Nokia VPRN study plan
Nokia VPRN · Give each week a clear focus.
8 weeks · About 7 hours per week
IP routing, switching and aggregation
Diagram the Nokia VPRN service model end to end (VPLS, VPRN, Epipe, IES) and label where IP routing, switching, and aggregation each enter the data path
Configure and verify a base router with IS-IS level 1/2 and OSPFv2 in a three-node lab, then explain which protocol wins at each prefix
Trace a single packet from a CE edge through a PE and core P router, writing down the lookup performed at each hop (MAC, IP, MPLS label)
Build a one-page comparison of Nokia SR OS interface types (SAP, spoke SDP, network port) and when each is used for aggregation
Your checkpoint
A labelled topology diagram plus a packet-walk table showing every lookup and encapsulation change across a 4-node lab, verified against captured output
IP routing, switching and aggregation
Configure VPRN instances with MP-BGP VPN-IPv4 and verify route targets import and export correctly between two VRFs
Implement VPLS with BGP-AD and with LDP signalling in the same lab and compare operational output
Configure LAG and MC-LAG for access aggregation and prove link-failure convergence with a shut/no-shut test
Tune IGP metrics and BFD timers to achieve sub-second failover, then measure the actual convergence time
Your checkpoint
A convergence test report with timestamps for three failure scenarios, showing measured failover under one second for at least one scenario
IP routing, switching and aggregation & Data center gateway
Configure a data center gateway VPRN with EVPN-VXLAN on a PE and verify MAC and IP learning across the fabric
Set up a redundant data center gateway pair with ESI multi-homing and confirm designated-forwarder election
Compare VXLAN, GRE, and MPLS encapsulation options on Nokia platforms and select one for a given north-south traffic profile
Document the underlay requirements (MTU, ECMP hashing, BGP-EVPN peering) needed before the overlay will work
Your checkpoint
A working EVPN-VXLAN gateway lab with one dual-homed host, plus a checklist of underlay prerequisites validated item by item
IP network automation (Network Services Platform)
Install and navigate Nokia NSP in a lab or sandbox, then create a service intent that deploys a VPRN to two PEs
Use NSP service templates and intent types to push the same service twice with different parameters and diff the resulting config
Configure NSP to discover and reconcile an existing device configuration that was changed out of band
Map NSP workflows to the manual CLI steps from weeks 1 to 3 and note where automation diverges
Your checkpoint
An NSP-deployed VPRN service that matches a hand-built reference configuration, with a written reconciliation report covering the out-of-band drift case
IP network automation (Network Services Platform) & IP network security
Write a Python script using the SR OS model-driven interfaces (gNMI or NETCONF) to read and set interface state on a router
Automate a configuration backup and compliance check across three devices and flag one intentional drift
Configure management-plane ACLs and secure gRPC/NETCONF access with TLS and role-based users, then verify automation still works
Enumerate the security controls NSP itself needs (RBAC, audit logging, API tokens) and apply two of them
Your checkpoint
A scripted backup-and-compliance run against three lab devices that produces a pass/fail report and correctly flags the seeded drift
IP network security
Harden a PE with control-plane protection: prefix limits, BGP maximum-prefix, and protocol-specific CPU protection policies
Implement uRPF and a filter to block spoofed source addresses, then test with crafted traffic
Configure IPsec on a VPRN or IES service and verify tunnel establishment and failover
Describe and configure BGPsec or RPKI-style origin validation concepts and test a route with an invalid origin
Your checkpoint
A before-and-after hardening matrix for one PE covering at least six controls, each with a test showing the control blocks or permits traffic as intended
IP network security & Data center gateway
Design a data center gateway security zone model separating tenant VRFs, shared services, and internet egress, then implement it with filters
Apply rate limiting and DDoS mitigation for the gateway uplink and measure the effect on legitimate traffic
Audit a full configuration from week 6 against a written security baseline and remediate every finding
Run a tabletop incident response for a compromised tenant and document detection, containment, and recovery steps
Your checkpoint
A completed security baseline audit with every finding remediated and a two-page incident response runbook for the gateway
IP routing, switching and aggregation & IP network automation (Network Services Platform) & IP network security & Data center gateway
Rebuild the full lab from scratch in under three hours using only scripts and templates, no manual CLI
Complete two timed practice sets of mixed-domain questions and review every wrong answer to root cause
Produce a one-page cheat sheet per domain covering the commands and concepts you missed most often
Walk through a full design scenario end to end, defending each choice against the other three domains
Your checkpoint
A reproducible build script that recreates the entire lab from a clean state, plus four domain cheat sheets and a scored practice-set log
Milestones
Week 2: You can explain and demonstrate how a packet crosses a VPRN from CE to CE, naming every lookup and label operation, without notes
Week 4: An NSP-deployed service exactly matches the hand-built reference configuration, and you can explain every reconciliation decision
Week 6: Your hardened PE passes all six control tests and you can justify each control against a specific attack
Week 8: You rebuild the full lab from scripts in under three hours and score above 80 percent on the mixed practice sets