Troubleshooting ISO CLNS

• ISO 9542---Documents the End System-to-Intermediate System (ES-IS) routing exchange protocol.

• ISO 8473---Documents the ISO Connectionless Network Protocol (CLNP).

• ISO 8348/Ad2---Documents NSAP addresses.

• ISO 10589---Documents Intermediate System-to-Intermediate System (IS-IS) Intra--domain Routing Exchange Protocol.

Both the ISO-developed IS-IS routing protocol and Cisco's ISO Interior Gateway Routing Protocol (IGRP) are supported for dynamic routing of ISO CLNS. In addition, static routing for ISO CLNS is supported.

• The domain part is of variable length and comes before the area address.

• The area address is the 2 bytes before the system ID.

• The system ID is the 6 bytes before the n-selector.

• The n-selector (S) is the last byte of the NSAP address.

Our ISO-IGRP routing implementation interprets the bytes from the AFI up to (but not including) the area field in the DSP as a domain identifier. The area field specifies the area, and the system ID specifies the system.

An IS-IS NSAP address is divided into two parts: an area address (AA) and a system ID. Level 2 routing uses the AA. Level 1 routing uses the system ID address. The NSAP address is laid out as follows:

• The n-selector (S) is the last byte of the NSAP address.

• The system ID is found between the area address and the n-selector byte.

• The area address is the NSAP address, not including the system ID and n-selector.

The IS-IS routing protocol interprets the bytes from the AFI up to (but not including) the system ID field in the DSP as an area identifier. The system ID specifies the system.

The following are examples of OSI network and GOSIP NSAP addresses using the ISO-IGRP implementation. The second example is the OSI network NSAP address format:

47.0004.004D.0003.0000.0C00.62E6.00
| Domain| Area| System ID| S|

Entry	NSAP Address Prefix	Next-Hop NET
1	47.0005.000c.0001	47.0005.000c.0001.0000.1234.00
2	47.0004	47.0005.000c.0002.0000.0231.00
3	47.0005.0003	47.0005.000c.0001.0000.1234.00
4	47.0005.000c	47.0005.000c.0004.0000.0011.00
5	47.0005	47.0005.000c.0002.0000.0231.00

Datagram Destination NSAP Address	Table Entry Number Used
47.0005.000c.0001.0000.3456.01	1
47.0005.000c.0001.6789.2345.01	1
47.0004.1234.1234.1234.1234.01	2
47.0005.0003.4321.4321.4321.01	3
47.0005.000c.0004.5678.5678.01	4
47.0005.0001.0005.3456.3456.01	5

Octet boundaries must be used for the internal boundaries of NSAP addresses and NETs.

Possible Problem	Solution
Missing or mis- configured default gateway specification	Step 1 Determine whether a default gateway is specified in the adjacency table of the host attempting to make a connection. Use the following UNIX command: host% netstat -rn Check the output of this command for a default gateway specification. Syntax Description: netstat---Displays protocol statistics and current TCP/IP1 network connections r---Displays the contents of the routing table n---Displays addresses and port numbers in numeric form Step 2 If the default gateway specification is incorrect, or if it is not present at all, you can change or add a default gateway using the following UNIX command at the local host: host% route add default address 1 where address is the IP address of the default gateway (the router local to the host). The value 1 indicates that the specified gateway is one hop away. Step 3 It is recommended that you specify a default gateway as part of the boot process. Specify the ISO CLNS address of the gateway in the following UNIX host file: /etc/defaultrouter This filename might be different on your UNIX system.
End system has no Level 1 router	Step 1 Use the show clns neighbors detail privileged exec command to show all ESs2 and ISs3 to which the router is directly connected. Step 2 Make sure there is at least one Level 1 router on the same network as the end system.
Level 1 router or ES has bad address	Step 1 Verify that the Level 1 router has the same address as the ES. Step 2 Verify that all bytes of the NSAP4 address, up to but not including the system ID, are the same on both the router and the ES. The domain and area addresses must match, and the station IDs must be unique. (The value of the n-selector byte has no impact in this case.)
ES host is not running ES-IS5 protocol	Step 1 Use the appropriate host commands to verify that an ES-IS process is running. If necessary, initiate the ES-IS process on the host. Step 2 Check the adjacency database on the host and verify that it has an entry for its directly connected router. Step 3 Use the debug clns packet privileged exec command on the Level 1 router to verify that it sees and forwards packets from the ES. Caution: Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, use debug commands only to troubleshoot specific problems or during troubleshooting sessions with Cisco technical support staff. Moreover, it is best to use debug commands during periods of lower network traffic and fewer users. Debugging during these periods decreases the likelihood that increased debug command processing overhead will affect system use. Step 4 If necessary, statically configure the router to recognize the ES by using the clns es-neighbor interface configuration command. The following is the syntax for the clns es-neighbor command: clns es-neighbor nsap snpa Syntax Description: nsap---Specific NSAP to map to a specific MAC6 address. snpa---Data link (MAC) address. Example: The following example defines an ES neighbor on Ethernet interface 0: interface ethernet 0 clns es-neighbor 47.0004.004D.0055.0000.0C00.A45B.00 0000.0C00.A45B In this case, the end systems with the following NSAP, or NET7, are configured with an Ethernet MAC address of 0000.0C00.A45B: 47.0004.004D.0055.0000.0C00.A45B.00
Router between hosts is down	Step 1 Use the trace exec command to check connectivity between routers and the source ES. Step 2 If the trace fails at a router, use the show clns neighbors exec command to see which neighboring routers and ESs are recognized. Sample Display: The following is sample output from the show clns neighbors command. This display is a composite of the show clns es-neighbor and show clns is-neighbor commands: router# show clns neighbors System Id SNPA Interface State Holdtime Type Protocol 0000.0000.0007 aa00.0400.6408 Ethernet0 Init 277 IS ES-IS 0000.0C00.0C35 0000.0c00.0c36 Ethernet1 Up 91 L1 IS-IS 0800.2B16.24EA aa00.0400.2d05 Ethernet0 Up 29 L1L2 IS-IS 0800.2B14.060E aa00.0400.9205 Ethernet0 Up 1698 ES ES-IS 0000.0C00.3E51 *HDLC* Serial1 Up 28 L2 IS-IS 0000.0C00.62E6 0000.0c00.62e7 Ethernet1 Up 22 L1 IS-IS 0A00.0400.2D05 aa00.0400.2d05 Ethernet0 Init 24 IS ES-IS Step 3 If neighboring routers and end systems are up, perform one of the following procedures: For ISO-IGRP8, check the routing table and see whether the routes are being learned. Use the show clns route exec command to display the routing tables. For IS-IS9, check the LSP10 database to see whether the links are being reported in link state advertisements. Check the IS-IS routing table to see whether the routes are being installed in the routing table. Use the show isis database detail exec command to display the routing tables.
Route redistribution problem	Misconfigured route redistribution can cause connectivity problems. For specific troubleshooting information, see the section "ISO CLNS: Redistribution Causes Routing Problems" later in this chapter.

1TCP/IP = Transmission Control Protocol/Internet Protocol 2ES = end system 3IS = intermediate system 4NSAP = Network service access point 5ES-IS = End System-to-Intermediate System 6MAC = Media Access Control 7NET = network entity title 8IGRP = Interior Gateway Routing Protocol 9IS-IS = Intermediate System-to-Intermediate System 10LSP = Link State Protocol

Possible Problem	Solution
Area address is configured incorrectly on the host	Step 1 Check all Level 1 routing tables and link-state databases. Step 2 Verify that the hosts are in the same area. Step 3 Check that the NSAP address is entered correctly on the hosts.
Different area addresses are merged into a single area, but the router is configured incorrectly	Step 1 Use the show running-config privileged exec command to see router configurations. Check whether multiple area addresses are configured. Step 2 If multiple network addresses are configured, verify that the router is configured to support a multihomed area (a single area that has more than one area address; see Figure 12-3). Step 3 To communicate, routers must establish a Level 1 adjacency. Therefore, area addresses in a multihomed area must overlap across routers. For example, in the multihomed area shown in Figure 12-3, to configure Area 1 and Area 2 as a multihomed area, both Router A and Router B must be configured to be in both areas. IS-IS routing supports the assignment of multiple area addresses on the same router. This concept is referred to as multihoming. Multihoming provides a mechanism for smoothly migrating network addresses, as follows: Splitting up an area---Nodes within a given area can accumulate until they are difficult to manage, cause excessive traffic, or threaten to exceed the usable address space for an area. Multiple area addresses can be assigned so that you can smoothly partition a network into separate areas without disrupting service.
Different area addresses are merged into a single area, but the router is configured incorrectly	Merging areas---Use transitional area addresses to merge as many as three separate areas that have a common area address into a single area. Transition to a different address---You may need to change an area address for a particular group of nodes. Use multiple area addresses to allow incoming traffic intended for an old area address to continue being routed to associated nodes. You must statically assign the multiple area addresses on the router. Cisco currently supports assignment of up to three area addresses on a router. The number of areas allowed in a domain is unlimited. All the addresses must have the same system ID. For example, you can assign one address (area1 plus system ID) and two additional addresses in different areas (area2 plus system ID and area3 plus system ID) where the system ID is the same. Step 4 Alternatively, one router can be configured in both areas, while the other router remains configured for a single area. Provided that the area numbers on routers overlap, the routers will establish a Level 1 adjacency, allowing them to communicate.
ES host is not running ES-IS protocol	Step 1 Use the appropriate host commands to verify that an ES-IS process is running. If necessary, initiate the ES-IS process on the host. Step 2 Check the adjacency database on the host and verify that it has an entry for its directly connected router. Step 3 Use the debug clns packet privileged exec command on the Level 1 router to verify that it sees and forwards packets from the ES.
ES host is not running ES-IS protocol	Caution: Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, use debug commands only to troubleshoot specific problems or during troubleshooting sessions with Cisco technical support staff. Moreover, it is best to use debug commands during periods of lower network traffic and fewer users. Debugging during these periods decreases the likelihood that increased debug command processing overhead will affect system use. Step 4 If necessary, statically configure the router to recognize the ES by using the clns es-neighbor interface configuration command. The following is the syntax for the clns es-neighbor command: clns es-neighbor nsap snpa Syntax Description: nsap---Specific NSAP to map to a specific MAC address. snpa---Data link (MAC) address. Example: The following example defines an ES neighbor on Ethernet interface 0: interface ethernet 0 clns es-neighbor 47.0004.004D.0055.0000.0C00.A45B.00 0000.0C00.A45B
Route redistribution problem	Misconfigured route redistribution can cause connectivity problems. For specific troubleshooting information, see the section "ISO CLNS: Redistribution Causes Routing Problems" later in this chapter.

Possible Problem	Solution
Level 2 routers are not routing packets to the correct area	Step 1 Use the trace command to verify that Level 1 routers are routing packets to the nearest Level 2 router. Sample Display: The following display shows an example of ISO CLNS trace output: router# trace Protocol [ip]: clns Target CLNS address: thoth Timeout in seconds [3]: Probe count [3]: Minimum Time to Live [1]: Maximum Time to Live [30]: Type escape sequence to abort. Tracing the route to THOTH (55.0006.0100.0000.0000.0001.8888.1112.1314.1516) HORUS(55.0006.0100.0000.0000.0001.6666.3132.3334.3536) 32 msec ! 28 msec 28 msec ! 2 ISIS(55.0006.0100.0000.0000.0001.7777.2122.2324.2526) 56 msec ! 80 msec 56 msec ! 3 THOTH(55.0006.0100.0000.0000.0001.8888.1112.1314.1516) 80 msec ! 80 msec ! 8
	Step 2 Use the trace exec command to verify that Level 2 routers are routing packets to the correct destination area. Step 3 If packets are not being routed to the correct area, check the Level 2 routing tables (ISO-IGRP1) or the Level 2 link state databases (IS-IS) to see whether the packets are being forwarded to another area. Step 4 If necessary, reconfigure routers with the correct area addresses and Level 2 (IS-IS) routing information.
ES host is not running ES-IS protocol	Step 1 Use the appropriate host commands to verify that an ES-IS process is running. If necessary, initiate the ES-IS process on the host. Step 2 Check the adjacency database on the host and verify that it has an entry for its directly connected router. Step 3 Use the debug clns packet privileged exec command on the Level 1 router to verify that it sees and forwards packets from the ES. Caution: Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, use debug commands only to troubleshoot specific problems or during troubleshooting sessions with Cisco technical support staff. Moreover, it is best to use debug commands during periods of lower network traffic and fewer users. Debugging during these periods decreases the likelihood that increased debug command processing overhead will affect system use. Step 4 If necessary, statically configure the router to recognize the ES by using the clns es-neighbor interface configuration command.
Route redistribution problem	Misconfigured route redistribution can cause connectivity problems. For specific troubleshooting information, see the section "ISO CLNS: Redistribution Causes Routing Problems" later in this chapter.
Router between hosts is down	Step 1 Use the trace exec command to check connectivity between routers and the source ES. Sample Display: The following display shows an example of ISO CLNS trace output: router# trace Protocol [ip]: clns Target CLNS address: thoth Timeout in seconds [3]: Probe count [3]: Minimum Time to Live [1]: Maximum Time to Live [30]: Type escape sequence to abort. Tracing the route to THOTH (55.0006.0100.0000.0000.0001.8888.1112.1314.1516) HORUS(55.0006.0100.0000.0000.0001.6666.3132.3334.3536) 32 msec ! 28 msec 28 msec ! 2 ISIS(55.0006.0100.0000.0000.0001.7777.2122.2324.2526) 56 msec ! 80 msec 56 msec ! 3 THOTH(55.0006.0100.0000.0000.0001.8888.1112.1314.1516) 80 msec ! 80 msec ! 8 Step 2 If the trace fails at a router, use the show clns neighbors exec command to see which neighboring routers and ESs are recognized. Step 3 If neighboring routers and end systems are up, perform one of the following procedures: For ISO-IGRP, check the routing table and see whether the routes are being learned. Use the show clns route exec command to display the routing tables. For IS-IS, check the LSP2 database to see whether the links are being reported in link state advertisements. Check the IS-IS routing table to see whether the routes are being installed in the routing table. Use the show isis database detail exec command to display the routing tables.

1IGRP = Interior Gateway Routing Protocol 2LSP = Link State Protocol

Possible Problem	Solution
Host is not configured to support the service	Verify that the needed protocols are correctly installed and configured on the host system. Consult your vendor's documentation for information on configuring hosts.
Misconfigured access list	Step 1 Use the trace exec command to determine the path taken to reach remote hosts. Step 2 If you discover a router that is stopping traffic, use the show access-lists privileged exec command to see whether any access lists are configured on the router. Step 3 Disable all access lists on the router using no access-group interface configuration commands on the appropriate interfaces. Step 4 Determine whether hosts can now use the protocol in question. If traffic can get through, it is likely that an access list is blocking protocol traffic. Step 5 Make sure the access list does not filter traffic from ports that are used by the protocol in question. Configure explicit permit statements for traffic that you want the router to forward normally. Step 6 Enable the access list and verify that the protocol still functions correctly. If problems persist, continue isolating and analyzing access lists on all routers in the path from source to destination.

Possible Problem	Solution
Routing has not converged	Step 1 Use the show clns route privileged exec command to view the CLNS routing table. Examine the table for routes listed as "possibly down." This indicates that the routing protocol has not converged. Step 2 Wait for the routing protocol to converge. Use the show clns route command again to see whether the routes are now up. Note: ISO-IGRP does load balancing only for domain prefix routes. If you are doing Level 1 or Level 2 routing in ISO-IGRP, only a single path is maintained. If that path goes down, you must wait for the network to converge before the alternate path is available.
Misconfigured access list	Step 1 Use the trace exec command to determine the path taken to reach remote hosts. Step 2 If you discover a router that is stopping traffic, use the show access-lists privileged exec command to see whether any access lists are configured on the router. Step 3 Disable all access lists on the router using no access-group interface configuration commands on the appropriate interfaces. Step 4 Determine whether hosts can now use the protocol in question. If traffic can get through, it is likely that an access list is blocking protocol traffic. Step 5 Make sure the access list does not filter traffic from ports that are used by the protocol in question. Configure explicit permit statements for traffic that you want the router to forward normally. Step 6 Enable the access list and verify that the protocol still functions correctly. If problems persist, continue isolating and analyzing access lists on all routers in the path from source to destination.
Hardware or media problem	For information on troubleshooting hardware problems, see "Troubleshooting Hardware and Booting Problems." For information on troubleshooting media problems, refer to the media troubleshooting chapter that covers the media type used in your network.

Possible Problem	Solution
Misordered sequence numbers	The sequence numbers used in route-map router configuration commands determine the order in which conditions are tested. Misordered sequence numbers can cause redistribution problems. Step 1 Use the show running-config privileged exec command to display the router configuration. Look for route-map router configuration command entries. Step 2 If route-map commands are configured, look at the sequence numbers that are assigned. Lower sequence numbers are tested before higher sequence numbers, regardless of the order in which they are listed in the configuration. Step 3 If conditions are not being tested in the order you want, you must modify the sequence numbers to change the testing order. The syntax for the route-map command to adjust the sequence number is as follows: route-map map-tag {permit | deny} sequence-number Syntax Description: map-tag---Meaningful name for the route map. The redistribute command uses this name to reference this route map. Multiple route maps can share the same map tag name. Can either be an expression or a filter set. permit---If the match criteria are met for this route map and permit is specified, the route is redistributed as controlled by the set actions. If the match criteria are not met, and permit is specified, the next route map with the same map tag is tested. If a route passes none of the match criteria for the set of route maps sharing the same name, it is not redistributed by that set.
Misordered sequence numbers	deny---If the match criteria are met for the route map and deny is specified, the route is not redistributed and no further route maps sharing the same map tag name will be examined. sequence-number---Number that indicates the position a new route map is to have in the list of route maps already configured with the same name. If given with the no form of this command, it specifies the position of the route map that should be deleted.
Missing or misconfigured default-metric command	Step 1 Use the show running-config exec command to view the router configuration. Look for a default-metric router configuration command entry. Step 2 If the default-metric router configuration command or the distance router configuration command is missing, add the appropriate version of the missing command. Syntax: The following is the syntax for the default-metric command: default-metric number Syntax Description: number---Default metric value appropriate for the specified routing protocol. Syntax: The following is the syntax for the distance command: distance value [clns] Syntax Description: value---Administrative distance, indicating the trustworthiness of a routing information source. This argument has a numeric value between 0 and 255. A higher relative value indicates a lower trustworthiness rating. Preference is given to routes with smaller values. The default, if unspecified, is 110. clns---(Optional) CLNS-derived routes for IS-IS. Refer to the Cisco IOS Network Protocols Configuration Guide, Part 2 and Network Protocols Command Reference, Part 2 for information about adjusting ISO CLNS default metrics.
Missing or misconfigured distance command	Step 1 Use the show running-config exec command to view the router configuration. Look for a distance router configuration command entry. Step 2 If the distance command is missing, configure a distance specification on the router. Use the distance router configuration command to configure the administrative distance for CLNS routes learned. Syntax: The following is the syntax for the distance command: distance value [clns] Syntax Description: value---Administrative distance, indicating the trustworthiness of a routing information source. This argument has a numeric value between 0 and 255. A higher relative value indicates a lower trustworthiness rating. Preference is given to routes with smaller values. The default, if unspecified, is 110. clns---(Optional) CLNS-derived routes for IS-IS. Example: In the following example, the distance value for CLNS routes learned is 90. Preference is given to these CLNS routes rather than routes with the default administrative distance value of 110: router isis distance 90 clns
Redistribution feedback loop exists	Redistribution between an IS-IS cloud and an ISO-IGRP cloud should be performed only at a single point. If it is not, routing information can be advertised back into one of the clouds, causing routing feedback loops. Examples: The following example illustrates redistribution of ISO-IGRP routes of Michigan and ISO-IGRP routes of Ohio into the IS-IS area tagged USA: router isis USA redistribute iso-igrp Michigan redistribute iso-igrp Ohio The following example illustrates redistribution of IS-IS routes of France and ISO-IGRP routes of Germany into the ISO-IGRP area tagged Backbone: router iso-igrp Backbone redistribute isis France redistribute iso-igrp Germany If you must redistribute at another point, use default metrics to perform the redistribution in one direction only. Refer to the Cisco IOS Network Protocols Configuration Guide, Part 2 and Network Protocols Command Reference, Part 2 for information about adjusting ISO CLNS default metrics.

Possible Problem	Solution
Multiple ISO-IGRP processes are configured on a single interface	Step 1 Use the show clns interface exec command to view the interface configuration. Look for multiple ISO-IGRP processes that are configured on a single interface. Step 2 If multiple ISO-IGRP processes are configured on a single interface, different Level 2 updates are being sent out through the same interface. Multiple Level 2 updates on the same interface can cause congestion problems, especially if the network is large and links are flapping outside the damping intervals. Flapping is a routing problem where an advertised route between two nodes alternates (flaps) back and forth between two paths due to a network problem that causes intermittent interface failures. Step 3 Remove one of the ISO-IGRP processes from the interface configuration using the appropriate no clns router iso-igrp interface configuration command.
Bridge or repeater in parallel with router	A bridge or repeater in parallel with a router can cause updates and traffic to be seen from both sides of an interface. Step 1 Use the show clns is-neighbors detail and the show clns neighbors detail exec commands to see through which routers and protocols the router's adjacencies were learned.
Bridge or repeater in parallel with router	The following is sample output from the show clns neighbors detail command: router# show clns neighbors detail System Id SNPA Interface State Holdtime Type Protocol 000.0000.0007 aa00.0400.6408 Ethernet0 Init 291 IS ES-IS Area Address(es): 47.0005.80FF.F500.0000.0003.0020 0000.0C00.0C35 0000.0c00.0c36 Ethernet1 Up 94 L1 IS-IS Area Address(es): 47.0004.004D.0001 39.0001 0800.2B16.24EA aa00.0400.2d05 Ethernet0 Up 9 L1L2 IS-IS Area Address(es): 47.0004.004D.0001 0800.2B14.060E aa00.0400.9205 Ethernet0 Up 1651 ES ES-IS Area Address(es): 49.0040 0000.0C00.3E51 *HDLC* Serial1 Up 27 L2 IS-IS Area Address(es): 39.0004 0000.0C00.62E6 0000.0c00.62e7 Ethernet1 Up 26 L1 IS-IS Area Address(es): 47.0004.004D.0001 oA00.0400.2D05 aa00.0400.2d05 Ethernet0 Init 29 IS ES-IS Area Address(es): 47.0004.004D.0001 Look for routers that are known to be on a remote network. A router listed in the adjacency table but that is not on a directly connected network indicates a problem. You can also look for paths to networks (or areas) on multiple interfaces. Step 2 If you determine that there is a parallel bridge or repeater, remove the device or configure filters that block routing updates from being learned from the device.
Route redistribution problem	Misconfigured route redistribution can cause performance problems. For specific troubleshooting information, see the section "ISO CLNS: Redistribution Causes Routing Problems" earlier in this chapter.