Nokia MPLS cheat sheet

Nokia SR OS uses a two-level routing hierarchy: a base router instance holds global routes, while VPRN (virtual private routed network) service instances hold per-VPN routing tables; VRF leaking between them is done explicitly via route export/import policies, not automatically.

IS-IS in SR OS uses NET addresses (area ID + system ID + NSEL); Level 1 routers stay intra-area, Level 2 forms the backbone, and L1/L2 routers set the ATT bit to advertise a default toward L1-only neighbors.

OSPFv2/v3 area rules: all non-backbone areas must touch Area 0 through an ABR; virtual links are the only exception. Stub areas block Type 5 LSAs; NSSA blocks Type 5 but carries Type 7, which the ABR translates.

BGP best-path order in SR OS starts with: highest local preference, then shortest AS path, then lowest origin (IGP < EGP < incomplete), then lowest MED (only among paths from the same neighbor AS unless always-compare-med is set), then eBGP over iBGP, then lowest IGP metric to next hop, then lowest router ID.

MP-BGP address families (vpn-ipv4, ipv6, evpn, label-ipv4) are enabled per neighbor under the BGP group; a session can carry unicast and VPN families simultaneously but each family has independent route policies.

SR OS route preference defaults (lower wins): direct/local 0, static 5, OSPF internal 10, IS-IS L1 15, IS-IS L2 18, OSPF external 150, BGP 170, RIP 100.

Segment routing uses SRGB (label block) plus node SIDs; an adjacency SID identifies a link, a node SID identifies a router. Prefix-SID uses the index into the SRGB, so all routers must agree on SRGB size for consistent label values.

ECMP in SR OS is enabled per interface with ecmp ; hashing uses LSR (label stack) or configurable hash fields (IP 5-tuple, MPLS labels) set under system hash-seed / l4-load-balancing.

SR OS service types: Epipe (point-to-point), VPLS (multipoint bridged), VPRN (routed), IES (internet enhanced service, routed with SAPs), and EVPN-based variants (EVPN-VPLS, EVPN-Epipe).

SAP (service access point) binds a service to a port or LAG (e.g., 1/1/1:100); SDP (service distribution point) binds a service to a far-end node over MPLS or GRE for transport.

VPLS MAC learning is per-service; split-horizon is enforced by default so a frame received from an SDP is not forwarded back to another SDP in the same VPLS (prevents loops).

LAG (link aggregation) uses LACP; in SR OS, LACP active/passive is configured per port, and the LAG must be administratively enabled before member ports come up.

STP variants in SR OS: RSTP (802.1w), MSTP (802.1s), and 802.1ag for CFM. MSTP maps VLANs to instances; the CIST root is the bridge with lowest bridge ID across all instances.

EVPN route types: Type 2 (MAC/IP advertisement), Type 3 (inclusive multicast/IMET), Type 4 (Ethernet segment), Type 5 (IP prefix). Type 3 is required for BUM traffic flooding in EVPN-VPLS.

QinQ (802.1ad) allows a service provider to stack an outer S-tag over customer C-tags; in SR OS this is expressed as port encapsulation dot1q with a qinq SAP (e.g., 1/1/1:100.*).

Aggregation design rule: access rings typically run L2 (VPLS/STP) while distribution uses L3 (VPRN/IS-IS); the boundary should be as close to the access as feasible to limit broadcast domains and STP scope.

NSP is Nokia's SDN controller; it comprises NSP Fabric (network modeling), NSP NFM-P (fault/performance management for IP/MPLS), and NSP Network Automation (intent-based provisioning) layers.

NSP communicates with SR OS devices via MD-CLI/NETCONF or gNMI (model-driven interfaces); SNMP is used for legacy polling but not for intent-based config.

YANG models are the data contract: Nokia publishes SR OS YANG modules (nokia-conf, nokia-state, nokia-li) so NSP can render config as a model rather than CLI text.

Intent-based automation: an intent (e.g., 'create a VPN between sites A and B') is decomposed by NSP into device-level config; validation is done against the model, not by parsing CLI output.

NSP uses a topology/graph model of the network (links, services, endpoints); service assurance correlates alarms with the modeled topology to root-cause faults.

gNMI (gRPC Network Management Interface) supports Get, Set, Subscribe, and Capabilities; Subscribe with streaming telemetry replaces periodic SNMP polling for high-frequency counters.

Telemetry in SR OS is configured under system grpc or telemetry; the collector endpoint and subscription paths (e.g., /state/router) are set per subscription.

Idempotency rule for automation: re-applying the same intent must produce no change; NSP computes a diff against the current model and only pushes deltas, so a no-op intent yields no config change.

SR OS filter (ACL) types: IP filter, MAC filter, IPv6 filter; each is applied to SAPs, network ports, or interfaces. Entries are evaluated top-down; the first match wins and an implicit default action applies at the end.

Filter actions: forward, drop, and (for IP filters) forward with a redirect to a next-hop or a policer; a filter can also mark DSCP or set a forwarding class.

Control-plane protection: CPM filters (configure system security cpm-filter) protect the management/control processor from DoS; separate filters apply to the CPM and to transit traffic.

uRPF (unicast reverse path forwarding) modes in SR OS: strict (packet must arrive on the interface used to reach the source) and loose (any route to the source suffices); strict is used at the edge, loose in the core.

MD5/TCP-AO for BGP and OSPF authentication: SR OS supports MD5 for BGP (configure router bgp authentication-key) and HMAC-SHA for TCP-AO; keys must match on both peers or the session drops.

Management access: SSH/TLS replace Telnet/HTTP; SNMPv3 with auth+priv (e.g., SHA + AES) is required where SNMP is used; local users are defined under system security user with profile-based privileges.

Lawful intercept (LI) in SR OS uses an x-intercept source (mirror or filter-based) and a destination (x-intercept destination) with an encryption/mediation handoff; it is separate from normal mirroring.

EVPN/MPLS security note: label spoofing across a shared LSP is mitigated by per-service VRF/VPLS isolation and by filtering at SAP ingress; MPLS does not provide encryption, so IPsec or MACsec is layered where confidentiality is required.

WDM basics: CWDM uses 20-nm spacing over ~1270-1610 nm (up to 18 channels); DWDM uses 50/100-GHz grid on the C-band (1530-1565 nm) with EDFA amplification; 100-GHz spacing gives 50 channels on the standard grid.

ITU-T G.694.1 defines the DWDM frequency grid anchored at 193.1 THz; channel spacing of 100 GHz = 0.8 nm, 50 GHz = 0.4 nm, 25 GHz = 0.2 nm at 1550 nm.

Optical signal-to-noise ratio (OSNR) degrades with each amplifier stage; OSNR penalty from cascaded EDFAs is roughly 10*log10(N) dB for N identical spans, so longer chains require higher per-span launch power or fewer amps.

Coherent optics (e.g., 100G/200G/400G QPSK/16QAM) use DSP to compensate chromatic dispersion and PMD electrically; higher-order modulation (16QAM vs QPSK) doubles capacity but halves reach.

DCI transport options: dark fiber with coherent muxponders, leased wavelength services, or IPoDWDM (coherent pluggables in routers, e.g., 400ZR/OpenZR+). IPoDWDM removes a transponder layer but limits reach to ~80-120 km for 400ZR.

Nokia optical portfolio includes the 1830 PSS (photonic service switch) for DWDM/OTN and the 1830 PSI for compact DCI; OTN framing adds FEC and OAM (G.709) versus raw WDM.

Data center fabric: EVPN-VXLAN is the standard scale-out overlay; VXLAN VNI (24-bit) maps to an EVPN VPLS instance, and anycast gateway (distributed L3) avoids traffic tromboning.

DCI redundancy: dual-homed DCI via two diverse paths (different conduit/route) with BFD for fast failure detection; sub-50ms protection requires either optical protection switching (OLP) or MPLS FRR, not IGP convergence alone.