Nokia NRS I cheat sheet

Longest-prefix match: among all routes matching a destination, the router selects the one with the most specific prefix; administrative distance (Nokia: preference) breaks ties between protocols, then metric.

Nokia preference defaults: direct/interface routes 0, static 5, OSPF internal 10, IS-IS L1 15, IS-IS L2 18, RIP 100, BGP 170; lower preference wins. eBGP default 170 vs iBGP 170 (iBGP resolved via IGP).

OSPFv2 (IPv4) and OSPFv3 (IPv6) both run on SR OS; OSPFv3 uses link-local next hops, so the outgoing interface must be specified in the route lookup.

IS-IS on SR OS is the preferred IGP for large service-provider cores; L1/L2 hierarchy, wide metrics (up to 2^24), and TE extensions support MPLS-TE.

BGP best-path order on SR OS: highest local-preference, shortest AS-path, lowest origin, lowest MED (same neighbor AS), eBGP over iBGP, lowest IGP cost to next hop, lowest router ID.

Route redistribution between protocols requires an explicit policy in SR OS; a route is not redistributed unless matched by a policy statement with default-action accept or an explicit accept action.

IPv6 routing uses the same SR OS RIB/FIB model; neighbor discovery replaces ARP, and link-local addresses (fe80::/10) serve as next hops.

ECMP: SR OS supports up to 64 equal-cost paths for IPv4/IPv6; configure 'ecmp ' under the router context; hashing is per-flow based on L3/L4 headers.

Null/blackhole routes: a static route to 'blackhole' or a discard next-hop drops traffic; useful for RTBH (remotely triggered blackhole) DDoS mitigation.

SR OS supports IEEE 802.1Q VLANs and 802.1ad (QinQ) service encapsulation; SAPs (service access points) map ports+VLANs to services.

VPLS provides multipoint L2 VPN; on SR OS it uses BGP auto-discovery (RFC 4761) or LDP signaling (RFC 4762), with MAC learning and flooding per VPLS instance.

EVPN (RFC 7432) on SR OS uses BGP to advertise MAC/IP and IMET routes, enabling all-active multihoming (ESI) and reduced flooding; it is the preferred L2 aggregation technology.

Link aggregation (LAG) uses LACP (802.3ad); SR OS supports LAG groups with up to 64 member links; hashing is configurable (L2/L3/L4) and must match on both ends.

MSTP (802.1s) on SR OS maps VLANs to multiple spanning-tree instances; RSTP (802.1w) is the default; BPDU guard and root guard protect the aggregation edge.

MC-LAG (multi-chassis LAG) uses ICCP over a peer link to present a single LAG to access switches, providing active-active redundancy without spanning tree.

QinQ (802.1ad) allows a service provider to stack a customer VLAN (C-VLAN) inside a provider VLAN (S-VLAN); SR OS uses SAPs with 'qinq' and dot1q encapsulation.

Service model: a VPLS or Epipe binds SAPs (access) to SDPs (network); SDPs are signaled via LDP or RSVP-TE and carry the service across the MPLS core.

Spanning tree timers: hello 2s, forward delay 15s, max age 20s; RSTP uses proposal/agreement for rapid convergence; edge ports (edge) skip learning and forwarding delay.

NSP (Network Services Platform) components: NSP NFM-P (network functions manager - packet) for device management, NSP WFM (workflow manager) for service orchestration, and NSP Analytics for telemetry.

NSP uses model-driven interfaces: NETCONF/YANG (RFC 6241/7950) and gRPC/gNMI for telemetry and configuration; SR OS supports both, with YANG models under /nokia-conf.

NSP Intent-based service provisioning: define a service intent (e.g., Epipe, VPLS, VPRN) and NSP computes the configuration and pushes it to devices via NETCONF.

MD-CLI (model-driven CLI) on SR OS 16+ uses a hierarchical, transactional configuration model; candidate configuration is committed atomically with 'commit'.

Telemetry: gRPC dial-out (model-driven) streams counters and state to NSP Analytics; subscription is configured under 'system grpc' with a target and sensor paths.

NSP supports template-based automation: YANG templates and Jinja2-style templates can generate device configuration; workflows are defined in WFM with tasks and states.

Zero-touch provisioning (ZTP): SR OS devices boot with DHCP option 66/67 or a USB/URL to fetch a boot file, then register with NSP for full configuration.

NSP RBAC: users are assigned scopes (read/write/admin) and roles; NSP integrates with external AAA (TACACS+/RADIUS) for authentication and authorization.

API access: NSP exposes REST/RESTCONF APIs for service creation and inventory; OAuth2 tokens or basic auth are used depending on version.

SR OS filter (ACL) types: IP filter (IPv4/IPv6), MAC filter, and logging; filters are applied to SAPs, network ports, or router interfaces with ingress/egress direction.

Filter entries match on source/destination IP, protocol, ports, DSCP, and TCP flags; default action is configurable (drop or forward); an implicit drop follows if no entry matches and default-action is drop.

Control-plane protection: CPM filters (configure system security cpm-filter) protect the management/control plane from DoS; apply to the CPM port and management interfaces.

uRPF (unicast RPF) on SR OS: strict mode (check route to source via same interface) or loose mode (any route to source); used to prevent spoofed source addresses.

BGP security: RPKI origin validation (ROV) via 'origin-validation' in SR OS; TTL security (GTSM) and MD5/TCP-AO authentication protect BGP sessions.

DDoS mitigation: RTBH (remotely triggered blackhole) uses BGP to advertise a host route to a blackhole next-hop; flowspec (RFC 5575) allows granular filtering via BGP.

IPsec on SR OS: IKEv2 with pre-shared keys or certificates; IPsec tunnels are configured in an IPsec gateway and applied to a tunnel interface or VPRN.

Management security: disable Telnet, use SSHv2, enable SNMPv3 auth/priv, and restrict management access with 'system security profile' and source-address filters.

Lawful intercept and logging: SR OS supports syslog to external collectors; security events (login failures, filter matches) can be logged with severity levels.

Data center leaf-spine: SR OS supports EVPN-VXLAN on leaf/spine; VXLAN (RFC 7348) encapsulates L2 frames in UDP (port 4789) over an IP underlay; VTEPs are loopback interfaces.

EVPN route types: Type 2 (MAC/IP), Type 3 (IMET), Type 5 (IP prefix); Type 5 enables L3 symmetric IRB with distributed anycast gateways.

VXLAN on SR OS: configure a VXLAN tunnel (source VTEP) and bind to a VPLS or EVPN service; MTU must account for 50-byte VXLAN overhead (outer IP/UDP/VXLAN).

Transport connectivity: SR OS supports OTN, DWDM, and packet transport; the 7750 SR and 7250 IXR platforms provide MPLS-TP and segment routing for transport.

Segment routing (SR-OS): SR-MPLS uses MPLS labels (node SID) and SRv6 uses IPv6 segment IDs; SR reduces state in the core and supports traffic engineering (SR-TE).

Data center interconnect (DCI): VPLS/EVPN over MPLS or VXLAN; SR OS supports EVPN multihoming (ESI) for active-active DCI links.

QoS in the data center: SR OS uses network queues and fabric profiles; on IXR, PFC (priority flow control) and ECN support lossless Ethernet for RoCE.

Clock synchronization: SR OS supports SyncE (G.8261/8262) and PTP (IEEE 1588v2) for transport and mobile backhaul; boundary and transparent clock modes.

MTU planning: underlay MTU must be >= 1600 for VXLAN; SR OS default port MTU is 9212 on IXR, 1500 on some access ports; adjust per service.