EIGRP, RIP and IS-IS

0 of 38 nailed

Core15

What kind of routing protocol is EIGRP, and how is it different from RIP and OSPF?

Say this first

EIGRP is an advanced distance vector protocol. Like RIP, a router only knows what its neighbors tell it: each neighbor's distance to each prefix. Unlike RIP, it forms neighbor relationships with hellos, sends partial updates only when something changes, uses a composite metric built from bandwidth and delay, and runs DUAL so it can keep proven loop-free backup paths ready. Unlike OSPF, it never builds a full map of the network.

Go deeper

The facts to have ready

Runs directly over IP as protocol 88, not TCP or UDP.
Hellos and most updates go to multicast 224.0.0.10 (FF02::A for IPv6).
Cisco built it. It was published as an informational RFC, RFC 7868, in 2016, but in production you will almost only see it on Cisco gear.
Administrative distance: 90 internal, 170 external, 5 for a summary the router creates.
Updates are partial (only what changed) and bounded (only to the neighbors that need them). There is no periodic full-table refresh.
Default metric uses the slowest bandwidth and the total delay along the path.

Side by side

	RIP v2	EIGRP	OSPF
Type	Distance vector	Advanced distance vector	Link state
Metric	Hop count, max 15	Bandwidth and delay	Cost from bandwidth
Updates	Full table every 30 s	Partial, on change	LSAs on change, refresh every 30 min
Transport	UDP 520	IP protocol 88	IP protocol 89
Loop prevention	Split horizon, holddown, max hops	DUAL feasibility condition	Full topology plus SPF
AD on Cisco	120	90 and 170	110

What it means in practice

When the best path fails and a feasible successor exists, EIGRP switches with no messages to anyone, because the backup was proven loop-free in advance. OSPF must flood the change and rerun SPF. When no feasible successor exists, EIGRP has to ask its neighbors (queries), and that is where badly designed EIGRP networks get into trouble.

They will ask next

Why did people call EIGRP a hybrid protocol?
Cisco used to market it that way because it borrows link-state style behaviour: neighbor discovery with hellos and partial, triggered updates. The routing algorithm is still distance vector, since a router only sees its neighbors' distances. "Advanced distance vector" is the accurate answer.
Does anyone run EIGRP outside Cisco?
Rarely. RFC 7868 made the protocol documented, and FRRouting has an EIGRP daemon, but the other big vendors do not ship it. In a multivendor network you choose OSPF or IS-IS.

Traps

Calling EIGRP a link state protocol. It never sees the whole topology.
Saying it uses TCP or UDP. It is its own IP protocol, number 88.

How did you do?Book 3.4 Routing Own page

What packet types does EIGRP use, and which ones are sent reliably?

Say this first

Five main types: Hello, Update, Query, Reply and Acknowledgment. Update, Query and Reply are reliable: every neighbor must acknowledge each one. Hello and ACK are not acknowledged. Modern IOS adds SIA-Query and SIA-Reply, also reliable, which let a router check on a neighbor that is slow to answer a query.

Go deeper

What each one does

Packet	Purpose	Usually sent to	Reliable
Hello	Find neighbors and keep them alive	Multicast 224.0.0.10	No
Update	Send routes: full table to a new neighbor, changes after that	Unicast to a new neighbor, multicast for changes	Yes
Query	"I lost my path to X and have no backup, what is yours?"	Multicast, unicast on retransmit	Yes
Reply	Answer to a query, with the neighbor's distance or infinity	Unicast to the querier	Yes
Ack	Confirms a reliable packet	Unicast	No
SIA-Query and SIA-Reply	"Are you still working on my query?" and "Yes"	Unicast	Yes

How the reliable part works

EIGRP has its own Reliable Transport Protocol (RTP). Each reliable packet has a sequence number. An ACK is a hello with no data that carries the sequence number being acknowledged. If a neighbor does not acknowledge a multicast packet in time, the router resends it to that neighbor by unicast.

Where to see the counters

Cisco IOS

R1# show ip eigrp traffic

It shows hellos, updates, queries, replies, acks and SIA packets sent and received. A query count that climbs every few minutes is a sign that something keeps flapping.

They will ask next

What happens if a neighbor never acknowledges an update?
The router keeps retransmitting by unicast. After 16 retries it gives up and resets the neighbor, logging is down: retry limit exceeded. That usually points to a one-way link, an ACL or a congested path.
Why are hellos unreliable but queries reliable?
Losing one hello costs nothing: the next one arrives five seconds later and the hold time covers the gap. Losing a query or reply would leave DUAL waiting forever or working with stale data, so those must be confirmed.

Traps

Saying a Query is unreliable or broadcast. It is reliable and normally multicast.
Forgetting the ACK is really a hello with no data.

How did you do?Book 3.4 Routing Own page

What has to match for two EIGRP routers to become neighbors?

Say this first

The same autonomous system number, the same K values, primary addresses in the same subnet on the shared link, matching authentication if it is configured, and the interface must not be passive on either side. Hello and hold timers do not have to match, and neither does MTU, which surprises people who come from OSPF.

Go deeper

The checklist and how each failure looks

Mismatch	What you see
AS number	Nothing at all. Hellos from another AS are ignored silently.
K values	Log message `is down: K-value mismatch`, repeating
Subnet	Log message saying the neighbor is not on a common subnet
Authentication	No neighbor; `debug eigrp packets` shows the packets being ignored for authentication
Passive interface	No hellos sent on that side, so no neighbor and no log
ACL or firewall	Silent. Protocol 88 or 224.0.0.10 is being dropped.

The commands I run

Cisco IOS

R1# show ip eigrp neighbors
R1# show ip eigrp interfaces
R1# show ip protocols

show ip eigrp interfaces tells me EIGRP is really running on the link (passive interfaces are not listed there). show ip protocols shows the AS and the K values.

What does not need to match

Hello and hold timers. Each router puts its own hold time in its hellos and the neighbor uses it.
MTU. EIGRP does not check it when forming the neighbor.
Router ID, as long as it is not duplicated (duplicates break external routes).

They will ask next

Can EIGRP form a neighbor over a secondary address?
No. Hellos are sourced from the primary address, and the neighbor's primary address must fall in your primary subnet. Secondary subnets are advertised, but never used to form neighbors.
Timers do not need to match, so can they ever cause a problem?
Yes, when one router's own settings are inconsistent. If R2 sends hellos every 20 seconds but advertises a hold time of 15, R1 times it out between hellos and the neighbor flaps. When I change hello-interval, I change hold-time too, because the hold time does not follow automatically.

Traps

Saying hello and hold timers must match. That is OSPF.
Expecting a log message for an AS mismatch. There is none, which is why it wastes so much time.

How did you do?Book 3.4 Routing Own page

What are the default EIGRP hello and hold timers, and how does the hold time really work?
Say this first
Hello every 5 seconds and hold time 15 seconds on LAN and point-to-point links. On multipoint NBMA interfaces at T1 speed or slower, hello every 60 seconds and hold time 180 seconds. The hold time is carried in my hellos: it tells my neighbor how long to wait for me. Changing the hello interval does not change the hold time, so I always change both.
Go deeper
Reading it live
Output
R1# show ip eigrp neighbors EIGRP-IPv4 Neighbors for AS(100) H Address Interface Hold Uptime SRTT RTO Q Seq (sec) (ms) Cnt Num 0 10.0.12.2 Gi0/0/0 13 01:02:33 1 100 0 27
The Hold column counts down from 15 and jumps back up each time a hello arrives, so values from about 10 to 14 are normal. If it keeps falling toward 0, hellos are being lost.

Changing them
Classic mode, per interface:

Cisco IOS
interface GigabitEthernet0/0/0 ip hello-interval eigrp 100 2 ip hold-time eigrp 100 6
Named mode, under the af-interface:

Cisco IOS
router eigrp CAMPUS address-family ipv4 unicast autonomous-system 100 af-interface GigabitEthernet0/0/0 hello-interval 2 hold-time 6
For fast failure detection I prefer BFD over aggressive hellos: bfd all-interfaces under classic router eigrp, or bfd under the af-interface in named mode. BFD detects a dead path in well under a second without loading the EIGRP process.
They will ask next
Do the hold times have to match between neighbors?
No. R1 might wait 15 seconds for R2 while R2 waits 30 seconds for R1. Each side uses the value the other side advertised.

What happens to routes when the hold time expires?
The neighbor is declared down and every route learned from it is removed. Where a feasible successor exists the router switches at once; otherwise it goes active and queries for those prefixes.
Traps
Changing only the hello interval and assuming the hold time scales with it like OSPF's dead interval.
How did you do?Book 3.4 Routing Own page
What administrative distances does EIGRP use, and why is external higher than internal?
Say this first
90 for internal routes, 170 for external routes that were redistributed into EIGRP, and 5 for a summary the router creates itself, which points to Null0. External is high so that a prefix learned natively from another protocol, such as OSPF at 110 or RIP at 120, beats the same prefix coming back in through EIGRP after redistribution. That stops a common redistribution loop.
Go deeper
How they look in the routing table
Output
D 10.50.0.0/24 [90/3328] via 10.0.12.2, 00:14:02, GigabitEthernet0/0/0 D EX 172.16.0.0/16 [170/5376] via 10.0.12.2, 00:14:02, GigabitEthernet0/0/0 D 10.20.0.0/22 is a summary, 00:14:02, Null0
D is EIGRP internal, D EX is EIGRP external. The summary line exists only on the router that configured the summary.

Why the external value matters
Take two routers that both redistribute OSPF into EIGRP. R1 learns 172.16.0.0/16 from OSPF at 110 and redistributes it. R2 learns the same prefix through OSPF and also as an EIGRP external from R1. Because 110 beats 170, R2 keeps the OSPF route and does not loop traffic back through R1. If externals had AD 90, R2 would prefer the redistributed copy and you would build a loop.

Changing them
Cisco IOS
router eigrp 100 distance eigrp 90 170
The first number is internal, the second external. I leave them alone unless I am fixing a specific redistribution problem.
They will ask next
What is special about an external route besides the AD?
It carries the router ID of the router that redistributed it, the source protocol, and a route tag. A router drops any external route that carries its own router ID, which is the loop check. The tag is what I match in route maps to stop routes being redistributed back.

Inside EIGRP, would an internal route lose to an external route with a lower metric?
No. The two have different AD, and the routing table compares AD first, so the internal route at 90 wins regardless of metric.
Traps
Forgetting the summary AD of 5. It is why a summary's Null0 route beats almost everything on the router that made it.
How did you do?Book 3.4 Routing Own page
What are a successor and a feasible successor in EIGRP?
Say this first
The successor is the neighbor on the best loop-free path to a prefix; that path goes into the routing table. A feasible successor is a backup neighbor that DUAL has proven loop-free, because its reported distance is lower than my feasible distance. When the successor fails, the feasible successor is promoted immediately, with no queries and no waiting.
Go deeper
Where to see them
R1 has three neighbors toward 10.50.0.0/24: R2 on Gi0/0/0, R3 on Gi0/0/1 and R4 on Gi0/0/2.

Output
R1# show ip eigrp topology EIGRP-IPv4 Topology Table for AS(100)/ID(10.255.0.1) Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply, r - reply Status, s - sia Status P 10.50.0.0/24, 1 successors, FD is 3328 via 10.0.12.2 (3328/3072), GigabitEthernet0/0/0 via 10.0.13.3 (26368/3072), GigabitEthernet0/0/1

The first via line is the successor (R2). Its total metric, 3328, is the FD.

The second line is a feasible successor (R3): its reported distance 3072 is less than 3328.

R4 is missing. Its path fails the feasibility condition, and the plain command only lists successors and feasible successors. show ip eigrp topology all-links shows it.

Why it matters
A feasible successor gives sub-second failover with no network-wide conversation. No feasible successor means the route goes active and the router queries its neighbors, which is slower and is the root of stuck-in-active problems.
They will ask next
Can there be more than one successor?
Yes. Paths with exactly the same best metric are all successors and all go into the routing table, up to maximum-paths, which defaults to 4.

Is the feasible successor in the routing table?
Not by default. It sits in the topology table ready to be promoted. It only goes into the routing table if you configure variance high enough to include it.
Traps
Calling the feasible successor "the second best path". It is a path that passed the feasibility condition, which is not always the next best by metric.
How did you do?Book 3.4 Routing Own page
What is the difference between reported distance and feasible distance?
Say this first
Reported distance, also called advertised distance, is the neighbor's own metric to the destination: the number it tells me. Feasible distance is my best total metric to the destination, which is a neighbor's reported distance plus my cost to reach that neighbor, for the best path. In show ip eigrp topology each line shows (my metric through that neighbor/that neighbor's RD).
Go deeper
Reading the numbers
Output
P 10.50.0.0/24, 1 successors, FD is 3328 via 10.0.12.2 (3328/3072), GigabitEthernet0/0/0 via 10.0.13.3 (26368/3072), GigabitEthernet0/0/1

Through R2: R2 reports 3072, R1 adds its own gigabit link and arrives at 3328.

Through R3: R3 also reports 3072, but R1's link to R3 is a 100 Mbps circuit, so R1's total is 26368.

The FD is the best total: 3328.

The precise definition
Strictly, the feasible distance is the lowest metric the router has had to that destination since the route last went from active to passive. In a stable network that is simply the successor's metric. The difference only matters while metrics are changing, and it is what keeps the feasibility check safe during those changes.

Why EIGRP needs both
The reported distance is how DUAL decides whether a neighbor is a safe backup. If the neighbor's own distance is lower than my best distance, the neighbor is closer to the destination than I am, so its path cannot run through me.
They will ask next
Where does the reported distance come from on the wire?
From the neighbor's update. It sends its vector metric (minimum bandwidth, total delay, and the other fields). I compute its RD from that vector, then add my own interface delay and take the lower of the two bandwidths to get my total through that neighbor.
Traps
Swapping the two numbers inside the brackets. The first is my total, the second is what the neighbor reported.
How did you do?Book 3.4 Routing Own page
What does auto-summary do in EIGRP, and is it on by default?
Say this first
Auto-summary summarizes to the classful network boundary when a route is sent out an interface in a different major network, for example 10.20.1.0/24 sent as 10.0.0.0/8 across a 172.16.0.0 link. It breaks discontiguous networks. It was on by default in older IOS; from IOS 15.0(1)M and in IOS-XE it is off. In classic mode I still write no auto-summary so the intent is visible.
Go deeper
The discontiguous problem
Site A has 10.1.0.0/16 and site B has 10.2.0.0/16, joined through a core addressed from 172.16.0.0/16. With auto-summary, both edge routers advertise 10.0.0.0/8 into the core. The core sees two equal routes to 10.0.0.0/8 and sends half the traffic for site A to site B, where it is dropped.

Turning it off
Cisco IOS
router eigrp 100 no auto-summary
In named mode it lives under topology base and is off by default.

The same issue in RIP
RIPv2 has auto-summary too and has historically had it on by default, so I configure no auto-summary there as well. RIPv1 is classful and always summarizes, which is one reason it is obsolete.
They will ask next
How do you spot auto-summary in a routing table?
A classful route such as 10.0.0.0/8 pointing to Null0 on the summarizing router, and the same classful prefix arriving from two directions on the routers in the middle.
Traps
Assuming the default is the same on every IOS version. Check the running config and be explicit.
How did you do?Book 3.3 Internet (IP)Book 3.4 Routing Own page

What does the network command do in EIGRP, and what does passive-interface change?

Say this first

The network statement with a wildcard mask selects interfaces. Any interface whose primary address falls in the range runs EIGRP: it sends hellos and its subnet is advertised. It does not inject a route the way a BGP network statement does. passive-interface keeps the subnet advertised but stops hellos, so no neighbor can form there. Use it on user and server LANs.

Go deeper

Precise network statements

Cisco IOS

router eigrp 100
 network 10.0.12.0 0.0.0.255
 network 10.1.0.0 0.0.0.255
 passive-interface default
 no passive-interface GigabitEthernet0/0/0

passive-interface default plus explicit exceptions is the safe pattern: a new LAN interface comes up passive, so nobody can plug in a router and start exchanging routes.

Checking it

Output

R1# show ip eigrp interfaces
EIGRP-IPv4 Interfaces for AS(100)
                              Xmit Queue   PeerQ        Mean   Pacing Time   Multicast    Pending
Interface              Peers  Un/Reliable  Un/Reliable  SRTT   Un/Reliable   Flow Timer   Routes
Gi0/0/0                  1        0/0       0/0           1       0/0           50           0

Passive interfaces do not appear here, but their subnets are still in the topology table and show ip protocols lists them as passive.

Passive is not the same in every protocol

Protocol	Passive interface
EIGRP	No hellos sent or processed, no neighbors, subnet still advertised
OSPF	Same idea: no hellos, subnet still advertised
RIP	Stops sending updates, but still listens to received updates

They will ask next

What does network 10.0.0.0 with no wildcard do?
It is taken as the classful network, so every interface in 10.0.0.0/8 runs EIGRP. That is easy to type and easy to regret, because it enables EIGRP on interfaces you did not intend.

Traps

Thinking the network command decides which prefixes are advertised regardless of interfaces. It matches interfaces only.

How did you do?Book 3.4 Routing Own page

How does RIP version 2 work, and how is it different from RIPv1?

Say this first

RIP is a distance vector protocol whose metric is hop count: 15 is the maximum and 16 means unreachable. Every 30 seconds each router sends its whole routing table to its neighbors. RIPv2 sends to multicast 224.0.0.9 on UDP port 520, carries the subnet mask so it supports VLSM and CIDR, supports authentication, and carries a route tag and a next hop field. RIPv1 broadcasts, is classful because it sends no mask, and has no authentication. Cisco gives RIP an AD of 120.

Go deeper

Configuration on IOS

Cisco IOS

router rip
 version 2
 no auto-summary
 network 10.0.0.0
 passive-interface GigabitEthernet0/0/2

The RIP network command is classful: network 10.0.0.0 enables RIP on every interface in 10.0.0.0/8. Without version 2, IOS sends version 1 and accepts both, which is a common surprise.

RIPv1 against RIPv2

	RIPv1	RIPv2
Standard	RFC 1058	RFC 2453
Updates sent to	Broadcast 255.255.255.255	Multicast 224.0.0.9
Subnet mask	Not carried, classful	Carried, classless
Authentication	None	Plain text or MD5
Route tag, next hop	No	Yes

Both use UDP 520, both send up to 25 routes per update message, both have the 15 hop limit.

RIPng

RIP for IPv6 (RFC 2080) uses UDP 521 and multicast FF02::9, and is enabled per interface with ipv6 rip NAME enable.

They will ask next

What does a RIP route look like in the routing table?
Output
```
R        10.4.0.0/24 [120/2] via 10.0.12.2, 00:00:17, GigabitEthernet0/0/0
```
AD 120, two hops, and the timer shows the seconds since the last update refreshed it. It should never climb much past 30.

Traps

Saying RIPv2 broadcasts. It uses multicast 224.0.0.9.
Saying a metric of 16 is the maximum usable value. 16 is unreachable; 15 is the last usable hop count.

How did you do?Book 3.4 Routing Own page

What are the RIP timers, and what does each one do?
Say this first
Cisco defaults are update 30 seconds, invalid 180, holddown 180 and flush 240. Update is how often the full table is sent. If no update refreshes a route for 180 seconds it becomes invalid: it is marked unreachable but kept and advertised as poisoned. Holddown makes the router ignore worse information about a failed route for a while, so old news cannot bring it back. Flush removes the route 240 seconds after the last update.
Go deeper
Seeing them
Output
R1# show ip protocols | include seconds|Invalid Sending updates every 30 seconds, next due in 12 seconds Invalid after 180 seconds, hold down 180, flushed after 240
Change them all at once (and on every router) with:

Cisco IOS
router rip timers basic 30 180 180 240
A failure, minute by minute

R2 stops hearing about 10.4.0.0/24 from R4 because the link failed silently (no interface down).

At 180 seconds after the last update, R2 marks the route invalid, metric 16, and starts holddown.

R2 advertises the route as 16 to its neighbors so they poison it too.

At 240 seconds after the last update, R2 flushes it.

If the interface itself goes down, R2 does not wait: it poisons the route at once and sends a triggered update. The timers matter when failures are silent.

Why it is slow
A silent failure takes three minutes before anyone reacts. That is the main reason RIP is out of place anywhere convergence matters.
They will ask next
Why does IOS not send updates exactly every 30 seconds?
It adds a small random offset each time. If every router sent at the same moment, updates would synchronize and cause bursts of CPU and link load across the network.
Traps
Mixing up invalid and flush. Invalid marks the route unreachable; flush deletes it.
How did you do?Book 3.4 Routing Own page
Why is RIP rarely used in production networks today?
Say this first
The 15 hop limit caps the network size. A silent failure takes minutes to converge. Hop count ignores bandwidth, so a one hop path over a slow WAN beats a two hop path over 10 Gbps links. Sending the whole table every 30 seconds wastes bandwidth and CPU at scale. It has no hierarchy, so you cannot contain changes. It still shows up on small sites, some CPE and appliances, and as a simple way to exchange a few routes with a legacy device.
Go deeper
Hop count in a real path choice
Branch R1 has two ways to the data center:

One hop over a 10 Mbps backup circuit.

Two hops over a 1 Gbps fiber pair. RIP picks the 10 Mbps circuit because 1 hop is less than 2. Fixing that needs an offset list to add hops to the backup path, which is manual metric tuning that EIGRP and OSPF do for you.

What replaced it
Need Choice
Enterprise, multivendor OSPF
Enterprise, all Cisco EIGRP or OSPF
Service provider core IS-IS or OSPF
Between organizations BGP
They will ask next
Where would you still accept RIP?
A small site with a few routers and one path, or one link to a device that speaks nothing else. I would keep RIP on that single link and redistribute into the main IGP at one router with a filter.
Traps
Saying RIP cannot do VLSM. RIPv1 cannot; RIPv2 carries masks.
How did you do?Book 3.4 Routing Own page

Need	Choice
Enterprise, multivendor	OSPF
Enterprise, all Cisco	EIGRP or OSPF
Service provider core	IS-IS or OSPF
Between organizations	BGP

Explain split horizon, route poisoning, poison reverse and holddown. What problem do they solve?

Say this first

They stop distance vector routing loops and count to infinity. Split horizon: never advertise a route back out the interface you learned it on. Route poisoning: when a route fails, advertise it at once with an infinite metric (16 in RIP) instead of just going quiet. Poison reverse: advertise routes back toward the neighbor you learned them from, but with metric 16, as an explicit "do not use me". Holddown: after a route fails, ignore worse news about it for a while. Triggered updates send changes right away instead of waiting for the next 30 second cycle.

Go deeper

Count to infinity

Chain R1 to R2 to R3, with 10.30.0.0/24 behind R3. R2 has it at 1 hop via R3, and R1 at 2 hops via R2. The R2 to R3 link fails.

R2 loses its route. Without split horizon, R1 still advertises "10.30.0.0/24, 2 hops" to R2.
R2 believes it and installs 3 hops via R1.
R2 advertises 3 hops to R1. R1 uses R2 as its next hop, so it updates to 4 hops.
They ping-pong upward until the metric hits 16. Until then, packets loop between R1 and R2.

What each tool does in that story

Mechanism	Effect
Split horizon	R1 never tells R2 about the route it learned from R2. The two node loop never starts.
Route poisoning	R2 sends 10.30.0.0/24 with metric 16 straight away, so R1 drops it quickly.
Poison reverse	R1 already advertises the route to R2 as 16, so R2 can never mistake it for a path.
Holddown	R2 ignores any non-better news about the route for 180 s, which protects against stale updates in larger loops.
Triggered updates	The poison goes out immediately, not at the next 30 s tick.

The limits

Split horizon only stops loops between two neighbors. In a ring of three or more routers, a loop can still form through the other side, which is why RIP also needs holddown and the 15 hop ceiling.

They will ask next

How does EIGRP avoid count to infinity without relying on these?
DUAL only uses a backup if the feasibility condition proves it loop-free. Anything else requires a query and replies from every neighbor before a new path is chosen, so it never counts upward.
Is split horizon on by default in Cisco IOS?
Yes, on normal interfaces. You turn it off only for a hub's multipoint interface, where all spokes sit behind one interface.

Traps

Mixing up route poisoning and poison reverse. Poisoning advertises a failed route as infinite; poison reverse advertises working routes back to their source as infinite.

How did you do?Book 3.4 Routing Own page

Explain IS-IS levels. What are L1, L2 and L1/L2 routers?
Say this first
IS-IS has two levels. Level 1 routers route inside their own area and reach everything else through a default route. Level 2 routers form the backbone that connects areas. An L1/L2 router sits at the edge of an area, keeps a separate database for each level, and joins the area to the backbone, much like an OSPF ABR. Unlike OSPF, a whole router belongs to one area, so the area border runs between routers, not through them. Cisco routers are L1/L2 by default.
Go deeper
Who forms what adjacency
Router A Router B Same area Different areas
L1 L1 L1 None
L1 L1/L2 L1 None
L1/L2 L1/L2 L1 and L2 L2 only
L2 L2 or L1/L2 L2 L2
L1 L2 None None
OSPF comparison
IS-IS OSPF equivalent
L1 area A totally stubby area, by default
L2 backbone Area 0
L1/L2 router ABR
Area border between routers Area border inside the ABR, on its interfaces
Setting the level
Cisco IOS
router isis CORE net 49.0001.0000.0000.0001.00 is-type level-1 ! interface GigabitEthernet0/0/1 isis circuit-type level-2-only
is-type sets what the router can be. isis circuit-type limits one interface, which saves sending useless L1 hellos on backbone links.
They will ask next
Must the L2 backbone be contiguous?
Yes. All L2-capable routers must form one connected L2 network, like OSPF area 0. The difference is that the backbone is not an area: it is the chain of L2 adjacencies, which can cross many areas.

Why leave every router as L1/L2 if that is the default?
Many providers run a single level, all L2, across the whole network. It is simple and keeps every router's view complete. L1 areas are added only when the database or flooding becomes too large.
Traps
Saying an interface belongs to an area, as in OSPF. In IS-IS the router belongs to the area.
How did you do?Book 4.1 Global Internet Book 3.4 Routing Own page
How do you read an IS-IS NET such as 49.0001.0000.0000.0001.00?
Say this first
The NET is an NSAP address with the last byte, the NSEL, set to 00, meaning the router itself. Read it from the right: 00 is the NSEL, the six bytes before it (0000.0000.0001) are the system ID, unique in the routing domain, and everything before that (49.0001) is the area address. 49 is the AFI for private use, the IS-IS version of RFC 1918. A router has one system ID and can have up to three area addresses by default, which is how you merge or split areas without downtime.
Go deeper
The pieces
Part In the example Length
Area address 49.0001 (AFI 49 plus area 0001) 1 to 13 bytes
System ID 0000.0000.0001 Always 6 bytes on Cisco
NSEL 00 1 byte, 00 for a NET
The whole NSAP is 8 to 20 bytes. Routers in the same area must share an area address to form an L1 adjacency.

Turning a loopback into a system ID
A common convention encodes the loopback. For 10.255.0.1:

Pad each octet to three digits: 010.255.000.001

Regroup the 12 digits into threes of four: 0102.5500.0001

NET: 49.0001.0102.5500.0001.00

Configuring it
Cisco IOS
router isis CORE net 49.0001.0102.5500.0001.00
Junos puts the NET on the loopback instead:

Junos
set interfaces lo0 unit 0 family iso address 49.0001.0102.5500.0001.00
They will ask next
What happens if two routers share a system ID?
Both generate LSPs with the same LSP ID. Each sees the other's LSP as a copy of its own with different content and floods a newer one to replace it, so the database churns and routing becomes unreliable. System IDs must be unique across the whole routing domain.

Why would a router have two NETs?
To migrate an area. Give routers both the old and new area address, move them over, then remove the old one. While both are present, the area is treated as one.
Traps
Ending a NET with anything other than 00. A non-zero NSEL addresses a service, not the router.
How did you do?Book 4.1 Global Internet Own page

Router A	Router B	Same area	Different areas
L1	L1	L1	None
L1	L1/L2	L1	None
L1/L2	L1/L2	L1 and L2	L2 only
L2	L2 or L1/L2	L2	L2
L1	L2	None	None

IS-IS	OSPF equivalent
L1 area	A totally stubby area, by default
L2 backbone	Area 0
L1/L2 router	ABR
Area border between routers	Area border inside the ABR, on its interfaces

Part	In the example	Length
Area address	49.0001 (AFI 49 plus area 0001)	1 to 13 bytes
System ID	0000.0000.0001	Always 6 bytes on Cisco
NSEL	00	1 byte, 00 for a NET

Working16

Walk me through the classic EIGRP metric calculation with the default K values.
Say this first
With the defaults K1=1, K2=0, K3=1, K4=0 and K5=0, the metric is 256 x (10^7 / slowest bandwidth in kbps + total delay in tens of microseconds). Bandwidth is the lowest along the path; delay is added up along the path. For a LAN two gigabit hops away: 256 x (10 + 3) = 3328.
Go deeper
The full formula
metric = 256 x [K1 x BW + (K2 x BW) / (256 - load) + K3 x delay], and if K5 is not 0 the result is multiplied by K5 / (reliability + K4).

BW = 10^7 divided by the lowest bandwidth on the path in kbps, rounded down to a whole number.

delay = sum of the interface delays along the path, in tens of microseconds. With default K values this collapses to 256 x (BW + delay).

Where the inputs come from
Output
R1# show interfaces GigabitEthernet0/0/0 | include BW MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
Interface BW (kbps) DLY BW term Delay term per hop
GigabitEthernet 1000000 10 usec 10 1
FastEthernet 100000 100 usec 100 10
Serial T1 1544 20000 usec 6476 2000
Loopback 8000000 5000 usec 1 500
Each router adds the delay of the interface it learned the route on, and the originating router adds the delay of the connected interface.

Worked example 1: all gigabit
10.50.0.0/24 is a gigabit LAN on R5. R1 reaches it through R2. Three gigabit interfaces are crossed: R1 toward R2, R2 toward R5, and R5's LAN interface.

BW term: 10^7 / 1000000 = 10

Delay term: 10 + 10 + 10 = 30 usec, which is 3 tens of usec

Metric: 256 x (10 + 3) = 3328 For R2 the same LAN is one interface less: 256 x (10 + 2) = 3072. On R5 it is connected: 256 x (10 + 1) = 2816, the familiar number for a gigabit connected route.

Worked example 2: a T1 in the path
Same LAN, but the path crosses a T1 plus two gigabit interfaces.

BW term: 10^7 / 1544 = 6476.7, rounded down to 6476

Delay term: 20000 + 10 + 10 = 20020 usec, which is 2002

Metric: 256 x (6476 + 2002) = 256 x 8478 = 2170368
They will ask next
Why multiply by 256?
EIGRP grew out of IGRP, whose metric was 24 bits. EIGRP uses 32 bits, so it scales the old IGRP formula by 256 to keep the same proportions with more resolution.

If you want to steer EIGRP, do you change bandwidth or delay?
Delay. It is additive, so it changes the path cost predictably, and nothing else uses it. The bandwidth command also feeds QoS percentages and EIGRP's own pacing, which by default lets EIGRP use at most 50 percent of the interface bandwidth, so a wrong low value slows convergence.
Traps
Adding bandwidths along the path. Bandwidth is the minimum; only delay is summed.
Using microseconds directly. The formula uses tens of microseconds.
Forgetting the destination LAN's own interface delay.
How did you do?Book 3.4 Routing Own page
What are the EIGRP K values, and why should you leave them at their defaults?
Say this first
K1 to K5 are weights that decide which of bandwidth, load, delay and reliability go into the metric. The defaults are K1=1 and K3=1, the rest 0, so only bandwidth and delay count. Named mode adds K6 for extended attributes such as jitter and energy, default 0. I leave them alone: load and reliability change constantly, so using them makes metrics move and routes churn, and every router must use the same values or neighbors will not form.
Go deeper
What each one weights
K value Weights Default
K1 Bandwidth 1
K2 Bandwidth divided by load 0
K3 Delay 1
K4, K5 Reliability 0
K6 (named mode) Extended attributes 0
The command
Cisco IOS
router eigrp 100 metric weights 0 1 0 1 0 0
The first number is the type of service and is always 0. Then K1 to K5. The line above is the default.

What a mismatch looks like
Output
%DUAL-5-NBRCHANGE: EIGRP-IPv4 100: Neighbor 10.0.13.3 (GigabitEthernet0/0/1) is down: K-value mismatch
Compare both sides quickly:

Output
R1# show ip protocols | include K1 Metric weight K1=1, K2=0, K3=1, K4=0, K5=0
They will ask next
Why is using load in the metric a bad idea?
Load is sampled over a few minutes and changes all the time. If it is in the metric, a busy link looks worse, traffic moves to the other path, the first link gets quiet and looks better again, and traffic swings back. You get route flapping driven by your own traffic.

What does a hello with every K value set to 255 mean?
It is the goodbye message. A router sends it when EIGRP is being shut down on that interface so the neighbor drops the adjacency at once instead of waiting for the hold time.
Traps
Leaving out the leading TOS value in metric weights and shifting every K value by one.
How did you do?Book 3.4 Routing Own page

Interface	BW (kbps)	DLY	BW term	Delay term per hop
GigabitEthernet	1000000	10 usec	10	1
FastEthernet	100000	100 usec	100	10
Serial T1	1544	20000 usec	6476	2000
Loopback	8000000	5000 usec	1	500

K value	Weights	Default
K1	Bandwidth	1
K2	Bandwidth divided by load	0
K3	Delay	1
K4, K5	Reliability	0
K6 (named mode)	Extended attributes	0

R1 has three neighbors toward 10.50.0.0/24. Walk me through which become successor and feasible successors.

Say this first

I compute each neighbor's total metric, take the lowest as the feasible distance, then compare every other neighbor's reported distance with it. Here R2 gives 3328 with RD 3072, so R2 is the successor and FD is 3328. R3 gives 26368 but reports 3072, which is less than 3328, so R3 is a feasible successor. R4 also gives 26368, but it reports 26112, which is not less than 3328, so R4 fails the feasibility condition and is not a backup, even though its path is perfectly loop-free.

Go deeper

The topology

R5 owns the gigabit LAN 10.50.0.0/24. R2, R3 and R4 each connect to R5. R1 connects to all three. All interfaces are gigabit (delay 10 usec), but two links are 100 Mbps circuits with bandwidth 100000 configured.

Link	Bandwidth EIGRP uses	Delay
R1 Gi0/0/0 to R2	1000000 kbps	10 usec
R1 Gi0/0/1 to R3	100000 kbps	10 usec
R1 Gi0/0/2 to R4	1000000 kbps	10 usec
R2 to R5 and R3 to R5	1000000 kbps	10 usec
R4 to R5	100000 kbps	10 usec
R5 LAN 10.50.0.0/24	1000000 kbps	10 usec

The math

Via	Slowest link	BW term	Delay term	R1's metric	Neighbor's RD
R2	1 Gbps	10	3	256 x 13 = 3328	256 x (10 + 2) = 3072
R3	100 Mbps (R1 to R3)	100	3	256 x 103 = 26368	256 x (10 + 2) = 3072
R4	100 Mbps (R4 to R5)	100	3	256 x 103 = 26368	256 x (100 + 2) = 26112

Applying DUAL

Lowest metric is 3328 via R2. R2 is the successor, FD = 3328.
R3: RD 3072 is less than 3328. Feasible successor.
R4: RD 26112 is not less than 3328. Not a feasible successor.

R3 and R4 cost R1 exactly the same, yet only one is a backup. R3's slow link is on R1's side, so R3 itself is close to the destination. R4's slow link is on R4's side, so R4 reports a large distance.

What the router shows

Output

R1# show ip eigrp topology all-links
EIGRP-IPv4 Topology Table for AS(100)/ID(10.255.0.1)
Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
       r - reply Status, s - sia Status

P 10.50.0.0/24, 1 successors, FD is 3328, serno 14
        via 10.0.12.2 (3328/3072), GigabitEthernet0/0/0
        via 10.0.13.3 (26368/3072), GigabitEthernet0/0/1
        via 10.0.14.4 (26368/26112), GigabitEthernet0/0/2

Plain show ip eigrp topology lists only the first two lines.

Failures

R2 fails: R1 promotes R3 at once. No queries are sent.
R2 and R3 both fail: no feasible successor remains, so the route goes active. R1 queries R4, R4 replies with 26112, and R1 installs the path via R4 at 26368.

They will ask next

Is the path through R4 really a loop risk?
No, R4 goes straight to R5. But DUAL only sees R4's reported distance, and a distance of 26112 is bigger than R1's own 3328, so for all DUAL knows R4 could be routing through R1. It cannot prove the path safe, so it will not use it without a query.
How would you make R4 a feasible successor?
Make R4's own distance lower than 3328. If the R4 to R5 link were a full gigabit, R4 would report 3072 and pass. Raising R1's FD would also work in theory, but making the primary path worse just to create a backup is the wrong trade.
With variance 8, which paths carry traffic?
R2 and R3. 8 x 3328 = 26624, and R3's 26368 is below that and R3 is a feasible successor. R4 has the same metric but is never eligible for variance because it is not a feasible successor.

Traps

Comparing the neighbor's RD with its own total metric through that neighbor. The comparison is RD against the successor's FD.
Treating equal as passing. The RD must be strictly less than the FD.

How did you do?Book 3.4 Routing Own page

How does EIGRP choose its router ID, and what breaks if two routers share one?
Say this first
Same order as OSPF: the configured eigrp router-id, otherwise the highest IPv4 address on an up loopback, otherwise the highest IPv4 address on an up interface. The router ID is stamped on external routes, and a router discards any external route carrying its own router ID as a loop check. So if two routers share an ID, each silently drops the other's redistributed routes.
Go deeper
Set it, do not let it float
Cisco IOS
router eigrp 100 eigrp router-id 10.255.0.1
Named mode puts the same eigrp router-id under the address family. Check it:

Output
R1# show ip protocols | include Router-ID Router-ID: 10.255.0.1
The duplicate ID failure
R2 and R6 were both cloned from one template with router ID 10.255.0.2. R6 redistributes a static route to 192.0.2.0/24. R2 receives the external, sees its own router ID as the originator, and drops it. Every router behind R2 also never sees it. Nothing is logged, the neighbor stays up, and the route is simply missing in part of the network.

Seeing the originator
show ip eigrp topology 192.0.2.0/24 on a router that does have the route lists "Originating router" and the external protocol. That is where you spot two routers with the same ID.
They will ask next
Does EIGRP for IPv6 need a router ID?
Yes, it is still a 32-bit value. On a router with no IPv4 address at all you must configure one by hand, or the process will not start.

Does the router ID have to be an address the router owns?
No. It is just a 32-bit identifier written like an address. Using the loopback address is a convention that makes it easy to find the router.
Traps
Saying a duplicate router ID stops the neighbor forming. It does not; the damage is silent loss of external routes.
How did you do?Book 3.4 Routing Own page
What happens when an EIGRP router loses its successor and has no feasible successor?
Say this first
The route goes active. The router sends a Query for that prefix to its neighbors and must get a Reply from every one of them before it picks a new path. Each neighbor either answers straight away from its own topology table, or, if it was using the querying router as its own successor and has no backup, goes active itself and queries its neighbors. When all replies are in, the router picks the best answer, installs it and the route goes passive again.
Go deeper
Step by step

The successor's link goes down, or it reports infinity. No feasible successor exists.

The router marks the prefix A (active) in the topology table and sends queries.

Each neighbor decides:

It does not know the prefix: replies "unreachable" at once and does not query anyone.

Its own successor is someone else: replies with its current distance at once.

Its successor was the querying router: it checks for a feasible successor; if it has one it replies with that distance, otherwise it goes active too and queries its own neighbors.

The original router waits for all replies, chooses the lowest, and goes passive (P).

What it looks like while it is happening
Output
R1# show ip eigrp topology active
Active routes show A, and neighbors that still owe a reply are listed under "Remaining replies" with an r.

Why it can hurt
The query spreads until it reaches routers that can answer without asking anyone. In a large flat network with no summarization and no stubs, one flapping subnet makes hundreds of routers work, and one slow router anywhere in the chain holds up the answer. That is the setup for stuck in active.
They will ask next
What does a router put in a reply when it has no path?
An infinite metric, shown as Infinity in the topology table. It tells the querier "not through me".

Why must the router wait for every reply instead of taking the first good one?
DUAL is a diffusing computation: its loop-freedom proof depends on every neighbor having updated its state for the change before a new path is chosen. Taking an early answer could pick a neighbor whose information is still based on the old path.
Traps
Saying the router sends the query only to the neighbor it hopes has a path. It queries all its neighbors.
How did you do?Book 3.4 Routing Own page

What does configuring an EIGRP stub do, and what does the default stub advertise?

Say this first

A stub router announces in its hellos that it is a stub. Its neighbors then stop sending it queries, and it stops acting as a transit path: it only advertises the route types you allow. Plain eigrp stub means connected summary. Other options are static, redistributed, receive-only, and a leak-map to let chosen learned routes through. The classic use is branch and spoke routers, so a failure at the hub never sends queries to hundreds of branches.

Go deeper

Configuring it

Classic mode:

Cisco IOS

router eigrp 100
 eigrp stub connected summary

Named mode:

Cisco IOS

router eigrp BRANCH
 address-family ipv4 unicast autonomous-system 100
  eigrp stub connected summary

The options

Keyword	Advertises
connected	Connected subnets covered by network statements or redistributed
summary	Summaries configured on this router
static	Redistributed static routes
redistributed	All redistributed routes
receive-only	Nothing
leak-map	Learned EIGRP routes matched by a route map, on top of the other choices

Verifying from the hub

Output

HUB1# show ip eigrp neighbors detail | include Stub|Suppressing
   Stub Peer Advertising (CONNECTED SUMMARY ) Routes
   Suppressing queries

Why transit matters

A branch dual-homed to HUB1 and HUB2 learns the data center from both. Without stub, it advertises those routes back to the other hub, and the hubs can end up using a small branch link as a path to each other when their own link fails. Stub stops that.

They will ask next

What do you need on the hub if a branch is receive-only?
Static routes to the branch LAN, usually redistributed into EIGRP. A receive-only stub advertises nothing, so the network never learns its subnets.
Does a stub router still send queries itself?
Yes. Stub only stops other routers from querying it. If its own path to something fails, it can go active and query its neighbors like any router.

Traps

Confusing it with an OSPF stub area. EIGRP stub controls what the router advertises and whether it gets queries, not what it receives.

How did you do?Book 3.4 Routing Own page

What is EIGRP named mode, and why would you use it instead of classic mode?

Say this first

Named mode puts all EIGRP configuration under one router eigrp NAME block, with address families for IPv4 and IPv6, per-interface settings in af-interface sections instead of scattered across interfaces, and routing policy under topology base. It is the only mode with 64-bit wide metrics, it supports HMAC-SHA-256 authentication, and af-interface default sets passive, timers or authentication once for every interface. The name is local; the AS number must still match the neighbor.

Go deeper

Same intent, both modes

Classic:

Cisco IOS

interface GigabitEthernet0/0/0
 ip hello-interval eigrp 100 2
 ip hold-time eigrp 100 6
!
router eigrp 100
 network 10.0.0.0 0.255.255.255
 passive-interface default
 no passive-interface GigabitEthernet0/0/0
 variance 2
 eigrp router-id 10.255.0.1

Named:

Cisco IOS

router eigrp CAMPUS
 address-family ipv4 unicast autonomous-system 100
  af-interface default
   passive-interface
  exit-af-interface
  af-interface GigabitEthernet0/0/0
   no passive-interface
   hello-interval 2
   hold-time 6
  exit-af-interface
  topology base
   variance 2
  exit-af-topology
  network 10.0.0.0 0.255.255.255
  eigrp router-id 10.255.0.1
 exit-address-family

Where things live in named mode

Section	Holds
address-family	network, eigrp router-id, eigrp stub
af-interface	hello and hold, passive, authentication, summary-address, split-horizon, bfd
topology base	variance, maximum-paths, redistribute, distance, summary-metric

Show commands

Named mode has its own: show eigrp address-family ipv4 neighbors and show eigrp address-family ipv4 topology. The classic show ip eigrp commands still work as well.

They will ask next

Can you convert a classic config to named mode without an outage?
Yes. Under the classic process, eigrp upgrade-cli CAMPUS rewrites the configuration into named mode in place without resetting neighbors. Save and review the result afterwards.
Can a named mode router peer with a classic mode router?
Yes, as long as the AS number and K values match. Mixing the two during a migration is normal.

Traps

Thinking the name has to match on both routers. Only the AS number is exchanged.

How did you do?Book 3.4 Routing Own page

How does EIGRP do unequal cost load balancing with variance? Give me a worked example.
Say this first
variance N lets EIGRP install extra paths whose metric is within N times the best metric, but only paths through feasible successors. Example: the best path is 3328 via R2. R3's path is 26368 with RD 3072, so it is a feasible successor; 26368 / 3328 is about 7.9, so variance 8 installs it. R4's path also costs 26368 but fails the feasibility condition, so no variance value ever uses it. Traffic is shared in inverse proportion to the metric.
Go deeper
The checks for each extra path

Is the neighbor a feasible successor (RD less than FD)? If not, stop.

Is its metric within variance x FD?

Is there room under maximum-paths (default 4)?

Worked numbers
Via Metric RD Feasible successor Variance 7 (limit 23296) Variance 8 (limit 26624)
R2 3328 3072 Successor Installed Installed
R3 26368 3072 Yes No Installed
R4 26368 26112 No No No
Cisco IOS
router eigrp 100 variance 8
Output
R1# show ip route eigrp | section 10.50.0.0 D 10.50.0.0/24 [90/3328] via 10.0.12.2, 00:02:10, GigabitEthernet0/0/0 [90/26368] via 10.0.13.3, 00:02:10, GigabitEthernet0/0/1
Each next hop keeps its own metric in the brackets. R2 gets roughly eight times as much traffic as R3.

How traffic is really split
CEF shares load per flow by default, hashing source and destination addresses. The ratio is applied to hash buckets, so with a few big flows the real split can be far from the intended one.

Keeping backups in the RIB only
traffic-share min across-interfaces installs the variance paths but sends traffic only on the best one. The others are already in the routing table if the best fails.
They will ask next
Why is variance rare in real networks?
The slower path usually has more latency, so flows on it behave differently, and per-flow hashing rarely gives the ratio you planned. Most designs use equal-cost paths or accept a primary and a backup.

What is the named mode equivalent?
variance 8 under topology base inside the address family.
Traps
Saying variance can use any path within the multiple. It only uses feasible successors.
How did you do?Book 3.4 Routing Own page
How do you summarize in EIGRP, and what does the router do when you configure a summary?
Say this first
On the interface facing the neighbors that should receive the summary: ip summary-address eigrp 100 10.20.0.0 255.255.252.0 in classic mode, or summary-address under the af-interface in named mode. The router stops sending the component routes out that interface, sends the summary with the metric of the best component, and installs a Null0 discard route with AD 5 so traffic for unused space inside the summary is dropped rather than looped. The summary stays as long as at least one component exists.
Go deeper
Example
DSW1 has 10.20.0.0/24 to 10.20.3.0/24 from two access switches and summarizes toward CORE1 on Gi1/0/1.

Cisco IOS
interface GigabitEthernet1/0/1 ip summary-address eigrp 100 10.20.0.0 255.255.252.0
On DSW1:

Output
DSW1# show ip route eigrp | include 10.20 D 10.20.0.0/22 is a summary, 00:03:52, Null0 D 10.20.0.0/24 [90/3072] via 10.0.1.2, 00:03:52, GigabitEthernet1/0/2 D 10.20.1.0/24 [90/3072] via 10.0.1.2, 00:03:52, GigabitEthernet1/0/2 D 10.20.2.0/24 [90/3072] via 10.0.1.6, 00:03:50, GigabitEthernet1/0/3 D 10.20.3.0/24 [90/3072] via 10.0.1.6, 00:03:50, GigabitEthernet1/0/3
On CORE1, only the summary arrives, with DSW1's best component metric 3072 plus one gigabit hop:

Output
CORE1# show ip route eigrp | include 10.20 D 10.20.0.0/22 [90/3328] via 10.0.0.2, 00:03:40, GigabitEthernet1/0/1
Why the Null0 route exists
Suppose VLAN 21 on ASW2 goes down and 10.20.3.0/24 disappears, while CORE1 still sees the /22. Without the Null0 route, DSW1 would forward a packet for 10.20.3.50 along its default route up to CORE1, and CORE1 would send it straight back down because of the /22. The packet would bounce until its TTL ran out. With the Null0 route, DSW1 drops it at once.

Leaking a specific
ip summary-address eigrp 100 10.20.0.0 255.255.252.0 leak-map LEAK also advertises any component that the route map LEAK permits, for example one /24 that should take a specific path.
They will ask next
Can EIGRP summarize anywhere, unlike OSPF?
Yes. EIGRP summarizes per interface on any router. OSPF only summarizes at area borders and at the ASBR. That freedom is one of EIGRP's design strengths.

What happens if you summarize 0.0.0.0/0?
Neighbors on that interface receive only a default route, which is a quick way to shrink a stub's table. But the summarizing router installs 0.0.0.0/0 to Null0 with AD 5, which can override its own learned default route and black-hole internet traffic. Check the routing table on that router after.
Traps
Configuring the summary on the downlink instead of the uplink. It goes on the interface toward the routers that should see only the summary.
How did you do?Book 3.4 Routing Book 4.1 Global Internet Own page
Why do you disable EIGRP split horizon on a DMVPN hub?
Say this first
Split horizon stops a router advertising a route out the interface it learned it on. A DMVPN hub reaches every spoke through one multipoint tunnel interface, so spoke A's LAN, learned on Tunnel0, would never be sent back out Tunnel0 to spoke B. Turning split horizon off on the hub tunnel lets the spokes learn each other's routes. Split horizon is on by default on every EIGRP interface.
Go deeper
The commands
Classic mode, on the hub tunnel:

Cisco IOS
interface Tunnel0 no ip split-horizon eigrp 100
Named mode:

Cisco IOS
router eigrp WAN address-family ipv4 unicast autonomous-system 100 af-interface Tunnel0 no split-horizon
DMVPN phases

Phase 1: all traffic goes through the hub. The hub can send just a summary or a default, and split horizon does not matter.

Phase 2: spokes build direct tunnels, so each spoke needs the other spoke's real next hop. The hub needs split horizon off and no ip next-hop-self eigrp 100 so it does not rewrite the next hop.

Phase 3: NHRP redirects and shortcuts handle spoke to spoke, so the hub can summarize to the spokes again. This is the design I would pick.

Is it safe?
Yes. For EIGRP, split horizon is an optimization. DUAL's feasibility condition still prevents loops when it is off.
They will ask next
Where else does split horizon bite?
Any multipoint interface where several neighbors sit behind one interface, such as old Frame Relay multipoint. Point-to-point subinterfaces avoid it because each neighbor has its own interface.
Traps
Disabling split horizon on the spokes. It only matters on the hub's multipoint interface.
How did you do?Book 3.4 Routing Own page

Via	Metric	RD	Feasible successor	Variance 7 (limit 23296)	Variance 8 (limit 26624)
R2	3328	3072	Successor	Installed	Installed
R3	26368	3072	Yes	No	Installed
R4	26368	26112	No	No	No

EIGRP or OSPF for an enterprise network, how do you choose?

Say this first

If the network is all Cisco, hub-and-spoke heavy and the team knows EIGRP, it is a fine choice: simple to configure, fast failover with feasible successors, summarization on any router, and stubs that keep branches out of the query domain. If the network is multivendor, or will connect firewalls, cloud routers and SD-WAN gear, I choose OSPF because everything speaks it. My default today is OSPF unless there is a reason for EIGRP.

Go deeper

Side by side

	EIGRP	OSPF
Vendor support	Cisco, plus RFC 7868 and a few open source stacks	Every router, firewall and cloud router
Visibility	Each router sees only neighbors' distances	Every router in an area has the full map
Hierarchy	None required; summarize anywhere	Areas, area 0 backbone, summarize at ABR or ASBR
Fast failover	Feasible successor, no messages	SPF rerun, fast with tuned timers and LFA
Failure mode to fear	Query storms and stuck in active	Flooding, LSDB size, area design mistakes
Metric	Bandwidth and delay	Cost from reference bandwidth

What I would say about scale

Both scale to thousands of routers when designed well. EIGRP needs summarization and stubs to bound queries. OSPF needs areas and summarization to bound flooding and SPF work.

They will ask next

What would you choose for a service provider core?
IS-IS, or OSPF. Not EIGRP: providers need multivendor support, MPLS-TE and segment routing extensions, which are built around the link state protocols.

Traps

Answering "EIGRP converges faster" with no conditions. It does only when a feasible successor exists.

How did you do?Book 3.4 Routing Own page

How do you authenticate EIGRP neighbors, and what changes between classic and named mode?
Say this first
Classic mode supports MD5 with a key chain applied per interface. Named mode adds HMAC-SHA-256 with a password under the af-interface, and still supports MD5 key chains. Authentication protects the adjacency: a router without the right key never becomes a neighbor, so nobody can plug in a router and inject routes. Key chains with lifetimes let you rotate keys without an outage.
Go deeper
Classic mode, MD5
Cisco IOS
key chain EIGRP-KEYS key 1 key-string Kj7mPq2xR4 ! interface GigabitEthernet0/0/0 ip authentication mode eigrp 100 md5 ip authentication key-chain eigrp 100 EIGRP-KEYS
Named mode, SHA-256
Cisco IOS
router eigrp CAMPUS address-family ipv4 unicast autonomous-system 100 af-interface GigabitEthernet0/0/0 authentication mode hmac-sha-256 0 Kj7mPq2xR4 exit-af-interface
To protect every interface, put it under af-interface default.

Checking

show ip eigrp neighbors: the neighbor is missing or flaps after a change.

show key chain: which keys are valid now.

debug eigrp packets briefly on a quiet router: you can see packets ignored because of authentication.
They will ask next
How do you rotate an MD5 key without dropping the neighbor?
Add key 2 on both routers with overlapping accept-lifetime values and a send-lifetime on key 2 that starts after both have it. EIGRP carries the key ID in the packet, so both sides need the same key number with the same string. Remove key 1 when it has expired everywhere.

Does authentication encrypt the routing updates?
No. It adds a hash that proves the sender knows the key and the packet was not changed. Anyone on the link can still read the routes.
Traps
Applying the key chain but forgetting ip authentication mode eigrp 100 md5. Without the mode line nothing is authenticated.
How did you do?Book 3.4 Routing Book 8.4 Authentication Protocols Own page

IS-IS does not run over IP. What does that mean, and why does it matter?

Say this first

IS-IS packets are carried directly in layer 2 frames, not inside IP packets. On Ethernet they use LLC with the OSI service access point 0xFE. Its packets are hellos (IIH), link state PDUs (LSPs), and complete and partial sequence number PDUs (CSNP, PSNP). IP prefixes are just TLVs inside the LSPs (RFC 1195 for IPv4, RFC 5308 for IPv6). Being outside IP means it cannot be attacked from a remote IP host, and adding IPv6 needed new TLVs rather than a new protocol.

Go deeper

The packet types

PDU	Purpose
IIH (LAN L1, LAN L2, point-to-point)	Find and keep neighbors
LSP (L1, L2)	A router's links and prefixes for one level
CSNP	A summary of every LSP in the database; the DIS sends it every 10 s on a LAN
PSNP	Requests or acknowledges specific LSPs

On Ethernet, L1 packets go to MAC 0180.C200.0014 and L2 packets to 0180.C200.0015.

Practical effects

On IOS you enable it per interface with ip router isis TAG. The hellos still list the interface IP addresses, because routers need them as next hops for the IP routes.
IS-IS pads hellos to the full interface MTU by default, so an MTU mismatch stops the adjacency. That is deliberate: it finds MTU problems before large LSPs are silently dropped.
You cannot ping or traceroute IS-IS itself. show isis neighbors and show clns interface are your tools.

They will ask next

What does the DIS do, and how is it different from an OSPF DR?
The DIS creates the pseudonode LSP for the LAN and sends CSNPs every 10 seconds so others can spot missing LSPs. There is no backup DIS, election is preemptive (highest priority, then highest MAC), and every router on the LAN still forms an adjacency with every other one. An OSPF DR has a backup, is not preemptive, and other routers only go Full with the DR and BDR.
Why use point-to-point mode on an Ethernet link between two routers?
isis network point-to-point skips DIS election and the pseudonode, so the database is smaller and the adjacency comes up faster. It is standard practice on router to router links.

Traps

Saying IS-IS runs over IP protocol 124 or similar. It is not carried in IP at all.

How did you do?Book 4.1 Global Internet Own page

How does a Level 1 IS-IS router reach destinations outside its area?
Say this first
Through a default route it builds itself. An L1/L2 router that is connected to the L2 backbone sets the attached (ATT) bit in its Level 1 LSP. L1 routers see that bit and install a default route toward the nearest L1/L2 router with ATT set. No L2 prefixes enter the area unless you configure route leaking, so by default an L1 area behaves like an OSPF totally stubby area.
Go deeper
What you see on the L1 router
Output
R1# show ip route isis | include 0.0.0.0 i*L1 0.0.0.0/0 [115/10] via 10.1.12.2, 00:06:12, GigabitEthernet0/0/0
And in the database, the ATT column for R2's LSP is 1:

Output
R1# show isis database Tag CORE: IS-IS Level-1 Link State Database: LSPID LSP Seq Num LSP Checksum LSP Holdtime/Rcvd ATT/P/OL R1.00-00 * 0x00000004 0x5D1E 1061/* 0/0/0 R2.00-00 0x00000005 0x8A42 1102/1199 1/0/0
The catch: nearest exit
With two L1/L2 routers in the area, every L1 router uses whichever is closest by IS-IS metric, even if the other one is much nearer to the actual destination. Traffic can cross the backbone the long way. Route leaking fixes this by giving L1 routers specific prefixes to compare.

Losing the exit
If an L1/L2 router loses all its L2 adjacencies, it clears ATT, and L1 routers stop using it as an exit. That is correct behaviour, and it is why a single L1/L2 router is a single point of failure for the area.
They will ask next
Does the L1 router need any configuration to install that default?
No. Installing a default toward the nearest router with ATT set is standard L1 behaviour. Some platforms let you ignore the ATT bit, for example when the area has its own default from elsewhere.
Traps
Saying the L1/L2 router sends a 0.0.0.0/0 prefix into L1. By default it only sets the ATT bit; the L1 routers create the default themselves.
How did you do?Book 4.1 Global Internet Own page

Why do so many service providers run IS-IS instead of OSPF?

Say this first

Partly history: several large ISPs chose IS-IS in the 1990s when mature implementations were available, and vendors kept investing in it. Partly design: it is TLV based, so new features such as IPv6, MPLS traffic engineering and segment routing arrived as new TLVs in the same protocol. It runs outside IP, so its control plane cannot be attacked from a remote IP host. And a flat L2 backbone is simple, with fewer database object types and fewer area rules than OSPF. OSPF can do the job too.

Go deeper

Side by side

	IS-IS	OSPF
Carried in	Layer 2 directly	IP protocol 89
IPv6	Same instance, new TLVs	OSPFv3, a separate protocol
Database objects	LSPs with TLVs, one per router per level (plus fragments)	Several LSA types with different flooding scopes
Area border	Between routers	Inside the ABR
Backbone	Any contiguous L2 routers	Area 0
LAN election	DIS, preemptive, no backup	DR and BDR, not preemptive
Default interface metric on Cisco	10 on every interface	Reference bandwidth divided by interface bandwidth
Default hello and hold on Cisco	10 s and 30 s	10 s and 40 s on broadcast links

What an interviewer wants to hear

That the choice is about operations and extensibility, not that one protocol is "faster". Both are link state, both run SPF, both converge in well under a second when tuned. Providers value a stable, simple, extensible core, and IS-IS gives them that with less to tune.

They will ask next

Would you put IS-IS in an enterprise?
It works well, but most enterprise engineers and many firewalls and cloud routers know OSPF better. I would use IS-IS where the team already runs it or the enterprise has a provider-style MPLS core.

Traps

Saying IS-IS converges faster because it is IS-IS. Convergence depends on timers and SPF tuning in both.

How did you do?Book 4.1 Global Internet Book 3.4 Routing Own page

What is the default IS-IS metric, and why do you configure wide metrics?
Say this first
Cisco IS-IS gives every interface a metric of 10 regardless of bandwidth, so out of the box it behaves like hop count until you set metrics. The original narrow metrics allow 6 bits per link (max 63) and 10 bits per path (max 1023). Wide metrics (RFC 5305) allow 24 bits per link and 32 bits per path, and they are required for MPLS traffic engineering and segment routing extensions. Every router must agree on the style, so you migrate through metric-style transition.
Go deeper
Configuring
Cisco IOS
router isis CORE metric-style wide ! interface TenGigabitEthernet0/1/0 isis metric 100 level-2 ! interface GigabitEthernet0/0/1 isis metric 1000 level-2
A simple plan is a reference value divided by the link speed, set by hand, so that 10 Gbps is 100 and 1 Gbps is 1000. Cisco IOS does not derive the IS-IS metric from bandwidth the way OSPF does, so an unplanned network ends up with 10 on every link.

Migrating from narrow to wide

Set metric-style transition on every router: it sends and accepts both.

When all routers run transition, set metric-style wide everywhere. A router left on narrow ignores wide TLVs. The adjacency stays up but routes are missing, which is a confusing failure to troubleshoot.
They will ask next
Why does MPLS-TE need wide metrics?
The TE attributes (bandwidth, admin groups, TE metric) are sub-TLVs of the extended IS reachability TLV defined with wide metrics. Narrow TLVs have no room for them.
Traps
Assuming IS-IS derives cost from bandwidth like OSPF. On Cisco every link is 10 until you change it.
How did you do?Book 4.1 Global Internet Book 3.4 Routing Own page

Expert7

Why does the feasibility condition guarantee a loop-free path, and why is it more conservative than it needs to be?
Say this first
If a neighbor's reported distance is lower than my feasible distance, the neighbor is closer to the destination than I have ever been since the route was last stable, so its path cannot pass through me: any path through me would cost at least my distance plus a link. DUAL proves this with one number per neighbor, without seeing the topology. It is conservative because many loop-free paths fail the test simply because the neighbor's own path is long. Those are only found by querying.

Go deeper
The argument
Suppose neighbor N reaches destination D through me. Then N's distance is my distance plus the cost of the link from N to me, which is always more than zero. So N's reported distance would be greater than my distance. If N reports less than my FD, N cannot be routing through me, so forwarding to N cannot loop back.

Why FD and not my current distance
The feasible distance is the lowest distance I have had since the route last went passive. Using that historical low means the check stays safe while metrics are rising: a neighbor has to beat my best recent distance, not just my current, possibly inflated, one.

Why it rejects good paths
In the classic example, R4 reaches the destination through its own slow link and reports 26112 against R1's FD of 3328. The path is loop-free, but the condition is sufficient, not necessary: it only proves safety for neighbors that are closer than me. For everything else DUAL falls back to a diffusing computation (going active and querying), which finds the new best path safely, just slower.

The same idea elsewhere
IP fast reroute loop-free alternates for OSPF and IS-IS (RFC 5286) use a very similar inequality: neighbor N is a safe alternate if N's distance to D is less than N's distance back to me plus my distance to D. Link state protocols can check it for every neighbor because they see the full map.
They will ask next
What happens if no neighbor meets the condition after the successor fails?
The route goes active. The router sends queries to all its neighbors and waits for every reply before it picks a new successor. If the failed successor was the only path in the routing table, traffic to that prefix is dropped until the computation finishes, which is why feasible successors and small query domains matter.

Could you relax the condition to RD less than or equal to FD?
DUAL uses strictly less than. I would not try to argue the equal case in an interview; the defined rule is strict and IOS implements it that way.
Traps
Saying a path that fails the feasibility condition must contain a loop. It only means DUAL cannot prove it is loop-free.
How did you do?Book 3.4 Routing Own page
EIGRP runs straight over IP. How does it deliver updates reliably, and what do SRTT, RTO and Q Cnt tell you?
Say this first
It uses its own Reliable Transport Protocol. Each reliable packet carries a sequence number and must be acknowledged by every neighbor. The router multicasts it, then retransmits by unicast to any neighbor that has not acknowledged within that neighbor's retransmission timeout. After 16 retries the neighbor is reset. SRTT is the smoothed round trip time to the neighbor, RTO is the retransmit timer derived from it, and Q Cnt is the number of packets waiting to go to that neighbor.
Go deeper
The neighbor table, column by column
Output
R1# show ip eigrp neighbors EIGRP-IPv4 Neighbors for AS(100) H Address Interface Hold Uptime SRTT RTO Q Seq (sec) (ms) Cnt Num 1 10.0.13.3 Gi0/0/1 11 00:42:10 2 100 0 41 0 10.0.12.2 Gi0/0/0 13 01:02:33 1 100 0 27

H: order in which neighbors came up.

Hold: seconds left before the neighbor is declared dead.

SRTT: average time for this neighbor to acknowledge a reliable packet.

RTO: how long to wait before retransmitting to this neighbor.

Q Cnt: reliable packets queued for this neighbor. It should be 0.

Seq Num: last sequence number received from the neighbor.

Signs of trouble

Q Cnt staying above 0 and RTO near its ceiling of several seconds: the neighbor is not acknowledging. Look for a one-way link, a congested WAN or a firewall dropping unicast EIGRP.

Uptime resetting every few minutes with retry limit exceeded in the log: same cause, worse.

Pacing
EIGRP limits itself to 50 percent of the interface bandwidth by default (ip bandwidth-percent eigrp 100 50). On a WAN link with a wrong, low bandwidth value, that pacing slows large updates and can make convergence look broken.
They will ask next
Why does it not just multicast the retransmission again?
Only one or two neighbors are usually missing. Unicasting to them avoids making every other neighbor process a duplicate, and lets a slow neighbor be handled without holding up the fast ones.

Which interface counter would you check next if Q Cnt is stuck?
Output drops and errors on the link with show interfaces, and show ip eigrp interfaces detail for retransmissions and pending routes. Then I test unicast reachability to the neighbor's address.
Traps
Ignoring Q Cnt. A nonzero queue that never drains is the earliest warning before a neighbor reset.
How did you do?Book 3.4 Routing Own page
What is stuck in active, what causes it, and how do you fix it for good?
Say this first
A route is stuck in active when the router has sent queries and a neighbor has not replied within the active timer, 3 minutes by default. Modern IOS sends that neighbor an SIA-Query halfway through; a neighbor that answers with an SIA-Reply is kept, a neighbor that stays silent is reset, and every route through it is lost. The usual causes are queries travelling too far and a lossy or overloaded path. The lasting fix is to bound queries with stub routers and summarization and repair the bad link, not to raise the timer.
Go deeper
The timeline with default settings

0 s: route goes active, queries sent.

90 s (half the active timer): SIA-Query sent to each neighbor that has not replied.

SIA-Reply received: the neighbor is alive and still working on it, so the router keeps waiting.

No SIA-Reply: the neighbor is reset:

Output
%DUAL-5-NBRCHANGE: EIGRP-IPv4 100: Neighbor 10.0.14.4 (GigabitEthernet0/0/2) is down: stuck in active
Finding the real culprit
The router that logs the reset is usually not the problem. Follow the chain:

show ip eigrp topology active on the router that logged it. Note the neighbor marked r under "Remaining replies".

Log in to that neighbor and run the same command. If it is also active and waiting on someone else, move again.

The end of the chain is the router that cannot answer: a congested or lossy link, a one-way link, a high CPU, or a neighbor that keeps retransmitting (Q Cnt above 0 in show ip eigrp neighbors).

The real fixes

Stub routers on branches and access: the hub never queries them.

Summarization at distribution and hubs: routers that only hold the summary answer queries for specifics immediately.

Route filtering so routers do not hold prefixes they do not need.

Fix the path: errors, drops, wrong bandwidth values that throttle EIGRP pacing.
They will ask next
Why not just raise the active timer?
It hides the design problem and makes convergence slower when a reply is truly lost. With SIA-Query and SIA-Reply, a neighbor that is busy but alive is no longer reset anyway, so the timer is rarely the thing to change.

How did stuck in active behave before SIA-Query existed?
The router simply waited the full active timer and then reset the neighbor that had not replied, even if that neighbor was healthy and was itself waiting on someone further away. Healthy adjacencies near the querier were torn down for a problem somewhere else.
Traps
Blaming the neighbor that was reset. Usually it was waiting on someone further down the chain.
How did you do?Book 3.4 Routing Own page
Besides stub routers, how do you stop EIGRP queries from travelling across the whole network?
Say this first
Make sure routers away from the failure do not know the exact prefix. A router that gets a query for a prefix it has no topology entry for replies "unreachable" at once and does not pass the query on. So summarization at distribution and hub routers, and route filtering, put a boundary on the query. Stubs mean the query is not sent at all. Together they keep a failure local.
Go deeper
A worked flow
DSW1 summarizes 10.20.0.0/24 to 10.20.3.0/24 to CORE1 as 10.20.0.0/22. ASW1 owns 10.20.1.0/24, and ASW1 and ASW2 are stubs.

10.20.1.0/24 goes down on ASW1. ASW1 tells DSW1.

DSW1 has no other path, so the /24 goes active on DSW1.

DSW1 does not query ASW2 because it is a stub.

DSW1 queries CORE1. CORE1 only knows the /22, so it has no entry for the /24 and replies unreachable immediately.

DSW1 goes passive with the /24 gone. The /22 stays up because other components remain.

The core and everything behind it did no work, and nothing outside the block saw a change.

The tradeoff
A summary hides detail. If one access block is dual-homed and summarized from two places, traffic can be drawn to the wrong side when a component fails there, because the summary still looks good. The summary also installs a Null0 route on the summarizing router, so traffic to unused space inside it is dropped there.

Summary metric churn
In classic mode the summary takes the metric of its best component. If that component flaps, the summary is re-advertised with a new metric, causing an update across the core. Named mode can pin the advertised value with summary-metric under topology base.
They will ask next
Does a distribute list scope queries the same way?
Yes, in effect. If a distribute list keeps a prefix out of a router's topology table, that router has no entry when the query arrives and answers unreachable immediately.
Traps
Saying summarization stops the query from being sent. The query is still sent to the core router; the summary makes that router answer at once.
How did you do?Book 3.4 Routing Book 4.1 Global Internet Own page
Why did Cisco add EIGRP wide metrics, and how do the numbers change?
Say this first
The classic metric runs out of resolution on fast links. Bandwidth is 10^7 divided by kbps, so a 10 Gbps link already scores 1 and faster links cannot be told apart, and delay is counted in tens of microseconds with the same 10 usec default from gigabit upward. Wide metrics, in named mode, use a 64-bit composite with throughput and latency scaled by 65536 and delay kept in picoseconds. The topology table shows the 64-bit value; the routing table shows it divided by the RIB scale, 128 by default.
Go deeper
The two main terms

Throughput = 65536 x 10^7 / slowest bandwidth in kbps

Latency = 65536 x total delay in picoseconds / 10^6 With default K values (K1=1, K3=1, and K2, K4, K5, K6 all 0) the composite is throughput plus latency.

Worked numbers for gigabit

Throughput: 65536 x 10^7 / 1000000 = 655360

Latency for one gigabit interface (10 usec = 10^7 ps): 65536 x 10^7 / 10^6 = 655360

Connected gigabit route: 655360 + 655360 = 1310720, shown in the RIB as 1310720 / 128 = 10240

Gigabit LAN one gigabit hop away: 655360 + 2 x 655360 = 1966080, RIB value 15360

Output
R1# show eigrp address-family ipv4 topology EIGRP-IPv4 VR(CAMPUS) Topology Table for AS(100)/ID(10.255.0.1) Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply, r - reply Status, s - sia Status P 10.2.0.0/24, 1 successors, FD is 1966080 via 10.0.12.2 (1966080/1310720), GigabitEthernet0/0/0
Output
R1# show ip route eigrp | include 10.2.0.0 D 10.2.0.0/24 [90/15360] via 10.0.12.2, 00:05:02, GigabitEthernet0/0/0
K6
Named mode adds K6 for extended attributes such as jitter and energy. It defaults to 0 and I have not seen it used in production.
They will ask next
Why is there a RIB scale at all?
The routing table metric field is 32 bits. A 64-bit composite can be larger than that, so EIGRP divides by the RIB scale (128 by default, set with metric rib-scale) before installing the route.

Can you compare a wide-metric topology table with a classic one?
No, they are different scales. A gigabit connected route is 2816 classic and 1310720 wide. Compare paths only within the same mode.
Traps
Reading the topology table FD and the routing table metric as different paths. In named mode they differ by the RIB scale.
How did you do?Book 3.4 Routing Own page
What is the IS-IS overload bit, and when do you set it?
Say this first
It is a flag in a router's LSP that says "do not use me for transit". Other routers still reach the router's own prefixes, but SPF will not route through it. The classic use is setting it at boot until BGP has converged, so a reloaded core router does not attract traffic it cannot yet forward. It is also the clean way to drain a router before maintenance. The OSPF equivalent is advertising maximum metric in the router LSA (RFC 6987).
Go deeper
On boot
Cisco IOS
router isis CORE set-overload-bit on-startup wait-for-bgp
wait-for-bgp clears the bit when BGP reports it has converged. set-overload-bit on-startup 300 clears it after a fixed 300 seconds instead.

The black hole it prevents
A provider core router reloads. IS-IS converges in seconds and the router becomes the shortest path to many PE loopbacks. BGP, which carries the full internet table, takes minutes. Without the overload bit, traffic lands on a router that has no route for most destinations and is dropped.

For maintenance
Cisco IOS
router isis CORE set-overload-bit
Traffic moves away before you touch anything. Remove it when done. Seeing it in the database:

Output
LSPID LSP Seq Num LSP Checksum LSP Holdtime/Rcvd ATT/P/OL P3.00-00 0x0000012A 0x3B7C 1137/1199 0/0/1
They will ask next
Does the overload bit make the router's own loopback unreachable?
No. Directly attached prefixes stay reachable, so you can still manage the router and BGP sessions to its loopback still work. It only stops transit through it.
Traps
Confusing the overload bit with the ATT bit. ATT advertises an exit from an L1 area; OL refuses transit.
How did you do?Book 4.1 Global Internet Own page
What is IS-IS route leaking, and when do you need it?
Say this first
By default L1 routers get only a default route out of their area. Route leaking copies chosen L2 prefixes into the L1 LSP of an L1/L2 router, so L1 routers see specific routes. You need it when an area has two exits and you want the best exit per destination, and in MPLS networks where PE loopbacks must be known as exact /32s for LDP to build label switched paths. Leaked prefixes have the up/down bit set, which stops them being sent back up into L2 and causing a loop (RFC 5302).
Go deeper
Configuration on IOS
Cisco IOS
ip prefix-list PE-LOOPBACKS seq 10 permit 10.255.0.0/16 ge 32 ! route-map LEAK-L2-TO-L1 permit 10 match ip address prefix-list PE-LOOPBACKS ! router isis CORE redistribute isis ip level-2 into level-1 route-map LEAK-L2-TO-L1
IOS-XR uses propagate level 2 into level 1 route-policy for the same job.

What the L1 router sees afterwards
Output
R1# show ip route isis | include ia i ia 10.255.0.3/32 [115/30] via 10.1.12.2, 00:01:05, GigabitEthernet0/0/0
ia marks an inter-area route that was leaked from L2.

Why MPLS cares
LDP only binds a label to a prefix that matches the routing table entry exactly. A remote PE's loopback reached through a default route has no label, so the LSP to it breaks and BGP VPN routes that use it as next hop fail. Leaking the /32 loopbacks fixes that.
They will ask next
What is the up/down bit for?
It marks a prefix that came down from L2 into L1. An L1/L2 router never advertises a prefix with that bit back into L2, so a leaked route cannot loop back up and compete with the real one.
Traps
Leaking everything. It defeats the point of L1 areas. Leak only what needs a specific path, such as loopbacks.
How did you do?Book 4.1 Global Internet Book 4.4 Multiprotocol Label Switching Own page

Core15

Say this first

Go deeper

The facts to have ready

Side by side

What it means in practice

They will ask next

Traps

Say this first

Go deeper

What each one does

How the reliable part works

Where to see the counters

They will ask next

Traps

Say this first

Go deeper

The checklist and how each failure looks

The commands I run

What does not need to match

They will ask next

Traps

Say this first

Go deeper

Reading it live

Changing them

They will ask next

Traps

Say this first

Go deeper

How they look in the routing table

Why the external value matters

Changing them

They will ask next

Traps

Say this first

Go deeper

Where to see them

Why it matters

They will ask next

Traps

Say this first

Go deeper

Reading the numbers

The precise definition

Why EIGRP needs both

They will ask next

Traps

Say this first

Go deeper

The discontiguous problem

Turning it off

The same issue in RIP

They will ask next

Traps

Say this first

Go deeper

Precise network statements

Checking it

Passive is not the same in every protocol

They will ask next

Traps

Say this first

Go deeper

Configuration on IOS

RIPv1 against RIPv2

RIPng

They will ask next

Traps

Say this first

Go deeper

Seeing them

A failure, minute by minute

Why it is slow

They will ask next

Traps

Say this first

Go deeper

Hop count in a real path choice

What replaced it