Nokia VPRN cheat sheet

OSPFv2 (IPv4) and OSPFv3 (IPv6) are link-state IGPs; OSPFv3 uses link-local addresses for adjacency and has no inherent authentication field (IPsec or RFC 7166 authentication trailer is used).

OSPF LSA types: Type 1 Router, Type 2 Network, Type 3 Summary, Type 4 ASBR Summary, Type 5 External, Type 7 NSSA External; Type 3/4/5 are flooded only within the area border scope they are generated for.

OSPF area rules: all non-backbone areas must connect to area 0 through ABRs or virtual links; stub areas block Type 5, NSSAs block Type 5 but allow Type 7.

IS-IS uses Level 1 (intra-area), Level 2 (backbone), and L1/L2 routers; wide metrics (up to 2^24) are the default on Nokia SR OS.

BGP path selection order (Nokia SR OS default): weight, local preference, locally originated, AS path length, origin, MED, eBGP over iBGP, lowest IGP metric to next hop, oldest route, lowest router ID, lowest peer address.

BGP well-known communities: NO_EXPORT (0xFFFFFF01), NO_ADVERTISE (0xFFFFFF02), NO_EXPORT_SUBCONFED (0xFFFFFF03); send-community must be enabled to propagate them.

SR OS BGP next-hop-self is required on iBGP route reflectors or when the advertising router is not reachable via IGP from the receiving peer.

Route preference values on SR OS: direct/interface 0, static 5, OSPF/IS-IS internal 10, eBGP 170, iBGP 170, OSPF external 150 - lower value wins.

BFD timers must be negotiated within the configured min-rx/min-tx and multiplier; on SR OS, BFD is enabled per-interface under router > interface > bfd and per-protocol under the protocol context.

802.1Q tag: 4-byte field with 12-bit VLAN ID (0-4095), 3-bit PCP, 1-bit DEI; VLAN 0 is priority-tagged, VLAN 4095 reserved.

STP variants on SR OS: RSTP (802.1w), MSTP (802.1s), and SPB (802.1aq); MSTP maps VLANs to instances and supports up to 64 instances per region.

LAG on SR OS: LACP (802.3ad) with active/standby or active/active modes; hash uses L2/L3/L4 fields configured via port-hash or lag hash settings.

MC-LAG uses ICCP over a peer link to synchronize state between two aggregation peers; sub-group and multi-chassis redundancy are configured under redundancy > multi-chassis.

QinQ (802.1ad): outer S-VLAN (TPID 0x88a8) and inner C-VLAN (TPID 0x8100); SR OS SAPs support dot1q, qinq, and null encapsulation.

VPLS uses a full mesh of SDPs (spoke or mesh) between PEs; MAC learning is per-VPLS; split-horizon prevents forwarding between spoke SDPs of the same VPLS.

EVPN-VPLS uses BGP EVPN route types 1-5; Type 2 (MAC/IP) carries MAC advertisement, Type 3 (Inclusive Multicast) carries BUM flooding, Type 4 carries DF election.

Storm control thresholds on SR OS are configured per SAP or port in kilo-packets per second (kpbs) or as a percentage of link bandwidth.

NSP is Nokia's SDN controller; it includes the Network Automation (NRC) and Network Functions Manager (NFM-P) components plus the Model-Driven Mediation (MDM) layer.

NSP uses NETCONF/YANG and gNMI/gRPC southbound to SR OS devices; SNMP is available for legacy NEs.

NSP intent-based workflow: create service intent (e.g., VPRN, Epipe, VPLS) -> NSP computes path and configures devices -> closed-loop assurance via telemetry.

NSP Workflow Manager (WFM) executes Python-based workflows; tasks can be scheduled, triggered by events, or chained.

NSP RESTCONF/NSP API gateway exposes REST endpoints for service creation, discovery, and telemetry; OAuth2 or basic auth is used.

gNMI telemetry subscriptions can be on-change, sample, or target-defined; on SR OS, model-driven telemetry is configured under system grpc.

NSP uses the Nokia YANG models for SR OS and the IETF service models (L2VPN, L3VPN) for multi-vendor intent.

NSP Fabric Services (NSD) automates underlay/overlay fabric deployment using BGP EVPN and VXLAN.

SR OS filter types: IP filter (IPv4), IPv6 filter, MAC filter, and match-list; entries have a default action (drop or forward) and optional action (accept, drop, forward, next-entry).

ACL evaluation is first-match by default; use 'next-entry' to continue evaluation after a match.

Management access control: configure system security profile with user, password, and SNMPv3 auth/priv (SHA/AES); disable Telnet and enable SSH/SCP.

Control-plane protection: apply CPM filters (system security cpm-filter) to rate-limit traffic destined to the router and protect against DoS.

IPsec on SR OS: IKEv2 with pre-shared key or certificates; IPsec tunnels support ESP with AES-GCM or AES-CBC + SHA; used for secure VPRN transport.

uRPF (unicast RPF) on SR OS is configured per-interface under router > interface (strict or loose mode) to mitigate spoofed source addresses.

BGP security: use TCP-MD5 or TCP-AO for peer authentication; RPKI origin validation via the 'origin-validation' command can drop invalid routes.

MACsec (802.1AE) on SR OS provides hop-by-hop L2 encryption on Ethernet ports; configured under port ethernet with a CAK/CKN.

VXLAN uses a 24-bit VNI (up to 16M segments) and 8-byte header; outer UDP destination port is 4789 by default.

EVPN route types: Type 1 Ethernet Auto-Discovery, Type 2 MAC/IP, Type 3 Inclusive Multicast, Type 4 Ethernet Segment, Type 5 IP Prefix.

EVPN multihoming: all-active uses Type 1/4 routes and DF election (RFC 7432 / RFC 8584); single-active uses Type 4 with the backup flag.

VXLAN VTEP on SR OS is configured under configure service vpls > vxlan instance; source IP is the loopback; BGP EVPN is the control plane.

Anycast gateway: the same IP and MAC are configured on all leafs for a subnet, allowing hosts to move without re-ARP; on SR OS use 'anycast-gw' under the interface.

Symmetric IRB uses the same VNI for L2 and L3; asymmetric IRB uses different VNIs and requires per-VRF route leaking.

EVPN Type 5 (IP Prefix) routes allow summarizing subnets for inter-VRF/inter-DC routing; Type 2 with MAC-only is used for silent hosts.

DC gateway redundancy: use MC-LAG or EVPN multihoming on the leaf-to-spine links; BFD fast-failover detects link loss in sub-second time.

OSPFv2 (IPv4) and OSPFv3 (IPv6) are link-state IGPs; OSPFv3 uses link-local addresses for adjacency and has no inherent authentication field (IPsec or RFC 7166 authentication trailer is used).

OSPF LSA types: Type 1 Router, Type 2 Network, Type 3 Summary, Type 4 ASBR Summary, Type 5 External, Type 7 NSSA External; Type 3/4/5 are flooded only within the area border scope they are generated for.

OSPF area rules: all non-backbone areas must connect to area 0 through ABRs or virtual links; stub areas block Type 5, NSSAs block Type 5 but allow Type 7.

IS-IS uses Level 1 (intra-area), Level 2 (backbone), and L1/L2 routers; wide metrics (up to 2^24) are the default on Nokia SR OS.

BGP path selection order (Nokia SR OS default): weight, local preference, locally originated, AS path length, origin, MED, eBGP over iBGP, lowest IGP metric to next hop, oldest route, lowest router ID, lowest peer address.

BGP well-known communities: NO_EXPORT (0xFFFFFF01), NO_ADVERTISE (0xFFFFFF02), NO_EXPORT_SUBCONFED (0xFFFFFF03); send-community must be enabled to propagate them.

SR OS BGP next-hop-self is required on iBGP route reflectors or when the advertising router is not reachable via IGP from the receiving peer.

Route preference values on SR OS: direct/interface 0, static 5, OSPF/IS-IS internal 10, eBGP 170, iBGP 170, OSPF external 150 - lower value wins.

BFD timers must be negotiated within the configured min-rx/min-tx and multiplier; on SR OS, BFD is enabled per-interface under router > interface > bfd and per-protocol under the protocol context.

802.1Q tag: 4-byte field with 12-bit VLAN ID (0-4095), 3-bit PCP, 1-bit DEI; VLAN 0 is priority-tagged, VLAN 4095 reserved.

STP variants on SR OS: RSTP (802.1w), MSTP (802.1s), and SPB (802.1aq); MSTP maps VLANs to instances and supports up to 64 instances per region.

LAG on SR OS: LACP (802.3ad) with active/standby or active/active modes; hash uses L2/L3/L4 fields configured via port-hash or lag hash settings.

MC-LAG uses ICCP over a peer link to synchronize state between two aggregation peers; sub-group and multi-chassis redundancy are configured under redundancy > multi-chassis.

QinQ (802.1ad): outer S-VLAN (TPID 0x88a8) and inner C-VLAN (TPID 0x8100); SR OS SAPs support dot1q, qinq, and null encapsulation.

VPLS uses a full mesh of SDPs (spoke or mesh) between PEs; MAC learning is per-VPLS; split-horizon prevents forwarding between spoke SDPs of the same VPLS.

EVPN-VPLS uses BGP EVPN route types 1-5; Type 2 (MAC/IP) carries MAC advertisement, Type 3 (Inclusive Multicast) carries BUM flooding, Type 4 carries DF election.

Storm control thresholds on SR OS are configured per SAP or port in kilo-packets per second (kpbs) or as a percentage of link bandwidth.

NSP is Nokia's SDN controller; it includes the Network Automation (NRC) and Network Functions Manager (NFM-P) components plus the Model-Driven Mediation (MDM) layer.

NSP uses NETCONF/YANG and gNMI/gRPC southbound to SR OS devices; SNMP is available for legacy NEs.

NSP intent-based workflow: create service intent (e.g., VPRN, Epipe, VPLS) -> NSP computes path and configures devices -> closed-loop assurance via telemetry.

NSP Workflow Manager (WFM) executes Python-based workflows; tasks can be scheduled, triggered by events, or chained.

NSP RESTCONF/NSP API gateway exposes REST endpoints for service creation, discovery, and telemetry; OAuth2 or basic auth is used.

gNMI telemetry subscriptions can be on-change, sample, or target-defined; on SR OS, model-driven telemetry is configured under system grpc.

NSP uses the Nokia YANG models for SR OS and the IETF service models (L2VPN, L3VPN) for multi-vendor intent.

NSP Fabric Services (NSD) automates underlay/overlay fabric deployment using BGP EVPN and VXLAN.

SR OS filter types: IP filter (IPv4), IPv6 filter, MAC filter, and match-list; entries have a default action (drop or forward) and optional action (accept, drop, forward, next-entry).

ACL evaluation is first-match by default; use 'next-entry' to continue evaluation after a match.

Management access control: configure system security profile with user, password, and SNMPv3 auth/priv (SHA/AES); disable Telnet and enable SSH/SCP.

Control-plane protection: apply CPM filters (system security cpm-filter) to rate-limit traffic destined to the router and protect against DoS.

IPsec on SR OS: IKEv2 with pre-shared key or certificates; IPsec tunnels support ESP with AES-GCM or AES-CBC + SHA; used for secure VPRN transport.

uRPF (unicast RPF) on SR OS is configured per-interface under router > interface (strict or loose mode) to mitigate spoofed source addresses.

BGP security: use TCP-MD5 or TCP-AO for peer authentication; RPKI origin validation via the 'origin-validation' command can drop invalid routes.

MACsec (802.1AE) on SR OS provides hop-by-hop L2 encryption on Ethernet ports; configured under port ethernet with a CAK/CKN.

VXLAN uses a 24-bit VNI (up to 16M segments) and 8-byte header; outer UDP destination port is 4789 by default.

EVPN route types: Type 1 Ethernet Auto-Discovery, Type 2 MAC/IP, Type 3 Inclusive Multicast, Type 4 Ethernet Segment, Type 5 IP Prefix.

EVPN multihoming: all-active uses Type 1/4 routes and DF election (RFC 7432 / RFC 8584); single-active uses Type 4 with the backup flag.

VXLAN VTEP on SR OS is configured under configure service vpls > vxlan instance; source IP is the loopback; BGP EVPN is the control plane.

Anycast gateway: the same IP and MAC are configured on all leafs for a subnet, allowing hosts to move without re-ARP; on SR OS use 'anycast-gw' under the interface.

Symmetric IRB uses the same VNI for L2 and L3; asymmetric IRB uses different VNIs and requires per-VRF route leaking.

EVPN Type 5 (IP Prefix) routes allow summarizing subnets for inter-VRF/inter-DC routing; Type 2 with MAC-only is used for silent hosts.

DC gateway redundancy: use MC-LAG or EVPN multihoming on the leaf-to-spine links; BFD fast-failover detects link loss in sub-second time.