LISP Basics — Locator/ID Separation Protocol

The one-sentence mental model

LISP replaces “route based on the destination IP” with “look up where the destination IP lives, then tunnel to that RLOC.” The destination endpoint’s IP (the EID) never has to be advertised into the underlay — the mapping system knows where it is. This decouples endpoint mobility from routing-table churn.

The two address spaces

• EID (Endpoint Identifier) — the address the host actually uses. 10.10.5.42/32.
• RLOC (Routing Locator) — the routable address of the router that currently reaches that EID. 203.0.113.1.

EIDs are in the overlay (host space). RLOCs are in the underlay (transit space). A single EID can appear behind different RLOCs at different times — that’s mobility.

The four roles

Role	Job	Analogy
ITR (Ingress Tunnel Router)	Encapsulates traffic. Looks up “which RLOC has this destination EID?” and wraps the packet in LISP.	The sender’s “which post office ships to Bob today?”
ETR (Egress Tunnel Router)	Decapsulates. Registers its EIDs with the mapping system so others know how to reach them.	The receiver’s local post office.
MS (Map-Server)	Stores mappings. ETRs register their EIDs to the MS.	Post-office HQ registry.
MR (Map-Resolver)	Answers lookups. ITRs query the MR to find an EID’s RLOC.	Post-office HQ query desk.

Same box can play multiple roles. A Catalyst 9500 running IOS-XE can be MS+MR+ITR+ETR simultaneously.

The lookup flow

1. Host at EID 10.10.1.5 sends packet to EID 10.10.5.42.
2. Local router acts as ITR. Doesn't know 10.10.5.42.
3. ITR queries Map-Resolver: "who has 10.10.5.42?"
4. MR returns: "RLOC 203.0.113.10, priority 10, weight 100"
5. ITR wraps original packet in LISP (UDP 4341) with outer dst 203.0.113.10.
6. Packet crosses underlay via normal IP routing.
7. ETR at 203.0.113.10 decaps → forwards to 10.10.5.42 on its local segment.

The mapping is cached at the ITR. Subsequent packets skip steps 3–4.

Sample IOS-XE config (ITR + ETR combined)

router lisp
  eid-table default instance-id 4100
    database-mapping 10.10.5.0/24 203.0.113.10 priority 10 weight 100
    exit-eid-table

  ipv4 itr map-resolver 198.51.100.5
  ipv4 etr map-server 198.51.100.5 key mysecret
  ipv4 itr
  ipv4 etr
exit

Where you actually see LISP

Cisco SD-Access

The whole DNAC / Catalyst Center SD-Access fabric is LISP under the hood:

• Fabric edge nodes are ITR/ETR.
• Fabric control-plane node runs MS/MR.
• Endpoint identity (EID) is separate from where the endpoint plugs in (RLOC), enabling wired + wireless roaming with consistent policy.

If SD-Access is on the ENCOR blueprint, LISP is the mechanism behind every “seamless roam.”

LISP as a BGP alternative

Some ISPs and CDNs use LISP for traffic engineering — advertising the same EID prefix from multiple RLOCs with priority/weight. Manipulate the reply to steer inbound traffic without touching BGP.

Cisco IWAN legacy

Older Intelligent WAN designs used LISP for path selection. Superseded by SD-WAN, but still on some blueprints.

Priority + weight

Each EID can be behind multiple RLOCs. The mapping reply carries per-RLOC priority (lower wins) and weight (load-share within same priority):

EID 10.10.5.0/24
  RLOC 203.0.113.10  priority 10 weight 100    ← primary
  RLOC 203.0.113.20  priority 20 weight 100    ← backup

Common exam / real-world mistakes

1. Confusing EID and RLOC direction. EID is what the host uses. RLOC is what the underlay routes to. Draw the two spaces; keep them separate mentally.
2. Forgetting to register EIDs. ETR must send Map-Register messages to the MS. If it doesn’t, no ITR can find the EID.
3. Underlay reachability of RLOCs. MS/MR + all RLOCs must be reachable in the underlay (typically via OSPF / BGP). If the underlay routing to the RLOC breaks, LISP breaks.
4. Instance-id vs VRF. LISP uses instance-id to segment overlays (multi-tenant). Maps 1:1 to the VRF concept but not identical config.
5. UDP 4341 blocked by firewalls. Both the LISP control (UDP 4342) and data (UDP 4341) must be permitted end-to-end.

Cheat strip

EID   endpoint identity (host address). Overlay.
RLOC  router locator on the underlay.

Roles ITR = encaps, does lookup
      ETR = decaps, registers EIDs
      MS  = stores mappings (registration target)
      MR  = answers lookups (resolution target)

Ports UDP 4341 data  |  UDP 4342 control
Flow  ITR asks MR → MR replies with RLOC → ITR encaps → ETR decaps

Where SD-Access fabric under the hood
      Optional BGP alternative for TE
      Instance-id = per-VRF overlay segmentation