Platform Study · Reference Infographic · IOS XR / Crosswork / NSO

CISCO SERVICE PROVIDER
the transport, the brains, the subscribers

Routers are the trucks, IOS XR is the drivetrain, Segment Routing is the pre-planned route sheet, and Crosswork + NSO are dispatch. One board, whole portfolio.

TRANSPORT SR-MPLS → SRv6 IGP IS-IS + SR FRR TI-LFA <50ms L2 EVPN only WRITE-PATH NSO transactions CRYPTO MACsec AES-256-XPN DAY-0 Secure ZTP + SUDI

01THE BOARD — HOW EVERYTHING TIES TOGETHER

Solid cyan = packet transport. Dashed amber = control & orchestration pushing intent down. Dotted green = telemetry streaming back up. The loop is the architecture: intent down, evidence up.

ORCHESTRATION & CONTROL PLANE CROSSWORK CNC topology · SR-TE intent service health · ZTP change automation NSO YANG svc models NEDs · dry-run commit / rollback SR-PCE BGP-LS in PCEP down + Optimization Eng. HCO + CONC multilayer L0–L3 RON / PLE circuits optical line control CDG + HEALTH gNMI / MDT / SNMP KPIs · anomalies → Kafka / SIEM PLANNING WAE / Crosswork failure sim capacity NETCONF push PCEP policies optical intents telemetry up TRANSPORT PLANE — IOS XR packet SUBSCRIBER CPE·OLT·gNB NCS 540/560 access · PTP/SyncE ASR 9000 edge · BNG-UP · H-QoS 8000 / NCS5700 SR core · Silicon One 8000 PEERING RPKI·FlowSpec INTERNET untrust [16011] [16024] [16002] NCS 1010 OLS ZR/ZR+ 400G DWDM RON: optics in router cnBNG CP · 5G CORE AMF·SMF·UPF on SMI K8s PFCP (CUPS) vRR ×2 (XRv9000) BGP · BGP-LS feed ZTA CHAIN: SUDI identity → secure boot → ownership voucher (Secure ZTP) → IMA runtime → Trust Insights dossier → continuous telemetry verification
packet transport control / intent down telemetry / evidence up

02HARDWARE — BUY SILICON FOR THE JOB

CISCO 8000

Silicon One. Core, peering, massive scale, best power-per-bit. Runs IOS XR or SONiC. The strategic flagship.

ASR 9000

The feature-deep edge: BNG user plane, CGN, deep H-QoS, lawful intercept. 15 years of subscriber battle scars.

NCS 5500/5700

Jericho-based cost-efficient aggregation and lean core. High 100/400G density, moderate feature depth.

NCS 540/560

Access & cell-site. Class-leading timing (SyncE, PTP G.8275.1, GNSS). The 5G xHaul standard.

NCS 1010/1014

Open line system for RON — C+L band, built for ZR/ZR+ pluggables living inside routers.

NCS 2000

Classic flex-grid multi-degree ROADM for complex photonic meshes. Legacy-forward.

XRv9000 / XRd

XR as a VM (production vRR) and as a container (labs, pipelines, cloud). Same OS, zero sheet metal.

ULTRA CLOUD CORE

4G/5G NFs (AMF, SMF, UPF, PCF…) + cnBNG control plane — cloud-native on SMI Kubernetes.

03TRANSPORT SHOWDOWN

Why Segment Routing won: the core stops holding per-path state, protection becomes math (TI-LFA), and the controller becomes optional instead of essential.

criterionLDPRSVP-TESR-MPLSSRv6
core stateper-LSPheavy per-LSPnonenone
traffic engineeringfull, complexSR Policy + PCE+ network programming
fast reroutepartial LFAfacility backupTI-LFA 100%TI-LFA
data planeMPLSMPLSMPLS (reuse HW)IPv6 native
verdictretirebrownfield onlydefault todaytarget state

EVPN vs legacy L2VPN

MAC learning moves to BGP; multihoming becomes native (ESI, DF election, all-active). VPLS is the flip-phone: it worked, it's done.

Flex-Algo = free slicing

Algo 129 latency plane, algo 130 MACsec-only plane — multiple topologies from one IGP, no RSVP machinery.

RON = layer collapse

ZR/ZR+ coherent optics in the router + NCS 1010 line system + HCO brain. Every transponder not bought is capex, watts, and a failure domain deleted.

04THE BRAINS — WHO DOES WHAT

NSO — the hands

  • YANG service models → device configs via NEDs
  • Transactional: dry-run, all-or-nothing, rollback
  • Multivendor; CFS/RFS + LSA at scale
  • The single production write-path

CNC — the eyes + brain

  • Topology via BGP-LS; SR-TE/RSVP intent
  • Service Health assurance
  • Optimization Engine + SR-PCE for real-time TE
  • ZTP, Change Automation, Health Insights riders

EPNM — the clipboard

  • Classic FCAPS: inventory, alarms, circuits
  • Optical + XR element management
  • Not intent-based — complements, not competes

05LAB BUILD-OUTS — FOUR TIERS + OSS TWIN

Zones on every tier: UNTRUST peering/attacker  DMZ jump·AAA·telemetry·ZTP·RPKI  TRUST core·PEs·RR·PCE·NSO·CNC·SoT. Deny-by-default between zones. All hosts STIG'd, FIPS mode, CNSA-track certs.

5 VMs

T1 · BARE MINIMUM

2× XRd PE, NSO local, untrust peer, DMZ jump/tools. Feel the commit model, run SR + one L3VPN, push one NSO change.

14 VMs

T2 · ONE PER ROLE

Core P, 2 PEs, access node, vRR, SR-PCE, NSO, CNC (fat single), SoT+GitLab, peering, traffic-gen, jump/AAA, telemetry, ZTP+RPKI.

18 VMs

T3 · HA THAT TEACHES

+P2, +vRR2, +PCE2, +NSO raft member. Duplicate only where duplication changes protocol behavior. CNC stays single.

26+ VMs

T4 · FULL FIDELITY

4-node dual-plane core, EVPN all-active PE pairs, dual peering, CNC 3-node K8s, CDG, cnBNG/5G core sandbox, dual RPKI, ISE. ~128–256 GB RAM.

OPEN-SOURCE TWIN

XR→FRR/VyOS/SONiC-VS · SRv6→Linux kernel · vRR→BIRD · NSO→Ansible/Nornir+Git · CNC→gNMIc+Prometheus+Grafana+SuzieQ · 5G/BNG→Open5GS/free5GC/accel-ppp · RPKI→Routinator+StayRTR · zones→OPNsense/VyOS. Tiers: 4 / 12 / 16 VMs. Honest gap: NSO transactions, PCE behavior, and XR's commit/LPTS model have no OSS equal — pair the OSS lab with T1 Cisco.

06COMPLIANCE — ONE DESIGN, 38 FRAMEWORKS

STIG'd XR + FIPS crypto + NSO change control + telemetry evidence + zone segmentation covers the technical core of nearly the whole Vanta catalog. Frameworks differ in scope and paperwork, not in what the routers must do.

DoD spine

  • DISA STIG: IOS XR NDM+RTR STIGs, RHEL 9, K8s STIG for SMI/CNC
  • FIPS 140-3: XR fips mode, MACsec GCM-AES-256, TLS 1.3
  • CNSA 1.0→2.0: P-384/RSA-3072 certs, SHA-384; PQC (ML-KEM) on roadmap watch
  • ZTA (800-207): SUDI identity, Secure ZTP vouchers, Trust Insights attestation, zone PEPs
  • 800-53/171/CMMC: NSO=CM, telemetry=AU, MACsec=SC-8, zones=SC-7, TACACS+=IA

Vanta 38 crosswalk highlights

  • SOC 2 / ISO 27001: commit logs, golden-config reports, AAA records
  • GDPR / 27701 / HIPAA / CJIS / PCI: subscriber & CGN data handling, link crypto, segmentation
  • CSF 2.0: Govern→SoT · Protect→MACsec/ZTP · Detect→MDT · Respond→FlowSpec/Change Automation · Recover→rollback/WAE
  • DORA / NIS 2: failover drill records, supply-chain attestation (Trust Insights)
  • ISO 42001 / EU AI Act: approval gates on closed-loop automation
SOC 2ISO 27001270172701827701NIST 800-53800-171CMMCFedRAMPCJISHIPAAHITRUSTGDPRPCI DSSCSF 2.0DORANIS 2ISO 42001EU AI Act+19 more via same control core