/rsBsP7HXX0UEsh6zx/Tagv6Q
EBOjk15Tfx+yP3twIpK7jN3hp/81Yjybg+hDV2sfVElqpVShHr8HrAqpiQdtuQiC
MNUtC3/GJy95CO0Wpg/qAKknG4H/wEQqG4wXU0yZ8qUE71xlO7p9Z2GqGMjcRmwZ
ADsIKvGBwNQSg77VZ+Bq2zYLosThz63r1kn7oVxt2dU4wNSpu3CvcAlVhxf7TJoW
mKCr7H99Yk8upFH6Nh+HUG6+BhFZEkkDOjIU1CJeFFO1qEToQA1U4ue0OMt0IQnU
KMA+1IfNCIoH05L4+x2TRHu+uEk1tgu5smU+QmJYSwn6drj74poXsuRcJgNs4VWO
0B7phKvaoXXUdkXiyaOMgHacnnCHL8LEzmp6BzVUbDCbBtYomeaFCI6B7BaOvwDv
sr1Z85xgynXhm1vGWJNd45Lk7+SSVaOp6qp/IIAcFTbA1OfqtWayMMcDHRsc1m3O
iyn5fa4AUlx6smkhkBe7lh1FCQh+C1DrZdrKVWmo7iuDfAxdC6IW+XiUW1gwlnKd
taw4Fy+AALlhMc/pKHqx2WVX1s6SAWgxwhsjxbFIZXSDdRfhkLdl9QAd6G0zVsBq
U7J1rPwZ1dMtZTDfyj/KSl2DbPpv90vJYGHMcU+h49XfBNF2QsizIkx8mjegmX0O
+ep0LsrsqV5XnMeotYzCTPNmb6PoE/fN+YdhzjWJHmTOt6HAdhRsKw==
-----END RSA PRIVATE KEY-----

R10-Primary-KS(config)#

!! -- Import this key using cut-and-paste -- !!
!! -- to other Key Server (KS) Router R11 -- !!

R11-Backup-KS#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R11-Backup-KS(config)#crypto key import rsa getvpn-export-general pem exportable terminal myrsakeypasswd    
% Enter PEM-formatted public General Purpose key or certificate.
% End with a blank line or "quit" on a line by itself.
-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC0W2WX/cvI41mAJ+AbDgOMpRbi
l6FPtOIiw6SDYa3z4GixsYqem5pt7SLk/spxLeHFNsYaD7XqzRAj/hmDWpfrHOmE
IANfiCwfhnh4/Ep1a0+dBKCqK7C90qtQQswdDJfdX8Eunbp93E73caSws4Qkpwqs
iEigKWoAauIvFlDV6QIDAQAB
-----END PUBLIC KEY-----
quit
% Enter PEM-formatted encrypted private General Purpose key.
% End with "quit" on a line by itself.
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,DAAC1EB9DAA8FA6D

HqkzonxyuD6bXNJZD6+Zblyscwuvbfskhs9mLnYo1CflKMUxHv1XU/5Ctdvmirp2
AVzlWFgR/FFriVYofQoT1BbCtoCJXsT4nPbF07K/rsBsP7HXX0UEsh6zx/Tagv6Q
EBOjk15Tfx+yP3twIpK7jN3hp/81Yjybg+hDV2sfVElqpVShHr8HrAqpiQdtuQiC
MNUtC3/GJy95CO0Wpg/qAKknG4H/wEQqG4wXU0yZ8qUE71xlO7p9Z2GqGMjcRmwZ
ADsIKvGBwNQSg77VZ+Bq2zYLosThz63r1kn7oVxt2dU4wNSpu3CvcAlVhxf7TJoW
mKCr7H99Yk8upFH6Nh+HUG6+BhFZEkkDOjIU1CJeFFO1qEToQA1U4ue0OMt0IQnU
KMA+1IfNCIoH05L4+x2TRHu+uEk1tgu5smU+QmJYSwn6drj74poXsuRcJgNs4VWO
0B7phKvaoXXUdkXiyaOMgHacnnCHL8LEzmp6BzVUbDCbBtYomeaFCI6B7BaOvwDv
sr1Z85xgynXhm1vGWJNd45Lk7+SSVaOp6qp/IIAcFTbA1OfqtWayMMcDHRsc1m3O
iyn5fa4AUlx6smkhkBe7lh1FCQh+C1DrZdrKVWmo7iuDfAxdC6IW+XiUW1gwlnKd
taw4Fy+AALlhMc/pKHqx2WVX1s6SAWgxwhsjxbFIZXSDdRfhkLdl9QAd6G0zVsBq
U7J1rPwZ1dMtZTDfyj/KSl2DbPpv90vJYGHMcU+h49XfBNF2QsizIkx8mjegmX0O
+ep0LsrsqV5XnMeotYzCTPNmb6PoE/fN+YdhzjWJHmTOt6HAdhRsKw==
-----END RSA PRIVATE KEY-----
quit
% Key pair import succeeded.

R11-Backup-KS(config)#

Configuration

!! -- R10 Primary Key Server Router -- !!

hostname R10-Primary-KS
!
!! -- IKE Phase 1 Configuration -- !!
crypto isakmp policy 10
 encr aes 256
 authentication pre-share
 group 2
!! --Defined Pre-shared key for peers network range 172.16.0.0/16--!! 
crypto isakmp key $3cur3dG3tVpNK3Y address 172.16.0.0
crypto isakmp keepalive 10 periodic     
!
!! -- Transform Set Configuration -- !!
crypto ipsec transform-set GDOI-TRANS esp-aes 256 esp-sha256-hmac 
 mode transport
!
!! -- IPsec Profile Configuration -- !!
crypto ipsec profile GDOI-PROFILE
 set security-association lifetime seconds 7200
 set transform-set GDOI-TRANS 
!
!! -- GDOI Group Configuration -- !!
crypto gdoi group GETVPN-GROUP
 identity number 1234
 !! -- Local keyword identified this router as Key Server -- !!
 server local
  rekey retransmit 10 number 2
  !! -- RSA Key -- !!
  rekey authentication mypubkey rsa getvpn-export-general
  !! -- Rekeying through unicast transport -- !!
  rekey transport unicast
  sa ipsec 1
   !! -- Transform Set for Group Members -- !!
   profile GDOI-PROFILE
   !! -- Policies defining traffic to be encrypted -- !!
   match address ipv4 GETVPN-ACL
   replay time window-size 5
  address ipv4 172.16.16.10
  !! -- Enable Cooperative Key Server feature -- !!
  !! -- High Priority server decides the Primary Key Server Role -- !!
  !! -- All other Key Server(s) must be configured with as peers -- !!
  redundancy
   local priority 100
   peer address ipv4 172.16.27.11
!
interface FastEthernet0/0
 ip address 172.16.16.10 255.255.255.0
!
ip route 0.0.0.0 0.0.0.0 172.16.16.6
!
ip access-list extended GETVPN-ACL
 permit ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255
!

!! -- R11 Backup Key Server Router -- !!

hostname R11-Backup-KS
!
crypto isakmp policy 10
 encr aes 256
 authentication pre-share
 group 2
!
crypto isakmp key $3cur3dG3tVpNK3Y address 172.16.0.0  
crypto isakmp keepalive 10 periodic   
!
crypto ipsec transform-set GDOI-TRANS esp-aes 256 esp-sha256-hmac 
 mode transport
!
crypto ipsec profile GDOI-PROFILE
 set security-association lifetime seconds 7200
 set transform-set GDOI-TRANS 
!
crypto gdoi group GETVPN-GROUP
 identity number 1234
 server local
  rekey retransmit 10 number 2
  rekey authentication mypubkey rsa getvpn-export-general
  rekey transport unicast
  sa ipsec 1
   profile GDOI-PROFILE
   match address ipv4 GETVPN-ACL
   replay time window-size 5
  address ipv4 172.16.27.11
  redundancy
   local priority 75
   peer address ipv4 172.16.16.10
!
interface FastEthernet0/0
 ip address 172.16.27.11 255.255.255.0
!
ip route 0.0.0.0 0.0.0.0 172.16.27.7
!
ip access-list extended GETVPN-ACL
 permit ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255
!

!! -- R6 CE, GET VPN Group Member Router -- !!

hostname R6-CE-GM
!
!! -- IKE Phase 1 Configuration -- !!
crypto isakmp policy 10
 encr aes 256
 authentication pre-share
 group 2
!
!! -- Defined Pre-shared key for Key Server Routers -- !!
crypto isakmp key $3cur3dG3tVpNK3Y address 172.16.16.10   
crypto isakmp key $3cur3dG3tVpNK3Y address 172.16.27.11   
!
!! -- GDOI Group Configuration -- !!
crypto gdoi group GETVPN-GROUP
 identity number 1234
 server address ipv4 172.16.16.10
 server address ipv4 172.16.27.11
!
!! -- Crypto MAP Configuration -- !!
crypto map GETVPN-MAP 10 gdoi 
 set group GETVPN-GROUP
!
!! -- Associate Crypto MAP to the WAN Interfaces -- !!
interface FastEthernet0/0
 description To MPLS Provider
 ip address 172.16.16.6 255.255.255.0
 crypto map GETVPN-MAP
!
interface FastEthernet0/1
 description To LAN
 ip address 192.168.6.6 255.255.255.0
!
router bgp 65001
 bgp router-id 172.16.16.6
 bgp log-neighbor-changes
 network 192.168.0.6 mask 255.255.255.255
 network 192.168.6.0
 neighbor 172.16.16.1 remote-as 100
!

!! -- R7 CE, GET VPN Group Member Router -- !!

hostname R7-CE-GM
!
crypto isakmp policy 10
 encr aes 256
 authentication pre-share
 group 2
!
crypto isakmp key $3cur3dG3tVpNK3Y address 172.16.16.10   
crypto isakmp key $3cur3dG3tVpNK3Y address 172.16.27.11   
!
crypto gdoi group GETVPN-GROUP
 identity number 1234
 server address ipv4 172.16.16.10
 server address ipv4 172.16.27.11
!
crypto map GETVPN-MAP 10 gdoi 
 set group GETVPN-GROUP
!
interface FastEthernet0/0
 description To MPLS Provider
 ip address 172.16.27.7 255.255.255.0
 crypto map GETVPN-MAP
!
interface FastEthernet0/1
 description To LAN
 ip address 192.168.7.7 255.255.255.0
!
router bgp 65001
 bgp router-id 172.16.27.7
 bgp log-neighbor-changes
 network 192.168.0.7 mask 255.255.255.255
 network 192.168.7.0
 neighbor 172.16.27.2 remote-as 100
!

!! -- R8 CE, GET VPN Group Member Router -- !!

hostname R8-CE-GM
!
crypto isakmp policy 10
 encr aes 256
 authentication pre-share
 group 2
!
crypto isakmp key $3cur3dG3tVpNK3Y address 172.16.16.10   
crypto isakmp key $3cur3dG3tVpNK3Y address 172.16.27.11   
!
crypto gdoi group GETVPN-GROUP
 identity number 1234
 server address ipv4 172.16.16.10
 server address ipv4 172.16.27.11
!
crypto map GETVPN-MAP 10 gdoi 
 set group GETVPN-GROUP
!
interface FastEthernet0/0
 description To MPLS Provider
 ip address 172.16.38.8 255.255.255.0
 crypto map GETVPN-MAP
!
interface FastEthernet0/1
 description To LAN
 ip address 192.168.8.8 255.255.255.0
!
router bgp 65001
 bgp router-id 192.168.8.8
 bgp log-neighbor-changes
 network 192.168.8.0
 neighbor 172.16.38.3 remote-as 100
!

!! -- R9 CE, GET VPN Group Member Router -- !!

hostname R9-CE-GM
!
crypto isakmp policy 10
 encr aes 256
 authentication pre-share
 group 2
!
crypto isakmp key $3cur3dG3tVpNK3Y address 172.16.16.10   
crypto isakmp key $3cur3dG3tVpNK3Y address 172.16.27.11   
!
crypto gdoi group GETVPN-GROUP
 identity number 1234
 server address ipv4 172.16.16.10
 server address ipv4 172.16.27.11
!
crypto map GETVPN-MAP 10 gdoi 
 set group GETVPN-GROUP
!
interface FastEthernet0/0
 description To MPLS Provider
 ip address 172.16.49.9 255.255.255.0
 crypto map GETVPN-MAP
!
interface FastEthernet0/1
 description To LAN
 ip address 192.168.9.9 255.255.255.0
!
router bgp 65001
 bgp router-id 192.168.9.9
 bgp log-neighbor-changes
 network 192.168.9.0
 neighbor 172.16.49.4 remote-as 100
!

Verification and Testing

!! -- Routing on all Customer sites Routers -- !!

R6-CE-GM#show ip route | beg Gate
Gateway of last resort is not set

      172.16.0.0/16 is variably subnetted, 5 subnets, 2 masks
C        172.16.16.0/24 is directly connected, FastEthernet0/0
L        172.16.16.6/32 is directly connected, FastEthernet0/0
B        172.16.27.0/24 [20/0] via 172.16.16.1, 09:25:04
B        172.16.38.0/24 [20/0] via 172.16.16.1, 09:25:04
B        172.16.49.0/24 [20/0] via 172.16.16.1, 09:24:55
      192.168.6.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.6.0/24 is directly connected, FastEthernet0/1
L        192.168.6.6/32 is directly connected, FastEthernet0/1
B     192.168.7.0/24 [20/0] via 172.16.16.1, 09:25:04
B     192.168.8.0/24 [20/0] via 172.16.16.1, 09:25:04
B     192.168.9.0/24 [20/0] via 172.16.16.1, 09:23:48


R7-CE-GM#show ip route | beg Gate
Gateway of last resort is not set

      172.16.0.0/16 is variably subnetted, 5 subnets, 2 masks
B        172.16.16.0/24 [20/0] via 172.16.27.2, 09:25:25
C        172.16.27.0/24 is directly connected, FastEthernet0/0
L        172.16.27.7/32 is directly connected, FastEthernet0/0
B        172.16.38.0/24 [20/0] via 172.16.27.2, 09:25:25
B        172.16.49.0/24 [20/0] via 172.16.27.2, 09:25:16
B     192.168.6.0/24 [20/0] via 172.16.27.2, 09:25:25
      192.168.7.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.7.0/24 is directly connected, FastEthernet0/1
L        192.168.7.7/32 is directly connected, FastEthernet0/1
B     192.168.8.0/24 [20/0] via 172.16.27.2, 09:25:25
B     192.168.9.0/24 [20/0] via 172.16.27.2, 09:24:09

R8-CE-GM#show ip route | beg Gate
Gateway of last resort is not set

      172.16.0.0/16 is variably subnetted, 5 subnets, 2 masks
B        172.16.16.0/24 [20/0] via 172.16.38.3, 09:25:35
B        172.16.27.0/24 [20/0] via 172.16.38.3, 09:25:35
C        172.16.38.0/24 is directly connected, FastEthernet0/0
L        172.16.38.8/32 is directly connected, FastEthernet0/0
B        172.16.49.0/24 [20/0] via 172.16.38.3, 09:25:26
B     192.168.6.0/24 [20/0] via 172.16.38.3, 09:25:35
B     192.168.7.0/24 [20/0] via 172.16.38.3, 09:25:35
      192.168.8.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.8.0/24 is directly connected, FastEthernet0/1
L        192.168.8.8/32 is directly connected, FastEthernet0/1
B     192.168.9.0/24 [20/0] via 172.16.38.3, 09:24:19

R9-CE-GM#show ip route | beg Gate
Gateway of last resort is not set

      172.16.0.0/16 is variably subnetted, 5 subnets, 2 masks
B        172.16.16.0/24 [20/0] via 172.16.49.4, 09:24:31
B        172.16.27.0/24 [20/0] via 172.16.49.4, 09:24:31
B        172.16.38.0/24 [20/0] via 172.16.49.4, 09:24:31
C        172.16.49.0/24 is directly connected, FastEthernet0/0
L        172.16.49.9/32 is directly connected, FastEthernet0/0
B     192.168.6.0/24 [20/0] via 172.16.49.4, 09:24:31
B     192.168.7.0/24 [20/0] via 172.16.49.4, 09:24:31
B     192.168.8.0/24 [20/0] via 172.16.49.4, 09:24:31
      192.168.9.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.9.0/24 is directly connected, FastEthernet0/1
L        192.168.9.9/32 is directly connected, FastEthernet0/1

R10-Primary-KS#show ip route | beg Gate
Gateway of last resort is 172.16.16.6 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 172.16.16.6
      172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
C        172.16.16.0/24 is directly connected, FastEthernet0/0
L        172.16.16.10/32 is directly connected, FastEthernet0/0

R11-Backup-KS#show ip route | beg Gate
Gateway of last resort is 172.16.27.7 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 172.16.27.7
      172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
C        172.16.27.0/24 is directly connected, FastEthernet0/0
L        172.16.27.11/32 is directly connected, FastEthernet0/0


!! -- When only Primary Key Server is configured -- !!
!! -- KS would participate in the Election with Secondary role -- !! 

*Apr 19 15:21:13.519: %CRYPTO-6-GDOI_ON_OFF: GDOI is ON
*Apr 19 15:21:47.923: %GDOI-5-KS_REKEY_TRANS_2_UNI: Group GETVPN-GROUP transitioned to Unicast Rekey.
*Apr 19 15:22:55.623: %GDOI-5-COOP_KS_ADD: 172.16.27.11 added as COOP Key Server in group GETVPN-GROUP.
*Apr 19 15:23:35.671: %GDOI-5-COOP_KS_ELECTION: KS entering election mode in group GETVPN-GROUP (Previous Primary = NONE)

R10-Primary-KS#sh crypto gdoi ks coop 
Crypto Gdoi Group Name :GETVPN-GROUP 
        Group handle: 2147483650, Local Key Server handle: 2147483650

        Local Address: 172.16.16.10 
        Local Priority: 100      
        Local KS Role: Secondary , Local KS Status: Alive     
        Local KS version: 1.0.4 
        Secondary Timers: 
                Sec Primary Periodic Time: 30 
                Remaining Time: 2, Retries: 2
                Invalid ANN PST recvd: 0
                New GM Temporary Blocking Enforced?: No
                Antireplay Sequence Number: 3

        Peer Sessions:
        Session 1:
                Server handle: 2147483651
                Peer Address: 172.16.27.11
                Peer Version: 0.0.0 
                Peer Priority: Unknown 
                Peer KS Role: Secondary , Peer KS Status: Unknown   
                Antireplay Sequence Number: 0

                IKE status: In Progress
                Counters:
                    Ann msgs sent: 0
                    Ann msgs sent with reply request: 0
                    Ann msgs recv: 0 
                    Ann msgs recv with reply request: 0
                    Packet sent drops: 3 
                    Packet Recv drops: 0 
                    Total bytes sent: 0 
                    Total bytes recv: 0
                
!! -- It keep trying to reach peer KS but we have not confiugured--!! 
!! -- Backup KS (Peer KS) so when Primary KS do not receive response!! 
!! -- from any other KS, it will become Primary and declare -- !!
!! -- Peer KS as dead -- !!

*Apr 19 15:25:05.775: %GDOI-5-COOP_KS_TRANS_TO_PRI: KS 172.16.16.10 in group GETVPN-GROUP transitioned to Primary (Previous Primary = NONE)
*Apr 19 15:25:05.815: %GDOI-3-COOP_KS_UNREACH: Cooperative KS 172.16.27.11 Unreachable in group GETVPN-GROUP. IKE SA Status = Failed to establish.

R10-Primary-KS#sh crypto gdoi ks coop 
Crypto Gdoi Group Name :GETVPN-GROUP 
        Group handle: 2147483650, Local Key Server handle: 2147483650

        Local Address: 172.16.16.10 
        Local Priority: 100      
        Local KS Role: Primary   , Local KS Status: Alive     
        Local KS version: 1.0.4 
        Primary Timers: 
                Primary Refresh Policy Time: 20 
                Remaining Time: 18
                Antireplay Sequence Number: 5

        Peer Sessions:
        Session 1:
                Server handle: 2147483651
                Peer Address: 172.16.27.11
                Peer Version: 0.0.0 
                Peer Priority: Unknown 
                Peer KS Role: Secondary , Peer KS Status: Dead      
                Antireplay Sequence Number: 0

                IKE status: In Progress
                Counters:
                    Ann msgs sent: 0
                    Ann msgs sent with reply request: 0
                    Ann msgs recv: 0 
                    Ann msgs recv with reply request: 0
                    Packet sent drops: 5 
                    Packet Recv drops: 0 
                    Total bytes sent: 0 
                    Total bytes recv: 0

!! -- When we configure Backup Key Server, it will also participate-!!
!! -- in the Election with Secondary KS Role -- !!
!! -- When It knows Primary KS with higher priority is active -- !!
!! -- It remains in the Secondary Role -- !! 

R11-Backup-KS# 
*Apr 19 15:26:17.627: %CRYPTO-6-GDOI_ON_OFF: GDOI is ON
*Apr 19 15:27:24.143: %GDOI-5-COOP_KS_ADD: 172.16.16.10 added as COOP Key Server in group GETVPN-GROUP.
*Apr 19 15:27:24.183: %GDOI-5-COOP_KS_ELECTION: KS entering election mode in group GETVPN-GROUP (Previous Primary = NONE)
*Apr 19 15:27:29.527: %GDOI-4-GDOI_ANN_TIMESTAMP_LARGE: COOP_KS ANN received from KS 172.16.16.10 in group GETVPN-GROUP has PST bigger than myself. Adjust to new PST:
my_old_pst is 71 sec, peer_pst is 375 sec
*Apr 19 15:27:34.543: %GDOI-5-COOP_KS_TRANS_TO_PRI: KS 172.16.16.10 in group GETVPN-GROUP transitioned to Primary (Previous Primary = NONE)

R11-Backup-KS#sh crypto gdoi ks coop                 
Crypto Gdoi Group Name :GETVPN-GROUP 
        Group handle: 2147483650, Local Key Server handle: 2147483650

        Local Address: 172.16.27.11 
        Local Priority: 75       
        Local KS Role: Secondary , Local KS Status: Alive     
        Local KS version: 1.0.4 
        Secondary Timers: 
                Sec Primary Periodic Time: 30 
                Remaining Time: 27, Retries: 0
                Invalid ANN PST recvd: 0
                New GM Temporary Blocking Enforced?: No
                Antireplay Sequence Number: 1

        Peer Sessions:
        Session 1:
                Server handle: 2147483651
                Peer Address: 172.16.16.10
                Peer Version: 1.0.4 
                Peer Priority: 100             
                Peer KS Role: Primary   , Peer KS Status: Alive     
                Antireplay Sequence Number: 42

                IKE status: Established
                Counters:
                    Ann msgs sent: 0
                    Ann msgs sent with reply request: 1
                    Ann msgs recv: 29 
                    Ann msgs recv with reply request: 0
                    Packet sent drops: 0 
                    Packet Recv drops: 0 
                    Total bytes sent: 152 
                    Total bytes recv: 18415

!! -- Now IKE phase-1 is UP between Primary and Backup KS -- !!

R10-Primary-KS#sh cry isa sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
172.16.27.11    172.16.16.10    GDOI_IDLE         1001 ACTIVE

R11-Backup-KS#sh cry isa sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
172.16.27.11    172.16.16.10    GDOI_IDLE         1001 ACTIVE

!! -- Verify interesting traffic ACL added into GETVPN domain -- !!

R10-Primary-KS#sh crypto gdoi ks acl 
Group Name: GETVPN-GROUP
 Configured ACL:
   access-list GETVPN-ACL  permit ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255

!! -- Verify GDOI Policy on KS, which would be pushed to the -- !!
!! -- Group Members (GM) -- !!

R10-Primary-KS#sh crypto gdoi ks policy 
Key Server Policy:
For group GETVPN-GROUP (handle: 2147483650) server 172.16.16.10 (handle: 2147483650):

  # of teks : 2  Seq num : 1
  KEK POLICY (transport type : Unicast)
    spi : 0x25C92085E5951A54B8182918A13D10B4
    management alg     : disabled    encrypt alg       : 3DES      
    crypto iv length   : 8           key size          : 24      
    orig life(sec): 86400       remaining life(sec): 79722     
    sig hash algorithm : enabled     sig key length    : 162     
    sig size           : 128       
    sig key name       : getvpn-export-general

  TEK POLICY (encaps : ENCAPS_TRANSPORT)
    spi                : 0xF22F8F3B
    access-list        : GETVPN-ACL
    transform          : esp-256-aes esp-sha256-hmac 
    alg key size       : 32            sig key size          : 32        
    orig life(sec)     : 7200          remaining life(sec)   : 523       
    tek life(sec)      : 7200          elapsed time(sec)     : 6677      
    override life (sec): 0             antireplay window size: 5         

          
  TEK POLICY (encaps : ENCAPS_TRANSPORT)
    spi                : 0xBB9CF351
    access-list        : GETVPN-ACL
    transform          : esp-256-aes esp-sha256-hmac 
    alg key size       : 32            sig key size          : 32        
    orig life(sec)     : 7200          remaining life(sec)   : 6978      
    tek life(sec)      : 7200          elapsed time(sec)     : 222       
    override life (sec): 0             antireplay window size: 5         

  Replay Value 6909.39 secs 
For group GETVPN-GROUP (handle: 2147483650) server 172.16.27.11 (handle: 2147483651):

!! -- After configuration of Group Member (GM) Router R6 -- !!
!! -- It will register to all key servers (KS) in order -- !!
!! -- of KS configuration list on GM -- !!
!! -- But GM will have ISAKMP SA only with Primary KS -- !!
!! -- and Primary KS will push the GDOI policies to GM -- !!

R6-CE-GM(config-if)#
*Apr 19 15:41:54.175: %CRYPTO-5-GM_REGSTER: Start registration to KS 172.16.16.10 for group GETVPN-GROUP using address 172.16.16.6
*Apr 19 15:41:54.191: %CRYPTO-6-GDOI_ON_OFF: GDOI is ON
R6-CE-GM(config-if)#
*Apr 19 15:41:54.719: %GDOI-5-GM_REKEY_TRANS_2_UNI: Group GETVPN-GROUP transitioned to Unicast Rekey.
*Apr 19 15:41:54.723: %GDOI-5-SA_KEK_UPDATED: SA KEK was updated
*Apr 19 15:41:54.727: %GDOI-5-SA_TEK_UPDATED: SA TEK was updated
*Apr 19 15:41:54.863: %GDOI-5-GM_REGS_COMPL: Registration to KS 172.16.16.10 complete for group GETVPN-GROUP using address 172.16.16.6
*Apr 19 15:41:54.883: %GDOI-5-GM_INSTALL_POLICIES_SUCCESS: SUCCESS: Installation of Reg/Rekey policies from KS 172.16.16.10 for group GETVPN-GROUP & gm identity  172.16.16.6
R6-CE-GM(config-if)#end
R6-CE-GM#

R6-CE-GM#sh cry isa sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
172.16.16.10    172.16.16.6     GDOI_IDLE         1001 ACTIVE
172.16.16.6     172.16.16.10    GDOI_REKEY        1002 ACTIVE

!! -- Similarily configure Group Member Router R7 -- !!

R7-CE-GM(config-if)#
*Apr 19 15:46:30.231: %CRYPTO-5-GM_REGSTER: Start registration to KS 172.16.16.10 for group GETVPN-GROUP using address 172.16.27.7
*Apr 19 15:46:30.247: %CRYPTO-6-GDOI_ON_OFF: GDOI is ON
*Apr 19 15:46:31.643: %GDOI-5-GM_REKEY_TRANS_2_UNI: Group GETVPN-GROUP transitioned to Unicast Rekey.
*Apr 19 15:46:31.647: %GDOI-5-SA_KEK_UPDATED: SA KEK was updated
*Apr 19 15:46:31.651: %GDOI-5-SA_TEK_UPDATED: SA TEK was updated
*Apr 19 15:46:31.851: %GDOI-5-GM_REGS_COMPL: Registration to KS 172.16.16.10 complete for group GETVPN-GROUP using address 172.16.27.7
*Apr 19 15:46:31.871: %GDOI-5-GM_INSTALL_POLICIES_SUCCESS: SUCCESS: Installation of Reg/Rekey policies from KS 172.16.16.10 for group GETVPN-GROUP & gm identity  172.16.27.7

R7-CE-GM#
*Apr 19 15:46:33.451: %SYS-5-CONFIG_I: Configured from console by console
R7-CE-GM#sh cry isa sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
172.16.16.10    172.16.27.7     GDOI_IDLE         1001 ACTIVE
172.16.27.7     172.16.16.10    GDOI_REKEY        1002 ACTIVE

!! -- Configure Group Member Router R8 -- !!

R8-CE-GM(config-if)#
*Apr 19 16:11:57.187: %CRYPTO-5-GM_REGSTER: Start registration to KS 172.16.16.10 for group GETVPN-GROUP using address 172.16.38.8
R8-CE-GM(config-if)#end
R8-CE-GM#
*Apr 19 16:11:57.207: %CRYPTO-6-GDOI_ON_OFF: GDOI is ON
R8-CE-GM#
*Apr 19 16:11:58.739: %SYS-5-CONFIG_I: Configured from console by console
*Apr 19 16:11:58.795: %GDOI-5-GM_REKEY_TRANS_2_UNI: Group GETVPN-GROUP transitioned to Unicast Rekey.
*Apr 19 16:11:58.799: %GDOI-5-SA_KEK_UPDATED: SA KEK was updated
*Apr 19 16:11:58.803: %GDOI-5-SA_TEK_UPDATED: SA TEK was updated
*Apr 19 16:11:59.131: %GDOI-5-GM_REGS_COMPL: Registration to KS 172.16.16.10 complete for group GETVPN-GROUP using address 172.16.38.8
*Apr 19 16:11:59.151: %GDOI-5-GM_INSTALL_POLICIES_SUCCESS: SUCCESS: Installation of Reg/Rekey policies from KS 172.16.16.10 for group GETVPN-GROUP & gm identity  172.16.38.8
R8-CE-GM#sh cry isa sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
172.16.38.8     172.16.16.10    GDOI_REKEY        1002 ACTIVE
172.16.16.10    172.16.38.8     GDOI_IDLE         1001 ACTIVE

!! -- Configure Group Member Router R9 -- !!

R9-CE-GM(config-if)#
*Apr 19 16:13:31.651: %CRYPTO-5-GM_REGSTER: Start registration to KS 172.16.16.10 for group GETVPN-GROUP using address 172.16.49.9
R9-CE-GM(config-if)#
*Apr 19 16:13:31.667: %CRYPTO-6-GDOI_ON_OFF: GDOI is ON
R9-CE-GM(config-if)#
*Apr 19 16:13:33.055: %GDOI-5-GM_REKEY_TRANS_2_UNI: Group GETVPN-GROUP transitioned to Unicast Rekey.
*Apr 19 16:13:33.059: %GDOI-5-SA_KEK_UPDATED: SA KEK was updated
*Apr 19 16:13:33.063: %GDOI-5-SA_TEK_UPDATED: SA TEK was updated
*Apr 19 16:13:33.279: %GDOI-5-GM_REGS_COMPL: Registration to KS 172.16.16.10 complete for group GETVPN-GROUP using address 172.16.49.9
*Apr 19 16:13:33.295: %GDOI-5-GM_INSTALL_POLICIES_SUCCESS: SUCCESS: Installation of Reg/Rekey policies from KS 172.16.16.10 for group GETVPN-GROUP & gm identity  172.16.49.9
R9-CE-GM(config-if)#end
R9-CE-GM#
*Apr 19 16:13:35.263: %SYS-5-CONFIG_I: Configured from console by console
R9-CE-GM#sh cry isa sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
172.16.49.9     172.16.16.10    GDOI_REKEY        1002 ACTIVE
172.16.16.10    172.16.49.9     GDOI_IDLE         1001 ACTIVE

!! -- After configuration of all GM -- !!

R10-Primary-KS#sh cry isa sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
172.16.16.10    172.16.27.7     GDOI_IDLE         1003 ACTIVE
172.16.16.10    172.16.49.9     GDOI_IDLE         1005 ACTIVE
172.16.16.10    172.16.16.6     GDOI_IDLE         1002 ACTIVE
172.16.27.11    172.16.16.10    GDOI_IDLE         1001 ACTIVE
172.16.16.10    172.16.38.8     GDOI_IDLE         1004 ACTIVE

R11-Backup-KS#sh cry isa sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
172.16.27.11    172.16.16.10    GDOI_IDLE         1001 ACTIVE

!! -- Verify GDOI status on Group Member (GM) Routers -- !!

R6-CE-GM#show crypto gdoi 
GROUP INFORMATION

    Group Name               : GETVPN-GROUP
    Group Identity           : 1234
    Crypto Path              : ipv4
    Key Management Path      : ipv4
    Rekeys received          : 1
    IPSec SA Direction       : Both

     Group Server list       : 172.16.16.10
                               172.16.27.11
                               
    Group member             : 172.16.16.6      vrf: None
       Version               : 1.0.4 
       Registration status   : Registered
       Registered with       : 172.16.16.10
       Re-registers in       : 6947 sec
       Succeeded registration: 1
       Attempted registration: 1
       Last rekey from       : 172.16.16.10
       Last rekey seq num    : 1
       Unicast rekey received: 1
       Rekey ACKs sent       : 1
       Rekey Rcvd(hh:mm:ss)  : 00:00:31
       allowable rekey cipher: any
       allowable rekey hash  : any
       allowable transformtag: any ESP

    Rekeys cumulative
       Total received        : 1
       After latest register : 1
       Rekey Acks sents      : 1

 ACL Downloaded From KS 172.16.16.10:
   access-list   permit ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255

KEK POLICY:
    Rekey Transport Type     : Unicast
    Lifetime (secs)          : 79912
    Encrypt Algorithm        : 3DES
    Key Size                 : 192     
    Sig Hash Algorithm       : HMAC_AUTH_SHA
    Sig Key Length (bits)    : 1024    

TEK POLICY for the current KS-Policy ACEs Downloaded:
  FastEthernet0/0:
    IPsec SA:
        spi: 0xF22F8F3B(4063203131)
        transform: esp-256-aes esp-sha256-hmac 
        sa timing:remaining key lifetime (sec): (714)
        Anti-Replay(Time Based) : 5 sec interval

    IPsec SA:
        spi: 0xBB9CF351(3147625297)
        transform: esp-256-aes esp-sha256-hmac 
        sa timing:remaining key lifetime (sec): (7169)
        Anti-Replay(Time Based) : 5 sec interval

!! -- No traffic is exchanged between sites yet -- !!
!! -- encap/decap and encryp/decrypt packet count is zero -- !!

R8-CE-GM#sh cry ipsec sa

interface: FastEthernet0/0
    Crypto map tag: GETVPN-MAP, local addr 172.16.38.8

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (192.168.0.0/255.255.0.0/0/0)
   remote ident (addr/mask/prot/port): (192.168.0.0/255.255.0.0/0/0)
   current_peer 0.0.0.0 port 848
     PERMIT, flags={}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 172.16.38.8, remote crypto endpt.: 0.0.0.0
     path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0
     current outbound spi: 0xBB9CF351(3147625297)
     PFS (Y/N): N, DH group: none

     inbound esp sas:
      spi: 0xBB9CF351(3147625297)
        transform: esp-256-aes esp-sha256-hmac ,
        in use settings ={Transport, }
        conn id: 3, flow_id: SW:3, sibling_flags 80000000, crypto map: GETVPN-MAP
        sa timing: remaining key lifetime (sec): (6387)
        Kilobyte Volume Rekey has been disabled
        IV size: 16 bytes
        replay detection support: Y  replay window size: 5
        Status: ACTIVE(ACTIVE)

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0xBB9CF351(3147625297)
        transform: esp-256-aes esp-sha256-hmac ,
        in use settings ={Transport, }
        conn id: 4, flow_id: SW:4, sibling_flags 80000000, crypto map: GETVPN-MAP
        sa timing: remaining key lifetime (sec): (6387)
        Kilobyte Volume Rekey has been disabled
        IV size: 16 bytes
        replay detection support: Y  replay window size: 5
        Status: ACTIVE(ACTIVE)

     outbound ah sas:

     outbound pcp sas:

!! -- Send traffic between Site-3 and Site-4 LAN -- !!

R8-CE-GM#ping 192.168.9.9 so 192.168.8.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.9.9, timeout is 2 seconds:
Packet sent with a source address of 192.168.8.8 
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 184/202/228 ms
R8-CE-GM#sh cry ipsec sa                

interface: FastEthernet0/0
    Crypto map tag: GETVPN-MAP, local addr 172.16.38.8

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (192.168.0.0/255.255.0.0/0/0)
   remote ident (addr/mask/prot/port): (192.168.0.0/255.255.0.0/0/0)
   current_peer 0.0.0.0 port 848
     PERMIT, flags={}
    #pkts encaps: 5, #pkts encrypt: 5, #pkts digest: 5
    #pkts decaps: 5, #pkts decrypt: 5, #pkts verify: 5
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 172.16.38.8, remote crypto endpt.: 0.0.0.0
     path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0
     current outbound spi: 0xBB9CF351(3147625297)
     PFS (Y/N): N, DH group: none

     inbound esp sas:
      spi: 0xBB9CF351(3147625297)
        transform: esp-256-aes esp-sha256-hmac ,
        in use settings ={Transport, }
        conn id: 3, flow_id: SW:3, sibling_flags 80000000, crypto map: GETVPN-MAP
        sa timing: remaining key lifetime (sec): (6373)
        Kilobyte Volume Rekey has been disabled
        IV size: 16 bytes
        replay detection support: Y  replay window size: 5
        Status: ACTIVE(ACTIVE)

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0xBB9CF351(3147625297)
        transform: esp-256-aes esp-sha256-hmac ,
        in use settings ={Transport, }
        conn id: 4, flow_id: SW:4, sibling_flags 80000000, crypto map: GETVPN-MAP
        sa timing: remaining key lifetime (sec): (6373)
        Kilobyte Volume Rekey has been disabled
        IV size: 16 bytes
        replay detection support: Y  replay window size: 5
        Status: ACTIVE(ACTIVE)

     outbound ah sas:

     outbound pcp sas:

!! -- Send traffic between Site-1 and Site-3 LAN -- !!

R8-CE-GM#ping 192.168.6.6 so 192.168.8.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.6.6, timeout is 2 seconds:
Packet sent with a source address of 192.168.8.8 
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 168/188/224 ms

!! -- Send traffic between Site-2 and Site-3 LAN -- !!

R8-CE-GM#ping 192.168.7.7 so 192.168.8.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.7.7, timeout is 2 seconds:
Packet sent with a source address of 192.168.8.8 
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 176/194/212 ms

!! -- Traffic between each site LAN is ecnrypted now -- !!
!! -- GM has downloaded the ACL from KS, which covers LAN subnets --!!
!! -- of all sites -- !!

R8-CE-GM#sh cry ipsec sa                

interface: FastEthernet0/0
    Crypto map tag: GETVPN-MAP, local addr 172.16.38.8

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (192.168.0.0/255.255.0.0/0/0)
   remote ident (addr/mask/prot/port): (192.168.0.0/255.255.0.0/0/0)
   current_peer 0.0.0.0 port 848
     PERMIT, flags={}
    #pkts encaps: 15, #pkts encrypt: 15, #pkts digest: 15
    #pkts decaps: 15, #pkts decrypt: 15, #pkts verify: 15
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 172.16.38.8, remote crypto endpt.: 0.0.0.0
     path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0
     current outbound spi: 0xBB9CF351(3147625297)
     PFS (Y/N): N, DH group: none

     inbound esp sas:
      spi: 0xBB9CF351(3147625297)
        transform: esp-256-aes esp-sha256-hmac ,
        in use settings ={Transport, }
        conn id: 3, flow_id: SW:3, sibling_flags 80000000, crypto map: GETVPN-MAP
        sa timing: remaining key lifetime (sec): (6341)
        Kilobyte Volume Rekey has been disabled
        IV size: 16 bytes
        replay detection support: Y  replay window size: 5
        Status: ACTIVE(ACTIVE)

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0xBB9CF351(3147625297)
        transform: esp-256-aes esp-sha256-hmac ,
        in use settings ={Transport, }
        conn id: 4, flow_id: SW:4, sibling_flags 80000000, crypto map: GETVPN-MAP
        sa timing: remaining key lifetime (sec): (6341)
        Kilobyte Volume Rekey has been disabled
        IV size: 16 bytes
        replay detection support: Y  replay window size: 5
        Status: ACTIVE(ACTIVE)

     outbound ah sas:

     outbound pcp sas:

Reference:

http://www.cisco.com/c/dam/en/us/products/collateral/security/group-encrypted-transport-vpn/GETVPN_DIG_version_1_0_External.pdf