Network Service Access Point (NSAP) Addressing

Cisco IOS supports both the ISO-developed IS-IS routing protocol and the Cisco IOS Interior Gateway Routing Protocol (IGRP) for dynamic routing of ISO CLNS, as well as static routing for ISO CLNS. ISO CLNS is a standard for the network layer of the OSI reference model. Understanding the NSAP addresses is important for learning and implementing CLNS and IS-IS. Cisco IOS supports all NSAP address formats defined by ISO 8348/AD2; however, Cisco IOS supports the ISO IGRP and IS-IS dynamic routing protocols only for NSAP addresses that conform to the ISO 10589 standard for IS-IS.

CLNS addresses in the ISO network layer are called Network Service Access Points (NSAPs) and Network Entity Titles (NETs). Each node in an OSI network often has many NSAP and NET addresses. Each NSAP differs from one of the NETs for that node in only the last byte – the NSAP-selector (NSEL), which identifies a process or upper-layer service on a device; similar to the transport layer port number and network layer Protocol field in the TCP/IP suite. When an NSAP is specified with an NSEL of 0, the NSAP is called the NET. The NET refers to the device itself, which is equivalent to the Layer 3 OSI address of the device. Routers use NETs similar to OSPF Router IDs to identify themselves in the IS-IS Link-State PDUs (LSPs) used to distribute link-state information – the basis for the OSI routing calculation; and the SPF calculations rely on NET addresses to identify routers for its operation.

IS-IS provides a large and hierarchical addressing scheme. Its addressing scheme is designed for global addressing instead of local addressing. CLNS uses long variable-length NSAP addresses up to a maximum of 20 bytes, making it a viable successor to IPv4. At the time when the IETF community started to design the next-generation IP (before IPv6 appeared on the drawing board), the proposals to use CLNS were taken pretty seriously. However in the end, IETF decided to invent another protocol – IPv6, which effectively quadrupling the IPv4 address space while retaining most of the benefits and drawbacks of IPv4. The technical explanation for this decision was the variable-length CLNS addresses make the hardware implementation of layer 3 forwarding pretty complex; while some of the real reasons are probably the not-invented-here syndrome, and the lack of total control over a new protocol inherited from another organization.

An NSAP address consists of the OSI network address and the info of the upper-layer protocols; which is equivalent to the combination of the IP address and the Protocol field that identifies upper-layer protocols in an IP header.

NSAP addresses have a maximum size of 20 bytes. Various uses require definition of different address structure. The high-order bits identify the inter-area structure, while the low-order bits identify the unique systems within an area (intra-area).

OSI, ISO IGRP, and IS-IS NSAP Address Structures

The NSAP address for IS-IS and Integrated IS-IS consists of 3 fields – Area Address, System Address, and NSEL. The length of the area address can range from 1 to 13 bytes; therefore an NSAP address of an OSI device can be as little as 8 bytes in length. However, the NSAP is usually longer for finer granularity of the allocation of areas.

The ISO 10589 NSAP addresses consist of the following:

• The Initial Domain Part (IDP) of a NSAP address consists of the 1-byte Authority and Format Identifier (AFI) and the variable-length Initial Domain Identifier (IDI). The IDP is similar to an IP classful major network. The AFI byte specifies the authority that assigned the address and the format of the address. The length of the IDI and the encoding format of the DSP of an NSAP address are based on the value of the AFI. Below lists some valid AFI values:
  

  AFI	Address Domain
  39	ISO Data Country Code (DCC)
  45	E.164
  47	ISO 6523 International Code Designation (ICD)
  49	Locally administered (private). Similar to private addresses defined in RFC 1918. IS-IS routes these addresses. However, these addresses should not be advertised to other CLNS networks because they are ad-hoc addresses. Organizations which implemented private addressing schemes may face issues upon merger.

  The IDI identifies a sub-domain under the AFI, eg: 47.0005 is assigned to civilian departments of the US Government; while 47.0006 to the US Department of Defense.
• The Domain-Specific Part (DSP) is used for routing within an IS-IS routing domain. The DSP of a NSAP address is comprised of the High-Order Domain-Specific Part (HO-DSP), system identifier (System ID), and NSAP selector (NSEL). The HO-DSP subdivides the domain into areas. The HO-DSP is the OSI equivalent of a subnet in IP. The System ID identifies an individual OSI device. In OSI, each device has an address; whereas in IP, each interface has an address that belongs to a different subnet. The NSEL identifies a process or service on the device and is not being used for routing.

The IDP is used for external routing between autonomous systems. It is assigned and standardized by ISO to identify organizations, and the organizations are responsible for assigning the format for the rest of the address by defining the DSP structure – the DSP is not standardized. The fact that ISO CLNS NSAP address can take so many forms often causes confusion. There is an address format recommended by the US GOSIP, ANSI, and UK GOSIP.

US GOSIP, ANSI, and UK GOSIP NSAP Address Structure

The simplest NSAP format when running IS-IS as an IGP, comprises the following:

• The Area Address, which must be at least 1 byte, separated into the 2 following parts:
  
  • The AFI set to 49, which designates locally administered and therefore individual addresses can be assigned by the organization.
  • The Area ID, the octets of the area address after the AFI, must be at least 1 byte.
• The System ID. All System IDs within an IS-IS routing domain must be the same length. Cisco enforces this OSI directive by fixing the length of the System ID at 6 bytes. Cisco IOS is compliant with the US Government OSI Profile (GOSIP) Version 2.0 standard which requires a 6-byte System ID.
• The NSEL, which must always be set to 0 for a router. The NSAP is called the NET when it has an NSEL of 0. Routers use NETs to identify themselves in the IS-IS PDUs.

The Area Address is like an IP subnet; the System ID is like the host portion of an IP address. The ISO CLNS NSAP address is assigned to system instead of interface as with TCP/IP.

A sample CLNS NSAP address is 49.0001.0000.0c12.3456.00, which represents the following:

• AFI of 49.
• Area ID of 0001.
• System ID of 0000.0c12.3456, the MAC address of a LAN interface on the device.
• NSEL of 0. The CLNS NSAP address is a NET which identifies a device.

A Cisco router interprets the first byte of an NSAP address as the AFI, the last byte as the NSEL, the preceding 6 bytes are System ID, and anything else as the area address.

Note: Sometimes the area address is also being referred to as the prefix.
Many IS-IS documentation uses the terms Area ID and Area Address interchangeability.

The 1st part of an NSAP is the Area Address and is associated with the IS-IS routing process. All devices within an area must have the same area address, which actually defines the area. The area address is used in L2 routing. Unlike OSPF which a router can reside in multiple areas, an IS-IS router can be a member of only one area.

IS-IS Routers are Members of Only One Area

ESs recognize only other ESs and ISs on the same subnetwork that share the same area address.

The 6-byte NSAP System ID must be unique within an area. The MAC address of a router is often being used as the System ID for the router; while for Integrated IS-IS, an IP address of a router is often being encoded as the System ID, eg: 192.168.0.1 > 1921.6800.0001.

L1 intra-area routing is based on System IDs; therefore, each ES and IS must have a unique System ID within the area. All L2 and L1/L2 ISs recognize themselves in the IS-IS backbone; therefore, they must also have unique System IDs. As a conclusion, the System IDs should remain unique throughout an IS-IS routing domain. When the System IDs remain unique, there can never be a conflict at L1 or L2 if when a device moves between different areas.

The 1-byte NSEL field in of an NSAP identifies a process or upper-layer service on a device; similar to the transport layer port number and network layer Protocol field in the TCP/IP suite. NET addresses are NSAP addresses with an NSEL value of 0. A NET address is actually the NSAP address is used to uniquely identify an OSI host within an IS-IS routing domain. Since IS-IS is originated from the OSI world and routing information is carried in IS-IS updates, NET addresses are still required even if the only routed protocol is IP.

3 additional IS-IS terms related to NET addresses – Subnetwork Point of Attachment (SNAP), Circuit ID, and Link are introduced in the figure below.

SNAP, Circuit ID, and Link

The Subnetwork Point of Attachment (SNPA) provides subnetwork (data link layer) services, which are the physical connection to a medium and the services offered to the physical and network layers. SNPA address is same as the Layer 2 address and is assigned using:

• The MAC address on a LAN interface.
• The Virtual Circuit ID from X.25 or ATM connection, or the Data-Link Connection Identifier (DLCI) from Frame Relay connection.
• SNPA is simply set to *HDLC* for High-Level Data Link Control (HDLC) interfaces.

A Circuit is the IS-IS term for an interface. Since the NSAP and NET refer to the entire device, therefore a Circuit ID is used to distinguish a particular interface. A router assigns a 1-byte Circuit ID to each of its interfaces as follows:

• In the case of point-to-point interfaces, the SNPA is the sole identifier for the circuit. Ex: For an HDLC point-to-point link, the Circuit ID is 0x00.
• In the case of LAN interfaces, the Circuit ID is appended to the end of the System ID of the Designated IS (DIS) to form a 7-byte LAN ID, eg: 1921.6800.0001.01. On Cisco routers, the router hostname is used instead of the System ID; therefore the Circuit ID of a LAN interface may look like P1R1.01.
  Note: The Designated IS (DIS) will be discussed in more detail later.
  

A Link is the path between 2 neighboring ISs. It is defined as being up when communication is possible between 2 neighboring SNPAs. It is transmitted to all other ISs within an area via LSPs.