CCNP Service Provider cheat sheet

Access–aggregation–core hierarchy: access terminates subscriber lines (DSL/FTTx/cellular), aggregation concentrates and applies policy (BNG, QoS, subscriber management), core provides high-capacity label-switched transport between PoPs.

Typical SP core capacity ratio is roughly access:aggregation:core = 1:10:100; design aggregation uplinks so no single link exceeds ~50% utilization at busy hour to absorb failure of a peer link.

PoP design rule: dual core routers per PoP, each with at least two diverse uplinks to different backbone paths; a PoP must survive loss of one core router and one inter-PoP link without losing subscriber sessions.

OSPF area design in SP cores: keep the backbone area 0 contiguous, put aggregation/access rings in stub or totally stubby non-backbone areas, and size areas to roughly 50–100 routers to bound SPF churn.

IS-IS is preferred for large SP cores because it runs directly on L2 (CLNS), scales with multi-level hierarchy, and uses TLV extensibility for traffic engineering and IPv6; OSPF remains common in enterprise-facing PE/CE edges.

BGP design: full mesh or route reflectors inside an AS, eBGP only on AS boundaries; use a consistent private ASN for internal confederation-free designs or confederations when a single IGP domain cannot span the topology.

Convergence targets: core IGP sub-second (BFD + fast hellos + LFA/TI-LFA), BGP PIC edge for prefix-independent convergence, and NSR/NSF so a control-plane restart does not drop forwarding.

QoS architecture: classify at ingress edge (DSCP or MPLS EXP), police to contracted rates at the aggregation/BNG, and use a small number of forwarding classes (typically 5–8: real-time, interactive, business, best-effort, scavenger) with strict priority reserved for real-time only.

High availability building blocks: redundant supervisors, SSO/NSR, graceful restart, BFD, link aggregation with LACP, and IGP/LDP IGP sync so LDP converges in step with the IGP.

BGP best-path order (simplified): highest weight, highest local preference, locally originated, shortest AS_PATH, lowest origin (IGP<EGP<incomplete), lowest MED, eBGP over iBGP, lowest IGP metric to next hop, oldest route, lowest router ID, lowest neighbor address.

MED is compared only among paths from the same neighboring AS by default; use bgp always-compare-med to change that, and remember missing MED is treated as 0 by default (bgp bestpath med missing-as-worst inverts this).

iBGP rules: routes learned from an iBGP peer are not re-advertised to another iBGP peer (split horizon), next hop is unchanged, and full-mesh or route reflectors are required; RR cluster loops are prevented by CLUSTER_LIST and ORIGINATOR_ID.

Route reflector rules: a route from a non-client is reflected to clients and non-clients; a route from a client is reflected to all peers except the originator; the RR does not change next hop, AS_PATH, or MED.

OSPF LSA types: 1 router, 2 network, 3 summary, 4 ASBR summary, 5 external, 7 NSSA external; type 3/5 filtering at ABRs and ASBRs controls what enters an area, and totally stubby areas allow only a default type 3.

IS-IS levels: L1 intra-area, L2 backbone, L1/L2 routers set the ATT bit to attract L1 traffic toward the nearest L2 exit; by default an L1 router uses a default route toward the nearest L1/L2 router.

MPLS forwarding: LFIB entries map (incoming label, incoming interface) to (outgoing label, outgoing interface); PHP pops the label so the penultimate hop forwards unlabeled to the egress, and implicit-null is advertised for that purpose.

LDP operation: discovery via UDP 646 hellos, session over TCP 646, label binding advertised for connected/IGP routes; LDP-IGP synchronization holds the IGP adjacency until LDP converges on the link.

Fast reroute: LFA computes a precomputed loop-free alternate using the inequality distance(N,D) < distance(N,S) + distance(S,D); remote LFA uses a tunnel to a PQ node when no local LFA exists; TI-LFA uses segment routing to guarantee coverage.

VRF components: RD (8 bytes, makes the prefix unique across the MPLS domain), route targets (extended community, control import/export), and a per-VRF routing table; the RD is prepended to the IPv4 prefix to form the VPNv4 NLRI.

MP-BGP VPNv4/VPNv6 uses address family 1/2 with SAFI 128; the route carries the RD, one or more route targets, the originator's label, and the next hop, which is normally rewritten to the PE loopback.

L3VPN data plane: ingress PE imposes a label stack of {VPN label, transport label}; the P router swaps only the transport label; the egress PE pops the transport label (PHP) and forwards on the VPN label to the VRF.

Route target semantics: export RT on the source VRF must match an import RT on the destination VRF; a hub VRF can import all spoke RTs while spokes import only the hub RT to build hub-and-spoke.

Inter-AS options: Option A back-to-back VRF subinterfaces (per-VRF, no labels exchanged), Option B MP-eBGP between ASBRs carrying VPNv4 with next-hop-self (ASBRs hold all VPN routes), Option C multihop MP-eBGP between PEs with IGP+label redistribution between ASBRs.

L2VPN types: VPWS (point-to-point pseudowire), VPLS (multipoint emulation using a full mesh of pseudowires and MAC learning in the data plane), and EVPN (BGP control plane for MAC/IP advertisement with multihoming via Ethernet Segment and DF election).

EVPN route types: 1 Ethernet Auto-Discovery, 2 MAC/IP advertisement, 3 Inclusive Multicast Ethernet Tag, 4 Ethernet Segment, 5 IP Prefix; type 2 carries the MAC and optional IP and is used for ARP/ND suppression.

Pseudowire signaling: LDP (RFC 8077 FEC 128 for static, FEC 129 for BGP autodiscovery) or BGP; control word is required for some encapsulations to preserve sequencing and pad small frames.

TE tunnel basics: RSVP-TE with CSPF uses IGP TE extensions (link bandwidth, affinity, admin groups) to compute a path; FRR with facility backup creates a bypass tunnel and uses label stacking to protect the protected LSP.

Model-driven telemetry replaces periodic SNMP polling with a subscription: the collector sends a subscription (dial-in or dial-out), the device streams YANG-modeled data at a configured sample interval with optional on-change triggers.

NETCONF runs over SSH (TCP 830) using XML RPCs (get-config, edit-config, commit, lock); RESTCONF maps the same YANG data to HTTP verbs (GET, POST, PUT, PATCH, DELETE) with JSON or XML payloads.

YANG models: openconfig models are vendor-neutral and preferred for multi-vendor automation; native models (e.g., Cisco-IOS-XE) expose full device features but are vendor-specific; IETF models cover standard structures.

Configuration workflow: candidate datastore + commit (with confirmed-commit and rollback) allows transactional changes; replace versus merge operations determine whether absent nodes are removed.

gNMI uses protobuf over HTTP/2 and supports Get, Set, Subscribe (stream, once, poll) and Capabilities; it is the transport most commonly paired with model-driven telemetry.

Assurance data sources: SNMP counters (interface, queue drops), syslog, flow telemetry (NetFlow/IPFIX/sFlow), streaming telemetry, and synthetic probes (IP SLA) for latency, jitter, and path availability.

IP SLA operation types include ICMP echo, UDP jitter, and UDP echo; results feed tracking objects that can withdraw static routes or shift traffic when thresholds are breached.

Segment routing assurance: SR-TE policies carry a segment list (SID stack); path verification compares the received SID list against the intended list, and TI-LFA provides sub-50 ms protection without RSVP state.

Automation safety: use out-of-band management with AAA (TACACS+/RADIUS), version control for configs and templates, pre/post-change validation, and canary deployment before fleet-wide rollout.

Access–aggregation–core hierarchy: access terminates subscriber lines (DSL/FTTx/cellular), aggregation concentrates and applies policy (BNG, QoS, subscriber management), core provides high-capacity label-switched transport between PoPs.

Typical SP core capacity ratio is roughly access:aggregation:core = 1:10:100; design aggregation uplinks so no single link exceeds ~50% utilization at busy hour to absorb failure of a peer link.

PoP design rule: dual core routers per PoP, each with at least two diverse uplinks to different backbone paths; a PoP must survive loss of one core router and one inter-PoP link without losing subscriber sessions.

OSPF area design in SP cores: keep the backbone area 0 contiguous, put aggregation/access rings in stub or totally stubby non-backbone areas, and size areas to roughly 50–100 routers to bound SPF churn.

IS-IS is preferred for large SP cores because it runs directly on L2 (CLNS), scales with multi-level hierarchy, and uses TLV extensibility for traffic engineering and IPv6; OSPF remains common in enterprise-facing PE/CE edges.

BGP design: full mesh or route reflectors inside an AS, eBGP only on AS boundaries; use a consistent private ASN for internal confederation-free designs or confederations when a single IGP domain cannot span the topology.

Convergence targets: core IGP sub-second (BFD + fast hellos + LFA/TI-LFA), BGP PIC edge for prefix-independent convergence, and NSR/NSF so a control-plane restart does not drop forwarding.

QoS architecture: classify at ingress edge (DSCP or MPLS EXP), police to contracted rates at the aggregation/BNG, and use a small number of forwarding classes (typically 5–8: real-time, interactive, business, best-effort, scavenger) with strict priority reserved for real-time only.

High availability building blocks: redundant supervisors, SSO/NSR, graceful restart, BFD, link aggregation with LACP, and IGP/LDP IGP sync so LDP converges in step with the IGP.

BGP best-path order (simplified): highest weight, highest local preference, locally originated, shortest AS_PATH, lowest origin (IGP<EGP<incomplete), lowest MED, eBGP over iBGP, lowest IGP metric to next hop, oldest route, lowest router ID, lowest neighbor address.

MED is compared only among paths from the same neighboring AS by default; use bgp always-compare-med to change that, and remember missing MED is treated as 0 by default (bgp bestpath med missing-as-worst inverts this).

iBGP rules: routes learned from an iBGP peer are not re-advertised to another iBGP peer (split horizon), next hop is unchanged, and full-mesh or route reflectors are required; RR cluster loops are prevented by CLUSTER_LIST and ORIGINATOR_ID.

Route reflector rules: a route from a non-client is reflected to clients and non-clients; a route from a client is reflected to all peers except the originator; the RR does not change next hop, AS_PATH, or MED.

OSPF LSA types: 1 router, 2 network, 3 summary, 4 ASBR summary, 5 external, 7 NSSA external; type 3/5 filtering at ABRs and ASBRs controls what enters an area, and totally stubby areas allow only a default type 3.

IS-IS levels: L1 intra-area, L2 backbone, L1/L2 routers set the ATT bit to attract L1 traffic toward the nearest L2 exit; by default an L1 router uses a default route toward the nearest L1/L2 router.

MPLS forwarding: LFIB entries map (incoming label, incoming interface) to (outgoing label, outgoing interface); PHP pops the label so the penultimate hop forwards unlabeled to the egress, and implicit-null is advertised for that purpose.

LDP operation: discovery via UDP 646 hellos, session over TCP 646, label binding advertised for connected/IGP routes; LDP-IGP synchronization holds the IGP adjacency until LDP converges on the link.

Fast reroute: LFA computes a precomputed loop-free alternate using the inequality distance(N,D) < distance(N,S) + distance(S,D); remote LFA uses a tunnel to a PQ node when no local LFA exists; TI-LFA uses segment routing to guarantee coverage.

VRF components: RD (8 bytes, makes the prefix unique across the MPLS domain), route targets (extended community, control import/export), and a per-VRF routing table; the RD is prepended to the IPv4 prefix to form the VPNv4 NLRI.

MP-BGP VPNv4/VPNv6 uses address family 1/2 with SAFI 128; the route carries the RD, one or more route targets, the originator's label, and the next hop, which is normally rewritten to the PE loopback.

L3VPN data plane: ingress PE imposes a label stack of {VPN label, transport label}; the P router swaps only the transport label; the egress PE pops the transport label (PHP) and forwards on the VPN label to the VRF.

Route target semantics: export RT on the source VRF must match an import RT on the destination VRF; a hub VRF can import all spoke RTs while spokes import only the hub RT to build hub-and-spoke.

Inter-AS options: Option A back-to-back VRF subinterfaces (per-VRF, no labels exchanged), Option B MP-eBGP between ASBRs carrying VPNv4 with next-hop-self (ASBRs hold all VPN routes), Option C multihop MP-eBGP between PEs with IGP+label redistribution between ASBRs.

L2VPN types: VPWS (point-to-point pseudowire), VPLS (multipoint emulation using a full mesh of pseudowires and MAC learning in the data plane), and EVPN (BGP control plane for MAC/IP advertisement with multihoming via Ethernet Segment and DF election).

EVPN route types: 1 Ethernet Auto-Discovery, 2 MAC/IP advertisement, 3 Inclusive Multicast Ethernet Tag, 4 Ethernet Segment, 5 IP Prefix; type 2 carries the MAC and optional IP and is used for ARP/ND suppression.

Pseudowire signaling: LDP (RFC 8077 FEC 128 for static, FEC 129 for BGP autodiscovery) or BGP; control word is required for some encapsulations to preserve sequencing and pad small frames.

TE tunnel basics: RSVP-TE with CSPF uses IGP TE extensions (link bandwidth, affinity, admin groups) to compute a path; FRR with facility backup creates a bypass tunnel and uses label stacking to protect the protected LSP.

Model-driven telemetry replaces periodic SNMP polling with a subscription: the collector sends a subscription (dial-in or dial-out), the device streams YANG-modeled data at a configured sample interval with optional on-change triggers.

NETCONF runs over SSH (TCP 830) using XML RPCs (get-config, edit-config, commit, lock); RESTCONF maps the same YANG data to HTTP verbs (GET, POST, PUT, PATCH, DELETE) with JSON or XML payloads.

YANG models: openconfig models are vendor-neutral and preferred for multi-vendor automation; native models (e.g., Cisco-IOS-XE) expose full device features but are vendor-specific; IETF models cover standard structures.

Configuration workflow: candidate datastore + commit (with confirmed-commit and rollback) allows transactional changes; replace versus merge operations determine whether absent nodes are removed.

gNMI uses protobuf over HTTP/2 and supports Get, Set, Subscribe (stream, once, poll) and Capabilities; it is the transport most commonly paired with model-driven telemetry.

Assurance data sources: SNMP counters (interface, queue drops), syslog, flow telemetry (NetFlow/IPFIX/sFlow), streaming telemetry, and synthetic probes (IP SLA) for latency, jitter, and path availability.

IP SLA operation types include ICMP echo, UDP jitter, and UDP echo; results feed tracking objects that can withdraw static routes or shift traffic when thresholds are breached.

Segment routing assurance: SR-TE policies carry a segment list (SID stack); path verification compares the received SID list against the intended list, and TI-LFA provides sub-50 ms protection without RSVP state.

Automation safety: use out-of-band management with AAA (TACACS+/RADIUS), version control for configs and templates, pre/post-change validation, and canary deployment before fleet-wide rollout.