Routers are the trucks, IOS XR is the drivetrain, Segment Routing is the pre-planned route sheet, and Crosswork + NSO are dispatch. One board, whole portfolio.
Solid cyan = packet transport. Dashed amber = control & orchestration pushing intent down. Dotted green = telemetry streaming back up. The loop is the architecture: intent down, evidence up.
Silicon One. Core, peering, massive scale, best power-per-bit. Runs IOS XR or SONiC. The strategic flagship.
The feature-deep edge: BNG user plane, CGN, deep H-QoS, lawful intercept. 15 years of subscriber battle scars.
Jericho-based cost-efficient aggregation and lean core. High 100/400G density, moderate feature depth.
Access & cell-site. Class-leading timing (SyncE, PTP G.8275.1, GNSS). The 5G xHaul standard.
Open line system for RON — C+L band, built for ZR/ZR+ pluggables living inside routers.
Classic flex-grid multi-degree ROADM for complex photonic meshes. Legacy-forward.
XR as a VM (production vRR) and as a container (labs, pipelines, cloud). Same OS, zero sheet metal.
4G/5G NFs (AMF, SMF, UPF, PCF…) + cnBNG control plane — cloud-native on SMI Kubernetes.
Why Segment Routing won: the core stops holding per-path state, protection becomes math (TI-LFA), and the controller becomes optional instead of essential.
| criterion | LDP | RSVP-TE | SR-MPLS | SRv6 |
|---|---|---|---|---|
| core state | per-LSP | heavy per-LSP | none | none |
| traffic engineering | — | full, complex | SR Policy + PCE | + network programming |
| fast reroute | partial LFA | facility backup | TI-LFA 100% | TI-LFA |
| data plane | MPLS | MPLS | MPLS (reuse HW) | IPv6 native |
| verdict | retire | brownfield only | default today | target state |
MAC learning moves to BGP; multihoming becomes native (ESI, DF election, all-active). VPLS is the flip-phone: it worked, it's done.
Algo 129 latency plane, algo 130 MACsec-only plane — multiple topologies from one IGP, no RSVP machinery.
ZR/ZR+ coherent optics in the router + NCS 1010 line system + HCO brain. Every transponder not bought is capex, watts, and a failure domain deleted.
Zones on every tier: UNTRUST peering/attacker DMZ jump·AAA·telemetry·ZTP·RPKI TRUST core·PEs·RR·PCE·NSO·CNC·SoT. Deny-by-default between zones. All hosts STIG'd, FIPS mode, CNSA-track certs.
2× XRd PE, NSO local, untrust peer, DMZ jump/tools. Feel the commit model, run SR + one L3VPN, push one NSO change.
Core P, 2 PEs, access node, vRR, SR-PCE, NSO, CNC (fat single), SoT+GitLab, peering, traffic-gen, jump/AAA, telemetry, ZTP+RPKI.
+P2, +vRR2, +PCE2, +NSO raft member. Duplicate only where duplication changes protocol behavior. CNC stays single.
4-node dual-plane core, EVPN all-active PE pairs, dual peering, CNC 3-node K8s, CDG, cnBNG/5G core sandbox, dual RPKI, ISE. ~128–256 GB RAM.
XR→FRR/VyOS/SONiC-VS · SRv6→Linux kernel · vRR→BIRD · NSO→Ansible/Nornir+Git · CNC→gNMIc+Prometheus+Grafana+SuzieQ · 5G/BNG→Open5GS/free5GC/accel-ppp · RPKI→Routinator+StayRTR · zones→OPNsense/VyOS. Tiers: 4 / 12 / 16 VMs. Honest gap: NSO transactions, PCE behavior, and XR's commit/LPTS model have no OSS equal — pair the OSS lab with T1 Cisco.
STIG'd XR + FIPS crypto + NSO change control + telemetry evidence + zone segmentation covers the technical core of nearly the whole Vanta catalog. Frameworks differ in scope and paperwork, not in what the routers must do.