10.1 IS-IS Encapsulation and NET Identity

IS-IS Architecture & NET Addressing

Intermediate System to Intermediate System (IS-IS) is an open-standard, link-state Interior Gateway Protocol (IGP) originally developed by the International Organization for Standardization (ISO) in standard ISO/IEC 10589. Initially designed to route the Connectionless Network Protocol (CLNP) within the Open Systems Interconnection (OSI) protocol suite, IS-IS was subsequently extended in IETF RFC 1195 to route IP alongside CLNP. This variant—known as Integrated IS-IS or Dual IS-IS—is widely deployed across service provider backbones and large-scale enterprise data center fabrics due to its protocol independence, rapid convergence, and clean separation between network transport and routing control.

---

1. OSI Data Link Encapsulation & Protocol Independence

A defining architectural distinction of IS-IS is its encapsulation layer. While OSPF encapsulates directly within IPv4 packets using IP protocol number 89, and BGP relies on TCP port 179 at the transport layer, IS-IS operates directly at the OSI data link layer (Layer 2).

+---------------------------------------------------------------------------------------------------+
| PROTOCOL ENCAPSULATION STACK COMPARISON                                                           |
|                                                                                                   |
|   OSPFv2 / OSPFv3 Encapsulation:               IS-IS Encapsulation:                               |
|   +------------------------------------+       +------------------------------------+             |
|   | Layer 2: Ethernet Header           |       | Layer 2: Ethernet Header           |             |
|   +------------------------------------+       +------------------------------------+             |
|   | Layer 3: IP Header (Protocol 89)   |       | Layer 2 LLC Header (DSAP/SSAP 0xFE)|             |
|   +------------------------------------+       +------------------------------------+             |
|   | OSPF Protocol Data Units (PDUs)    |       | IS-IS NLPID (0x83)                 |             |
|   +------------------------------------+       +------------------------------------+             |
|                                                | IS-IS Protocol Data Units (PDUs)   |             |
|                                                +------------------------------------+             |
+---------------------------------------------------------------------------------------------------+

On Ethernet networks, IS-IS frames use standard IEEE 802.3 framing with an 802.2 Logical Link Control (LLC) header:

• Destination MAC Address: Dedicated Layer 2 multicast addresses (01:80:C2:00:00:14 for Level 1; 01:80:C2:00:00:15 for Level 2).
• DSAP / SSAP: Set to 0xFE (ISO Network Layer).
• Control Field: 0x03 (Unnumbered Information).
• Network Layer Protocol Identifier (NLPID): Set to 0x83, which uniquely designates IS-IS.

Operational Advantages of Direct Layer 2 Encapsulation

1. IP Protocol Independence: Because IS-IS does not require an operational IP address to form neighbor adjacencies or exchange routing updates, it can simultaneously transport IPv4 and IPv6 topologies over common link states using Type-Length-Value (TLV) extensions (such as TLV 128, 130, 232, and 236).
2. Security & Resiliency: Because IS-IS does not run over IP, its protocol packets cannot be injected through an ordinary routed IP session. Local attackers and shared CPU/link resource exhaustion remain possible.
3. Interface Subnet Independence: IS-IS routers on point-to-point links can form full adjacencies even if their IP interface addresses belong to different subnets or if interfaces are entirely unnumbered.

---

2. Network Entity Title (NET) & NSAP Addressing Breakdown

Even though Integrated IS-IS routes IP packets, the routing protocol itself requires OSI network addressing for internal node identification. In OSI networking, devices are identified by Network Service Access Point (NSAP) addresses. When an NSAP address identifies the router itself (the network entity) rather than a specific upper-layer service, it is designated as a Network Entity Title (NET).

An NSAP/NET address ranges between 8 and 20 octets (16 to 40 hexadecimal characters) and consists of three distinct functional components:

+---------------------------------------------------------------------------------------------------+
| NETWORK ENTITY TITLE (NET) ADDRESS STRUCTURE                                                      |
+-----------------------------------+---------------------------------------+-----------------------+
|        AREA ADDRESS (IDP + DSP)   |               SYSTEM ID               |      N-SELECTOR       |
|        (Variable: 1 to 13 octets) |          (Fixed: 6 octets / 48 bits)  |   (Fixed: 1 octet)    |
+-----------------+-----------------+---------------------------------------+-----------------------+
| AFI (1 octet)   | Area ID (var)   | Unique Router Identifier within Area  | Must be 00 for Router |
| Example: 49     | Example: 0001   | Example: 1921.6800.0001 (192.168.0.1) | Example: 00           |
+-----------------+-----------------+---------------------------------------+-----------------------+
| Resulting NET:  49.0001.1921.6800.0001.00                                                         |
+---------------------------------------------------------------------------------------------------+

1. Area Address (Initial Domain Part & High-Order DSP)

• Authority and Format Identifier (AFI): The first octet defines the formatting and authority governing the address. The value 49 denotes locally administered private addressing (analogous to RFC 1918 private IPv4 space) and is the universal standard in private enterprise deployments.
• Area ID: Specifies the logical area to which the router belongs. It can vary from 1 to 12 octets in standard ISO profiles, though enterprise designs typically use a 2-octet area identifier (such as 0001 or 0002).

2. System ID (Fixed 6 Octets / 48 Bits)

The System ID uniquely identifies the individual router within an area (and across the entire routing domain). To guarantee uniqueness and simplify administration, enterprise network engineers map a router's stable loopback IPv4 address into the 6-octet System ID format by padding each octet to three digits and regrouping into four-digit blocks:

$\text{Loopback IPv4: } 192.168.0.1 \longrightarrow 192.168.000.001 \longrightarrow 1921.6800.0001$ $\text{Loopback IPv4: } 10.255.1.100 \longrightarrow 010.255.001.100 \longrightarrow 0102.5500.1100$

Alternatively, an IEEE 802 MAC address (such as 0010.94ab.0001) can serve as the System ID.

3. N-Selector (SEL, Fixed 1 Octet)

The final octet represents the Network Selector. For host end systems, the SEL identifies an upper-layer protocol or service. For an Intermediate System (router), the N-selector must always be 00. A NET is formally defined as an NSAP address where $\text{SEL} = 00$.

---