Complete First-Time Setup

Step 1

After the Cisco DNA Center appliance reboot is completed, launch your browser.

Step 2

Enter the host IP address to access the Cisco DNA Center GUI, using HTTPS:// and the IP address of the Cisco DNA Center GUI that was displayed at the end of the configuration process.

Step 3

Ignore the message and click Advanced.

Step 4

Ignore the message and do one of the following:

Step 5

Do one of the following and then click Log In:

Step 6

Do one of the following:

Step 7

Enter your cisco.com username and password (which are used to register software downloads and receive system communications) and then click Next.

Step 8

After reviewing these documents, click Next to accept the EULA.

Step 9

Complete the Quick Start workflow:

1. Click Let's Do it.

2. In the Discover Devices: Provide IP Ranges screen, enter the following information and then click Next:

   • The name for the device discovery job.

   • The IP address ranges of the devices you want to discover. Click + to enter additional ranges.

   • Specify whether you want to designate your appliance's loopback address as its preferred management IP address. For more information, see the "Preferred Management IP Address" topic in the Cisco DNA Center User Guide.

3. In the Discover Devices: Provide Credentials screen, enter the information described in the following table for the type of credentials you want to configure and then click Next:

   Field	Description
   CLI (SSH) Credentials
   Username	Username used to log in to the CLI of the devices in your network.
   Password	Password used to log in to the CLI of the devices in your network. The password you enter must be at least eight characters long.
   Name/Description	Name or description of the CLI credentials.
   Enable Password	Password used to enable a higher privilege level in the CLI. Configure this password only if your network devices require it.
   SNMP Credentials: SNMPv2c Read tab Note   Cisco DNA Center does not support SNMPv2c credentials when FIPS mode is enabled. You'll need to enter SNMPv3 credentials instead. For more information regarding FIPS mode, see Configure the Primary Node Using the Maglev Wizard.
   Name/Description	Name or description of the SNMPv2c read community string.
   Community String	Read-only community string password used only to view SNMP information on the device.
   SNMP Credentials: SNMPv2c Write tab
   Name/Description	Name or description of the SNMPv2c write community string.
   Community String	Write community string used to make changes to the SNMP information on the device.
   SNMP Credentials: SNMPv3
   Name/Description	Name or description of the SNMPv3 credentials.
   Username	Username associated with the SNMPv3 credentials.
   Mode	Security level that SNMP messages require: No Authentication, No Privacy (noAuthnoPriv): Does not provide authentication or encryption. Authentication, No Privacy (authNoPriv): Provides authentication, but does not provide encryption. Authentication and Privacy (authPriv): Provides both authentication and encryption. Note   When FIPS mode is enabled, Cisco DNA Center only supports Authentication and Privacy mode.
   Authentication Password	Password required to gain access to information from devices that use SNMPv3. The password must be at least eight characters in length. Note the following points: Some wireless controllers require that passwords be at least 12 characters long. Be sure to check the minimum password requirements for your wireless controllers. Failure to ensure these required minimum character lengths for passwords results in devices not being discovered, monitored, or managed by Cisco DNA Center. Passwords are encrypted for security reasons and are not displayed in the configuration.
   Authentication Type	Hash-based Message Authentication Code (HMAC) type used when either Authentication and Privacy or Authentication, No Privacy is set as the authentication mode: SHA: HMAC-SHA authentication. MD5: HMAC-MD5 authentication. Note   Cisco DNA Center does not support this authentication type when FIPS mode is enabled.
   Privacy Type	Privacy type used when Authentication and Privacy is set as the authentication mode. Choose one of the following privacy types: AES128: 128-bit CBC mode AES for encryption. CISCOAES192: 192-bit CBC mode AES for encryption. CISCOAES256: 256-bit CBC mode AES for encryption. Note   Discovery and Inventory features support only AES192 and AES256 privacy types. Cisco DNA Assurance does not support any of these privacy types.
   Privacy Password	SNMPv3 privacy password that is used to generate the secret key for encrypting messages are exchanged with devices supported with AES128, AES192, and AES256 encryption standards. Passwords (or passphrases) must be at least eight characters long. Note the following points: Some wireless controllers require that passwords be at least 12 characters long. Be sure to check the minimum password requirements for your wireless controllers. Failure to ensure these required minimum character lengths for passwords results in devices not being discovered, monitored, or managed by Cisco DNA Center. Passwords are encrypted for security reasons and are not displayed in the configuration.
   NETCONF
   Port	The NETCONF port that Cisco DNA Center should use in order to discover wireless controllers that run Cisco IOS-XE.

4. In the Create Site screen, group the devices you are going to discover into one site in order to facilitate telemetry and then click Next.

   You can enter the site's information manually or click the location you want to use in the provided map.

5. In the Enable Telemetry screen, check the network components that you want Cisco DNA Center to collect telemetry for and then click Next.

   Note	If both the Enable Telemetry and Disable Telemetry options are grayed out, this indicates that either devices are not capable of supporting telemetry or devices are running an OS version that does not support telemetry enablement.

6. In the Summary screen, review the settings that you have entered and then do one of the following:

   • If you want to make changes, click the appropriate Edit link to open the relevant screen.

   • If you're happy with the settings, click Start Discovery and Telemetry. Cisco DNA Center validates your settings to ensure that they will not result in any issues. After validation is complete, the screen updates.

     Cisco DNA Center begins the process of discovering your network's devices and enabling telemetry for the network components you selected. The process will take a minimum of 30 minutes (more for larger networks).

     A message appears at the top of the homepage to indicate when the Quick Start workflow has completed.

7. Do one of the following:

   • Click View Discovery to open the Discovery page and confirm that the devices in your network have been discovered.

   • Click the Go to Network Settings link to open the Device Credentials page. From here, you can verify that the credentials you entered previously have been configured for your site.

   • Click the View Activity Page link to open the Tasks page and view any tasks (such as a weekly scan of the network for security advisories) that Cisco DNA Center has already scheduled to run.

   • Click the Workflow Home link to access guided workflows that will help you set up and maintain your network.

Step 1

Enable the pxGrid service and ERS on Cisco ISE:

1. Log in to the primary policy administration node.

2. In the Cisco ISE GUI, click the menu icon () and choose Administration > System > Deployment.

   The Deployment Nodes window appears.

3. Click the hostname of the Cisco ISE node on which you want to enable the pxGrid service. In a distributed deployment, this can be any Cisco ISE node in the deployment.

   The Edit Node window appears.

4. In the General Settings tab, check the pxGrid check box, and click Save.

5. In the Cisco ISE GUI, click the menu icon () and choose Administration > System > Settings.

6. From the left navigation pane, click ERS Settings to open the ERS Settings window.

7. Click the Enable ERS for Read/Write radio button, and then click OK in the notification prompt.

8. Click Save.

Step 2

Add the Cisco ISE node to Cisco DNA Center as a AAA server:

1. Log in to the Cisco DNA Center GUI.

2. Click the menu icon () and choose System > System 360.

3. In the Identity Services Engine (ISE) pane, click the Configure link.

4. From the Authentication and Policy Servers window, click Add and choose ISE from the drop-down list.

5. Enter the following details in the Add ISE server slide-in pane:

   • In the Server IP Address field, enter the IP address of the Cisco ISE server.

   • Enter the Shared Secret used to secure communications between your network devices and Cisco ISE.

   • In the Username and Password fields, enter the corresponding Cisco ISE admin credentials.

   • Enter the FQDN for the Cisco ISE node.

   • (Optional) Enter the virtual IP address of the load balancer behind which the Cisco ISE PSNs are located. If you have multiple policy service node farms behind different load balancers, you can enter a maximum of six virtual IP addresses.

   • Connect to pxGrid: Check this check box under Advanced Settings to enable pxGrid connection.

     If you want to use the Cisco DNA Center system certificate as the pxGrid client certificate (sent to ISE to authenticate the Cisco DNA Center system as a pxGrid client), check the Use Cisco DNA Center Certificate for pxGrid check box. You can use this option if all the certificates that are used in your operating environments must be generated by the same Certificate Authority (CA). If this option is disabled, Cisco DNA Center will send a request to Cisco ISE to generate a pxGrid client certificate for the system to use.

     When you enable this option, ensure that:

     • The Cisco DNA Center certificate is generated by the same CA as is in use by Cisco ISE (otherwise the pxGrid authentication will fail).

     • The Certificate Extended Key Use (EKU) field includes “Client Authentication”.

     • In the Advanced Settings area:

       • You can choose the protocol that must be used by checking the check box for RADIUS or TACACS

       • Enter the required values in the following fields: Authentication Port, Accounting Port, Retries, and (Timeout seconds).

     Note	This option is available only if third-party certificates are used by Cisco DNA Center. If Cisco DNA Center uses the default self-signed system certificate, then this option is disabled.

6. Click Add.

If there is any issue in the integration process, an error message is displayed. An option to edit or retry is displayed where applicable.

• If the error message says that the Cisco ISE Admin credentials are invalid, click Edit and re-enter the correct information.

• If errors are found with certificates in the integration process, you must delete the Cisco ISE server entry and restart the integration from the beginning after the certificate issue has been resolved.

Step 3

Verify that Cisco DNA Center is connected to Cisco ISE, and that the Cisco ISE SGT groups and devices are pushed to Cisco DNA Center:

1. Log in to the Cisco DNA Center GUI.

2. Click the menu icon () and choose System > System 360.

3. In the Identity Services Engine (ISE) pane, verify that the status of all listed ISE servers is displayed as Available or Configured.

4. In the Identity Services Engine (ISE) pane, click the Update link.

5. From the Authentication and Policy Servers window, verify that the status of the Cisco ISE AAA server is still Active.

Step 4

Verify that Cisco ISE is connected to Cisco DNA Center and that the connection has subscribers:

1. Log in to the Cisco ISE nodes that are shown as pxGrid servers in the Identity Services Engine (ISE) pane.

2. Choose Administration > pxGrid Services and click the Web Clients tab.

   You should see the pxGrid clients in the list with the IP address of the Cisco DNA Center server.

Step 1

Click the menu icon () and choose System > Settings > External Services > Authentication and Policy Servers.

Step 2

From the Add drop-down list, choose AAA or ISE.

Step 3

To configure the primary AAA server, enter the following information:

Step 4

To configure a Cisco ISE server, enter the following details:

Step 5

Click Advanced Settings and configure the settings:

Step 6

Click Add.

Step 7

To add a secondary server, repeat the preceding steps.

Step 1

Click the menu icon () and choose System > Settings > Device Settings > SNMP.

Step 2

Configure the following fields:

Step 3

Click Save.