QME CommunicationsTelecommunications network configuration reference

Core routing underlay: IS-IS backbone with an OSPF edge

Platform: Juniper Junos 21.4R3 · Role: core and aggregation router · Last reviewed 2026-09-22

Role in the network

The interior gateway protocol in a carrier network has one job: carry loopback reachability between routers quickly and predictably, so that MPLS label distribution and internal BGP sessions have something stable to run over. It should not carry customer routes, it should converge in tens of milliseconds where the transport allows it, and every adjacency should be authenticated.

This reference uses IS-IS level 2 throughout the core because it scales without area design decisions and is transparent to the address family, and OSPF at the aggregation edge where existing equipment only speaks OSPF. The two are kept separate; controlled redistribution happens in one direction only.

Addressing and identifiers

Documentation addressing per RFC 5737 and RFC 3849.
Router loopback203.0.113.1/32, 2001:db8:113::1/128
IS-IS network entity title49.0001.0203.0113.0001.00
Core links203.0.113.64/30 and 203.0.113.68/30, point to point
OSPF aggregation areaarea 0.0.0.10, 203.0.113.128/26

Configuration

interfaces {
    lo0 {
        description "Router ID, IS-IS NET carrier, MPLS LSP endpoint";
        unit 0 {
            family inet {
                address 203.0.113.1/32;
            }
            family iso {
                address 49.0001.0203.0113.0001.00;
            }
            family inet6 {
                address 2001:db8:113::1/128;
            }
        }
    }
    et-0/0/0 {
        description "Core link to core-rtr-02";
        mtu 9192;
        unit 0 {
            family inet {
                address 203.0.113.65/30;
            }
            family iso;
            family inet6 {
                address 2001:db8:113:40::1/64;
            }
            family mpls;
        }
    }
    et-0/0/1 {
        description "Core link to core-rtr-03";
        mtu 9192;
        unit 0 {
            family inet {
                address 203.0.113.69/30;
            }
            family iso;
            family inet6 {
                address 2001:db8:113:44::1/64;
            }
            family mpls;
        }
    }
    ge-0/0/4 {
        description "Aggregation edge, OSPF area 10";
        unit 0 {
            family inet {
                address 203.0.113.129/26;
            }
        }
    }
}

routing-options {
    router-id 203.0.113.1;
    /* The IGP carries infrastructure only. Customer routes live in BGP. */
    autonomous-system 64512;
}

protocols {
    isis {
        /* Level 2 only: a flat backbone needs no level 1 and no area design. */
        level 1 disable;
        level 2 {
            authentication-key "$9$removed";        /* HMAC over the PDU */
            authentication-type hmac-sha-256;
            wide-metrics-only;                      /* RFC 5305 wide metrics */
        }
        reference-bandwidth 400g;
        /* Sub-second detection without waiting for hello timers. */
        interface et-0/0/0.0 {
            point-to-point;
            level 2 metric 100;
            bfd-liveness-detection {
                minimum-interval 100;
                multiplier 3;
            }
        }
        interface et-0/0/1.0 {
            point-to-point;
            level 2 metric 100;
            bfd-liveness-detection {
                minimum-interval 100;
                multiplier 3;
            }
        }
        interface lo0.0 {
            passive;
        }
        /* Precomputed backup next hop, installed before the SPF runs. */
        backup-spf-options {
            use-post-convergence-lfa;
            per-prefix-calculation;
        }
        traffic-engineering {
            family inet-vpn {
                shortcuts;
            }
        }
    }
    ospf {
        area 0.0.0.10 {
            interface ge-0/0/4.0 {
                interface-type p2mp;
                authentication {
                    md5 1 key "$9$removed";
                }
                hello-interval 3;
                dead-interval 12;
                metric 1000;
            }
            interface lo0.0 {
                passive;
            }
        }
        reference-bandwidth 400g;
        export ISIS-TO-OSPF;
    }
    mpls {
        interface et-0/0/0.0;
        interface et-0/0/1.0;
    }
    ldp {
        interface et-0/0/0.0;
        interface et-0/0/1.0;
        interface lo0.0;
        /* Do not withdraw labels the instant a link flaps. */
        session-protection {
            timeout 300;
        }
    }
    bfd {
        no-adaptation;
    }
}

policy-options {
    /* One-way leak: the core is advertised into the OSPF edge, never the
       reverse. A two-way redistribution between IGPs is how you build a
       routing loop that only appears under failure. */
    policy-statement ISIS-TO-OSPF {
        term core-loopbacks {
            from {
                protocol isis;
                route-filter 203.0.113.0/24 prefix-length-range /32-/32;
            }
            then {
                metric 2000;
                external type 2;
                accept;
            }
        }
        term default-deny {
            then reject;
        }
    }
}

Verification

CommandExpected result
show isis adjacency Both core interfaces Up at level 2. A missing adjacency with a matching interface list is almost always an authentication type mismatch.
show isis interface detail Level 2 metric 100 on core links, lo0.0 listed as passive.
show route 203.0.113.2/32 detail An active next hop plus a Backup next hop entry, which is the proof that loop-free alternate protection actually computed a backup.
show bfd session summary Sessions Up with a 300 ms detection time (100 ms interval, multiplier 3).
show ldp session Operational sessions to each core neighbour; label bindings present for every core loopback.
show ospf neighbor Aggregation neighbours in Full state in area 0.0.0.10.

Operational notes

Standards

Back to the configuration library