Cisco Software-Defined Access

Jason Gooley, CCIE No. 38759 (RS and SP), is a very enthusiastic and spontaneous person who has more than 25 years of experience in the industry. Currently, Jason works as a technical evangelist for the Worldwide Enterprise Networking sales team at Cisco Systems. Jason is very passionate about helping others in the industry succeed. In addition to being a Cisco Press author, Jason is a distinguished speaker at CiscoLive, contributes to the development of the Cisco CCIE and DevNet exams, provides training for Learning@Cisco, is an active CCIE mentor, is a committee member for the Cisco Continuing Education Program (CE), and is a program committee member of the Chicago Network Operators Group (CHI-NOG), www.chinog.org. Jason also hosts a show called MetalDevOps. Jason can be found at www.MetalDevOps.com, @MetalDevOps, and @Jason_Gooley on all social media platforms.Roddie Hasan, CCIE No. 7472 (RS), is a technical solutions architect for Cisco Systems and has 29 years of networking experience. He has been with Cisco for more than 12 years and is a subject matter expert on enterprise networks. His role is supporting customers and account teams globally, with a focus on Cisco DNA Center and Cisco Software-Defined Access. He also specializes in technologies such as MPLS, Enterprise BGP, and SD-WAN. Prior to joining Cisco, Roddie worked in the U.S. federal government and service provider verticals. Roddie blogs at www.ccie.tv and can be found on Twitter at @eiddor.Srilatha Vemula, CCIE No. 33670 (SEC), is a technical solutions architect for the Worldwide Enterprise Networking Sales team at Cisco Systems. There, she works with account teams and systems engineers to help Cisco customers adopt Cisco DNA Center, Cisco SD-Access, Cisco Identity Services Engine, and Cisco TrustSec. Srilatha has served in multiple roles at Cisco, including technical consulting engineer and security solutions architect. She led the design and implementation of security projects using Cisco flagship security products for key U.S. financial customers.

• Introduction xviiChapter 1 Today’s Networks and the Drivers for Change 1Networks of Today 1Common Business and IT Trends 4Common Desired Benefits 5High-Level Design Considerations 6Cisco Digital Network Architecture 10Past Solutions to Today’s Problems 12Spanning-Tree and Layer 2–Based Networks 13Introduction to Multidomain 16Cloud Trends and Adoption 18Summary 20Chapter 2 Introduction to Cisco Software-Defined Access 21Challenges with Today’s Networks 22Software-Defined Networking 22Cisco Software-Defined Access 23Cisco Campus Fabric Architecture 24Campus Fabric Fundamentals 25Cisco SD-Access Roles 27Network Access Control 30Why Network Access Control? 31Introduction to Cisco Identity Services Engine 32Overview of Cisco Identity Services Engine 32Cisco ISE Features 34Secure Access 34Device Administration 37Guest Access 38Profiling 40Bring Your Own Device 45Compliance 46Integrations with pxGrid 48Cisco ISE Design Considerations 50Cisco ISE Architecture 50Cisco ISE Deployment Options 51Standalone Deployment 51Distributed Deployment 51Dedicated Distributed Deployment 52Segmentation with Cisco TrustSec 54Cisco TrustSec Functions 54Classification 55Propagation 55Enforcement 57Summary 58Chapter 3 Introduction to Cisco DNA Center 59Network Planning and Deployment Trends 59History of Automation Tools 60Cisco DNA Center Overview 62Design and Visualization of the Network 64Site Design and Layout 64Network Settings 69Wireless Deployments 70Network Discovery and Inventory 72Discovery Tool 72Inventory 74Device Configuration and Provisioning 77Summary 79Chapter 4 Cisco Software-Defined Access Fundamentals 81Network Topologies 81Cisco Software-Defined Access Underlay 82Manual Underlay 83Automated Underlay: LAN Automation 84Wireless LAN Controllers and Access Points in Cisco Software-Defined Access 89Shared Services 90Transit Networks 91IP-Based Transit 91SD-Access Transit 92Fabric Creation 92Fabric Location 93Fabric VNs 94Fabric Device Roles 94Control Plane 95Fabric Borders 96Border Automation 98Border and Control Plane Collocation 99Fabric Edge Nodes 100Intermediate Nodes 103External Connectivity 104Fusion Router 104Host Onboarding 105Authentication Templates 105VN to IP Pool Mapping 106SSID to IP Pool Mapping 108Switchport Override 109Summary 110References in This Chapter 110Chapter 5 Cisco Identity Services Engine with Cisco DNA Center 111Policy Management in Cisco DNA Center with Cisco ISE 112Integration of Cisco DNA Center and ISE 113Certificates in Cisco DNA Center 113Certificates on Cisco Identity Services Engine 115Cisco ISE and Cisco DNA Center Integration Process 116Group-Based Access Control 122Segmentation with Third-Party RADIUS Server 126Secure Host Onboarding in Enterprise Networks 128Endpoint Host Modes in 802.1X 128Single-Host Mode 128Multi-Host Mode 128Multi-Domain Mode 129Multi-Auth Mode 129802.1X Phased Deployment 130Why a Phased Approach? 131Phase I: Monitor Mode (Visibility Mode) 132Phase II: Low-Impact Mode 133Phase II: Closed Mode 134Host Onboarding with Cisco DNA Center 136No Authentication Template 137Open Authentication Template 138Closed Authentication 140Easy Connect 141Security in Cisco Software-Defined Access Network 144Macro-Segmentation in Cisco SD-Access 144Micro-Segmentation in Cisco SD-Access 145Policy Set Overview in Cisco ISE 146Segmentation Policy Construction in Cisco SD-Access 148Corporate Network Access Use Case 149Guest Access Use Case 159Segmentation Outside the Fabric 164Summary 164References in This Chapter 165Chapter 6 Cisco Software-Defined Access Operation and Troubleshooting 167Cisco SD-Access Under the Covers 167Fabric Encapsulation 167LISP 168VXLAN 171MTU Considerations 172Host Operation and Packet Flow in Cisco SD-Access 172DHCP in Cisco SD-Access 172Wired Host Onboarding and Registration 175Wired Host Operation 176Intra-Subnet Traffic in the Fabric 176Inter-Subnet Traffic in the Fabric 179Traffic to Destinations Outside of the Fabric 180Wireless Host Operation 180Initial Onboarding and Registration 180Cisco SD-Access Troubleshooting 181Fabric Edge 182Fabric Control Plane 186Authentication/Policy Troubleshooting 188Authentication 188Policy 190Scalable Group Tags 191Summary 193References in This Chapter 193Chapter 7 Advanced Cisco Software-Defined Access Topics 195Cisco Software-Defined Access Extension to IoT 196Types of Extended Nodes 198Extended Nodes 198Policy Extended Nodes 198Configuration of Extended Nodes 200Onboarding the Extended Node 203Packet Walk of Extended Cisco SD-Access Use Cases 205Use Case: Hosts in Fabric Communicating with Hosts Connected Outside the Fabric 205Use Case: Traffic from a Client Connected to a Policy Extended Node 206Use Case: Traffic to a Client Connected to a Policy Extended Node 207Use Case: Traffic Flow Within a Policy Extended Node 207Multicast in Cisco SD-Access 208Multicast Overview 209IP Multicast Delivery Modes 210Multicast Flows in Cisco SD-Access 210Scenario 1: Multicast in PIM ASM with Head-End Replication (Fabric RP) 211Scenario 2: Multicast in PIM SSM with Head-End Replication 213Scenario 3: Cisco SD-Access Fabric Native Multicast 214Cisco SD-Access Multicast Configuration in Cisco DNA Center 216Layer 2 Flooding in Cisco SD-Access 218Layer 2 Flooding Operation 219Layer 2 Border in Cisco SD-Access 221Layer 2 Intersite 224Layer 2 Intersite Design and Traffic Flow 224Fabric in a Box in Cisco SD-Access 227Cisco SD-Access for Distributed Campus Deployments 228Types of Transit 229IP Transit 229Fabric Multisite or Multidomain with IP Transit 230Cisco SD-Access Transit 232Cisco SD-WAN Transit 237Policy Deployment Models in Cisco SD-Access Distributed Deployment 238Cisco SD-Access Design Considerations 240Latency Considerations 240Cisco SD-Access Design Approach 241Very Small Site 241Small Site 242Medium Site 243Large Site 243Single-Site Design Versus Multisite Design 244Cisco SD-Access Component Considerations 245Underlay Network 246Underlay Network Design Considerations 246Overlay Network 247Overlay Fabric Design Considerations 247Fabric Control Plane Node Design Considerations 248Fabric Border Node Design Considerations 248Infrastructure Services Design Considerations 249Fabric Wireless Integration Design Considerations 249Wireless Over-the-Top Centralized Wireless Option Design Considerations 250Mixed SD-Access Wireless and Centralized Wireless Option Design Considerations 250Wireless Guest Deployment Considerations 250Security Policy Design Considerations 251Cisco SD-Access Policy Extension to Cisco ACI 252Summary 254References in This Chapter 254Chapter 8 Advanced Cisco DNA Center 255Cisco DNA Center Architecture and Connectivity 256Hardware and Scale 256Network Connectivity 256High Availability and Clustering with Cisco DNA Center 258Software Image Management 259Image Repository 261Golden Image 262Upgrading Devices 263Cisco DNA Center Templates 266Template Creation 267Template Assignment and Network Profiles 269Deploying Templates 270Plug and Play 272Onboarding Templates 273PnP Agent 275Claiming a Device 276Cisco DNA Center Tools 280Topology 280Command Runner 281Security Advisories 283Summary 284References in This Chapter 284Chapter 9 Cisco DNA Assurance 285Assurance Benefits 285Challenges of Traditional Implementations 285Cisco DNA Analytics 286Cisco DNA Assurance Architecture 287Cisco DNA Assurance Data Collection Points 289Streaming Telemetry 290Network Time Travel 292Health Dashboards 292Overall Health Dashboard 293Network Health Dashboard 294Cisco SD-Access Fabric Network Health 296Client Health Dashboard 297Application Health Dashboard 299Cisco DNA Assurance Tools 300Intelligent Capture 300Anomaly Capture 301Path Trace 303Sensor Tests 303Cisco AI Network Analytics 304Summary 306References in This Chapter 306Glossary 3079780136448389 TOC 6/24/2020