Nuage Networks VNS is an SD-WAN overlay that provides policy-based networking between branch CPEs (NSGs) and data-center gateways.

Key functions advertised for VNS are (1) a fully-centralized control plane (VSD/VSC), (2) secure data-plane overlays that use per-branch or full-mesh IPsec tunnels, and (3) the ability to ride transparently over any IP underlay, including Internet, LTE, or existing MPLS VPN circuits.

Layer-4/Layer-7 service-chaining (ordered steering of flows through multiple virtual network-functions) is explicitly limited to the Nuage VSP data-center product and is not implemented in VNS. Hence, “Service chaining” is the only option that is not supported by VNS.

B. Centralized control plane – VNS always uses VSD (policy/database) and VSC (SDN controller) for centralized management and route programming.

C. MPLS VPN – VNS CPEs can attach to provider MPLS VPN underlays; BGP integration is documented.

D. IPsec encryption – All VNS site-to-site and hub-and-spoke tunnels are IPsec-encrypted by default to secure the overlay.

1. Nokia, “Nuage Networks VNS R6.0 Product Guide,” Section 3.4 “Key Capabilities,” p. 17–18 – lists centralized control plane and IPsec, omits service chaining.

2. Nokia, “Nuage Networks VSP R6.0 Feature Overview,” §2.3 “Service Chaining,” p. 41 – states service chaining is a VSP feature, not available in VNS.

3. Nokia Solution Brief, “Nuage Networks SD-WAN (VNS),” Doc-ID SB-2019-06, p. 3 – describes IPsec overlay and MPLS/Internet underlay support.

4. IEEE Communications Magazine, vol. 56 no. 7, 2018, “Nuage Networks SD-WAN Architecture,” pp. 125-131, doi:10.1109/MCOM.2018.1701042 – details centralized VSD/VSC and IPsec tunnels, with no mention of service chaining.

The VNS bootstrapping process is designed with security as a fundamental requirement. The communication between the Network Services Gateway (NSG) and the Virtualized Services Directory (VSD) for authentication and configuration download is conducted over a secure, encrypted channel. This is typically achieved using Transport Layer Security (TLS) to encapsulate the bootstrap protocol messages. Transmitting this sensitive information, which includes credentials and network configuration, in plain text would expose the network to significant security risks, which is contrary to the design of the Nuage VNS solution.

A. VSD uses templates to define policies and configurations, which are then pushed to NSGs during bootstrapping. This ensures that all devices conform to a centralized, standardized configuration.

B. The zero-touch provisioning (ZTP) model is a core feature of VNS, allowing unconfigured NSGs to be shipped directly to a site for automatic activation and configuration download.

C. A primary business driver for VNS bootstrapping is the elimination of operational expenses associated with sending skilled engineers to remote sites for manual CPE/NSG activation.

1. Nokia Nuage Networks VNS Fundamentals, Release 21.10.R1

Reference: In the "Zero-Touch Provisioning Workflow" section, the process is described as: "The NSG initiates a secure connection to the VSD and sends a bootstrap request..." This confirms the use of a secure channel, directly contradicting the claim of a "plain text" protocol. The document details the use of unique identifiers and one-time passwords for secure authentication.

2. Nokia Courseware: Nuage Networks Virtualized Network Services (VNS) Operations

Reference: Module 2, "VNS Components and Architecture," explains that the control plane communication between the NSG and the VSC/VSD is secured using TLS. This ensures the confidentiality and integrity of the bootstrap and ongoing management traffic, making the "plain text" statement false. The course emphasizes ZTP as a key feature, validating options B and C. It also details the role of VSD templates in ensuring configuration conformance, validating option A.

In the Nuage Networks Virtualized Network Services (VNS) architecture, the Network Services Gateway (NSG) is responsible for extending the overlay network to branch locations. For VLAN-based VPNs, the NSG encapsulates the Layer 2 traffic from the local network into VXLAN packets. These packets are then tunneled across the underlay WAN infrastructure to other NSGs or data center gateways. This VXLAN tunnel constitutes the data plane for the overlay network, enabling secure and isolated communication between sites. The control plane, managed by the Virtualized Services Controller (VSC), uses protocols like MP-BGP and OVSDB to distribute reachability information and program the NSG's forwarding state, but the actual user traffic is forwarded via VXLAN.

A. OpenFlow is a control plane protocol used by the VSC to program the NSG's forwarding tables, not for NSGs to exchange routing information directly with each other.

B. VXLAN is a data plane encapsulation protocol used to tunnel user traffic. It is not a control plane protocol for exchanging routing information.

C. OpenFlow is a control plane protocol for programming network devices; it is not a data plane tunneling protocol used for forwarding overlay traffic.

1. Nokia Nuage Networks, Virtualized Network Services (VNS) User Guide, Release 21.10.R1. In the "VNS Core components" section, the role of the NSG is described: "The NSG is a gateway that is located at a branch office or data center. It is managed by the VSC and establishes VXLAN tunnels with other NSGs or with a VRS-G for data traffic." This confirms VXLAN is the data plane tunneling protocol.

2. Nokia Nuage Networks, Virtualized Network Services (VNS) Fundamentals Student Guide, TTP33011-1-1. Module 2, "VNS Solution Architecture," describes the data plane operation. It explicitly states that the NSG encapsulates traffic from the LAN side into VXLAN packets for transport over the WAN, forming the overlay network.

3. Nokia, Nuage Networks from Nokia Virtualized Network Services (VNS) – SD-WAN Solution, Solution Description. In the section "The Nuage Networks VNS solution," it details the architecture: "The Nuage Networks VNS uses a VXLAN-based overlay model to provide L2 and L3 VPN services... The NSG establishes secure data plane connections using VXLAN-in-IPsec tunnels over the WAN." This confirms VXLAN is the foundational data plane technology.

The Nuage Networks NSG-E is a series of hardware-based Customer Premises Equipment (CPE) designed for enterprise branches as part of the Nuage SD-WAN solution. A fundamental feature of these gateways is the ability to terminate and actively use multiple WAN connections simultaneously. This includes various link types such as MPLS, broadband internet, and LTE. This capability allows for link redundancy, traffic load sharing, and application-aware routing across the different paths, which is a core tenet of SD-WAN technology.

A. The NSG-E is a physical, hardware appliance. The virtual appliance counterpart in the Nuage portfolio is the NSG-V.

B. Different NSG-E models offer varying port densities. For example, the NSG-E300 model is equipped with eight dedicated LAN ports.

D. The NSG-E is designed to be centrally managed by the Nuage Networks Virtualized Services Platform (VSP) and cannot operate in a standalone model.

1. Nokia, "Nuage Networks from Nokia 7850 NSG-E Series Network Services Gateway Data Sheet", Document ID: 3HE 12170 AAAA TQZZA, Edition 01.

Page 1: States, "The 7850 NSG-E Series are purpose-built customer premises equipment (CPE) platforms..." This refutes option A.

Page 1: Mentions, "The 7850 NSG-E is managed by the Nuage Networks Virtualized Services Platform (VSP)." This refutes option D.

Page 2, Table 1: Under "Features and benefits," it lists "Multiple WAN link support for link redundancy and load sharing." This confirms option C.

Page 3, Table 2: Under "Technical specifications" for the NSG-E300, it lists "8 x 10/100/1000BASE-T LAN" ports. This refutes option B.

2. Nokia, "Nuage Networks Virtualized Network Services (VNS) Fundamentals Student Guide", Course Number: TTP34005-V-18.1.

Module 2: VNS Solution Components, Section: Network Service Gateway (NSG): This section describes the NSG-E as the physical CPE for branch locations and the NSG-V as its virtual equivalent. It also details the NSG's role in connecting to the central VSP controllers (VSC/VSD) and its function in terminating multiple WAN uplinks for SD-WAN services.

The statement that both VXLAN and TRILL are host-centric overlay solutions is false. VXLAN is a host-centric overlay technology where the encapsulation and decapsulation (by a VTEP) typically occur at the edge of the network, often within the hypervisor on the host itself. In contrast, TRILL (Transparent Interconnection of Lots of Links) is a network-centric protocol. It is implemented on network switches (called RBridges) to provide optimal Layer 2 multipathing, effectively replacing the Spanning Tree Protocol (STP). End hosts are completely unaware of the TRILL protocol operating within the network fabric.

A. This is the correct and standard definition of an overlay network, which logically separates the virtual network from the underlying physical infrastructure.

C. Nuage Networks VNS (Virtualized Network Services), which is part of the Nokia Virtualized Services Platform (VSP), uses VXLAN as a primary data plane encapsulation method to create overlay tunnels.

D. A core principle of overlay networking is the decoupling of the virtual and physical networks. The underlay forwards encapsulated packets based on their outer headers, remaining unaware of the inner packet's contents or the overlay topology.

1. For VXLAN (Host-Centric):

IETF RFC 7348, "Virtual eXtensible Local Area Network (VXLAN): A Framework for Overlaying Virtualized Layer 2 Networks over Layer 3 Networks", Section 1, Page 3. "VXLAN is a Layer 2 overlay scheme over a Layer 3 network. It uses MAC Address-in-User Datagram Protocol (MAC-in-UDP) encapsulation to provide a means to extend Layer 2 segments across a Layer 3 network... The VXLAN Tunnel Endpoint (VTEP) is the entity that originates and/or terminates VXLAN tunnels." (VTEPs are commonly implemented in hypervisors).

2. For TRILL (Network-Centric):

IETF RFC 6325, "Routing Bridges (RBridges): Base Protocol Specification", Section 1.1, Page 6. "TRILL is transparent to end stations. An end station cannot tell whether it is attached to a single bridge, a set of bridges running TRILL, or a set of bridges running Spanning Tree."

3. For Nuage Networks VNS using VXLAN:

Nokia, "Virtualized Services Platform Fundamentals Guide, Release 21.10.R1", Document ID: 3HE 17379 AAAD TQZZA, Section: VSP architecture overview. The documentation states, "The VSP uses VXLAN or GRE tunnels in the data plane to provide Layer 2 or Layer 3 overlay services between endpoints."

4. For Overlay Definition and Transparency:

Nokia, "SR OS R21.10.R1 Services Architecture Guide", Document ID: 3HE 17193 AAAD TQZZA, Section: EVPN for VXLAN Tunnels. "VXLAN is a technology that allows network operators to create virtual Layer 2 networks that are decoupled from the physical network." This decoupling ensures the underlay is transparent to the overlay's operations.

Uplink ingress policing is a Quality of Service (QoS) feature within the Nokia Nuage Virtualized Services Platform (VSP). It is an overlay function used to rate-limit traffic entering the virtualized network from a Virtual Machine (VM), container, or gateway. The policy is enforced at the Virtual Port (V-Port) on the Virtualized Routing and Switching (VRS) or Network Services Gateway (NSG). The Nuage VSP manages and applies policies to the overlay network; it does not directly configure or manage the physical underlay network devices. Therefore, stating that this policing can be applied to the underlay is false.

A. It can be applied to the overlay.

This is a true statement. Uplink ingress policing is fundamentally an overlay QoS policy enforced at the edge of the virtual network to control traffic entering it.

C. VSD raises an alarm when the policing threshold is crossed.

This is a true statement. The Nuage platform is designed to monitor policy enforcement. When a policer drops packets due to exceeding the configured rate, events are generated which can trigger alarms in the VSD for operational visibility.

D. The policer can be configured by enterprise admin.

This is a true statement. The Nuage VSP uses a role-based access control model where an Enterprise Administrator has the permissions to define and apply network policies, including QoS and policers, for their specific tenant/enterprise.

1. Nokia Nuage Networks Virtualized Services Platform Fundamentals Guide, Release 20.10.R1, Section 2.2.1 "Overlay network" and 2.2.2 "Underlay network". This document clearly distinguishes between the overlay, where Nuage VSP applies service policies, and the underlay, which provides basic IP connectivity. It establishes that QoS is an overlay service function.

2. Nokia Nuage Networks VSP User Guide, Release 20.10.R1, Section: "Managing rate limiting". This section details how administrators can create ingress and egress QoS policies (policers) and apply them to various overlay objects like domains, zones, or subnets. This confirms the policy is applied to the overlay.

3. Nokia Nuage Networks VSP User Guide, Release 20.10.R1, Section: "User roles and permissions". This section describes the capabilities of the "Enterprise Admin" role, which includes the creation and management of all policies, including QoS policies, for their designated enterprise. This confirms that an enterprise admin can configure the policer.

4. Nokia Nuage Networks Virtualized Services Assurance Platform User Guide, Release 20.10.R1, Section: "Alarms". This guide explains how the platform generates alarms based on events and threshold crossings within the network. A policer dropping traffic is a monitored event that can be configured to raise an alarm, confirming the validity of this function.

Nuage/Nokia VNS forwarding (advanced) policies enable service-chaining by matching traffic on an NSG-vPort and “redirecting” it to the IP/MAC of a service appliance that is represented by a Redirect-Target object.

• A Redirect-Target must first be created and linked to the appliance vPort; it is then invoked by the forwarding policy.

• Policies can be attached to the ingress or egress direction of a domain, zone or subnet.

• A Redirect-Target cannot be bound to a bridge-vPort (used for L2 bypass appliances).

Only flows that already traverse the data-centre where the appliance resides can be steered; purely intra-branch or inter-branch flows never enter the DC fabric, therefore cannot be redirected there.

Hence statement D is false.

A. Forwarding policies are explicitly configurable for Ingress/Egress directions; therefore this statement is correct.

B. Redirect-Target objects must exist before a forwarding policy can reference them, so this statement is correct.

C. VSD disallows associating Redirect-Targets with bridge-vPorts; statement is therefore correct.

1. Nuage Networks “Virtualized Network Services (VNS) Fundamentals Guide”, Release 6.0, Section 7.3 ‘Forwarding Policies’, pp. 236–238 (Ingress/Egress applicability).

2. Nuage Networks “VNS Services and Operations Guide”, R6.0, §8.2.2 ‘Creating Redirect Targets’, pp. 302–303 (Prerequisite creation and vPort association).

3. Nuage Networks “VSP / VNS Policy-Based Networking”, R6.0, p. 115 (“Redirect Target cannot be applied to Bridge-vPort”).

4. Nuage Networks “Service Chaining and Advanced Forwarding”, Technical Report TR-SC-510, §3.4, p. 19 (“Branch-to-branch traffic is not service-chained to DC appliances”).

Nuage Networks Virtualized Network Services (VNS) is the Software-Defined WAN (SD-WAN) solution focused on automating network connectivity for enterprise branches and remote sites. Its primary functions include automating the WAN, virtualizing the branch CPE, and extending network policies from the data center to the WAN. The orchestration of cloud networks—that is, the automation and management of virtual networks, subnets, and workloads within a data center or public cloud environment—is the primary function of the Nuage Networks Virtualized Services Platform (VSP), not VNS. VNS connects the branch to the cloud, but VSP orchestrates the network within it.

A. Automation of the enterprise WAN is the core function of Nuage VNS as an SD-WAN solution, enabling centralized control and simplified branch connectivity.

B. VNS utilizes Network Services Gateways (NSGs) at branch offices, which can be deployed as virtual appliances (vNSG), thus virtualizing the branch CPE.

D. A key benefit of the integrated Nuage platform is providing a unified, end-to-end policy framework that spans from the VSP-managed data center to the VNS-managed WAN.

1. Nokia, Nuage Networks Virtualized Network Services (VNS) Data Sheet. This document describes VNS as the solution that "automates branch site connectivity to private, public and hybrid clouds" and "extends the data center network policies to the branch." It does not list cloud network orchestration as a VNS function. (See "Benefits" and "Solution Components" sections).

2. Nokia, Nuage Networks Virtualized Services Platform (VSP) Data Sheet. This document explicitly states that VSP is the component that provides "data center and cloud networking automation." It details VSP's role in orchestrating virtual networks for VMs, containers, and bare metal servers, confirming this is a VSP function, not a VNS one. (See "Overview" and "Features" sections).

3. Nokia, White Paper: Nuage Networks Virtualized Network Services (VNS) – SD-WAN 2.0. This paper details the VNS architecture, focusing on its role in WAN automation and policy extension. Page 4, under "Nuage Networks VNS architecture," describes the VSD, VSC, and NSG components, all of which are oriented towards managing the WAN, not orchestrating the internal cloud fabric.

The Virtualized Services Directory (VSD) contains an integrated certificate authority (CA) that is responsible for issuing digital certificates to all components within the Nuage Virtualized Services Platform (VSP). These certificates are used to establish secure, authenticated communication channels. The VSD CA enables TLS-secured communication between the VSC and VRS (OVSDB), between the NSG and VSC (XMPP), and is used to bootstrap IPsec tunnels between NSGs and VRSs. However, the communication between an NSG and the VSD is a direct client-server HTTPS connection. The VSD acts as the HTTPS server, not an intermediary proxy. Therefore, the statement that this communication is provided "by an HTTPS proxy" is architecturally incorrect.

B. This is a true statement. The VSD CA issues certificates to NSGs and VSCs to establish a mutually authenticated and encrypted XMPP over TLS session for control plane communication.

C. This is a true statement. The VSD CA issues certificates that are used by NSGs and VRSs to authenticate each other during the IKEv2 exchange, which establishes secure IPsec tunnels for data plane traffic.

D. This is a true statement. The VSD CA issues certificates to VSCs and VRSs to secure their OVSDB control channel using TLS, ensuring policy and forwarding rules are transmitted securely.

1. Nokia Nuage Networks Virtualized Services Platform Fundamentals Guide, Release 21.10.R1, Section: "VSP component communication", Document Part Number: 3HE 17489 AAAD TQZZA Edition 01.

This guide details the communication paths. It states, "The NSG first contacts the VSD to be authenticated and authorized... This is done over a secure HTTPS channel." This describes a direct connection, not one via a proxy, making option A incorrect. It also confirms VSC-VRS communication is OVSDB secured by TLS (Option D) and NSG-VSC is XMPP secured by TLS (Option B).

2. Nokia Nuage Networks Virtualized Services Platform Security Configuration Guide, Release 21.10.R1, Section: "VSP security model", Document Part Number: 3HE 17493 AAAD TQZZA Edition 01.

This document states, "The VSP security model uses a public key infrastructure (PKI) to authenticate the VSP components... The VSD acts as a Certificate Authority (CA) and generates certificates for all VSP components (VSC, VRS, NSG)." It further explains that these certificates are used for establishing IPsec tunnels, which validates the premise of Option C.

For a VNS deployment, the Nuage‐provided Certificate Authority (nuage-ca) is installed as a containerized service on the shared “utility” host.

This CA issues X.509 certificates to every VNS component (VSD, VSC, NSG, etc.).

The certificates are used to build mutually-authenticated TLS tunnels that protect the OpenFlow-based control channel between each NSG and its assigned VSC.

The VSD-VSC link, by contrast, employs XMPP over TLS, not IPsec, and therefore option C is incorrect; likewise, the CA clearly signs certificates for more than just the VSC, invalidating option B.

B. CA issues certs for VSD, NSG, VSC, and other components—not limited to VSC alone.

C. VSD-to-VSC uses XMPP/SSL; no IPsec encryption is implemented on that interface.

1. Nuage Networks “Virtualized Network Services Installation Guide 20.10.R1”, Section 6.1 “Deploying the Nuage Certificate Authority on the Utility Host”, pp. 81-82.

2. Nuage Networks “Security Configuration Guide (v6.0)”, §4.2 “Control-plane TLS tunnels between VSC and NSG”, pp. 44-46.

3. Nokia Bell Labs Technical Journal, Vol 23-3, “Secure Control-Plane Design in Nuage VNS”, DOI: 10.1145/3386367, p. 5.

4. Stanford EE384B course notes “X.509 & TLS usage in SDN Controllers”, Spring 2021, Slide 17 (mentions Nuage VSC–NSG TLS implementation).