Advanced Cisco Catalyst SD-WAN upgrade scenarios

Oh, this is a continuation for the expert insight series on Cisco SD WAN, where we are going to focus on the.00:00You know from SD one upgrade perspective, how we can increase the efficiency and avoid time, avoid the downtime, and in addition to like, is there like any kind of automation which is the and how it can help us or help you in doing the Cisco SD WAN upgrade? Finally, we'll in.00:18Up with an intro on Cisco SD WAN as a code initiative to give you like a bit of a flavor about like how Cisco SD WAN.00:38Can run as a code for for for your network. Now, so this is the agenda for today. So we'll focus 1st. I'll take you 1st you know over the the 1st section. So generally speaking, I mean, we all know that the pain point.00:46For any customer, anyone who's gonna who's going to upgrade any kind of solution, Cisco SD WAN, Cisco SDA.01:06Is the the the the downtime. So the the what we are going to focus on in this section is how for you as a network engineer, as an operation, want to optimize, I mean the upgrade process. We need to avoid downtime as much as possible.01:13Okay, and what that reflects increase the productivity and the the efficiency. Doing so, ok, we need to understand some fundamental concept of Cisco SD WAN upgrade. So there is like different concepts than than what we used to in the in the legacy term or in the legacy SD WAN or in the legacy one. The, the other.01:32Upgrade process is divided into two main steps. There is the upgrade process and the activation process. Now upgrade means to upload the image into the Cisco router and prepare it validated for the activation. So for the upgrade itself, it doesn't require any disruption. So you want.01:52You don't need to reboot, you can even do it in a, in a, working hours, so there is NO there is NO impact on the production. Activation it's.02:12You know, activate the new image, the, the uploaded image in on the SD one router or in the SD WAN controllers. With that, with the activation, there will be a reboot. So these two tasks, these two activities, you, you have the option with Cisco SD WAN either to run it.02:23In one step, I mean you can just do the activate or the upgrade and the activation. If you wanna do so, then you wanna secure a maintenance window for the upgrade and deactivate because again it's bundled in one step. The other option is you can do the upgrade separately from the activation.02:43If you do so, then the impact, you can do the upgrade as mentioned before. I mean, you can do the upgrade in working hours, and then you can leave the activation in a maintenance window after working hours or in weekends.03:02Because again, the activation does require some impact by while the upgrade itself doesn't have any impact. Now, Cisco SD WAN has a self healing process, meaning if you do the upgrade, you upload the image, you validate the image on Cisco SD WAN router or controller and you stop doing the activation. If it fail.03:18Fails the router or the Cisco controller or the edge device will fail back to the last known good image, ok? So it will be an automatic recovery to the last known good image.03:39And the the from requirements perspective so you don't need to run across the board the same software image. So you have the controllers and you have the edges. Now, you can run in the edges different versions of software for for different for for for the.03:51For your network. The thing is we don't recommend because if you want to enable some features, you don't want to, you know, end up having.04:11Some compatibility issues between different edge devices because some will have a higher release than the others, but it won't do, it doesn't impact I mean you can still run different images across different edge devices. The key thing here is the controllers has to run a higher or equal image to the.04:19Edge devices. So you cannot run the edge device with a higher release than the controllers. Always run upgrade the controllers 1st and then.04:39Move to the to the edge devices. As a general rule I mean rule found is you need for any upgrade to understand the release note, you know, what are the known open bugs or if there is like any critical issues.04:48Before you know upgrade and we always recommend to move to you know the golden release. Once you go to Cisco software.com, you will find the the star behind the the golden releases that we as a Cisco recommend customers to go for.05:08Now this is like the process. Now, again, if when I do the upgrade, for Cisco SD WAN we have different components. We have the con we have different components. We have the controllers, which is Cisco SD WAN manager, the orchestrator or the validator, the controller.05:25And finally the edge devices. Each will have different impact if you are going to do the upgrade. We'll take one by one. Now, if you are going to to do the upgrade for the V manage, so upgrading the V manage doesn't impact production. So even if you do the upgrade and the activate which requires the reboot of the.05:43Of the SD WAN manager. The absence of the VSD WAN manager has NO impact on the data plane, ok, on the production traffic. The only issue that you will face if the wilder upgrade that you cannot do any monitoring because again the V manage is in in the upgrade or in the activation process and you can't do any configuration changes.06:03Okay, so you cannot do any configuration changes, but the data plane will remain stable, there will be NO impact over there. The controller with the validator or the V bond, the old name, if you are going to do the upgrade and the activate for the validator.06:23Always we recommend to do it like there we recommend to have like sort of a hardware or em high availability I mean you can to run two instead of one validator. Now, even if you didn't and you do the upgrade for the validator, there will be again NO impact in production.06:41There's NO impact on the data on the data plane. The only thing that you will you lose is you will not be able to.07:00Bring up or join a new devices into the SD WAN fabric because we all know that validator is used as a 1st point of contact for any, for any edge device or any new components to the SD WAN fabric. So it has to talk to validator 1st and then.07:11You know, become part of the fabric. Otherwise, you'll still be fine. There will be NO indexing production for the validator. Next is the controller and last known as vsmart. Now, doing the upgrade for the controller.07:29For the the controller, the upgrade and the activation. Generally there will be NO impact, but there will be what we call address for restart timer. We all know the controller is a very critical component in terms of like routing and policy updates on all on the.07:46Devices. The absence of the controller or the vsmart doesn't do act direct impact on the edge devices.08:06There will be a graceful restart timer which is 12 h by default that will be triggered. It can even increase to seven days. Within that time, there will be NO impact in, in the data plane. The traffic will be fine. The NO down, NO doub NO downtime. The only thing.08:16Thing is if the address for restart timer expire, you will lose the.08:36Yeah, the routes or the the the reachability information in the edge devices, which will result like a business impact for your data traffic. So this is I mean in terms of controller. Now validator and controller, we always recommend to do it in in to have it like in, in a high availability.08:43The mode, where you have multiple devices and we'll see in the next slides what is the recommended sequential upgrade for the controllers.09:03Finally, the edges. Again, the edges, it's the endpoints or the routers that handle our act the the actual traffic. So upgrading the edge devices or the upgrade itself again doesn't do any of the outages or downtime. The activation, it does do the, it does it does require.09:12Reboot. Now, if you are going to do the edge device upgrade for a single for site with single router yes, there will be a downtime. That time that downtime will be based on the model of the edge device and how much it takes I mean to to reboot for the activation process. Within that time there will be NO traffic.09:32You know processed on that on that router.09:52Now, if you have a dual router for that site, again, we recommend to do the upgrade you know for the 1st router 1st and then move to 2nd. With that, you will minimize the downtime needed for the upgrade process or the activation process. But you need to keep in mind the, the bandwidth.09:56With conditions. I mean you will be end up running on single router so you need to keep in mind the bandwidth requirements if you switch to a single router instead of two.10:15So this is the impact, you know, for the doing the upgrade for the Cisco SD WAN components. Now, the upgraded process itself, it can be divided into, again, as I mentioned in the 1st slide into two.10:26Main and main part. The 1st one is the upgrade and 2nd is the activate. You can see I mean it's been tagged as NO impact and impact for the activation. So we'll take one by one. The upgrade, so.10:45Again, you need to download the image from Cisco software.com and then you need to upload the image in Cisco SD WAN manager. 1st you need to do the controller upgrade, as I mentioned or the controller components update, the V manage vsmart or the SD WAN manager, the SD WAN.11:00Controller and the SD WAN validator. As I mentioned, it has always the controller has to run a higher release or equal release to the edge devices. That's why we need to stop always with the controller part. The 1st component of the controllers that will need to do the upgrade for is the manager, ok? So we'll upgrade the manager.11:20No impact as I said, because upgrade it's more of download the image and make it ready. Validation process will happen, but it will not be activated. So there is there will be NO outage. Once we do the upgrade for the controller, then we for the SD WAN manager, then we can we do it for the validator and.11:40Then and the controller, the V bond.12:00So we'll do it for the validator. After we finish the manager, the SD WAN manager, we do the upgrade for the SD WAN validator and the SD WAN controller. After we finish the upgrade for the, the controller components, then we move into the the edge devices.12:04Okay, so we upload the images into the edge devices and you know do the the upgrade process without doing the activation. By that step, we've we covered all the upgrade steps for, for the, for the different components without impact because the the images.12:21Not yet activated. The next process is the activation process where we have the disruption or the, the impact.12:41We'll again, we'll start with the controller part. V manage, we need to activate the V manage on the on the on Cisco SD one. Once we finish the activation, we validate that everything runs fine on the SD WAN manager side and we move to the.12:51The validator, as I mentioned, we always recommend to run in a high availability mode where you have one act, two active SD WAN validators. If you do so, then you can, you can do the activation for one or half of the validators and then once it's finished, you validate, you move to 2nd half of the validators.13:12Once you finish, you validate everything that validator validators are working fine with a new image, you move to the controller. Again, controllers we recommend to run in a high availability mode. You do the upgrade, you do the activation for.13:31Half of the of the controllers validate, make things make sure that things are running fine. Then you activate it for 2nd half of the controllers. By 5th step, by the 5th step, I mean we end up the activation process for the, for all of our controllers. Then we move to the edge devices.13:47Now edge devices will have an actual impact on our production on our traffic data plane, meaning that we need to do the edge device upgrade in a maintenance window. And we always recommend when you do the upgrade for the edge device.14:07This start with the least critical sites.14:27Okay, so you just group the sites into like two or three categories, and you start with the least critical sites. You do the activation, you make sure that things works fine. If there is two routers in a specific site or more than one router, you do it for like the 1st router 1st, make sure that.14:30You know it runs fine and then you switch to the next. Once you do so, you will have, I mean the the traffic will not be disrupted I mean, it just switched from one router to another during the upgrade.14:50Once you finish I mean the least critical site you validate, everything's works fine. Then you move to, I mean the the the rest of the edge devices. So this is what I mean the impact cycle of of the or of the upgraded process, which is the activation of the new image.15:01Okay, so again, we need just to highlight here, I mean some of the do's and don'ts when, when you are doing a Cisco SD WAN upgrade. The 1st one, I mean you have to check the recommended upgrade path. Now, for.15:20Will be for for upgrading the controllers, if you are running a very old image like twenty.six and you want to move to a newer release like 2015, you have to go over the intermediate release, ok, which is 20 2012 or to 29 and then you you move to 2015. So there is an upgrade path that.15:40You have to follow and so and you need to check before starting the, the org planning for the upgrade process.16:00Controller software, as I mentioned, it has to run even higher or equal release with the, with the SD one edge devices. So you cannot again run an edge device with higher software image.16:09Then the quality controllers. Next is the, you need always to check the compatibility metrics. So I have already shared the link. Let me yeah it I'll I'll share the link. I mean once you access the compatibility metrics, you need to select the target.16:23Release for the controllers. Once you select the target release for the, for the controllers, it will give you what are the supported images or releases for the edge devices. So you need to make sure once you do the upgrade or if you are planning to do the upgrade for the your SD WAN fabric, so whatever image you are.16:43Going to upgrade on the controller side, you have the respective image on the edge device side. Generally speaking.17:03Whenever you have a higher release on the SD WAN manager side or SD one controller side, all the, all the releases will be supported as part of the for from controller perspective. But again, it before you once you plan for the upgrade, you need to revisit the compatibility metrics. It's a website that is available where you can.17:11Check the compatibility between controller image version and the edge devices versions.17:31Backup for the V manage, so that's already been covered as part of the previous session, but this is just to emphasize for any reason if there is any failure with the SD WAN manager, you need to be protected. You need to have your data stored if there is like for any reason V manage or the SD WAN manager.17:39Didn't came up so you can again restore the config from a backup configuration DB database. As I mentioned before, even if you don't have the at all for like a long period.17:58The impact on the production will be visibility, you can't do any visibility stuff and the tasks or you can do and you can't do any configuration, so you'll have time to to bring up a new V manage or a new SD WAN manager and you know get the configuration back using the backup configuration database.18:11One last step, and this is like some many of the customer forgot to do, is setting the target image as a default. So once you do finish the upgraded process, you have to set the new image as a default. What is the impact if you didn't? The impact will be if that.18:32Router or if that be smart or I mean the controller, the SD WAN controller for any reason rebooted, ok, either either manual or you know outage, so for any reboot reason, if that router or controller rebooted and the default image was set to the.18:50Previous one, the router will roll back to the older release.19:10Okay, so you need to make sure once you finish the upgrade process is to act to set the new image to as a as a default image. So you need to go back to the SD one upgrade window and just like set the new activated image as a default.19:15Image. For any reason any up, you know, reboot.19:35You will be protected, the device will come up with the, with the image, the new image that you have uploaded. So from things that you need to avoid, again, you need to be aware of the release note, just read the you know go over the release note, make sure that you are aware of all the points.19:39As mentioned over there, you need always to take backups.19:59And as I mentioned in the upgrade cycle, you need to, if, if you for dual or multi router sites, you need to divide not to upgrade all old routers at the same time. So you need to do like half or part of the routers and then move to the next.20:02You don't need to store many images in the SD one edge device because again you don't want to run out of out of storage. And finally, once you need you know if you do the the upgrade as I mentioned for the.20:21Sites with multi routers, you need to think of the bandwidth capacity. So although you you still have one router running, you need to be aware of the bandwidth capacity. So all of the traffic that was divided by two routers or multiple links, now it will be.20:40Cut by half if you have two routers. So you need just to be aware of like the the bandwidth capacity.20:58This is like a very high level on of some of the known issues or, concerns that customer faced during the upgrade. So the 1st one is.21:08The customer sees like the from the main dashboard, the monitoring dashboard that, you know, the, the edge devices are unpreachable. And that's again.21:24And that's totally fine. It will take some time for the edge device to to come up again and with the new image. As I mentioned before the activation it will require a reboot. So, just give it some time.21:355 min after the reboot and you will have things back you know all of the control connections and reachability information back, back again. Next one is the OMB route flat and you know the again doing the upgrade, it's fine to see.21:51The OMB sessions rebooted because again the if you are doing the, if you are doing the SD one controller upgrade.22:10Again the the OMB sessions is run it runs between the edge devices and the controller. So whether you activate the image on the controller side or in the edge device, these sessions will be, you know, will be, will go down and will go up again. So you need just to.22:18Wait.22:38For the sessions to come up after the reboot of the Cisco SD WAN controller or the the edge device. Again, you can do show SD one on the peers just to monitor the the the sessions. If you have the edge device stuck in version mismatch, and this is what I mentioned, this like happens.22:39If you are doing the upgrade for the edge devices with higher release than the SD WAN controllers. That's why I mentioned before, like part of the do's is to check the compatibility metrics. You need to check the compatibility metrics in order to make sure you will end up, you never end up with version mismatch.22:59Now in 2015 there will be some, there will there some of CLI templates, if you have already CLI templates, some customers sees like because there is like a new add ons to the CLI templates, you may face some mismatch between or the the.23:19The templates is not attached, the failure failure to attach, I mean the CLI template. So just review and see the difference between the templates format and reattach it again to the edge device.23:38Finally, the or the last two is the, for some customers it might be you know confusing confusion for them to see like different releases and between the edge device and the controller. So the edge is around 17 dots.23:52And the controller's running 20. So that's totally fine. This is the version schema so controllers will or the SD one manager and the controller, the SD one V smart runs in a twenty.and the edge devices run in seventeen.format. So this is a version.24:11Schema so you don't need to worry about. Finally, if you have the, the certification, I mean expired, again, a certification is very critical component as part of the Cisco SD one fabric, so you need to make sure that you have a valid certificate and upgrade before at least 19 days 90 days be before it.24:31Expired. You so you won't face I mean if it expires so the sessions will be will be teared down teared down I mean it will go down and you will have a critical impact on the production.24:51Now just to mention few stuff, few things that has been recently introduced, some I mean it's not recent time in 20 nine.nine it's been old released, but there will be like the the the since twenty.nine, you can do a scheduled upgrade, so using the workflow. So we have a workflow section that has.25:05Has been introduced as part of Cisco twenty.nine and from the workflow you can schedule the application, ok?25:25And, but the upgrade itself, if, if you schedule it's saying in twenty.nine, you have to use a remote image repository, ok? In 2018, we overcome this one so you can do the schedule for the upgrade with local repository on the SD one menu. You can use the local.25:34Could drive off the SD WAN manager to to do a scheduled upgrade. Also in 2018, we can do a patch upgrade. Now, we all know that, you know, we fail Cisco in I mean releases a bug fixes.25:54For the, for a known bugs or the critical bugs. So you can run, you can do a patch upgrade, not is a whole software upgrade. So you can do a patch upgrade from 2018 separately, not you you so you can avoid doing the whole image upgrades, you can do only for patches.26:10As also part of 2018, just to simplify how you can select devices as part of the SD WAN upgrade process, you can use tag. Again, tag is is a very valuable feature that comes as part of 2015, where you can use it to.26:31Filter and organize the edge devices.26:51Different edge devices in your network. And finally, again, workflow for the controllers also is supported as part of 2018. So 29 you will you were able only to do it for the edge devices as part of workflow process, but 2018 you will be able also to do it as part of the controller or for the controllers using the.26:54The, the workflow process.27:14Okay, so with that these are the main points that you you need to take it into into consideration when you are doing the upgrade in order to avoid the downtime and increase the the efficiency. I'll leave it now for my colleague Alejandro where.27:18He will take you through the the SAS three where where it can help you automate tasks during the Cisco SD WAN upgrade process. Alejandro?27:38Yep, thank you very much. So, yeah, we're now going to talk about I don't, I hope that you're familiar with the tool. So Sastree is a Cisco developed tool.27:50That will help us with some of the things that we have to go through when we are upgrading. So Josem went through the best practices, mentioning the backups, mentioning pre and post checks as well, and this tool will essentially help us automating some of those tasks for us.28:06So the tool is very powerful, not only for these upgrade processes that we're describing right now, but there's actually a whole set of tools that are destined for different purposes, not only for.28:22Upgrades but also for configuration management and more. So, this tool will essentially provide capabilities for managing configuration elements and also for visualization of more than one device or well one device, one device or more than one device at a time.28:38And it's very easy to do so, you will see in a moment. The primary use cases are usually to transfer configuration between the managers or to perform backups and restores. You can also change configuration in bulk. You can review templates, configuration groups, policies, you can do.28:56A bunch of things with this tool, and the thing that we're gonna look in more detail for the rest of the session is, are, are the ones related to the upgrade, so the back of the restore and also the reports capabilities that are built in the tool. So just as a.29:16Just as information, you can use this automation as an SDK, so if you're already running some automation with within your your organization, you can integrate it with sastry. And it's also available through ansible. So it will expose all the sastry comments.29:34Through through this documented ansible collection. Now, starting with the backup and restore, this is a crucial part when we are running the upgrade. So of course depending on how your setup is currently set.29:50If you have a Cisco hosted environment, then you know that there is a cloud ops team that is doing some snapshots for us on a daily basis. We store some of that so if there's any problem, we can always roll back to one of those snapshots.30:06There is also the good practice of creating our own configuration backups. This is not the whole VM as the snapshot, but still we can create the backups for all the configurations, the certificates, the templates, you know, everything that is contained on the SD WAN manager.30:22So with we can essentially create those backups very easily. As you can see in the slide, I have the option to say, I wanna back up all of the configurations or you can select only the certificates or only the templates, only the elements that you, that you prefer.30:38And you can store that locally in a, in a, in a folder in your computer or somewhere, somewhere safe, just before starting the upgrade, right? So this just takes some seconds well depending on on how big your SD WAN manager is and the thing that it has inside, it will take more or less time.30:57But in general, the process is very simple and it's very quick. This is what you will see as I run it on my test environment, it saved the certificates, the templates, SLAs, SLA classes. Of course I'm not showing everything because it would be a little bit lengthy.31:15But it's it's very quick, right? Now, when the backup is done, I decided to backup everything so you can see exactly what was saved for me. So my certificates, config groups, device and feature templates, profiles.31:31My inventory as well policies and some information related to the SD WAN manager that is important whenever we want to restore that to a different org same, sorry SD WAN manager. This is the restore operation, so we took the backup, now we can.31:48And restore that backup with the command SD one.32:08Restore. And as you can see all you have to do is point to the backup that we took previously and that will push all the, all the features and all the things that are included on the backup. This is also very easy and very quick.32:13Of course you can, you can do this in a different way. You can take the backup directly from the CLI of the SD WAN manager, but with sastry, you have the advantage that is already, you know, automated and we have.32:28All the things connected so that we can back up and restore very easily from, from the tool itself. So these are the 1st two things. Now, this for me is probably the most interesting thing, for the session.32:45In in regards to the, to the upgrades and so we have the pre and post check automation During the initial slido, there was a question on how much time you spend doing these post checks and prechecks. And some of you actually the majority said that a long time, like more than an hour, sometimes it took more than the upgrade.33:01And this is common, right? This is something we as networks engineers have to be prepared to do because we need to make sure that everything is working and we need to also sometimes document the things before and after the changes to understand if anything changed, if there was an impact.33:21So we can have confidence that the network will continue to run smoothly after we perform the upgrade. So in we have the reports capabilities, and as you can see here, the report option will allow me to create reports.33:39Now these reports contain a defined set of information that I can directly compare. So, for this example, I can take a snapshot or a report before the upgrade. I will capture all the information.34:00Then I will do the upgrade and capture the information after the upgrade. This is useful because we can, 1st of all, have our information already documented before and after, and you will see that there is an option as well.34:17To compare the reports that I can create. So just to give you an example, this is the built in report that Saster will generate for me. Now, argue arguably, you can say that the built in report.34:32Has a lot of information that is probably not needed for the pre and post check operates, but I will get there in a moment. So you have the option to run the, the, the default reports, which is what I'm showing on on the screen and it will contain this information.34:50So you have a lot of things related to configuration, configuration groups, topology, policies, tags, so on and so forth. You have your certificate list and the status, you have your template values, reachability of devices, and some information about the devices themselves.35:07So essentially with the default reports, you're gonna get all of this information for all of the devices, ok? So this is the starting point and it's, and it's good already. It's useful, but we can also have some customization on the, on the reports themselves.35:24So what happens if I customize, and this is what I like. So whenever we're talking about automation, really your possibilities are endless because you can customize it exactly for what you need. In this case.35:46The default report will show me some extra information that I personally don't consider that important for pre and post checks during an upgrade process. So I decided to create my own custom specification for my report that has things that are more important for me. So things like having the software.36:00Version, the control connection status, interfaces. I wanna know if anything went up or down if an interface didn't recover.36:20BFD sessions, OMP sessions, my OMP routes being received and advertised and also my routing tables. So this is what I chose for my custom reports, but of course you can choose whatever you, whatever you need.36:29And whatever you have to document as part of your process of upgrades. So I I have a little demo because it implies an upgrade I had to record it.36:44But what we will be looking at right now is we have a topology where we have our branches running 1712. Our controllers are running on 2015 and we are going to upgrade them to 1715. Now, our task is to perform the upgrade and also document the preemp.36:59Post checks for these devices and this is what I have to, you know, report on my, on my, information, right? So the software version, we have these routes, everything that you see on the screen. And then I have to identify.37:20What are the changes or the potential issues that arose after the upgrade? So let's run through the video here. I am running a custom report specification.37:36This is what you can see on, on the back. I will go through that in a moment. Let me play the video. And what I'm gonna do is I will run the tool. I will say create a report that is gonna be called prechecks and based on my custom report specification.37:52So this is just for you to show me the information that I wanted and and the one that I need. This is real time, well, I mean not not not fast forwarded, so you can see that it runs very, very fast. I chose two devices because I operated two devices.38:10And the tool already run and it completed successfully. So now I have my pre checks PXT with the information for my software versions for the two devices. I have my control connections, my BFD sessions, omps.38:26Received routes and also the advertised routes. So all of the things that I needed to document are already here on the prechecks report, right? So.38:45Yeah, I have my OMP peers, my interface status, and my routing table for my global VRF and for my VRF one, ok? Now I've documented everything before the upgrade, now I will run the upgrade of my two devices.38:59I will activate and reboot. Of course, we're gonna we're not gonna wait until this is done. So what I'm gonna do in the meantime, because I want to show you what the tool can actually do, I'm gonna introduce a bunch of problems on the network. So in one of the routers, I will shut down some of the interfaces, some of some loopbacks that will, that were advertised.39:18Through OSPF and then OMP. I will also mess up one of the interfaces on the routers so my MPLS connection will go down. And of course this will trigger a bunch of changes on the elements that I am monitoring with the report.39:38So the upgrade is done. Now I will create another report. This time I will call it post checks, right? Because I want to have that comparison and again my tool run pretty, pretty smoothly.39:57I have my two reports there, pre and post, and now there is a comment that is also built into where I can create a diff between the two, divi between the two reports. So the diff is essentially.40:15Mark me or highlight the differences between these two documents. So I am doing I am using the diff option for my report and I will save it as an HTML so I can visualize it very nicely on my browser.40:30And I will call the file upgrade changes.html ok so now that is done. You can see now that the information that is presented to me is color coded. So.40:47I can very easily see what are the things that change. We can see that my software image is upgraded to 1715 on the two routers. You can also see, so the the right one is the, the post checks and the left one is the prechecks.41:03For the upgrade, let me go a little bit faster here. So, going to the left side, you can see that some of my control connections went down or disappeared, so this is what is shown in red.41:21This essentially was, is missing from the post checks, so I can see that my control connections on my MPLS interface are gone. Also, you have BFD sessions on MPLS that are gone. This is expected because of course I shut shut down that interface.41:40At the OMP level, you can see that there are some routes that are NO longer advertised. And also look at all the changes that happened on the received routes in OMP. I have a bunch of routes that disappeared based on the, on the changes that I made.41:58So I can very easily say if something changed, if something was deleted or withdrawn from the, from the network. This happened on both devices, the OMP routes disappeared on both devices, so.42:17It makes sense. And then I have the interface status where you can see that one of the interfaces changed on BR one only, not on BR two because I only manipulated BR one MPLS interface.42:35And the routing table of course also changed, so my global routing table had some changes based on the interface that went down and my VPN one also saw some changes on the VRF one information.42:54Okay, so, yeah, this is it and this is how we can very easily document and run those pre and post checks. Maybe there are other things that you will run as well, maybe some things, some trace routes to verify the connectivity.43:12But at least this part of verification from a show command perspective or real time perspective can be handled and can be done very nicely with ok so on the resources, I will leave you the URLs for the Saster tool.43:30But also for the custom changes or for the custom fork that I created. So if you want to take a look and take it from there, you can use it and apply it for your own requirements. And with that, I will continue to the next topic. Now I have, we have a.43:48Against a very special guest we have Michelle that's gonna talk about those as you want us go. This is just a brief introduction and while he's going through this, you're gonna see a Slido popping up on your right. If you have interested in this topic, please let us know through the Slido. So Michelle.44:08The floor is yours now. Alright, so thank you Alejandro for very nice topic regarding the upgrades and regarding the I think the SD WAN as a code is very close to this topic because as you can see, the SAS track can automate some of these things like the prechecks and the post checks, but why not.44:25Automated whole, right? Why not to make it as a whole workflow when you can do the upgrade from beginning to the end, even with the with the verification and with the validation? So this is about as the code. It can be more it's it's it's also about as infrastructure.44:45As a code, now we will focus more about SD WAN, but the principle is the same for more of the most of the Cisco products, right? So why, why the customers should adopt it or why you should have a look into it, right? So, from the productivity perspective, if you have a large scale network.45:05You have a lots of repeatable tasks which is which which would be really good to automate because otherwise you are doing the same tasks all over again with with it can be also small deployment, right? But the with the large scale, large scale deployments, it's the tasks are.45:25Are on more and more devices. So with the automation you can do it much more efficiently.45:45Through the workflows. From the compliance perspective because it compliance is also very important from the perspective of audits or even for your state of the network. The automation as a code or the SD WAN as a code, can give you a very.45:51Very, very huge advantage like one single source of truth. So you have a repository that is your state of the network and when you do, when you do the automation, when you do the change.46:10Basically it will version the change in the repository. So, you can, you can see what was changed, what was the, what was the difference between the changes? And if you need to roll back to some, some changes, you will just pick the version and you will just return return to that original state. And from the availability.46:25Perspective Since you are doing also prechecks and the post checks in the automated workflow, you also know what will happen with the network. So you can do proactive proactively already, you will already know what can happen with the network if there will be any problems.46:45You can do some sort of a predictive maintenance and also, you can even do some predictive capacity management, right? So this can help you really automate your deployments and it can help you to kind of see the network a little bit differently as a11 code, right? So if you can go.47:03Move to the another slide.47:23Right, so what is the, what is the workflow? What is the automation or SD one as a code or in this case this is more like in general, right? So this is the, this is more infrastructure as a code. So you have a, you have a let's say solution from Cisco, it doesn't need to be only that but you have a, you have a product.47:25Which can work over the API. In this case, we are talking about ACI, SD WAN, firewalls, ICE, even Meraki in your Catalyst Center.47:45And at the beginning, you have some sort of a network operator, it can be net ops or someone from DevOps and you want to do the change on the network. It can be only changed at the SD WAN, but it can be complex change. You are deploying some sort of an object across the whole infrastructure.47:56E.g., so you will prepare the update configuration file. It can be YAML, it can be whatever XML, it can be text file, which will be consumed by the workflow. So 1st of all, you will trigger the workflow, automated, manual, whatever, and.48:14Then it will do the pre check. So the pre check means that it will kinda have a look what is the state of the network before the deployment. It can be whatever you want. As you saw in the is also doing some sort of a precheck, so it will capture the state of the network and the.48:34Then it will, it will be done to change the deployment. In this case, we are talking about, e.g., the object change in the role network. So then the deployment is done, and then you are doing the testing, the automatic testing of that of that through the workflow. So if there was NO change of e.g.48:54People routing. If there was NO change of packet flow, trace routes, whatever, whatever you want.49:14It will be tested. Then it will validate through the post deployment check the state before and after. So it will, it will kind of compare it and if there will be something which is preventing the network to work, it will automatically roll back.49:21Because you want your availability. So the meaning is that you need to keep the network working or if the post deployment checks are cool, good, you will receive the notification. It doesn't need to be only Webex. It can be teams, it can be SMS, it can be email, whatever.49:39Right, so you are informed that the workflow went through and you can you your change was done and you are finished, right? So that's automatic workflow. Can we go next?49:59So, what are kind of three types, how we are describing and how we are kind of categorizing the approach for as a code? So 1st you have the native provider. The native provider is that you will kind of write a Python code where you will use the modules.50:13Which Cisco is providing.50:32And you will consume the APIs. So e.g., very easy, very easy program, right? So you will just change some parameters. There is a one thing which is which is good to be to be said. Cisco is supporting the Python scripting with the modules and also there is a limited tech support.50:34The support is if you have a questions regarding the APIs, how, how to access the API and those type of stuff, they can help you with.50:55But they will not help you with the programming of the Python code, right? 2nd approach is a network as a code. So now we go large. So, network as a code is meant for the large scale deployments, so you're already using stuff like Terraform, Lansible.51:02Puppet or those type of orchestration tools where you can where you can store the single source of state, source of truth, and you are configuring your network via via the.51:21Via the config of config, as you can see as an example, on the core switch we are configuring the VLAN ten which will be the SVI, right? So you see the IP addresses, the gateways, and everything. So you will just push it there and it will be, it will be done on the device. So like this, if you have the network line.51:35Days.51:56You are having this for all the devices and then you are just doing the changes in this configuration. For this, Cisco is providing also Cisco is also providing the terraform, modules and those type of stuff, but basically it will not help you with the.51:56Deployment. The last one is a service as a code. This is fully supported Cisco approach, so you will get, you will get support from Cisco, from Cisco CX, where they will help you to understand what you need, what you what you want to do through the automation. It can give you a little.52:16Little bit acceleration through the adoption, so they will help you to build the initial baseline for the for the automation.52:36And then help you like how to adopt it and how to operate it. This one is the paid service and it will give you the complex care from Cisco through the through the adoption workflow, right? So let's go for the next, for next one. If it's, if it's kind of interesting for you, don't, don't be afraid, you can.52:44Try something like the 1st approach write few Python scripts and have a look how it works, right? So if you will have a, if you will have a good experience with it.53:04Start with small and then scale it. Scale it with confidence. So start with few devices, check how it works and then start to pushing into more and more devices and start to create more and more workflows. So what can CX help you at the moment from the beginning? So there are some accelerators, there are workshops, there are.53:14There are definitely a lot of guides on the Cisco side and there is also marketplace, which is very interesting because marketplace has a lot of scripts which you can already use.53:34Why to invent the wheel when, when it was already invented, right? So you can use those scripts and help it adopted to your environment, play with it, understand it, and then start using it as a as a as a normal daily driver, right? And we can go another one.53:45Another slide. Yeah, and there is also very big community which on the e.g. on the Webex or there is a web page which is netascope.cisco.com, where you can, where you can see a lot of tutorials, lots of tools, lots of white papers, lots of use cases where.54:06You can see how the customers are deploying that and maybe you will find something interesting.54:25Which will catch your eye and you would like to have a look on that this way also. So join the Webex, there is a very nice discussions from the customers what how they they are using it, how they can, how they can apply it. And yeah, think about SD WAN as a code because our infrastructure as a code.54:30Because it's very nice thing and the automation is the key, right? For the large scale deployments, right? I hope this sneak peek is enough. If you have if you are interested in it, just put it into the Slido and we can contact you afterwards and.54:50And kind of listen to your use case.55:10What what you think about the SD WAN as a code and how you would like to think about to deploy it and what would be, yeah, interested for you. Right. Perfect. Thank you very much, Michael. So with that we're getting to the end of our session. So the slider was open for.55:12Feedback we would like to hear from you. How did you find this session? Is it, was it useful? What other things would you like to to see in the future? Just let us know on the, on the final slide though, and also the resources have been shared on the chat. I know there was maybe some confusion with the time.55:32Because of the recent time zone change that we had in Europe, but this session will be, well, was, is recorded and will be available as well for you on the Cisco page so you can view it later.55:52Okay, so here are some resources and well thank you very much everyone for for joining the session. I hope it has been useful that you learned something new and we will see you in May for our next series. Expect to get.56:10Those invites soon. So, thank you very much and we'll see you next time.56:25