1
00:00:00,000 --> 00:00:03,297
[AUDIO LOGO]

2
00:00:03,297 --> 00:00:07,070

3
00:00:07,070 --> 00:00:12,650
So now let's talk about leaking
routes between IS-IS levels.

4
00:00:12,650 --> 00:00:15,770
We're going to take a look
at the automatic process.

5
00:00:15,770 --> 00:00:19,790
What does IS-IS do automatically
without us intervening,

6
00:00:19,790 --> 00:00:23,070
and we'll take a look
at what we can control.

7
00:00:23,070 --> 00:00:25,670
We can control a little bit
of that automatic process,

8
00:00:25,670 --> 00:00:28,910
as well as doing some
completely separate leaking

9
00:00:28,910 --> 00:00:31,380
that the automatic
process doesn't do at all.

10
00:00:31,380 --> 00:00:33,890
So we'll take a look at
leaking from level one

11
00:00:33,890 --> 00:00:37,260
to level two, level two
to level one, and so on.

12
00:00:37,260 --> 00:00:39,290
But let's go ahead
and jump in first

13
00:00:39,290 --> 00:00:42,170
and talk about what
happens automatically

14
00:00:42,170 --> 00:00:46,870
in IS-IS without us
having to do anything.

15
00:00:46,870 --> 00:00:52,230
So what IS-IS is going to do
automatically or by default

16
00:00:52,230 --> 00:00:58,320
is step one, is it's going
to leak routes from level one

17
00:00:58,320 --> 00:00:59,910
to level two.

18
00:00:59,910 --> 00:01:01,890
So again, this
happens automatically,

19
00:01:01,890 --> 00:01:03,750
we're going to take
all of the prefixes

20
00:01:03,750 --> 00:01:08,970
that we learn from level one
send them into level two.

21
00:01:08,970 --> 00:01:11,940
The second thing we
do is we're going

22
00:01:11,940 --> 00:01:15,330
to block routes going
the other direction.

23
00:01:15,330 --> 00:01:19,080
We don't take any of the
routes from level two

24
00:01:19,080 --> 00:01:21,450
and send them into level one.

25
00:01:21,450 --> 00:01:24,000
This is just simply not done.

26
00:01:24,000 --> 00:01:27,330
And number three, since we're
not sending those routes

27
00:01:27,330 --> 00:01:32,520
into level one, we're instead
going to inject a default route

28
00:01:32,520 --> 00:01:34,200
into level one.

29
00:01:34,200 --> 00:01:36,690
Otherwise, of course,
nobody in level one

30
00:01:36,690 --> 00:01:38,980
would be able to get
out of that area.

31
00:01:38,980 --> 00:01:42,900
So this is done to allow us
to forward the traffic when

32
00:01:42,900 --> 00:01:46,440
we're not sending all the
routes in the level one.

33
00:01:46,440 --> 00:01:48,840
Just to put this in a
little bit of perspective

34
00:01:48,840 --> 00:01:51,690
and compare it to
something in OSPF,

35
00:01:51,690 --> 00:01:56,430
this is a bit like an
OSPF totally stubby area

36
00:01:56,430 --> 00:01:58,290
or a total stub.

37
00:01:58,290 --> 00:02:01,740
We're not going to send any
routes from the other areas

38
00:02:01,740 --> 00:02:05,370
into this level one
adjacency, instead

39
00:02:05,370 --> 00:02:09,270
we just give it a default,
which is exactly how a totally

40
00:02:09,270 --> 00:02:11,230
stubby area works.

41
00:02:11,230 --> 00:02:14,910
Now, again, this is simply
the default behavior.

42
00:02:14,910 --> 00:02:20,830
We can modify this by manually
configuring route leaking.

43
00:02:20,830 --> 00:02:26,920
Now what we can control is this
behavior in both directions.

44
00:02:26,920 --> 00:02:28,310
What does that mean?

45
00:02:28,310 --> 00:02:32,990
Well, first overriding
rule two up at the top,

46
00:02:32,990 --> 00:02:39,010
we can actually leak some or
all of the routes from level two

47
00:02:39,010 --> 00:02:40,180
to level one.

48
00:02:40,180 --> 00:02:43,090
Which of course, the default
here as we mentioned above

49
00:02:43,090 --> 00:02:48,010
is we would get none of these,
but we can control this.

50
00:02:48,010 --> 00:02:52,850
We can also limit what's
happening in rule number one.

51
00:02:52,850 --> 00:02:56,260
So again, we say limit here
because this is happening

52
00:02:56,260 --> 00:02:58,600
by default. Again,
like rule number

53
00:02:58,600 --> 00:03:02,500
one says, we are leaking routes
from level one to level two.

54
00:03:02,500 --> 00:03:05,530
But here, we can
limit either some

55
00:03:05,530 --> 00:03:10,420
or all of those from level two.

56
00:03:10,420 --> 00:03:13,880
So we would not be sending
them into level two any longer.

57
00:03:13,880 --> 00:03:17,320
So these are the things that we
can control with route leaking.

58
00:03:17,320 --> 00:03:20,600
Of course, the best thing
is to see this happen.

59
00:03:20,600 --> 00:03:22,450
So let's take a
look at our topology

60
00:03:22,450 --> 00:03:24,760
discuss where we're going
to do this, and then

61
00:03:24,760 --> 00:03:30,140
jump into the command line
and do some route leaking.

62
00:03:30,140 --> 00:03:33,920
So first, we'll look at
filtering some routes coming

63
00:03:33,920 --> 00:03:35,390
into router five.

64
00:03:35,390 --> 00:03:39,690
Remember that router five is
only a level one adjacency.

65
00:03:39,690 --> 00:03:42,740
So this would represent
leaking routes from level two

66
00:03:42,740 --> 00:03:44,300
to level one.

67
00:03:44,300 --> 00:03:46,820
And then we'll also
do some filtering over

68
00:03:46,820 --> 00:03:50,270
here between router
eight and router seven,

69
00:03:50,270 --> 00:03:54,020
where we'll filter a route
going into level two.

70
00:03:54,020 --> 00:03:57,050
So we'll take a look at
both of these locations.

71
00:03:57,050 --> 00:03:59,480
Let's start off by looking
at the routing table

72
00:03:59,480 --> 00:04:04,170
as it currently
is on router five.

73
00:04:04,170 --> 00:04:06,840
So let's do a show IP
route here on router five.

74
00:04:06,840 --> 00:04:10,530
And as we can see, all
we're getting from IS-IS

75
00:04:10,530 --> 00:04:14,280
right now are the two loopbacks
for router two and router

76
00:04:14,280 --> 00:04:18,810
four, which are of course, level
one routes within this area.

77
00:04:18,810 --> 00:04:21,390
And of course, that
level one default

78
00:04:21,390 --> 00:04:24,840
that's being generated by both
router two and router four

79
00:04:24,840 --> 00:04:27,400
to this level one adjacency.

80
00:04:27,400 --> 00:04:30,720
So now let's take a look at
actually leaking a route.

81
00:04:30,720 --> 00:04:33,810
We'll do this on router
two, and what we'll do

82
00:04:33,810 --> 00:04:37,560
is we'll just leak router
seven's loopback in here

83
00:04:37,560 --> 00:04:38,490
to router five.

84
00:04:38,490 --> 00:04:41,040

85
00:04:41,040 --> 00:04:44,280
So the first thing we're
going to need is a prefix set.

86
00:04:44,280 --> 00:04:46,770
This is going to be the match
on what we want to leak,

87
00:04:46,770 --> 00:04:51,420
so we'll simply call
this leak routes.

88
00:04:51,420 --> 00:04:54,150
This will match on
router seven's loopback

89
00:04:54,150 --> 00:04:56,100
because that's what we
said we wanted to leak.

90
00:04:56,100 --> 00:04:57,780
This could, of
course, be anything

91
00:04:57,780 --> 00:05:01,410
you want to do leak
here, we'll end the set,

92
00:05:01,410 --> 00:05:03,870
then we'll write our policy.

93
00:05:03,870 --> 00:05:08,010
We'll simply call this
RP underscore ISIS leak.

94
00:05:08,010 --> 00:05:15,750
For our logic, we will say if
destination is in our prefix

95
00:05:15,750 --> 00:05:20,050
set, then we're done.

96
00:05:20,050 --> 00:05:22,680
So that's going to cause
it to leak whatever

97
00:05:22,680 --> 00:05:25,380
matches that prefix set.

98
00:05:25,380 --> 00:05:28,593
Then we'll say, else drop.

99
00:05:28,593 --> 00:05:30,760
Because we're going to want
to drop everything else.

100
00:05:30,760 --> 00:05:33,480
We don't want to leak
all the other prefixes.

101
00:05:33,480 --> 00:05:37,870
We'll end our statement,
we'll end our policy,

102
00:05:37,870 --> 00:05:40,770
then we go into
router IS-IS one,

103
00:05:40,770 --> 00:05:43,910
under the address family IPv4.

104
00:05:43,910 --> 00:05:47,120
And we'll say,
propagate level two--

105
00:05:47,120 --> 00:05:49,400
this is where the
router coming from--

106
00:05:49,400 --> 00:05:55,610
into level one but going
through the route policy

107
00:05:55,610 --> 00:05:58,602
RP underscore IS-IS leak.

108
00:05:58,602 --> 00:06:00,060
If we've done
everything correctly,

109
00:06:00,060 --> 00:06:04,580
we should be able to commit our
changes, and our configuration,

110
00:06:04,580 --> 00:06:07,910
and go check out and see if we
have our new route on router

111
00:06:07,910 --> 00:06:09,140
five.

112
00:06:09,140 --> 00:06:12,600
On router five will simply
repeat the last command.

113
00:06:12,600 --> 00:06:14,840
And we see that
just like that, we

114
00:06:14,840 --> 00:06:19,680
have an i a, which
is IS-IS inter-area,

115
00:06:19,680 --> 00:06:23,330
so we have an IS-IS
inter-area route

116
00:06:23,330 --> 00:06:31,470
to 10.7.7.7 router 7 loopback,
which was exactly our design.

117
00:06:31,470 --> 00:06:34,850
Now notice that prefix
is not multipathing

118
00:06:34,850 --> 00:06:39,110
sort of like our default is,
we only have the single path.

119
00:06:39,110 --> 00:06:43,250
And that's because we only
leaked it on router two.

120
00:06:43,250 --> 00:06:47,600
We could, if we wanted to
go leak this on router four,

121
00:06:47,600 --> 00:06:50,240
and then of course, we
would have multipathing.

122
00:06:50,240 --> 00:06:53,840
But this particular video is not
really about multipathing, it's

123
00:06:53,840 --> 00:06:55,100
more about the leaking.

124
00:06:55,100 --> 00:06:57,440
And now we see how
to do the leaking,

125
00:06:57,440 --> 00:06:58,830
and that's the important part.

126
00:06:58,830 --> 00:07:00,830
So we'll leave it
like this, and we'll

127
00:07:00,830 --> 00:07:03,260
jump over to routers
seven and eight

128
00:07:03,260 --> 00:07:06,770
and do some filtering over
there for prefixes going

129
00:07:06,770 --> 00:07:10,630
from level one into level two.

130
00:07:10,630 --> 00:07:12,700
So let's start here
on router seven,

131
00:07:12,700 --> 00:07:15,280
we'll just do a
show IP route ISIS

132
00:07:15,280 --> 00:07:19,570
and we see here that we
have router 8 loopback being

133
00:07:19,570 --> 00:07:21,790
learned here on router seven.

134
00:07:21,790 --> 00:07:25,760
We see that it's a /24
with a high metric.

135
00:07:25,760 --> 00:07:29,210
This is from stuff we
did in previous skills.

136
00:07:29,210 --> 00:07:31,870
However, it is here
and let's take a look

137
00:07:31,870 --> 00:07:33,590
at how we can filter it.

138
00:07:33,590 --> 00:07:35,800
So let's go over
to router eight.

139
00:07:35,800 --> 00:07:40,310
So the first thing we're going
to need is a prefix list.

140
00:07:40,310 --> 00:07:47,740
So we'll call this PL underscore
L1 filter and we're going to be

141
00:07:47,740 --> 00:07:54,520
denying this time the
10.8.8.0/24, then of course,

142
00:07:54,520 --> 00:07:57,870
we'll permit everything else,
so that will permit everything

143
00:07:57,870 --> 00:07:58,560
else.

144
00:07:58,560 --> 00:08:00,000
Then we'll write a route map.

145
00:08:00,000 --> 00:08:05,800
And let's call this our
M underscore L1 filter.

146
00:08:05,800 --> 00:08:09,210
And in this route map we
will match on the IP address

147
00:08:09,210 --> 00:08:15,750
based on the prefix list,
PL underscore L1 filter.

148
00:08:15,750 --> 00:08:18,120
Will go into our
routing process.

149
00:08:18,120 --> 00:08:22,480
Now here it's not propagate,
it's redistribute.

150
00:08:22,480 --> 00:08:27,690
So it's going to be
redistribute IS-IS for IP level

151
00:08:27,690 --> 00:08:33,704
one, in the level two, and
go through the route map RM

152
00:08:33,704 --> 00:08:37,650
underscore L1 filter.

153
00:08:37,650 --> 00:08:39,725
If we've configured
everything correctly,

154
00:08:39,725 --> 00:08:41,100
we should be able
to go back over

155
00:08:41,100 --> 00:08:44,265
to router seven and router eight
loopback should be missing.

156
00:08:44,265 --> 00:08:47,510

157
00:08:47,510 --> 00:08:53,190
So as we can see here, router
eight loopback is now gone.

158
00:08:53,190 --> 00:08:57,210
It's no longer being shown,
it's filtered out of IS-IS.

159
00:08:57,210 --> 00:08:59,740

160
00:08:59,740 --> 00:09:05,110
In this video, we took a
look at IS-IS route leaking.

161
00:09:05,110 --> 00:09:10,420
Now we started off by looking at
the default behavior of IS-IS.

162
00:09:10,420 --> 00:09:13,810
Remember that we take
all level one routes

163
00:09:13,810 --> 00:09:16,000
and send them into level two.

164
00:09:16,000 --> 00:09:20,290
But level two to level one,
everything gets blocked,

165
00:09:20,290 --> 00:09:23,080
and instead we
generate a default.

166
00:09:23,080 --> 00:09:27,460
Then we saw how we can
override that behavior really

167
00:09:27,460 --> 00:09:31,060
in both directions, either
by filtering the level one

168
00:09:31,060 --> 00:09:33,520
routes that are
sent into level two,

169
00:09:33,520 --> 00:09:38,560
or by allowing routes to
be leaked from level two

170
00:09:38,560 --> 00:09:42,700
into level one like we did on
the router two, router five

171
00:09:42,700 --> 00:09:43,480
side.

172
00:09:43,480 --> 00:09:47,230
And as you can see,
we can filter or allow

173
00:09:47,230 --> 00:09:52,480
whatever routes we want
through manual control of IS-IS

174
00:09:52,480 --> 00:09:53,710
leaking.

175
00:09:53,710 --> 00:09:55,930
I hope this has been
informative for you.

176
00:09:55,930 --> 00:09:59,160
And I'd like to thank
you for viewing.

177
00:09:59,160 --> 00:10:03,000