Cisco Connect 2018 Malaysia

2. © 2017 Cisco and/or its affiliates. All rights reserved.
Cisco Software Defined Access (SDA)
Transformational Approach to Network Design & Provisioning
Sanjay Kumar Kundnani
Regional Manager- ASEAN, Cisco Systems

3. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public
What is network about?
Today...In the past...
Voice
Video
Data
Mobility
Security
Cloud
IOT
Source: google.de images
Source: google.de images
What really matters !!!

4. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
The Challenge.
“I want to design and deploy a network.”
Platform choices
Best practices
Manageable
Design
options
On time
Future ready
Within budget

5. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
Typical Traditional Campus
Data
Centre
WAN/BRANCH
Access
Points
Core
Switches
Aggregation
Switches
Access
Switches
WLC
ETHERCHANNEL
HSRP SPANNING TREECLI
L2/L3
AVC
VLANS
ACL
802.1x
FNF
Very powerful and feature
rich but:
- Complex to operate
- Difficult to scale
- Difficult to secure
- Inflexible and closed
architecture
- And you manage it all
with CLI…
Internet

6. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
Traditional Network Design & Build Work Flow
spanning-tree mode rapid-pvst
spanning-tree portfast bpduguard default
udld enable
errdisable recovery cause all
vtp mode transparent
load-interval 30
Spanning Tree Protection across the LAN
access-list 55 permit 10.4.48.0 0.0.0.255
line vty 0 15
access-class 55 in
!
snmp-server community [SNMP RO] RO 55
snmp-server community [SNMP RW] RW 55
SNMPv2c access
ntp server 10.4.48.17
ntp update-calendar
!
clock timezone PST -8
clock summer-time PDT recurring
!
service timestamps debug datetime msec localtime
service timestamps log datetime msec localtime
Global LAN Switch Configuration
vlan 10
name Data
vlan 20
name Voice
vlan 30
name Management
Uplink Interfaces
Mgmt VLAN 30
Data VLAN 10
Voice VLAN 20
Client Facing Interfaces
Access Layer Virtual LANs

7. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
How we build Traditional Network
Box by Box
Manual | Error Prone
ip domain-name cisco.local
no ip http server
ip http secure-server
ip ssh version 2
ip scp server enable
line vty 0 15
transport input ssh
transport preferred none
Manually
Repetitive Steps
CLI
Skill | Time | Effort

8. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
Key Challenges for Traditional Networks
Difficult to Segment
Ever increasing number of
users and endpoint types
Ever increasing number of
VLANs and IP Subnets
Complex to Manage
Multiple steps,
user credentials, complex
interactions
Multiple touch-points
Slower Issue Resolution
Separate user policies for
wired and wireless networks
Unable to find users
when troubleshooting
Traditional Networks Cannot Keep Up!

9. © 2017 Cisco and/or its affiliates. All rights reserved.
Cisco’s Intent-based Networking
Intent Context
Security
Learning
Network Infrastructure
DNA Center
AnalyticsPolicy Automation
Switching Routers Wireless
Powered by Intent.
Informed by Context.
The Network. Intuitive.
9
CISCO CONNECT 2018 . IT’S ALL YOU

10. © 2017 Cisco and/or its affiliates. All rights reserved.
Intent-based Networking Model – Industry Approach
Activation
Physical and Virtual Infrastructure
Translation
Assurance
Orchestrate policies
& configure systems
Capture business intent,
translate to policies, and
check integrity Continuous verification,
insights & visibility, and
corrective actions
Cisco DNA
Intent-based Networking
Industry Initiative
10

11. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
Campus
Fabric
Software Defined Access
Policy, Automation and Assurance for an
Intent-based Network Infrastructure
Intent-based
Network Infrastructure
DNA Center
AnalyticsPolicy Automation
I N T E N T C O N T E X T
S E C U R I T Y
L E A R N I N G
WAN
Branch
Wireless
Control
Fabric
Control
Wired + Wireless – Mobility – Segmentation – Scale

12. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
Automated
Network Fabric
Single Fabric for Wired & Wireless
with Workflow-based Automation
Insights
& Telemetry
Analytics and insights into
user and application behavior
Identity-based
Policy & Segmentation
Decoupled security policy
definition from VLAN and IP
Address
Software-Defined Access
Networking at the speed of Software!
DNA Center
AnalyticsPolicy Automation
IoT Network Employee Network
SDA-Extension User Mobility
Policy stays with
user

13. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
What is SD-Access?
Campus Fabric + DNA Center (Automation & Assurance)
APIC-EM
1.X
Campus
Fabric
ISE PI
Automation
Policy Assurance
DNA Center
B
C
B
▪ Campus Fabric
An Overlay network is a logical
topology used to virtually connect
devices
Separated management systems
▪ SD-Access
GUI approach provides
automation & assurance of all
Fabric configuration,
management and group-based
policy
DNA Center integrates multiple
systems, to orchestrate your
LAN, Wireless LAN and WAN
access

14. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
SD-Access
Fabric Roles & Terminology
Automation
Policy Assurance
Identity
Services
Intermediate
Nodes (Underlay)
Fabric Border
Nodes
Fabric Edge
Nodes
DNA
Center
Analytics
Engine
Control-Plane
Nodes
Fabric Wireless
Controller
Campus
Fabric
B
C
B ▪ Control-Plane Nodes – Map System that
manages Endpoint to Device relationships
▪ Fabric Edge Nodes – A Fabric device
(e.g. Access or Distribution) that connects
Wired Endpoints to the SDA Fabric
▪ Identity Services – NAC & ID Systems
(e.g. ISE) for dynamic Endpoint to Group
mapping and Policy definition
▪ Fabric Border Nodes – A Fabric device
(e.g. Core) that connects External L3
network(s) to the SDA Fabric
▪ DNA Center – Enterprise SDN Controller
provides GUI management and abstraction
via Apps that share context
▪ Analytics Engine – Data Collectors
(e.g. NDP) analyze Endpoint to App flows
and monitor fabric status
▪ Fabric Wireless Controller – A Fabric device
(WLC) that connects APs and Wireless
Endpoints to the SDA Fabric

15. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
Software-Defined Access
AssuranceAutomation Policy
Routers Switches Wireless AP WLC
DNA Center
DESIGN PROVISION POLICY ASSURANCE
DNA Center:
Simple Workflows
Solution Components

16. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
You Need a Network that Drives your Digital Business
With SDA Cisco Rewriting the Networking
Playbook
Hardware Centric Software Driven
Manual (eg CLI) Automated
Silo’ed Security Integrated Security
Network Monitoring Analytics and Insights
Historicaly Digital-Ready Network

17. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
SDA Network Design & Build Work Flow
Assure
Assure
Design
Network Hierarchy
Network Settings
Image Management
Network Profiles
Policy
Virtual Networks
Access Control
Application Priority

18. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
SDA Network Design & Build Work Flow
Assure
Provision Assure
Provision
Device Onboarding
Host Onboarding
Device Inventory
Fabric Administration
Assurance
Network Health Score
Client 360
Device 360
Application 360

19. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
Syslog
Server
SDA Design in DNA Center – Global Setup
AAA
Server
Site1
North
America
South
America
Site2
Africa
EMEAR
AAA
Server
DNS
Server
Syslog
Server
DHCP
Server
• Ability to Define
Global Settings
once and
replicate to all
sites/devices
• Automated
Provisioning

20. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public
L2 Switch
L3 Switch
Trunks
Trunk
BYOD Employee Contractor
One SSID
Production
Servers
AAA
DHCP
AD
WLAN
Developer
Servers
LAN Core
Multiple Steps and
Touch Points
1. Define Groups in AD
2. Define Policies
▪ VLAN/subnet based
3. Implement VLANs/Subnets
▪ Create VLANs
▪ Define DHCP scope
▪ Create subnets and L3 interfaces
▪ Routing for new subnets
▪ Map SSID to Interface/VLAN
4. Implement Policy
▪ Define ACLs
▪ Apply ACLs
5. Many different User Interfaces
AAA WLC Devices CLI
….
What if You Need to Add Another Group & Policy?
Network Segmentation Policy Rollout Today

21. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
How SDA Simplifies Network Segmentation
Access Layer
Enterprise
Backbone
Voice
VLAN
Voice
Data
VLAN
Employee
Aggregation Layer
Supplier
Guest
VLAN
BYOD
BYOD
VLAN
Non-Compliant
Quarantine
VLAN
VLAN
Address
DHCP Scope
Redundancy
Routing
Static ACL
VACL
Security Policy based on Topology
High cost and complex maintenance
Voice
VLAN
Voice
Data
VLAN
Employee Supplier BYODNon-Compliant
Use existing topology and automate
security policy to reduce OpEx
ISE
No VLAN Change
No Topology Change
Central Policy Provisioning
Micro/Macro Segmentation
Employee Tag
Supplier Tag
Non-Compliant Tag
Access Layer
Enterprise
Backbone
DC Firewall / Switch
DC Servers
Policy
TrustSecTraditional Segmentation

22. © 2017 Cisco and/or its affiliates. All rights reserved.
Employees Contractors Production Development
Source Destination
FABRIC NODES
Contract
CISCO
DNA CENTER
CISCO ISE
FABRIC POLICIES
PERMIT
Employees Production
Employees Production
API
POLICY DOWNLOAD
SDA Segmentation Policy Automation

23. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
Network quality is a complex, end-to-end problem
* Both = Join/roam and quality/throughput
APs
Local WLCs
Network services DCOffice site
ISE
DHCP
Mobile clients
CUCM
Client firmware
AP coverage
WAN Uplink usage
WAN QoS, Routing, ...
End-User services
RF Noise/Interf.
Client density
...
Cisco Prime™
Configuration
Addressing
Authentication
Affects Join/Roam
Affects Quality/Throughput
WLC Capacity
Affects Both*
Affects Both*Affects Both*
Affects Both*
Affects Both*
Affects Quality/Throughput
Affects Quality/Throughput Affects Join/Roam
Affects Join/Roam
WAN

24. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
When users complain about Application Problem
Wireless Network Issue
Increased Latency
WAN Network Issue
Application Problem
Server Problem
User Problem
Network is so
slow I cannot get
any work done
today
I do not see
anything
wrong
End Users
Network
Admin
What the users see What network admins see What can happen
ping – OK
show ip route - OK
traceroute - OK
show interface - OK

25. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
Reverse Path
Lookup
SDA Assurance Path Visualization
Enhanced App Flow Visibility

26. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
SDA Real-time dashboard & analytics
Global health - Network and clients
Application and compliance health require DNA advantage.

27. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
SDA Real-time dashboard & analytics
Global health : Floor-level health score

28. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
SDA Real-time dashboard & analytics
Client/Sensor/Device health
360 view
offers
complete
troubleshooti
ng info on a
per client
basis.

29. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
SDA Application performance troubleshooting
Application Health shows you top apps
with performance issues.
From landing, drill down App Health to see which
applications have issues
1 2

30. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
SDA Ready Platforms
ASR-1000-X
ASR-1000-HX
ISR 4430
ISR 4450
WIRELESSROUTINGSWITCHING
AIR-CT5520
AIR-CT8540
Wave 2 APs (1800, 2800,3800)
Wave 1 APs* (1700, 2700,3700)
Catalyst 9400
Catalyst 9300
Catalyst 9500
Catalyst 4500E Catalyst 6K Nexus 7700
Catalyst 3850 and 3650
AIR-CT3504
CSR 1000V
*with Caveats

31. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
Catalyst 9000 Platform
World’s Most Advanced Enterprise Switches
Catalyst 9300
Fixed Access
Catalyst 9400
Modular Access
Catalyst 9500
Fixed Core
Programmable Mobile Ready
Cloud Ready
Design
Integrated Security
IoT Ready

32. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
The Catalyst 9K Family
Catalyst 9300
Catalyst 9400
Catalyst 9500
Stackable Access Modular Access Fixed Aggregation
Built on Cisco’s Innovative UADP ASIC & Open IOS-XE

33. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
4000+
Customers
Wins
Gaining Momentum with the Catalyst 9000!

34. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
Some Early Recognitions…

35. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
Catalyst 9300
1G Data
mGig UPOE
1G UPOE/POE+
2.5G at the
Price of 1G
40G at the
Price of 10G
New Generation of Fixed Access
24 Ports
Modular Power SuppliesModular UplinksModular Fans
UADP 2.0
Open IOS-XE
SD-Access
X86 CPU & Containers
Encrypted Traffic
Analytics (ETA)*
256 bit MACSEC*
Trustworthy Systems
StackWise Virtual*
IEEE1588 & AVB*
NBAR2
Perpetual/Fast PoE
Model Driven
Programmability
Patching/GIR
Catalyst 9K Leadership
Streaming Telemetry
48 Ports
8x10G 2x40G 4x mGig 4x1G 350W 715W 1100W
Only
Stackable
Switch with 8X
10G Uplinks
Highest
2.5G/mGig
Density in the
Industry

36. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
Catalyst 9300
2.5G at the
Price of 1G
40G at the
Price of 10G
New Generation of Fixed Access
Only Stackable
Switch with 8X
10G Uplinks
Highest
2.5G/mGig
Density in the
Industry
24 Ports
48 Ports1G Data
1G POE+
24 Ports
48 Ports
24 Ports
48 Ports
1G UPOE
24 Ports
48 Ports (*)mGig UPOE

37. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
Catalyst 9400
New Generation of Modular Access
4-Slot* 7-Slot 10-Slot
Power Supply
3200W AC
3200W DC*
2400W AC*
Core Linecards
24x 10G SFP+*
48x1G SFP*
24x1G SFP*
Access Linecards
24xmGig + 24xUPOE*
48xUPoE
48xPoE+*
48xData
Supervisor
Sup-1: 80G/Slot Access Optimized
Sup-1XL*: 120G/Slot Core
Optimized
Redundancy
is now
Table-stake
Industry’s
Highest PoE
Scale
9Tbps
System
b/w
UADP 2.0
Open IOS-XE
SD-Access
X86 CPU & Containers
Encrypted Traffic
Analytics*
256 bit MACSEC*
Trustworthy
Systems
StackWise Virtual*
IEEE1588 & AVB*
NBAR2
Perpetual PoE*
Model Driven
Programmability
Patching/GIR
Catalyst 9K Leadership
Streaming Telemetry*
*not available at FCS

38. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
Catalyst 9500
Catalyst 9500-40X
Catalyst 9500-24Q
Catalyst 9500-12Q
New Generation of Purpose Built Fixed Core/Aggregation UADP 2.0
Open IOS-XE
SD-Access
X86 CPU & Containers
Encrypted Traffic
Analytics*
256 bit MACSEC*
Trustworthy
Systems
StackWise Virtual
IEEE1588 & AVB*
NBAR2
Model Driven
Programmability
Patching/GIR
Catalyst 9K Leadership
Streaming Telemetry*
40G at the
Price of 10G
8X Buffering
vs.
Competition
Industry’s
First 40G
Enterprise
Switch

39. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
Catalyst 9500
Granular Port Densities to Address all Campus Sizes
12Px40G
24Px40G
40Px10G + 8Px10G / 2Px40G

40. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
Current three-tier packaging
IP Services
Full Layer 3 and Advanced Networking
IP Base
Traditional Access and Basic Layer 3 features
LAN Base
L2 Features
Simplified two-tier packaging
DNA Essentials
Simplified Network Operations Solution Package
DNA Advantage
Software Defined Access, Assurance and ETA
Solution Package
Network Advantage
Full L3 with flexible Segmentation and Network
Resiliency
Network Essentials
Competitive Parity with Full L2 and Routed Access
Catalyst 9K: Simplified packaging

41. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
Single
SKU
Prime
DNA Advantage
(Includes DNA Essentials)
DNA EssentialsDNA Essentials
Single
SKU
DNA Essentials
Cat 9K w/ Network Advantage
(Full Layer 3 Routing)
Cat 9K w/ Network Essentials
(Layer 2 & Routed Access)
Base Automation & Monitoring SDA & Assurance Capable
Stealthwatch
Single
SKU
ISE Base + ISE Plus
DNA Advantage
(Includes DNA Essentials)
SDA & Assurance Ready
DNA Advantage
Cisco ONE Advantage
Catalyst 9K Switching Software
Must Attach Cisco ONE Advantage or DNA Advantage or DNA Essentials as Subscription
with 9K
• Available in 3/5/7 year subscriptions

42. © 2017 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
The Journey to the Software Defined Access (SDA)
Infrastructure
Readiness
Open and Programmable
Policy Based
Automation
Simplify, scale network deployment
for Cloud, Mobile, IoT
Intent-based
Network
Constantly learning,
adapting, protecting
Analytics
for Assurance
Predictive performance
with machine learning
Secure
Foundation
Rapid threat detection
and mitigation
Software-Driven Innovation