Technical Tip: Solving IS-IS FortiGate to Cisco adjacency issue when jumbo frames are used

As a primer, IS-IS transmits Hello packets to establish adjacencies between peers. One of the established behaviors for Hello packets is that they must be transmitted to the full size of the MTU for the configured link. This was done by adding padding on top of the actual Hello packet's contents until the packet reaches the link MTU, and it was used as a means of detecting MTU mismatches between IS-IS peers.

However, while this padding is generally not an issue, it does become an issue when forming IS-IS adjacencies between the FortiGate and Cisco routers. When jumbo frames are enabled (such as by setting MTU to 9216 bytes), some Cisco devices may also start transmitting IS-IS Hello packets with an EtherType value of 0x8870. This was due to a proposed standard that Cisco implemented, which was ultimately not implemented/accepted by the rest of the industry.

When both of the above behaviors are combined (padding up to MTU and unexpected EtherType 0x8870 for Cisco jumbo frames), IS-IS adjacencies will not successfully form between a Cisco router and the FortiGate. The unexpected EtherType 0x8870 appears to add several more bytes to the total length than expected, which results in an MTU mismatch.

Solution/workaround:

To resolve this issue, IS-IS Hello padding must be disabled on both the FortiGate and the Cisco router. This disables MTU mismatch checks for Hello packets and allows the adjacency to form.

To disable Hello padding on the FortiGate, run the following commands:

config router isis
    config isis-interface
        edit <interface_name>
            set hello-padding disable
        next
    end
end

On the Cisco side, the command no hello padding always must be added to the interface to fully disable the addition of Hello packet padding. Refer to the following Cisco documentation for more information: IS-IS Hello Padding Behavior.

As an alternative, consider setting the interface MTU to a value lower than 9000 bytes when forming adjacencies with Cisco devices, as this should help to avoid the transmission of EtherType 0x8870.

Related article:

Technical Tip: FortiGate Intermediate System-Intermediate System (IS-IS) configuration example