BSS/OSS Academy
9.115 min read

MANO vs Cisco NSO: What's the Difference?

MANO vs Cisco NSO: What's the Difference?

In modern telco architectures, service orchestration does not stop at SOM. Below SOM, two major platforms frequently appear: ETSI MANO (Management and Orchestration) for virtualised and cloud-native network functions, and Cisco NSO (Network Services Orchestrator) for device-level network service automation. Understanding what each does — and what it does not do — is critical for architects designing the fulfillment stack.

These three systems — SOM, MANO, and NSO — are complementary, not competing. Each operates at a different abstraction layer. Confusion arises because their names sound similar ("orchestrator", "service management") and their functional boundaries are not always obvious. This section clarifies the distinctions.

Quick Definitions

ETSI MANO (NFV Management and Orchestration)
The ETSI-standardised framework for managing the lifecycle of Virtual Network Functions (VNFs) and Cloud-Native Network Functions (CNFs). MANO consists of three functional blocks — NFVO (NFV Orchestrator), VNFM (VNF Manager), and VIM (Virtualised Infrastructure Manager) — and handles instantiation, scaling, healing, and termination of virtualised workloads on NFVI (NFV Infrastructure). MANO operates at the infrastructure and VNF lifecycle layer.
Cisco NSO (Network Services Orchestrator)
A model-driven network automation platform originally developed by Tail-f Systems (acquired by Cisco in 2014). NSO uses YANG data models and a transactional configuration engine to manage device configurations across multi-vendor networks. NSO excels at Day-1 and Day-2 device configuration (routers, switches, firewalls) via NETCONF, CLI, SNMP, or REST southbound interfaces. NSO operates at the network device configuration layer.
SOM (Service Order Management)
The OSS orchestration engine that translates commercial intent into service-level fulfillment. SOM operates at the CFS/RFS layer, receiving service orders from COM, decomposing them into actionable items, and delegating execution to downstream systems — including MANO (for VNF/CNF lifecycle) and NSO (for device configuration). SOM is the system of record for Service Order entities and manages the end-to-end service fulfillment lifecycle.

Side-by-Side Comparison

The following table compares ETSI MANO, Cisco NSO, and SOM across key architectural dimensions. Pay attention to the differences in target objects, lifecycle scope, and integration style — these are the primary differentiators.

ETSI MANO vs Cisco NSO vs SOM

DimensionETSI MANOCisco NSOSOM
Primary domainNFV infrastructure and VNF/CNF lifecycleMulti-vendor network device configurationEnd-to-end service fulfillment orchestration
Standards bodyETSI NFV ISG (GS NFV-MAN 001)Proprietary (Cisco), uses IETF YANG/NETCONFTM Forum (eTOM, SID, ODA, TMF641)
Main purposeInstantiate, scale, heal, and terminate VNFs/CNFs on virtualised infrastructureConfigure network devices (routers, switches, firewalls) in a transactional, model-driven wayReceive service orders from COM, decompose CFS → RFS, orchestrate fulfillment across all downstream systems
Target objectsVNFs, CNFs, NS (Network Services), VDUs, virtual linksDevice configurations (interfaces, routing, ACLs, VPNs, QoS policies)CFS instances, RFS instances, Service Order Items
Lifecycle managedVNF/CNF instantiate → configure → scale → heal → terminateDevice config: create → modify → rollback → audit → deleteService order: acknowledged → inProgress → completed/failed
Southbound interfacesVIM APIs (OpenStack, Kubernetes), VNFM pluginsNETCONF/YANG, CLI (SSH), SNMP, REST, gNMITMF652 (to ROM), TMF APIs, custom adapters to MANO/NSO/workforce
Northbound interfacesSOL005 REST APIs (NSD, VNF lifecycle, NS lifecycle)REST API, NETCONF, CLI, web UITMF641 (from COM), TMF638 (to Service Inventory)
Day-0 / Day-1 / Day-2 focusDay-0 (infrastructure prep) and Day-1 (VNF instantiation). Limited Day-2.Day-1 (initial config push) and Day-2 (ongoing config changes, audits, compliance)Spans Day-0 through Day-2 at the service level — delegates infrastructure and device work to MANO/NSO
Best-fit use casesDeploying virtualised or cloud-native workloads (vFirewall, vRouter, 5G UPF, SD-WAN VNF)Configuring L2/L3 services, VPN provisioning, firewall rules, multi-vendor device automationEnd-to-end order fulfillment: broadband provisioning, enterprise service activation, multi-domain orchestration
Not best forPhysical device configuration, commercial order logic, service-level orchestrationVM/container lifecycle, infrastructure scaling, cloud orchestrationDirect device configuration, VNF lifecycle management, infrastructure provisioning
Integration styleCalled by SOM or ROM to manage VNF/CNF lifecycle as part of service fulfillmentCalled by SOM or ROM to push device configurations as part of resource activationCalled by COM to initiate fulfillment; calls MANO, NSO, ROM, and other systems as needed
Data / state ownershipVNF instance state, NS instance state, NFVI resource allocationDevice configuration state (intended config, actual config, config diff)Service order state, CFS/RFS instance state (in Service Inventory)

Where Each System Sits in the Stack

The three systems form a natural layered hierarchy. SOM sits at the top (service layer), MANO and NSO sit in the middle (resource/network layer), and the actual infrastructure and devices sit at the bottom.

The Orchestration Stack
Layer 1 (top): BSS / COM — commercial order capture and product lifecycle. Layer 2: SOM — service orchestration, CFS/RFS decomposition, fulfillment coordination. Layer 3a: ETSI MANO — VNF/CNF lifecycle on virtualised infrastructure. Layer 3b: Cisco NSO — device configuration across multi-vendor networks. Layer 4: VIM / Controllers — OpenStack, Kubernetes, SDN controllers. Layer 5 (bottom): NFVI / Physical Network — compute, storage, network hardware, routers, switches. SOM delegates to MANO or NSO (or both) depending on the RFS type being fulfilled.

Think of it this way: SOM decides what needs to happen (e.g., "provision a cloud firewall and configure an L3VPN"). It then calls the right specialist system for each task. MANO handles the cloud firewall VNF lifecycle (create the VM, attach networks, verify health). NSO handles the L3VPN configuration on the routers (push PE/CE configs). SOM tracks overall progress and reports back to COM.

The key insight is that each RFS type in the service catalog maps to a specific execution engine. The service catalog (or a routing table within SOM/ROM) defines these mappings:

  • RFS:vFirewall → MANO (VNF lifecycle)
  • RFS:L3VPN-Config → NSO (device configuration)
  • RFS:GPON-Bearer → Element Manager or SDN Controller (access network)
  • RFS:CPE-Provisioning → TR-069 ACS or Workforce (physical install)
  • RFS:Cloud-Controller-Link → Cloud Platform API (SaaS integration)

SOM does not need to know how MANO or NSO work internally. It submits a resource order item via TMF652 or a direct adapter, and tracks the result. This is the principle of delegation with tracking.

In complex enterprise services (e.g., SD-WAN with cloud security), a single service order may require SOM to coordinate across multiple downstream systems simultaneously: MANO for VNF deployment, NSO for device configuration, an SDN controller for transport path setup, and a cloud API for SaaS integration. SOM's orchestration plan manages the dependencies across these domains — for example, the MANO-deployed vFirewall must be running before NSO pushes the routing policy that references it.

Cross-Domain Rollback
Multi-domain orchestration creates a challenging rollback problem. If MANO successfully deploys a VNF but NSO fails to configure the associated routing, SOM must coordinate compensation: instruct MANO to terminate the VNF and release resources. Without SOM as the overarching orchestrator, cross-domain rollback becomes an unsolvable mess of manual cleanup.

When to Use MANO, NSO, or Both

Rule of Thumb: Match the Object to the Engine
Use MANO when the task involves managing the lifecycle of a virtualised or cloud-native workload (VM, container, Helm chart). Use NSO when the task involves pushing configuration to network devices (routers, switches, firewalls). Use both when a service requires a new VNF/CNF to be deployed and device configurations to be updated to integrate it into the network. Use neither when the task is purely a physical installation (workforce management) or a SaaS integration (cloud API). SOM always sits above — it orchestrates which engine(s) to call based on the RFS decomposition.

Decision Guide: Which System Handles What?

ScenarioSystem(s) InvolvedWhy
Deploy a virtual firewallMANOVNF lifecycle: create VM, attach vNICs, verify health. No device config needed yet.
Configure an L3VPN across PE routersNSODevice configuration: push VRF, BGP, and interface configs to PE routers via NETCONF.
Deploy SD-WAN CPE with cloud gatewayMANO + NSOMANO deploys the vCPE/CNF. NSO configures the underlay routing and IPsec tunnels on PE routers.
Provision a new GPON broadband serviceNeither (EMS / SDN Controller)Access network provisioning is typically handled by Element Management Systems, not MANO or NSO.
Install physical CPE at customer siteNeither (Workforce Management)Physical installation requires a field technician, managed by WFM (TMF646).
Activate a cloud-based UCaaS serviceNeither (Cloud API)SaaS activation via the vendor's provisioning API — no network function or device config involved.

Section 9.1 Key Takeaways

  • MANO, NSO, and SOM are complementary systems operating at different abstraction layers — not competing alternatives
  • MANO manages VNF/CNF lifecycle (instantiate, scale, heal, terminate) on virtualised infrastructure per ETSI standards
  • NSO manages device configuration (create, modify, rollback, audit) across multi-vendor networks using YANG models
  • SOM orchestrates end-to-end service fulfillment and delegates infrastructure and device work to MANO and NSO
  • The RFS type in the service catalog determines which execution engine SOM delegates to
  • Complex services may require both MANO and NSO working in coordination, with SOM managing cross-domain dependencies
  • Neither MANO nor NSO replaces SOM — they lack commercial context, service-level state management, and cross-domain orchestration