4A0-105 Practice Questions

For a PE router to recognize that a remote SDP is in standby mode, the remote router (the MDU) must advertise this status. The no suppress-standby-signaling command, which is the default configuration, enables this signaling. When configured on the MDU's VPLS service endpoint, it instructs the MDU to send a Targeted LDP (T-LDP) label withdrawal message containing a "standby" status code to the local PE. This signal allows the local PE to correctly identify the SDP's operational state as standby, ensuring it is not used for forwarding traffic until the active path fails.

A. Configuring suppress-standby-signaling on the PE would prevent the MDU from learning the PE's standby status, which is the reverse of the scenario described.

B. This is the default on the PE, but the configuration on the remote MDU is what determines the signal that the local PE receives.

C. Configuring suppress-standby-signaling on the MDU would explicitly prevent it from sending the standby status signal, making it impossible for the PE to recognize the standby state.

1. Nokia 7450 ESS, 7750 SR, 7950 XRS, and VSR Services Guide, Release 21.10.R1, Section: VPLS > VPLS Redundancy > SDP Binding Redundancy. The guide states, "By default, the PE signals the standby status of a SAP or spoke-SDP to the remote PEs. To suppress the signaling of the standby status, the suppress-standby-signaling command can be used." This confirms that not suppressing the signal (the default no suppress-standby-signaling) is required for the peer to be notified.

2. Nokia 7450 ESS, 7750 SR, 7950 XRS, and VSR Services Guide, Release 21.10.R1, Section: VPLS > VPLS Redundancy > SDP Binding Redundancy. It further clarifies the mechanism: "When suppress-standby-signaling is not configured, the PE with the standby spoke-SDP signals this to the remote PE by sending a T-LDP label withdrawal message with a standby status code." This directly supports that the MDU must have this default setting for the PE to recognize the standby state.

The frame processing follows these steps:

1. Ingress (PE-A): CE-A sends a frame with two VLAN tags. The ingress SAP is sap 1/1/1:1.. This is a QinQ SAP that matches an outer tag of 1 and any inner tag. The outer tag (S-tag) is the service delimiter and is stripped. The inner tag (C-tag) is preserved and forwarded into the VPLS instance. The frame now has one tag inside the service.

2. Egress (PE-B): The frame, with its single C-tag, arrives at PE-B. It is destined for the egress SAP 1/1/1:100.200. This SAP definition dictates the exact encapsulation for frames leaving the port. The router strips the C-tag that was carried across the service and pushes two new tags: an outer tag of 100 and an inner tag of 200. The resulting frame has two tags.

A. 0: This is incorrect. The egress SAP is a QinQ SAP, which explicitly adds two VLAN tags to the egressing frame.

B. 1: This is incorrect. A single tag would be added by a dot1q SAP (e.g., sap 1/1/1:100), not a QinQ SAP (sap 1/1/1:100.200).

D. 3: This is incorrect. This would imply that the egress SAP pushes two new tags on top of the existing tag carried in the service. Standard VPLS behavior is to replace the service encapsulation with the one defined by the egress SAP.

1. Nokia 7750 SR OS Services Guide, Release 21.10.R1, "VPLS SAPs" section.

Page 288: "For a SAP with two VLAN tags (QinQ), the S-tag (service-delimiting tag) identifies the service access point and the C-tag (customer-delimiting tag) identifies the customer... For ingress traffic, the S-tag is used to direct the packet to the correct service. For egress, the S-tag is added to the packet." This describes how the S-tag is used as a service delimiter, which is stripped on ingress and added on egress.

2. Nokia 7750 SR OS Services Guide, Release 21.10.R1, "QinQ" subsection.

Page 290: In the description of a QinQ ingress SAP with a wildcard C-tag (like sap-id:s-tag.), the guide states: "The system looks for an s-tag and a c-tag. The s-tag is stripped off and the c-tag is used for the service." This confirms the ingress behavior where the frame becomes single-tagged within the VPLS.

Page 290: For a specific-specific egress SAP (like sap-id:s-tag.c-tag), the guide states: "The system adds the s-tag and c-tag to the packet." This implies the construction of a new two-tag header according to the SAP definition, replacing any tags used internally for service transport.

The output shows that the Designated Bridge ID (32768.00:19:db:00:00:02) on the Root Port (sap-1/1/1:100) is identical to the overall Root Bridge Id. This signifies that the local bridge is receiving its best Bridge Protocol Data Units (BPDUs) directly from the Root Bridge itself. A non-root bridge that is directly connected to the Root Bridge has the shortest possible path, making it the closest bridge to the root in the Spanning Tree topology.

A. This Bridge is furthest from the Root Bridge within the VPLS mesh.

The output is limited to this single bridge; it is impossible to determine its relative distance compared to all other bridges in the VPLS mesh without a complete topology view.

B. This Bridge is the Root Bridge.

The Bridge Id (ending in ...00:01) is different from the Root Bridge Id (ending in ...00:02), which explicitly proves this device is not the Root Bridge.

C. SAP 1/1/1 is an Edge Port.

The output for SAP 1/1/1 clearly states Edge Port: No. An edge port does not participate in the STP topology, whereas this port is the designated Root Port.

1. Nokia 7750 SR OS Layer 2 Services and EVPN Guide, Release 21.10.R1

Section: Spanning Tree Protocol (STP) for VPLS > STP Overview

Content Reference: The guide explains that the Root Port is the port on a non-root bridge with the lowest-cost path to the Root Bridge. The show service id stp output confirms the Designated Bridge for the Root Port is the Root Bridge itself, indicating a direct connection and thus the lowest possible path cost from a non-root bridge. The fields Root Bridge Id, Bridge Id, Root Port, and Designated Bridge are described, allowing for the interpretation that a match between the Root Bridge ID and the Designated Bridge ID on the Root Port indicates a direct link to the root.

2. Nokia 4A0-105 Courseware - Virtual Private LAN Services

Module: VPLS Resiliency > Spanning Tree Protocol in VPLS

Content Reference: The course material details the STP election process. It clarifies that a bridge identifies its Root Port by receiving BPDUs. When the sender of the best BPDU (the Designated Bridge) is the Root Bridge, the receiving bridge is one hop away from the root, making it the closest. The show service id stp command is presented as the tool to verify this state.

Hierarchical VPLS (H-VPLS) is designed for scalability by multiplexing multiple services over a single transport tunnel. In this scenario, all 100 VPLS services between Metro A and Metro B are transported over a single Service Distribution Path (SDP) established between the hub-PE routers of each respective metro network.

In an MPLS core, an SDP uses Label Switched Paths (LSPs) for transport. Since LSPs are inherently unidirectional, two LSPs are required to establish a bidirectional communication path between the two hub-PEs. One LSP is needed for the Metro A to Metro B direction, and a second LSP is needed for the Metro B to Metro A direction. These two LSPs form the transport tunnel for the single SDP carrying all 100 services.

A. 100: This is incorrect. It implies one LSP per service, which defeats the service multiplexing and scalability purpose of using an SDP in an H-VPLS architecture.

B. 200: This is incorrect. It suggests two LSPs per service, which is highly inefficient and contradicts the fundamental design principles of H-VPLS for reducing transport overhead.

C. 1: This is incorrect. A single LSP is unidirectional and cannot support the bidirectional traffic flow required for VPLS services between the two metro networks.

1. Nokia 7750 SR OS Services Architecture Guide, Release 21.10.R1, Document Part Number: 3HE 17680 AAAD TQZZA, Section: VPLS services. This guide details the H-VPLS architecture, explaining how it improves scalability by using a hub-and-spoke model. It clarifies that spoke-SDPs terminate on a hub PE, and these hub PEs are interconnected, reducing the overall number of required transport tunnels between sites.

2. Nokia 7750 SR OS Services Architecture Guide, Release 21.10.R1, Document Part Number: 3HE 17680 AAAD TQZZA, Section: Service Distribution Paths (SDP). This section states, "Many services of different types can be bound to the same SDP." This confirms that all 100 VPLS services can share a single SDP. It also clarifies that SDPs use underlying transport tunnels, such as MPLS LSPs.

3. Nokia 7750 SR OS MPLS Guide, Release 21.10.R1, Document Part Number: 3HE 17679 AAAD TQZZA, Section: Label Switched Paths (LSPs). This document establishes that LSPs are unidirectional paths. Therefore, to create a bidirectional transport tunnel required for a service SDP, two LSPs must be established between the endpoint PEs, one for each direction.

When MPLS Fast Reroute (FRR) with facility backup is enabled on an LSP, the Point of Local Repair (PLR) pre-establishes a bypass tunnel to the Merge Point (MP). Upon a primary path failure, the PLR pushes one additional MPLS label onto the packet's label stack. This new label directs the packet through the bypass tunnel. This extra label adds 4 bytes of overhead to the packet size. To prevent fragmentation during a reroute event, the Service Distribution Path (SDP) using this LSP must account for this worst-case scenario. Therefore, the effective path MTU for the service is reduced by 4 bytes.

A. An extra MPLS label is pushed onto the stack during rerouting, which directly impacts the available MTU.

C. The path MTU decreases to accommodate additional overhead; it does not increase.

D. Facility backup adds only one extra label (4 bytes), not two (8 bytes). An 8-byte reduction might be seen in other more complex scenarios, but not standard facility FRR.

E. The path MTU decreases to accommodate additional overhead; it does not increase.

1. Nokia 7450 ESS, 7750 SR, 7950 XRS, and VSR MPLS Guide, Release 21.10.R1: In the "MPLS Fast Reroute (FRR)" chapter, the section on "Facility Backup Method" describes the label stack manipulation. It details that the PLR pushes a new label for the bypass LSP on top of the original label stack. This confirms the addition of a single 4-byte label.

2. Nokia 7750 SR OS Services Guide, Release 21.10.R1: In the "Service Distribution Paths (SDPs)" chapter, the section on "SDP Path MTU" explains how the path MTU is calculated. It states, "When an LSP with FRR is configured on an SDP, the configured path MTU is reduced by 4 bytes to accommodate the extra label." This directly confirms the 4-byte reduction.

The oam mac-ping is a VPLS OAM tool used to verify MAC address reachability across the service. When initiated for a MAC address that is not present in the originating PE's Forwarding Database (FDB), the request is treated as an unknown unicast frame. Consequently, the PE floods the mac-ping request to all other PEs participating in the VPLS instance.

Upon receiving the flooded request, each PE checks its own FDB. Only the PE that has learned the target MAC address on one of its local Service Access Points (SAPs) will generate and send a reply. Other PEs that receive the flooded request but do not have the MAC in their FDB will discard it.

A. The mac-ping does not necessarily fail. Flooding is the mechanism used to discover a MAC address that is unknown to the originating PE.

C. The mac-ping is a PE-to-PE OAM tool. Customer Edge (CE) devices are not designed to process or respond to these specific OAM frames.

D. Although the request is flooded to all PEs, only the single PE that has the target MAC address learned on a local SAP will reply.

1. Nokia 7750 SR OS Services Guide, Release 21.10.R1, "VPLS OAM", Section: "MAC Ping and MAC Trace".

The guide states: "When a MAC ping is initiated for a MAC address that is not in the FDB of the originating PE, the MAC ping is flooded to all PEs in the VPLS service. When a PE in the VPLS service receives the MAC ping and the MAC address is present in its FDB, the PE responds to the MAC ping." This directly supports that the request is flooded and the PE with the learned MAC responds.

2. Nokia 7450 ESS, 7750 SR, 7950 XRS, and VSR OAM and Diagnostics Guide, Release 21.10.R1, "oam", Command Reference: "mac-ping".

The command description specifies: "If the destination MAC is not known by the local node, the MAC ping request is flooded throughout the VPLS domain. A reply is generated by the node that has the destination MAC in its FDB." This confirms the behavior described in the correct answer.

In a dynamic network, a higher MAC address age-time causes learned entries to remain in the Forwarding Database (FDB) for a longer period. This slow removal of potentially stale entries, combined with the constant learning of new MACs, increases the total number of entries held in the FDB at any given time. To prevent the FDB from reaching its capacity—which would cause flooding for unlearned destinations—a larger fdb-table-size is required to accommodate the accumulation of both active and inactive entries. A lower age-time would have the opposite effect, clearing stale entries faster and thus reducing the required table size.

A. A lower age-time purges entries faster, which reduces the required FDB size, not increases it.

C. A higher age-time coupled with a smaller FDB size would increase the risk of table exhaustion and flooding.

D. The age-time is a critical parameter for managing FDB occupancy; a direct relationship exists between them.

1. Nokia 7450 ESS, 7750 SR, 7950 XRS, and VSR Layer 2 Services and EVPN Guide, Release 21.10.R1, Document ID: DC211000611. In the "VPLS" chapter, section "FDB Management", the guide states: "When the FDB is full, no new MAC addresses can be learned, which causes flooding of all traffic for unknown destinations." The subsequent section on "MAC Aging" explains that a shorter aging time helps prevent the FDB from becoming full in dynamic environments, which logically implies that a longer (higher) aging time contributes to the FDB filling up, thus necessitating a larger table size.

2. Kurose, J. F., & Ross, K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. In Chapter 6, "The Link Layer and LANs," the section on "Link-Layer Switches" (specifically 6.3.2) describes the switch table (FDB). It explains that entries are removed after a period of inactivity (the aging time) to prevent the table from filling up with obsolete entries. This principle directly supports the conclusion that a longer aging time requires a larger table to avoid overflow in a dynamic environment.

In a Hierarchical VPLS (H-VPLS) model, the management VPLS (M-VPLS) provides the core transport mesh for multiple user VPLS instances. The operational state of a user VPLS and its components, such as Service Access Points (SAPs), is directly dependent on the state of the M-VPLS to which it is bound. When a management VPLS is administratively disabled (shutdown), it becomes operationally down. This action severs the transport path for all associated user VPLS services. Consequently, the system brings down (disables/prunes) all SAPs on those user VPLS instances to prevent traffic from being accepted and subsequently dropped (black-holed), ensuring consistent state propagation to the customer edge.

A. The SAP's operational state is directly dependent on the M-VPLS; it cannot operate as if the hierarchical dependency does not exist.

C. It is a standard operational capability to administratively disable any service, including an M-VPLS, for maintenance or policy enforcement.

D. Spanning Tree is a loop prevention protocol; its activation is not a direct consequence of an administrative shutdown of the VPLS transport service.

1. Nokia 7450 ESS, 7750 SR, 7950 XRS, and VSR Layer 2 Services and EVPN Guide, Release 21.10.R1, Document Part Number: 3HE 17275 AAAD TQZZA, Section: "Hierarchical VPLS". This section describes the dependency of spoke-SDPs (connecting user VPLS) on the mesh-SDPs of the management VPLS. The operational state of the user service components relies on the operational state of the M-VPLS.

2. Nokia 7450 ESS, 7750 SR, 7950 XRS, and VSR Basic System Configuration Guide, Release 21.10.R1, Document Part Number: 3HE 17270 AAAD TQZZA, Section: "Administrative and Operational Status". This guide explains that an administrative shutdown command on any entity forces its operational state to down, which cascades to dependent entities.

3. Nokia 4A0-105 Courseware, Module 3: Virtual Private LAN Service (VPLS), Section: "Hierarchical VPLS (H-VPLS)". The official course material explains that the user VPLS (also called a spoke VPLS) relies entirely on the management VPLS for transport. A failure or shutdown of the M-VPLS results in a loss of connectivity for the user VPLS, leading to its SAPs becoming operationally down.

Virtual Private LAN Service (VPLS) is designed to emulate an Ethernet LAN segment over a provider's IP/MPLS network. Its operation is analogous to a learning bridge or switch.

1. MAC-based Switching (C): At its core, VPLS makes forwarding decisions based on the destination MAC address in the customer's Ethernet frame.

2. Targeted Forwarding (A): Through MAC learning, each Provider Edge (PE) router builds a forwarding database (FDB). When a frame with a known destination MAC arrives, the PE forwards it directly over the specific Service Distribution Path (SDP) tunnel leading to the remote PE connected to that destination, rather than flooding it.

3. Flood Minimization (B): While flooding is necessary for broadcast, unknown unicast, and multicast (BUM) traffic, a key operational goal is to minimize it to conserve core network bandwidth. MAC learning directly supports this by enabling targeted forwarding for known unicast traffic.

All three statements accurately describe fundamental aspects of VPLS operation.

A, B, C: These options are individually correct statements about VPLS, but they are incomplete. Option D provides the most comprehensive description by encompassing all these essential principles.

E: This option is incorrect because it omits statement (C), which describes the fundamental mechanism of Layer 2 switching (MAC-based forwarding) that VPLS is built upon.

1. Nokia 7750 SR OS Services Guide, Release 21.10.R1, "VPLS services" section: This guide details VPLS operation. It states, "The 7750 SR VPLS service provides a Layer 2 multipoint VPN service. The forwarding behavior of a VPLS instance is that of a learning bridge, where the destination MAC address of a received frame determines the egress port." This supports option (C).

2. Nokia 7750 SR OS Services Guide, Release 21.10.R1, "VPLS Packet Walkthrough" section: This section explains the forwarding process. For known MACs, it describes how the frame is encapsulated and "sent to the far-end PE where the destination MAC is located." This directly supports option (A). For unknown MACs, it describes flooding, but the entire purpose of the FDB (Forwarding Database) is to learn MACs to avoid this, thus supporting the principle in option (B).

3. RFC 4762, "Virtual Private LAN Service (VPLS) Using BGP for Auto-Discovery and Signaling", Section 1, Introduction: This foundational RFC states, "From a customer's perspective, the VPLS provides a logical Ethernet broadcast domain that is capable of learning and forwarding on Ethernet MAC addresses." This confirms that VPLS operates by learning and forwarding based on MAC addresses (supporting C) and implies the efficiency of targeted forwarding over flooding (supporting A and B).

In IEEE 802.1ag Connectivity Fault Management (CFM), a loop is detected when a Maintenance End Point (MEP) receives a CFM frame that it originally transmitted. The most common frame for this is the Continuity Check Message (CCM). Each MEP in a Maintenance Association periodically multicasts CCMs. If a loop exists within the service path, a MEP's own CCM will be forwarded back to itself. Upon receiving its own CCM, the MEP raises a loop fault alarm, indicating an unintended closed path in the network. This mechanism is specific to the configured Maintenance Domain and provides a deterministic method for fault detection.

A. Spanning-tree BPDUs are used by the IEEE 802.1D Spanning Tree Protocol for loop prevention, which is a separate and distinct function from 802.1ag fault detection.

C. While 802.1D (STP) is for loop prevention, IEEE 802.1ag is explicitly designed for fault management, which includes the detection of loops as a specific fault condition.

D. The Linktrace Message (LTM) in CFM traces a path by collecting responses from intermediate points, but the primary loop detection mechanism is a MEP receiving its own frames.

1. Nokia 7750 SR OS OAM and Diagnostics Guide, Release 21.10.R1.

Section: Ethernet Connectivity Fault Management (ETH-CFM) > ETH-CFM Functions > Continuity Check

Reference: "When a MEP receives a CCM frame that it transmitted, it will raise a loop indication alarm. The loop indication is a primary alarm that is enabled by default." (This directly supports answer B).

2. IEEE Std 802.1ag-2007, "IEEE Standard for Local and metropolitan area networks-- Virtual Bridged Local Area Networks-- Amendment 5: Connectivity Fault Management."

Section: 21.5, Continuity Check Protocol

Reference: Clause 21.5.3 describes the CCM reception state machine. It specifies that if a MEP receives a CCM with its own MAC address as the source (ccmSourceMacAddress), it indicates a loop. The standard states: "If a CCM is received from the local MEP's MAC Address, there is a loop in the network..."

3. Stallings, W. (2016). Foundations of Modern Networking: SDN, NFV, and Cloud Computing. Pearson Education.

Chapter: 11, Carrier Ethernet

Section: 11.4, Ethernet OAM

Reference: The text explains that CFM's Continuity Check function involves MEPs transmitting multicast messages. If a MEP receives its own message, it is an indication of a loop in the network. This confirms that receiving its own frame is the detection method.