IS-IS Autoconfiguration
Extracted elements (25)
On resource-constrained devices (e.g., home routers) where only a MAC address is available, the MAC is used as System ID and a pseudorandom number derived from an alternative seed (e.g., a program variable's memory address) is used as the Router-Fingerprint. This reduces uniqueness guarantees but is considered sufficient for small home network deployments.
Startup mode exists to minimize disruption: a router entering the network defers advertising IS neighbor and prefix reachability until it has fully synchronized its LSPDB, so any System ID collision that forces a restart has minimal impact because the router is not yet forwarding traffic.
The all-zeros area address makes accidental interoperation between autoconfigured and non-autoconfigured routers unlikely. The A flag check in the Router-Fingerprint TLV provides an additional layer of protection beyond the area address mismatch.
To minimize recurrence of dual System ID and Router-Fingerprint duplication after a restart, routers SHOULD include the LSP sequence number of the next LSP they will send as additional entropy when regenerating the Router-Fingerprint.
Using an IEEE 802 48-bit MAC address as the initial System ID is recommended because it provides a high probability of uniqueness. The document does not mandate a specific regeneration method for collisions, acknowledging implementation flexibility.
IS-IS autoconfiguration is scoped to single-area, level-1-only deployments in small networks (tens of devices). Multiple IS-IS instances, multi-area or level-2 routing, and interworking with other routing protocols are explicitly not supported.
After initial generation, the System ID SHOULD remain stable across events such as interface enable/disable, reboot, firmware update, or configuration changes. System ID change during collision resolution MUST be supported.
Autoconfiguration routers MAY advertise the Dynamic Name TLV (TLV 137). To help guarantee hostname uniqueness, the System ID SHOULD be appended as a suffix to the advertised hostname.
Extended IS reachability (TLV 22) and IP reachability (TLV 135) MUST be used. Routers in autoconfiguration mode MUST NOT use legacy TLVs 2, 128, or 130, and MUST ignore those TLVs on receipt.
IS-IS autoconfiguration instances MUST be configured as level-1 only. Interfaces MUST be autoconfigured to the type corresponding to their Layer 2 capability (e.g., Ethernet as broadcast, PPP as point-to-point).
It is RECOMMENDED that autoconfiguration routers use a high metric value (e.g., 100000) as the default in reachability TLVs so that manually configured adjacencies are preferred over autoconfigured ones.
It is RECOMMENDED that IS-IS routers supporting autoconfiguration offer an option to configure a single password for HMAC-MD5 authentication as specified in RFC 5304.
Routers operating in autoconfiguration mode MUST NOT form adjacencies with routers that are not operating in autoconfiguration mode. Presence of the Router-Fingerprint TLV with the A flag set is the indicator.
The Router-Fingerprint TLV MUST NOT be included in any LSP with a non-zero number; if received in such an LSP it MUST be ignored.
The Router-Fingerprint TLV with the A flag set MUST be included in LSP #0. If an LSP #0 is received without this TLV or with the A flag clear, it is flooded normally but the entire LSP set from that router MUST be ignored in the Decision Process.
When a DD-LSP is received and DD-count reaches or exceeds DD-max, the local system MUST generate a new System ID and Router-Fingerprint and restart the protocol.
Duplicate System ID detection with a neighbor occurs when an IIH carries a System ID identical to the local System ID but a different Router-Fingerprint. With a non-neighbor, duplication is detected when a received LSP #0 has the same System ID but a different Router-Fingerprint.
The IS-IS Network Entity Title (NET) for autoconfiguration consists of a 13-octet area address set to all 0s followed by a 6-octet System ID. The special all-zeros area address distinguishes autoconfigured routers from manually configured ones.
IANA assigned codepoint 15 in the 'IS-IS TLV Codepoints' registry for the Router-Fingerprint TLV, with usage permitted in IIH, LSP, and Purge PDUs, but not SNP PDUs.
For wired deployments, physical access control serves as an implicit authentication mechanism. For wireless deployments, authentication should be achieved at the lower wireless link layer, since IS-IS-level cryptographic authentication cannot be used in autoconfiguration mode.
In the absence of cryptographic authentication, an attacker can inject a PDU falsely indicating a duplicate System ID, triggering an automatic protocol restart via the duplicate-ID resolution procedures. Authentication is fundamentally incompatible with autoconfiguration because it requires manual configuration.
DD-LSP procedure for detecting dual System ID and Router-Fingerprint duplication: DD-state (boolean), DD-count (occurrence counter), DD-timer (recommended 60 seconds), and DD-max (recommended 3). When DD-count reaches DD-max within the timer window, the local router MUST generate a new System ID and Router-Fingerprint and restart the protocol; DD-state is reset and the timer cancelled.
Duplicate System ID resolution: if one router has the S flag set (startup) and the other does not, the startup-mode router MUST generate a new System ID and restart. If both or neither are in startup mode, the router with the numerically smaller Router-Fingerprint MUST generate a new System ID and restart. If fingerprints are identical and duplication is in hellos, both MUST restart.
Startup mode: a router starts with both S and A flags set, generates only LSP #0 with no IS/IP reachability TLVs, and remains in startup mode for at least 1 minute. It exits startup mode after the minimum time has elapsed and full LSP database synchronization is achieved with all UP neighbors, at which point it clears the S flag and MAY advertise reachability and generate non-zero LSPs.
Router-Fingerprint TLV (Type 15): 1-octet Type, 1-octet Length, 1-octet Flags field (S flag at bit 0, A flag at bit 1, remaining bits reserved and MUST be zero), followed by a variable-length Router-Fingerprint of 32 or more octets.