Skip to main content
BSS/OSS Academy
Domain Examples/Enterprise VPN Activation

Enterprise VPN Activation

End-to-end flow for provisioning a multi-site MPLS L3VPN for ACME Ltd: from enquiry and solution design through SOM service design, what SOM passes to ROM, ROM’s resource feasibility and reservation against inventory, activation through Cisco NSO, site turn-up and the VPN connectivity test, to inventory update, per-site billing, SLA baselining and managed-service monitoring — with the failure paths at each stage.

Architecture Overview

An MPLS L3VPN connects multiple enterprise sites over the operator's MPLS backbone. Each site has a CE router connecting over an access circuit to the operator's PE router; VRFs on the PEs isolate each customer's routes, and route targets decide which PEs share them. Above the network, four roles stay distinct: SOM designs and orchestrates the service, Inventory identifies and provides the resource instances, ROM owns the resource order and its activation, and NSO turns it into device configuration. Values are ACME Ltd's illustrative order — two of its five sites are shown.

COM & Order MgmtSOMdesigns · orchestrates the serviceROMresource order · lifecycleNSO / controllersService activeService / Resource Inventory — beside SOM and ROM, not between themService requirements +selected resource instancesUNI • Circuit • PE • VLAN • VRFIP • RD/RT • Routing • QoSBandwidthResource activation /network configurationVRF • RD/RT • sub-if • VLANIP • BGP • policy • QoSCOM: Managed MPLS VPN and its options. No VRF, RD, PE port or VLAN.L3VPN productsites · bandwidth · QoS · SLAOne master order with a sub-order per site, validated against contract and feasibility.Order managementcapture · validateDesigns and decomposes the customer service: one VRF, and per site access, PE interface, routing and CE.Service designCFS L3VPN → per-site RFSOrchestrates the multi-site delivery. Passes ROM requirements and selected instances; configures nothing.Service orchestrationsites · dependenciesOwns the resource order: resolves requirements with inventory, reserves, requests activation, tracks, reports to SOM.Resource orderallocate · activate · trackTranslates the resource request into vendor-specific configuration and commits it to the PEs and CEs as one transaction.Cisco NSOservice model → device configConfigures the access circuits and UNIs.Access NMS / EMScircuits · VLAN / QinQBGP health, latency / loss per class, the SLA — and reconciliation with inventory.AssuranceSLA · BGPBilling per site from its tested date; the VPN and its CIs in the CMDB; the SLA registered.Active L3VPNbilling · CMDBThe VPN, its sites and their UNIs, and the service instances once active.Service inventoryVPN · sites · UNIsSites, UNIs, circuits, CEs, PEs, PE interfaces, VLANs / QinQ, subnets, VRFs, RD / RT, QoS and capacity — and their state.Resource inventoryPE ports · VLANs · IPs · VRFsCommits the chosen instances to ACME’s order before anything is configured.Reserve / allocateAVAILABLE → RESERVEDSite A — HQ OsloAccess (Site A)PE — Site AMPLS corePE — Site BAccess (Site B)Site B — BergeneBGP 65001 ↔ 65000eBGP 65001 ↔ 65000HQ · LANCE-OSL-01 — managed CE, Gi0/0 10.10.1.2/30, eBGP AS 65001 to PE-OSL-01.CECE-OSL-0110.10.1.2/30ACC-12345 on UNI-OSL-001 — Ethernet over fibre, 500 Mbps, VLAN 3105.ACC-12345UNI-OSL-001VLAN 3105 · 500 MbpsPE-OSL-01 — xe-0/0/12.3105 in VRF ACME-VPN, 10.10.1.1/30, eBGP to the CE.PE-OSL-01xe-0/0/12.3105VRF ACME-VPN10.10.1.1/30MPLS core — P routers and LSPs; MP-BGP carries ACME’s VPNv4 routes between the PEs by route target 65000:100. Nothing per customer here.MPLS(IP VPN)PPLSPs · MP-BGP VPNv4RT 65000:100nothing per customerPE-BGO-01 — xe-0/0/8.4210 in VRF ACME-VPN, 10.10.2.1/30, eBGP to the CE.PE-BGO-01xe-0/0/8.4210VRF ACME-VPN10.10.2.1/30ACC-67890 on UNI-BGO-001 — Ethernet over fibre, 100 Mbps, VLAN 4210.ACC-67890UNI-BGO-001VLAN 4210 · 100 MbpsCE-BGO-01 — managed CE, Gi0/0 10.10.2.2/30, eBGP AS 65001 to PE-BGO-01.CECE-BGO-0110.10.2.2/30Branch · LANTwo of ACME’s five sites — the other three repeat the per-site pattern
InventoryUNI-OSL-001ACC-12345xe-0/0/12VLAN 310510.10.1.0/30CE-OSL-01VRF ACME-VPNRD/RT 65000:100UNI-BGO-001ACC-67890xe-0/0/8VLAN 421010.10.2.0/30CE-BGO-01

Press Simulate an activation to follow ACME’s L3VPN from the product to a tested, live VPN between Oslo and Bergen: the systems light up as they act, the callouts show what crosses each hand-off, and the inventory strip follows every resource from AVAILABLE through RESERVED to IN SERVICE. Tick Simulate a failed activation to see NSO reject the commit and the transaction abort cleanly.

Detailed network view — SOM touchpoints and network layers
L3VPN PRODUCTENABLERSEnterprise VPN Sites + VASCustomer premisesCE / CPEOperator-suppliedAccess / AggregationOperator-ownedMPLS Core NetworkOperator-ownedBSS/OSS EnablersOperator-ownedExternal / PeeringInter-carrierUser Network Interface — service demarcation between the customer network (CE) and the service provider network (PE).Network-to-Network Interface — internal provider interface connecting different network segments such as access, aggregation, and core.External Network-to-Network Interface — interconnection between different service provider networks for services such as peering or inter-carrier VPN.HQ / Main Office (Hub)Core apps, servers, DCBranch Offices (Spoke)End users, LAN, Wi-FiVAS: Managed LANPublic IPs, behind CEVAS: FWA Backup4G/5G, behind CEVAS ADD-ONS ↓CE RoutereBGP/OSPF → PEOperator CPEBranch CEConfig via NSOManaged FWUTM / behind CEAccess SwitchEthernet / fibre handoffLast-mile transportAggregationMetro Ethernet / DSLAMMicrowave / FWARural / backup accessP Routers (Core)PE RouterVRF / MP-BGP / MPLSSOMNetwork InventoryPhysical + logical (EAI)ROM (Cisco NSO)Activates resources → PE/CEIPAMPublic + private IPsITSM / CMDBCIs & SLA trackingAssurance / SLAMonitoring & faultsNSO activates network resources via NETCONF/YANG: customer access circuit, CE-PE interface/sub-interface, VLAN/802.1Q tagging, VRF, Route Distinguisher (RD), Route Targets (RT import/export), CE-PE BGP neighbor, MP-BGP VPNv4/VPNv6 configuration.Internet PeeringVAS internet breakoutPartner / Wholesale3rd-party access circuitsInter-Carrier VPNMulti-operator MPLSNETWORK LAYERSAccess layer: CE/CPE devices at the customer edge providing last-mile connectivity to the operator network.ACCESSDistribution/aggregation layer: Metro Ethernet switches and DSLAM aggregation between access and core.DISTRIBUTIONMPLS core: P and PE routers providing VRF isolation, MP-BGP VPNv4/v6, and label switching across the backbone.COREPeering layer: inter-carrier connectivity for internet breakout, wholesale access, and multi-operator MPLS VPN handoff.PEERINGINTERFACESUser Network Interface — service demarcation between the customer network (CE) and the service provider network (PE).UNINetwork-to-Network Interface — internal provider interface connecting different network segments such as access, aggregation, and core.NNIInternal Network-to-Network Interface — interface between routers within the same provider backbone (for example PE ↔ P or P ↔ P links).I-NNIExternal Network-to-Network Interface — interconnection between different service provider networks for services such as peering or inter-carrier VPN.ENNIPROTOCOLSIPv4 / IPv6EthernetDHCPeBGP (CE→PE)OSPF / StaticBFD (failover)Ethernet handoffVLAN trunkingQoS / CoSL3VPN PROTOCOL STACKVRF (per-customer)MP-BGP (VPNv4/v6)MPLS labels (LDP/SR)IGP (IS-IS / OSPF)eBGP peeringInter-AS Opt B/CNNI / VLANsSOM sends ResourceOrders (TMF652) to NSO via REST API. The order contains the full configuration intent: VRF, BGP, interface, QoS parameters derived from the inventory network graph.REST APINSO activates network resources via NETCONF/YANG: customer access circuit, CE-PE interface/sub-interface, VLAN/802.1Q tagging, VRF, Route Distinguisher (RD), Route Targets (RT import/export), CE-PE BGP neighbor, MP-BGP VPNv4/VPNv6 configuration.NETCONF/YANGNSO also provisions the CE router: eBGP peering config toward the PE, static/OSPF routes for the customer LAN, interface IP addressing, and any IPsec or QoS marking policies required at the customer edge.

Enterprise sites & CE

HQ Oslo and the Bergen branch, each with a LAN and a managed CE (CE-OSL-01, CE-BGO-01) running eBGP to its PE (AS 65001 ↔ 65000). VAS products (managed LAN, managed firewall, FWA backup) may add public IP allocation for internet breakout or management.

Access circuits

Ethernet over fibre from each site to the PE: ACC-12345 on UNI-OSL-001 (500 Mbps, VLAN 3105) and ACC-67890 on UNI-BGO-001 (100 Mbps, VLAN 4210), QinQ where the access network uses it. Configured by the access NMS.

PE routers

PE-OSL-01 and PE-BGO-01 hold VRF ACME-VPN (RD / RT 65000:100), the customer sub-interfaces (xe-0/0/12.3105, xe-0/0/8.4210), the PE–CE eBGP sessions and QoS. Configured by NSO, one transaction across both.

MPLS backbone

P routers and label-switched paths; MP-BGP carries VPNv4 routes between PEs, imported by route target. Shared by every customer: adding a VPN changes the PEs, not the core.

BSS/OSS enablers

SOM designs and orchestrates; ROM owns the resource order; Inventory (e.g. EAI) and IPAM provide and track the instances; NSO configures the devices; ITSM / CMDB tracks CIs and SLAs.