Nokia NRS II cheat sheet

IPv4 header is 20 bytes minimum; total length field counts header plus payload, so MSS = MTU − 20 (IPv4) or − 40 (IPv6) for TCP.

Private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16; 169.254.0.0/16 is link-local (no DHCP server reachable), 127.0.0.0/8 is loopback.

Subnet host count = 2^h − 2 for classic subnets; /31 gives 2 usable addresses on point-to-point links (RFC 3021); /32 is a single host route.

IPv6 address is 128 bits; global unicast 2000::/3, link-local fe80::/10, multicast ff00::/8, loopback ::1. No broadcast, no ARP - replaced by NDP.

NDP uses ICMPv6: RS/RA for router discovery and prefix/SLAAC, NS/NA for address resolution and duplicate address detection.

Path MTU Discovery relies on ICMPv6 Packet Too Big (type 2) or ICMPv4 Fragmentation Needed (type 3 code 4); filtering these breaks large flows.

VLAN tag adds 4 bytes (802.1Q), so tagged frame MTU budget shrinks; QinQ adds 8 bytes with an outer S-VLAN tag.

DHCP DORA = Discover, Offer, Request, Acknowledge; relay agents set giaddr so the server selects the correct pool.

Administrative distance (Nokia/typical): connected 0, static 5, OSPF 110, IS-IS 115, RIP 100, eBGP 20, iBGP 200; lower wins before metric comparison.

OSPF: routers flood LSAs within an area; all areas must touch area 0. Cost = reference bandwidth / interface bandwidth, so set reference-bandwidth consistently.

OSPF LSA types: 1 router, 2 network, 3 summary, 4 ASBR summary, 5 external, 7 NSSA external.

IS-IS: Level 1 = intra-area, Level 2 = backbone; L1/L2 routers set the attached bit to attract L1 traffic toward L2. Uses NET (NSAP) addressing, not IP, for the router ID.

BGP best-path order starts: highest weight, highest local preference, locally originated, shortest AS_PATH, lowest origin (IGP<EGP<incomplete), lowest MED.

iBGP requires full mesh or route reflectors because of the split-horizon rule; next-hop-self is needed when the next hop is unreachable via IGP.

BFD provides sub-second failure detection independent of routing protocol hellos; it must be configured on both peers with matching timers/multiplier.

Route recursion: a route is usable only if its next hop resolves via a more specific route in the RIB; unresolved next hops stay inactive.

STP port states: blocking, listening, learning, forwarding, disabled; 802.1w RSTP collapses these to discarding, learning, forwarding.

Root bridge election: lowest bridge ID wins = priority (default 32768, in 4096 steps) then MAC; lower root path cost selects the root port.

RSTP roles: root port, designated port, alternate port (backup for root port), backup port; edge/portfast ports skip learning but still run BPDU guard.

LAG/LACP: active and passive modes interoperate; static LAGs skip negotiation. All member links must match speed, duplex, and VLAN membership.

MC-LAG (multi-chassis LAG) lets two aggregation switches present one LAG to an access switch, removing STP blocking while providing redundancy.

MAC learning is per VLAN; unknown unicast is flooded, broadcast/multicast flooded within the broadcast domain. Aging default is typically 300 s.

802.1Q trunk: native/untagged VLAN on one side must match the other, or traffic leaks between VLANs; PVID sets the untagged ingress VLAN.

Storm control and loop protection (BPDU guard, loop-detect) prevent broadcast storms when STP is disabled on edge ports.

NETCONF uses SSH (port 830) with XML-encoded RPCs; operations include get-config, edit-config, copy-config, lock, commit, discard-changes.

YANG models define the data tree; a candidate datastore holds uncommitted changes, running holds active config, startup persists across reboot.

gNMI runs over HTTP/2 with protobuf encoding and supports Get, Set, Subscribe (streaming telemetry) and Capabilities.

RESTCONF maps YANG to HTTP verbs: GET, POST, PUT, PATCH, DELETE, with JSON or XML payloads.

Model-driven telemetry pushes data on-change or at a dial-out interval, replacing periodic SNMP polling for scale.

Idempotency: a playbook/template run twice must yield the same device state; configuration templates should be declarative, not command scripts.

Ansible uses inventory plus YANG/NETCONF or CLI modules; Nornir is Python-native; both rely on version-controlled templates.

Commit-confirmed / rollback: stage changes, confirm within a timer, otherwise the device reverts automatically - key safety net for automation.

uRPF: strict mode drops packets whose source is not reachable via the incoming interface; loose mode only checks the source exists in the RIB.

DHCP snooping builds a trusted-port binding table; combined with IP Source Guard and Dynamic ARP Inspection it blocks spoofing.

RA Guard and IPv6 First-Hop Security block rogue router advertisements that could hijack the default gateway via SLAAC.

ACL evaluation is top-down, first match wins; an implicit deny follows, so every ACL needs an explicit permit for required traffic.

Control-plane protection (CoPP) rate-limits traffic destined to the router CPU while allowing transit traffic unaffected.

BGP security: prefix limits, TTL security (GTSM), MD5/TCP-AO, and RPKI origin validation defend against hijacks and spoofed sessions.

IPsec: IKE negotiates SAs (phase 1), ESP/AH protects data (phase 2); ESP provides confidentiality plus integrity, AH integrity only.

Management hardening: disable Telnet, use SSHv2 and SNMPv3 authPriv, restrict management access with ACLs, and log to a remote syslog.