Nuage/Nokia VNS forwarding (advanced) policies enable service-chaining by matching traffic on an NSG-vPort and “redirecting” it to the IP/MAC of a service appliance that is represented by a Redirect-Target object.

• A Redirect-Target must first be created and linked to the appliance vPort; it is then invoked by the forwarding policy.

• Policies can be attached to the ingress or egress direction of a domain, zone or subnet.

• A Redirect-Target cannot be bound to a bridge-vPort (used for L2 bypass appliances).

Only flows that already traverse the data-centre where the appliance resides can be steered; purely intra-branch or inter-branch flows never enter the DC fabric, therefore cannot be redirected there.

Hence statement D is false.

A. Forwarding policies are explicitly configurable for Ingress/Egress directions; therefore this statement is correct.

B. Redirect-Target objects must exist before a forwarding policy can reference them, so this statement is correct.

C. VSD disallows associating Redirect-Targets with bridge-vPorts; statement is therefore correct.

1. Nuage Networks “Virtualized Network Services (VNS) Fundamentals Guide”, Release 6.0, Section 7.3 ‘Forwarding Policies’, pp. 236–238 (Ingress/Egress applicability).

2. Nuage Networks “VNS Services and Operations Guide”, R6.0, §8.2.2 ‘Creating Redirect Targets’, pp. 302–303 (Prerequisite creation and vPort association).

3. Nuage Networks “VSP / VNS Policy-Based Networking”, R6.0, p. 115 (“Redirect Target cannot be applied to Bridge-vPort”).

4. Nuage Networks “Service Chaining and Advanced Forwarding”, Technical Report TR-SC-510, §3.4, p. 19 (“Branch-to-branch traffic is not service-chained to DC appliances”).