Advanced features for Catalyst Center-monitored wireless networks

Good morning, good afternoon, good evening, everybody. Thank you for joining yet another.00:10Expert insights webinar. This time we will talk about advanced features for catalyst monitor catalyst center monitored to wireless networks. My name is Alex Ergis and I have with with us.00:17My colleagues Adrian Mentoza Patino and all three of us are customer success specialist as is Marco in the panelists in the panel.00:33We will try to present you the session and answer your questions but before we start one note, what you will see is best practices is recommended practices from Cisco regarding your net.00:49Network, the decisions are yours, business decisions, strategic decisions, technical decisions.01:09If you need more advice, if you need more support from us, you can always contact us, but please consider the session and the slides as guidance. So this is 2nd session in expert inside series.01:16April schedule. We saw wireless automation with Cisco catalyst center last week and we have one more session for you next week on catalyst center three.X.01:37I would say and in that session we will see the latest the latest features plus the upgrade process if you want, if you wish to upgrade to the three.X version when it becomes global.01:50Globally available. When you are all muted and you will be muted during the session, when you have a question please please please please send it to Q and A panel, not in chat.02:06Chat will not be monitored for, questions. So all questions should be in the Q and A panel. Bottom right corner, you see the three dots, click there, you find the Q and A panel and you should your questions.02:21If we have a lot of questions and NO time to answer them, you will receive an email with your reply. So if your question is not answered, don't worry about that you will get the information you need offline. And if you have any difficulties, technical difficulties, audio, video.02:38So.02:58Anything that has to do with technical issues, send us a direct message to chat. Agenda wise, we have a quick recap just to introduce the session if you like, and then we will see wireless assurance with our Cisco Catalyst Center every.02:59Very.03:19Quick and high level overview of the dashboards in order to focus on AI network analytics, security, dashboards and AI enhanced RRM features that we considered advanced and enhanced and we won't use.03:19Need to see.03:39In detail. So last week you saw with Christian Gower Andra, you saw how to onboard wireless networks in catalyst center. Now remember, I say this every time I speak to.03:41Customers. Catalyst center is not just for SD access. Catalyst Center is not just for wired networks. In fact, Catalyst Center gives us a lot more information on wireless networks. And last week you saw the two different scenarios, the Greenfield center.04:00Scenario where you don't have a network, it's a brand new controller, you can provision the controller and you can configure it from scratch.04:20From catalyst center, and then you saw how to onboard access points, the workflows, software upgrades and so on. But you, we also covered the brownfield scenario where you have the controller and you want to onboard, it's figured and you want to onboard it to.04:31Catalyst center. There are three options there. The assurance only, which is grayed out because you didn't see assurance. In that case you only have the controller sending information and catalyst center showing information.04:50The information that we will see today. In the other two cases, you saw how to configure the controllers to provision them per device configuration, again AP onboarding and so on. If you missed that session, you can find the recording in our community page.05:08And we will provide links and information towards the end.05:28So today we will see wireless assurance and we go straight to screenshots straight to the point. Assurance is one of the sections on the left hand side of the menu.05:34What you see is the menu of catalyst center version three.two.three and we will use this to show you how it will look like. There are not many differences between the versions that you probably have now 23 792-371-0237.05:51If there is a difference you will see the version on the top right corner and you can understand.06:13What you are seeing. So assurance section we have the dashboards, we have the AI network analytics and we have the settings and in those three subsections we have this the the things that we will see today we will.06:21Over today. Those are focusing on wireless networks and wireless networks not in SDA we won't cover SD access, we won't cover wired networks.06:40So let's start with the settings 1st. We do have the settings because we can tweak if you like various things on the values and the parameters that we see in in the dashboards. So in the settings, we.06:561st have the health score settings. Now.07:16Each device each client will have, as you probably know, we have a health score, it's gonna be either green or orange or red, which means that the health will be ok or poor. These, health scores are defined by different KPIs and.07:20You see in the screen the KPIs for wireless controllers.07:40Now, you can modify the KPIs, you can take them out of the picture if you want, you can modify the the health scores, the, the values. Of course, we advise you not to do it unless you know what you are doing. These are best practices.07:45These are suggestions from Cisco and unless you know exactly what you want, we advise you to keep them as they are. We have settings for our wireless controllers. We have settings for access points and.08:05For access points, we actually have 16 or 17 KPIs you see here air quality interference for the three bands, noise utilization and so on. If you do not have something from those, e.g., if you don't have five or.08:23Six gig bands or if you don't want to have a 2.4 gig in the health score, you can exclude them.08:44And the health scores will be calculated on the remaining KPIs. We also have KPIs for our wireless clients. Again, if you know what you want fair enough, otherwise leave them as they are.08:51We have site analytics settings. You will see site analytics with my Colleagueslav but these are the settings and again KPIs for the health of the sites.09:12In settings we have SSID monitoring and in here we can disable an SSID from monitoring. This does not mean that the SSID will not be active or enabled. The SSID will uplo.09:30The Eight will get and.09:48Send traffic, but NO data will be used in the monitoring phase of catalyst centers, so we won't see any data from that SSID in assurance dashboards. Why we want to do this? Maybe we have an SSID that.09:52We don't really care so in order to avoid having ironous data or garbage if you like we can disable it and again.10:11This is for monitoring the SSID will be operational as it should. Now, once we are ok with our settings, we know where to find them, we know what they are, we know if we want how to change them. Let's go and have a quick look on the dashboard.10:23And what we get from the monitoring point of view. So in assurance we have the dashboards and we will focus on health.10:43We also have issues and events and the with the readiness in the 1st section of the presentation. And then from the dashboards Adrian will show us the rogue enter A WIPS subsection.10:55Now if we go to health, the menu is from three.two.three version. The screenshots are from 2379 and this is because our labs do not have yet assurance data for three.two.three. The view is almost.11:13Identical so nothing will.11:33Not be familiar when you see three.two.three. So the 1st screen we have is the overall screen. We have network devices and here we have wired and wireless clients, also site analytics. This is something that will be covered later. So.11:38So we click the view network details to go deeper in the wireless.11:58Devices and here we see the network dashboard. On the top the typical timeline for the 24 h the geographical filtering there is there global, we can filter and we can have data for specific, sites. What we care is.12:06Is this the the categories, the wireless categories, wireless controllers or access points. And here we also see some statistics from catalyst center on access points, total access points up down, topen access points by client count and so on.12:26Useful information all these dashlets have the few details link and if we click that link, we will find more on the specific topic.12:46What we want is to go and see more details on the devices, so we click the view details link. We also click the access points and we get the information below device types, we can see the device models, the device operation operation.12:57Operating systems, we get the list.13:16Of, access points, we also get the health. We see that all these are ten. Now if I want to see more information on a specific access point, if I if I want to go to the device three 60 view, I click on the specific access point.13:20The name and then I go to the.13:40Device three 60 view. There are other ways to go there but we went through from from the network, we drilled to into the wireless and now we are in a specific access point.13:43We have the timeline. We have a lot of information on the specific access point and the different tabs issues we have the tools that we can use to troubleshoot. We can see the physical network topology and we also have the event viewer.14:01So whatever happens in access point, we can see it in catalyst center and we also have the device information RF, Ethernet and and PoE.14:21So this is the device three 60. Now, the same way we can see information about clients. This time we go to view client health from the overall page and.14:33In the same way we have information about all the clients. We have the wireless and the wide clients for the for both we have the onboarding process. So in this example we have three that did not onboard. So if I click on that view details section.14:49I can see more information on why they didn't onboard and so on and.15:09I also have the site analytics again. So if I click on that link, the view details I will go to the wireless clients and for the specific section I see failure reasons locations, access points and host top.15:16Course device types.15:35And the list that is affected and again if I click on the name of the client, then I get the client three 60 and I can hear troubleshoot the client, the specific client. Now, one quick information on the name that you.15:37So.15:57Names and information for the wireless clients are coming from the controller. If we talk about the wild clients, we need in the integration with ICE, but this information comes from the wireless controller. What we have here, the timeline with telemetry with our.15:58Different health scores. Of course, this is a demo so the numbers maybe eroneous. We have the summary, we have the onboarding process event viewer and so on. So all these are data that can help us troubleshoot and find out what is the problem with the specific.16:18Client. Now, one, very important and interesting tool is the intelligent capture. What happens with all the other data, the data that we saw so far is that the controller talks to access points and sends information to catalyst center. So.16:39So the controller is in between and center gets the clients events, the access points events and so on. If we enable intelligent capture, then the access points will talk to catalyst center directly.16:59Through a specific TCP port and this allows catalyst center to get information directly from access points and we can have different types of captures. So onboarding packet capture will show us events that have to do with the onboarding process of client.17:13We can have a full packet capture, we can have an over the air sniffer capture for a specific channel. We can have statistics on access points, anomaly captures and even a spectrum analysis from the.17:34Access points. How can we use intelligent capture? Client three 60 we have the top right corner, we have the link and if we click.17:53On that link we get the the intelligent capture for Anita Cooper the dashboard that shows the onboarding events and here we see all but we can filter and we can see the anomalies that catalyst.18:06That has found on the onboarding process of Anita Cooper. We can have the client location you see here this path is the path that the user has.18:26Followed while we were having the capture. We have RF statistics and so on and if we run the packet capture, we can actually get the file and if if we download it, we can use it in Wiresark and we can investigate any.18:39Issues that.18:59The client has. The same with device three 60 we have three two options here the sniffer, the over the air capture and the intelligent capture. The sniffer will give us.19:00What is happening in the air? We can choose two access points. We see the map of the floor that we want to investigate and we can choose another one. We have to.19:20Select a band radio channel winds and channel, and then we get again a file with the information provided by the sniffer. If we want to use the intelligent capture and we click the specific button.19:33We can have our statistics for the access point as you see clients channel utilization and other dastlets. But we also have the spectrum analysis tab over here and here we have the spectrum analysis for the specific.19:53Bank channel and so on.20:13So, quite interesting information. Of course, there are prerequisites, of course there are some limitations on the hardware that supports the the these features but.20:17As I said at the beginning and you probably you will probably hear me saying quite a lot. If you need more information on any of those topics, feel free to contact us either through the survey or by sending us an email and we can take it further in a session in a one on one session. Now.20:36In the dashboards and in health, we also have the site analytics. I won't go through because We'll that in a bit this is the the the dashboard but we will see that in a bit. We also have the issues again.20:56Issues and events for me this is what makes catalyst center easier to use in the sense that I don't need to sit down and be in front of a monitor 2047. If something happens catalyst center will raise an issue.21:16And inform us and we can then take care. In in that case in our case, I have filtered, it doesn't show here but I have filtered for wireless and you see that the device role is wireless, so all these issues are for wireless and we have the AI driven issues.21:33Again more details on that in a bit. And we also have the Wi-Fi six in 2379 or Wi-Fi readiness dashboards in.21:53Three.two.three. In the old version with six would give us the readiness of our network for Wi-Fi six clients and infrastructure. In the new version we included with seven and we see whether.22:11Our access points can support with seven but also if we have any clients that support with seven Wi-Fi six E And we also have the capability the the distribution and again if we click on view details, we get more information, the location.22:31Sites that access points are located and and so on.22:52So, enough with let's say the traditional dashboards, let's let's go to and let's have a look at AI issues now and how catalyst center is utilizing artificial intelligence.22:56It's clearly very trendy. Let's see what we can do.23:16We are all ears. Thank you Alex and hello to everyone. So I will present today two sections. 1st of all, it's about as Alex said this this is the 1st advanced feature you can get from catalyst center.23:22So what is it about and why we need AI AI network analytics to retroubleshoot the network? The thing is that as soon as you have bigger wireless network, you will see that there are many alerts, many issues, many events coming into in.23:41To the management dashboard. And it means it's pretty hard to refine what is really important and how to, even when you would like to start troubleshooting some issues, it's very hard to find what is relevant and really be be successful.24:01Miss the troubleshooting. So what you definitely need is some something what will what will help you to narrow the scope of all messages coming into center. Ideally you need to show it in the right way to be able to follow just few rules.24:18To solve the problem. And there is one more issue. The issue with wireless is that wireless is a medium, it's really.24:38Under demonstic, so it means if you are today able to connect and go over one gig speed on your AP, it doesn't mean that tomorrow the situation will be exactly the same. There are different factors like channel utilization, number of clients connected to the same shared medium.24:46Rock APs and so on.25:06So definitely for wireless, it's not possible, really not possible to set statical thresholds to say if if my will be over 100 mb, everything is ok. If it's below it's it's it's bad. So what we need is something like a dynamic threshold. So we need the system.25:08To learn the behavior of the network and then only in case we are outside the green envelope some some anomalies.25:28Will be marked and and you will be you will be you will get the, the announcement. So how we solve that? One example I already mentioned low throughput and here are some some reasons why you can have low throughput when you are connected to the wireless AP from it.25:36SSI channel utilization, number of clients connected, time of day, and so on. So it's pretty hard for really impossible to analyze it by hand. Yes, you have some logs on 1900.25:56On the other hand, it's, yeah, as I said, not possible especially in bigger network. Moreover, in most cases you are not solving wireless issue in real time. In most cases, it is about yesterday at five, we had some issues, please solve this. So how to do that?26:09We have machine learning algorithm, so this is the way how how catalyst center or the component of of AI network analytics can learn how the network behaves, collect the logs, and then you can use it for some analytics analysis, some, some, problem solving.26:28And so on. So how we do it, how we build that component of AI network analytics and how is it presented to you? So the catalyst center itself, it's not powerful enough to do everything to add machine learning.26:48AI models and so on. So you will see that we will need a cloud component. We call it a Cisco AI AI cloud and using that cloud we can then offer to you personalized recommendations. So based on the normal, based on the green green envelope, we can, we can check for some.27:06Some, some deviations we can present you some insights recommendations, even proactive insights based on those long term historical trends. Again, we can we can we can mark something, we can we can present it to you, group of APs which are, which maybe are not in the optimal.27:25Optimal status probably some clients are are for for them it's problematic to connect or the throughput is slow. And in some cases, we can even offer our catalyst center can even offer to you a cell healing. It's mostly related to AI and answer.27:46By the way around the prerequisite is to AI network analytics to be enabled plus machine reasoning engine can at least give you root cause analysis with some guidance onto how how to solve something plus, in case of ARM it's fully automatic in the background.28:05Different channels could be assigned different and and yeah the the solution or your network will get into much better shape.28:25So architecture, how it works, 1st of all, we need, we need definitely data from the network. It's, we are we are collecting those data using advanced telemetry. Catalyst Center receive those data and it do some.28:34Actually, it's not antimization, it's encryption. It's fully encrypted, all personal data leaving catalyst center into the cloud are fully encrypted. The key is stored locally on the catalyst center, so we are in the cloud, in the Cisco cloud, we are not able to read personal data, but we can see the behavior. So.28:55So, so we can we can really run some pipelines on it. Machine learning is definitely the most important part, but yeah, we have different different models which can be applied to recognize some some behaviors, deviations and so on. Over API, it's.29:14Then send back to the center encrypted so we can really use the assurance AI and present to you as admin all the details about the client, about the AP and everything what is needed to solve the the problem. And yeah, it is cloud, so.29:34For sure, your security colleagues will ask, ok, what is sent to the cloud? Why? How is it there and so on? You will find all answers on these links Cisco trust portal. By the way, it's opt in features so you have to enable it. We will talk about it before anything is sent to the cloud.29:54So what is available here on the right in the right corner you can see where we are in the in the in the catalyst center menu. So what you will see AI driven issues, Alex already mentioned issues and trends, so so you will find.30:13System generated issues plus at some of them you will see AI marks, so those are AI driven in the this this AI network analytics in the background. Heat maps, you will see some examples in a few seconds for different KPIs.30:32AT performance is the nice use case. You can get details about how the network is behaving. Then, then two components comparison, peer comparison or network comparison. In case you know that at one building of your your campus, there are some issues you can just compare different buildings and then see.30:50Different behaviors of clients, APs, different channel authorization, number of radio resets and so on. So that's network comparison, and if you, if you just want to know, ok, my network is.31:10Something, but how others are similar companies are behaving. So there are also some KPIs like RF throughput, you can compare not just your buildings, but you can add something else some other companies, everything is anonymized for sure, so you will not see specific names or some.31:22Thing like that, but at least you can see if your network is in the right shape or not. Plus network insights, more details about APs behaving, number of the coverage and so on capacity throughput plus, and that's actually where, where everything starts. That's the baseline. That's your.31:42For historical data plus the machine learning, the, the green green envelope which we were talking.32:02So here, let's start with the green band. So that's the historical data we learned. It's over several weeks, so it's not just one line, it's definitely something like an interval envelope or you can say green band. So if I'm out inside that.32:08Green bent, it's it's ok. But as soon as I'm outside that that green envelope, probably something is happening. It is not like clients are not able to connect. It could be just maybe there is some slowness or the onboarding time is much higher.32:28But yeah, it's already time when you can start troubleshooting it. But 1st we need to know when, where, who, what, why, and how. And that's exactly what is in this slide on this slide. If you, if you check the whole report, you will see that you will find everything there. So it means.32:48Who is impacted, clients, APs, what is happening, the description as clear as possible to for you to understand really what's what is it about? You will also find when it happened, where it happened, so specific sites.33:08Why and how. So you can see different KPIs KPIs are added into the report. It's automatic, but you can you can you can go and add specific KPIs. So r1 example just to show you what is possible, it's from some university don't want to access this ID.33:25Background, and and what we found or the engine, what it found is that there is abnormal onboarding failure rate for several hours. So you can see we are outside the envelope. It's definitely one static threshold. As I said, it's outside the envelope dynamic envo.33:44We have different KPIs, the number of onboardings or the the average duration it's yeah it's maybe higher, but it's not because so where is the problem here? Auto selected attribute is to play authentication fail, and we can see a big here, so it could be.34:05See that on, on radios, maybe some backend database for clients is down or something like that. By the way in three to one you will see even the fail reasons directly on catalyst center if you have integration with with ice. So you don't have to go directly twice.34:23Error example of heat maps. So as I said, if you, if you want to have a list of top something, top top issues, top radio support, top APs with this radio reset, something like that, go and select select heat maps.34:42Then you can select the right metric or KPI, you can select bands to which you want those to show the heat map and based on that you can start from the very top and start troubleshooting why those specific APs are outside my my predictive scope or outside.35:01The best practice. In our example, this is long term trending and charts so based on based on historical data, machine learning, and so on, we can show you if there are some deviations on.35:21Some KPIs, so e.g. here SNR for one AP over two, three weeks, it moved from SNR about 33 DBs, which is pretty good SNR down to 17 DBs, still good enough, on your hand, the overall throughput on such.35:41AP will be not so good. So it's just deviation, it's not marked by any color, up to you, it's proactive, proactive monitoring as soon as it is really something something problematic, you will see different color.36:01In our way how to show you something is trends and inside here AP performance advisories. For some type of deviations maybe you just want to identify some APs where client experience.36:17This is not so good or even poor. So using those those dashboards catalyst center will will tell you, ok, here you can check.36:35You have higher transmit power in this case on those on this group of APs compared to the rest of the network. So maybe there is something happening or maybe you need to add some additional IPs to have good enough coverage for your clients, something like that.36:46Site analytics already mentioned actually site analytics, the prerequisite to have site analytics in your center is to enable AI network analytics and actually it is really just a different way how to present you all those data.37:04We already we already discussed on those previous previous dashboards. So here site analytics you will find them directly in the network or client dashboards per site and it's just tell you how these sites are doing or what is divorce performance.37:19Inside. So here we can see we are at google but we can see the boards performing side is London so so I can go click on it, go through Europe, UK, London up to the AP, AP floor level, and you can you can get some, some, some data about about.37:39Network up to those insights. After you click it, you are back in on the dashboard with all all those details.37:59So that's about what, what AI network analytics is. And now if you are interested, if you like it, then definitely you want to enable it. So how to do it? So 1st settings at services, AI analytics, it's pretty simple, just one click.38:09Moreover, you will need to select the, the data center where we where all the data will be stored. Yeah GDPR and so on. We need to be compliant. As I said, here is once again the the link to the trust portal where you where where you can find all detail for your security security colleagues.38:28Also, you will be offered to download the config file which includes not only the instant ID but also the key. As I said, everything is encrypted, you need the key. If you, you know, need to reinstall the catalyst sensor or I don't know migration.38:46In doing the immigration from DN to appliances.39:06You need to provide that key back to catalyst center to be able to reconnect to the same instance ID. So very simple to enable, now short short demo. So just a second.39:11Just a second, I will switch my screen. Here we go. I hope you can see my catalyst center is the cloud demo so so some of those data.39:27Are really really really emulated, so it's not real data center, but at least we can we can show you some specific issues. So assurance the right menu item and then.39:42Issues and even here for for a set of features or dashboards for AI network analytics. So let's start with baselines. As the name says, it's something really important. 1st, as I said the the component needs data, it can learn.39:58Learn machine learning is in the background and we can then start building some, some, some dashboards or.40:18You know, data around around it. So 1st this is the baseline. You can see three KPIs onboarding time, failures and and roaming failures and and you can see different sites. Every, every point is aside, if it's blue, it means that.40:27Inside the green envelope, everything is working as predicted even though you can see that for different sites you have different different parameters is expected, not static or it's dynamic. But here.40:47Something is happening. Catalyst centers see some, some issues there so it it is marked as, as red. So when I dig into it, I will see that onboarding five failures are outside, outside the green arrow, I can.41:04Click on it again and here is the dashboard with all details as I presented already to you. So problem description, when it happened, where it happened, what are impacted clients and APs, you can go up to the list of.41:23Both clients or APs and here you will find you know what root cause analysis as promised, automatically edit KPIs which are somehow relevant to the issue you are seeing. So here for the failed onboarding sessions.41:41Catalyst center automatically edit replay authentication fail and the HCP timeouts. So yeah, and by the way, you can see that those charts are really growing here or or the number of failed or the ACP sessions.42:01It's pretty high. So it's probably relevant more you can go into details like which AP clients and so on five fail percentage, so per AP, you can you can see all additional details same for for clients. So this is.42:19Root cause analytic analyzes and based on that you will see you will see some suggested actions. Both DHCP and services are outside catalyst center. So here we can just say, ok, check those services in your network. The reason is probably there, but.42:37Also in some cases maybe the RF conditions so so problem is the client onboarding could be also caused.42:57By by RF issues, so maybe the client does not have strong enough signal to be able to to connect to the AP. So everything like that on one dashboard, and you can, you can start troubleshooting the network. And, what I will also show you is.43:04The heat map. So here, yeah, very, very, very nice dashboard I'm using it very pretty often in case of any troubleshooting, so you can select what you want to check switches access point for switches, not, not many KPIs, but for APs, you can see the number of KPIs is pretty high.43:25And yeah, you can check for radio resets, you can check for a number of clients and so on. The output will be similar. Top.43:4520 if I'm not mistaken, something like that, maybe more APs with monthly view per day or if you click on it, you will see better hour statistics. You can filter per band so probably 5 ghz is most important for you for your enterprise applications. You can go and get applica.43:56The average or max max values. So this is the way how to how to use that part. And the last one which I will show you.44:16Is the client is the issue and events dashboard as Alex mentioned, here you will be presented with system generated issues so if you are just reactively checking what is happening on the network, you will see that.44:27Some of those issues are marked with AI AI standard and that's exactly where you will find AI networks analytics in the background. So here one of.44:46The issues exit failure to connect high deviation from baseline 1st line you can check it and we are back again for the for the full problem description root cause analysis, and yeah, you saw already those dashboards so so I can skip that.45:00So with that, the next chapter is about security and wireless, so Adrianne floor is yours. Yeah, thank you very much guys let me just share my screen really quickly.45:18You can see my screen, right? Yes. Okay. Nice. So, going on on the advanced capabilities that we can encounter in Catalyst Center, right? We we face with one of the important ones, which is security.45:36And the landscape of the vulnerability has been increasing a lot lately. So what we make, we need to make sure in in this is that we understand where that attack or threats are coming from.45:56In particular case, we may face vulnerabilities on the wire, right? Over the air, which most likely is what you think that we will be talking up today and maybe true, maybe not. And then, even.46:15People who is not using Wi Fi can affect how we connect to you know to to our enterprise networks Using other type of network or connectivity like e.g. microwave.46:32The fact that they share our media or medium, that implies that we will be affecting our packet, our packet sharing on across that same medium, right? So on the wire, we, you know, we have row on wire, particularly.46:49Vulnerability or threat, which we may solve with switch port tracing or one X on the on the over the air, we have done two solutions. Row management will be extensively speaking up today and also wips.47:08Row management, let's say is a basic way of scanning the environment to see who is out there and is using and analyzing patterns to check, ok, is that guy outside my network? Yes, but why he's behaving like that? And finally, again.47:24We have the cisco clean air solution for those known Wi Fi things that may or may not affect to us, right? So now, in order to to to expand on on this on this part about Robot and A wips, we will need to just to define really quickly because I understand.47:42That maybe some, some.48:02Administrators who have been extensively working with wired, but not wireless, and because the landscape has basically grown in the wireless part, they are now really you know taking a deep dive in in the wireless part. But security usually is left alone.48:05Unless you, you know, you face some, some issues. And let's let's just dive in a little bit into what each part is just to, to, to set the the standards, right? So we have in the left side row APs, right? And on the on the on the right side we have row clients.48:24Row AP is basically, an access point that is not part of our infrastructure, right? We don't have control over it. Most of it, or most of them are not a threat and they maybe legend you know, maybe you're if you're in your at your house.48:41Your neighbor Wi Fi maybe a row AP for you, right? They can or cannot be considered a trial depending on, you know, how they behave towards your environment. And the other side we have rogue clients. Rogue clients are basically clients that are attached.49:01To a row AP. I don't really care if my network my neighbor's apple TV is connecting to his access point. That's ok, right? The problem is when my enterprise customers are joining, you know, a row AP.49:21Without they, you know, knowing that this is really important because then I need to make sure, ok, why aren't my clients joined to that device? In that way, we have a capability within the raw suite that allows us to detect that impersonation, ok? Maybe that APs.49:39Trying to mimic my network and that's why my clients are moving towards those access points and we're doing a row impersonation detection.49:59Based on to or doing it in three three ways, right? Row AP channel match, AP authentication, and infrastructure MFP. Those are the three ways how, the role detection mechanism within the the Cisco architecture allows us to detect.50:10That an access point is or it is not a threat besides being a row, right? Now, in the other part, right, with what is a web signature? Because maybe a row AP is there.50:26But it's, you know, just doing business as, as, as us, we have maybe a co locator enterprise that they, because of the fact that we need to share the median, it is really hard for them to to not you know be part of of our scanning. So the the.50:41The good.51:01Part here is that the with signature is basically a set of predefined patterns or behavioral conducts basically. So, ok, that row AP is there, but it's doing something out of, you know, normal. Eh, the way how we detect that pattern.51:03If it is good or not, it's basically a catalyst center will push signatures basically specific, conducts on the hardware of the access point which will automatically be able to detect if what the AP seeing over the year, ok, this might this is not normal.51:22Why this guy's sending My clients this amount of.51:42The authentication packets, e.g., just just to give you an example. This kind of activity is what triggers an alert, right? And we combine this with forensic capture, we will see what it is, and then a protocol anomaly detection. Those are the capabilities that would offer within the Cisco Cisco Wi Fi architecture.51:46Now, if we look at that landscape, right, we're essentially fighting these four fronts. Outdated threat detection, again, is basically that even though we do have the architecture.52:05It's like an antivirus, right? You, you may have a really good software in the antivirus, but if you don't update your database for the new threats, you will be relegated to not be able to find anything that is actively affecting your network.52:22That landscape landscape is growing, so complex architecture because of that growth basically are targeting to our teams, security teams to know what to do with, with this amount of.52:38Of of of traffic basically. Because the amount of traffic we have, then we're reaching other fatigue, right? Because then the devices are generating so much information that our teams don't have enough time to go through all this part and then.52:56You know, there is a a big amount of noise and it's hard for them to track down what is really important. And well finally mitigation process is really address. Try not just, ok, once you find out what it is, what it's doing.53:16Your pinpoint and also you know smooth process and it is seems something that we will we want to tackle from the Cisco standpoint. Now, the architecture from the access point and and controller perspective has been changing a bit in the hardware itself.53:35Right, but the flow is more or less the same. We still have access points of our layer of detection, then the controller which can work as a matter for correcting or removing and detecting threats.53:55But then reporting capabilities usually tends to be on the prime side back in the days, but prime was that these alerts are reports. Now catalyst center come into play with an active role, and that's what I want to talk to you today. We want Catalyst Center not only to report an alert, but also to manage.54:11Through the correlation of data, that important aspect, right? So again, really quickly, just to for you to understand how the components interconnect with each other, we have the raw AP, we have the managed AP. Usually the the channel of communication between the AP and the controller is there.54:31If your enterprise is working, then on Catalyst Center, what we have is already telemetry when we add the controller to the catalyst center inventory, that that is there. But the feature or telling the controller to send raw data needs to be done 1st. So once that's done, you can then.54:49Subscribe to some telemetry, we'll see that.55:10And the controller will start sending those reports to Catalyst Center. Within Catalyst Center, we have the row part within the assurance, and then it's where we do the aggregation and classification. That works specifically if you have several controllers, right? You aggregate data from several controllers.55:12And then correlate what's important, what is not doing also ruling in in catalyst center. But it is not enough. Can see that it's a row, you can see that it there is a thread, but if you cannot locate it in your map, then you are really hard doing anything.55:31Important, right? And this is why, even though location is optional, you still can do with and role detection without location, not having location is like not doing much for for the the actions to take.55:49Now, how do we enable this, right? Because this is one of the important part. Let me just put this over here. Okay nice. So in the 1st thing we need to do is feature enablement, right? The feature enablement will be done on the software packages. Usually.56:07A rule enabled is a package that you installed like an application that you installed on, on the catalyst center.56:26Then once installed, you will see that catalyst center will display within the assurance part, this-this you know icon that says rule enables. And here is where we can then launch this page. This page will allows us to enable or not.56:35The telemetry information that we need from the controller regards row and wips. Again, having the controller inventory enables some specific telemetry but does not enable road any wips. This is why we need to do this.56:54After even join or make the, the, the controller join to the, to the catalyst center. Now, once that's done, what we'll see is that a job status has been triggered and once the status is successed.57:10What we will see is that if you go to controller CLI, right, you will see that there are four channels of of rogue telemetry and and and so two related with data, rogue data, row client, and they which data and and they which alerts, right? So that's.57:26That's what we will be seeing at the controller CLI level. If you do not enable this, probably if you do the the the filtering, you won't be able to see anything appearing as a subscription from the controller side. Now, something important that.57:46Was mentioned by, by Alex at the beginning, right? How we manage controllers or Wi Fi networks within catalyst center. I am putting this here just a clarification.58:04You may see manage only or manage and provision, also, a synonym for managed only will be on board assurance only or provision for managed and provision. What we are we are basically saying here is look, there are some features within Catalyst Center.58:19That requires the controller to be controlled by Catalyst Center and some others does not require this, right? In in this case, row detection and management through Catalyst Center worked.58:38With the two scenarios, either if you have managed only controllers or if you have managed and provision controllers, it works just as nice as, as, with the two options. Something important to notice is that since there are some.58:55Things that needs to be enabled for those controllers who are not managed completely by catalyst center or we mean onboard controller, we have to do some tweaking. Let's let's just see that really quickly here, ok? So.59:11Hi, I'm catalyst center. My controller is already in Catalyst Center, and what I'm gonna be doing is checking how is my AP join profile in the controller. Why is this important? Because even though role detection is enabled by default, the thing with awips, it is not enabled. So I will need to enable that part as well as forensic.59:26Yeah, right? This is for controllers in assurance mode. I only want to have visibility of that controller I don't want my, my catalyst center to be doing something else. In the other aspect, we do have those clients who want to use the intent, so all the flow from catalyst center because.59:46They want to orchestrate several controllers, so it's easier to create one SSID, apply that to all the controllers, the same happens with with the road detection. You can enable it through Catalyst Center in, in the following way, and it will basically help you to.01:00:05To push that configuration to other controllers. This is done in in in here in the design network settings, then we go to wireless, we find all the settings regarding wireless, same the naming is the same EP profile within catalyst center for wireless configuration.01:00:23We go there, we edit that part, we go to security, and then we enable the A wips, progressive captures and row detection, ok? That's how we enable the feature. We have done with one part. Remember enabling the feature means.01:00:39Enabling subscription, and then once we enable the the subscriptions, we need to make sure that the capabilities are, are there. Why here we're missing a part in, in this, in this.01:00:54You know, flow. Once you apply the the conditions to catalyst center, you need to provision the controller, right? Because that is only stored in Catalyst Center. Now, once the feature has been enabled.01:01:13So you're sending telemetry data to Catalyst Center and either you have an onboard controller, assurance only controller or a managed controller, you will start getting information on a populated dashboard, which we want. Well.01:01:29There are some levels that you need to take into account that are there by default, right? Those this is automatically done by catalyst center. And this way how we categorize issues are three and are informational potential and high. Informational, any row that are.01:01:45Not wire on wire decked onward, but are higher, so it's really long in in our SSI.01:02:05Than new 75 dbmiss, right? It is there, we can hear it, but because it's not that cloud we will just consider it as a neighbor. In the other aspect, the same kind of thing but like another AP, another row, not on wire, that is closer.01:02:1375 will detect as an interfere.01:02:33Right, this is out of the box classification done by center. And then anything else, as you can see list there is gonna be considered as a high thread, right? You can override in a way that behavior by doing rules. If you do rules, you may categorize a neighbor as a high thread or as a.01:02:38Potential depending on what you put on.01:02:58On the dashboard, right? So what's important to see here, 1st we have row rules, and then we have, row rule profiles. So we add we create rules and then we add the rules to a profile. In this case, e.g., what I'm doing is I'm creating an rule.01:03:00That matches two conditions, that contains the exact same bleaser name SSID or that contains part of a blue in its name, right? Besides that, my condition must also match the, this guy besides having these two.01:03:20This really close to my enterprise. If those two rules are connected, then I will map that rule to my role profile. In this case, this is a scam enterprise, that's how I I can call it. And.01:03:40You know, that's how you tied the two things. Just as a matter of fact, there are four rules in 2372 type of rules we can create, right? Based on ssids as you saw, based on RSSI as you saw, but also as based on encryption condition.01:03:58Or a minimum row client count, right? You you can tweak where what's really important for you. How all this again falls still into the profile catalyst center dashboard.01:04:16Now, in two oh sorry in Yes. In once the the rule is in effect, right? What we will see because I categorize it as high as if you don't if you didn't see it, victorization is done right here, right? I categorize it as a thread level.01:04:32Then automatically it will, you know, in this case detect something that matches my description, it will, the type will be used using my my rule name or or my rule profi my rule profile yes, my profiling name, and then it will appear in the row dashboard, right? That's how I.01:04:50Do matching condition in in Catalyst Center. If you have been doing rules on controller, you, you may have some experience, there are some things that changes, but but the the way how you know the flow is handled is the same.01:05:11Something that we have added in 3.1 is the capability of within the rules. Remember that I mentioned we had four in 237 in in 3.1, we are now capable of adding conditions matching the channel width, right? So this is really important for.01:05:27Those specific scenarios you know, maybe there are some tweaks that needs to be done for, for some particular row APs, then this also is achievable on 3.1. Now, once you do a ruling, you have that capability, you showcase the capability.01:05:44In dashboard. You can take some actions. The dashboard allows you to take some actions, right? And one of that actions, those actions is row containment. A containment, if, again, for those known Wi Fi guys is basically a type of attack.01:06:04That where I spoof the clients or the target device MAC address, and then I start sending disassociation requests or the authentication request.01:06:22So you we detect a row AP and then what we do, we, once we detect if we know that there are valid clients in that row AP, we contain using this association request or the authentication request with our enterprise access point, because we don't want clients to be joined to the.01:06:36That device, right? This is how we contain it.01:06:56This or what this is what containing basically means. What's important here is that you will see this warning because this is an attack at the end of the day and may have legal consequences. So knowing if the device is in or outside your infrastructure is critical to avoid those legal consequences. If you want to.01:07:00Container advice that is within your enterprise, ok, good makes sense. But why you know targeting enabling AP that is.01:07:19You know, not not really bothering much. This maybe an issue later on. Now, there is another part of containment which will, you know, we, we will talk we we were talking about containment on the wireless side, right? When where APs will be attacking our, our.01:07:26Attack attacker, let's say. In this case, our attacker is already plugged in our switch, right? This is really crazy, right? Because ideally you should have a level of security at poor level, like.01:07:47Dot one X e.g., that avoid that to happen. But let's say it happens. What's gonna happen is that Catalyst Center dashboard will detect that AP instead of as a row device as a row on wire.01:08:01And the action that you will see will change instead of, you know, doing a containment, you will have the opportunity to switch, to chew down the switchboard. Something important. There's a warning there. We are only doing.01:08:16Or the shutdown on switch ports that are on access mode, not on trump ports. You will see still the alert in trump ports, but you won't have an action to take. This has been decided like this because, you know, on trump ports there are several type of traffics, not necessarily only.01:08:32We're seeing here and may, you know, in in in an effort to solve an issue, you may create another. So that's why we are only doing reporting on trunk ports, but not actively containing or shutting down the port. How we do this?01:08:51Usually vendors, even Cisco have a Mac address system, right? And that Mac address system usually implies that the Mac address used for internet match in a longer condition.01:09:09For, the, the wire part. So maybe the last two the last one, the last three parts of the Mac address changes. And this is where this is the type of match we're doing. If an access point listened over here something and then.01:09:26We have a report of a MAC address on a switch with that condition matching, then we will categorize that guy as a row on wire. This is again why wire.1X matters, guys. Please use the one X on your switch ports. For your information.01:09:43Due to the type of, of actions you can do, and depends on the trap level, these action buttons, as you saw, it will change, right? Row on wire has some actions, row wireless row has another actions. You can just see that over here. I'll just.01:10:00Later in this slide for you for your references. Now, that's a rule for ropes and rope profiles for ropes. Let's talk about just quickly about profiling in in a webs. Remember the condition we we we we start?01:10:17And this conversation will what we highlight that with is basically a way how we match patterns, right? In the way how we do it in Cisco network is checking this is some signatures.01:10:35And the WIPS profile specifically allows you to select what signatures are gonna be pushed to the AP. So the WIPS profile creation basically allows you to put a name there, you have then also the the signature name you want to use.01:10:52And then you attach that profile to a specific place or in the hierarchy and also means a control, right? Once that's done, what you will be able to see is at the AP level, you'll see that has been enabled, and if there is any detection happening, you will see the option.01:11:08Account happening, right? This is what you will see at, at the controller level, obviously in the.01:11:28In the other side of the of the equation let's say in catalyst center, what you will see you know the the chats being detected over here as a wips. We'll see that in a minute. Because I want to you know it's really related with wips. And probably you have been listening, ok, what is that about the.01:11:36So once a match happens, right? Let me just go back really quickly here. Once a match happens, we are gonna be able to select a conditioning for the threshold of the signature.01:11:57And also visible here, but we'll see visible later. If we want to enable a feature called forensic capture, right? Over here. So what what this does is basically once we have a match of an alert.01:12:13Are we allowing Catalyst Center to tell the APs to send a capture of whatever the alert triggers? If that's the case, then what we will see is this appearing here as a forensic capture in their webs part and.01:12:29Let's just take a look really quickly how that looks like. So again, our dashboard, then we go to our Rope profile. We have by default one already created by catalyst center. We cannot delete it. It's just there as a standard.01:12:46And in this one, we can see the signatures, we can see the default threshold and the configured threshold, which cannot be modified again in the depot. And the forensic capture also cannot be modified, right? But for whatever business purposes you will need to modify it, then you can go directly.01:13:03To to creating a new profile, right? This is what's what I did.01:13:23And I'll just show you really quickly, you know, that in this case I can select what type of technicals I want to to match on my APs, if I want to enable it or not the forensic capture, right? And if the threshold that is used by default.01:13:28Yeah, I I want it larger or smaller, right? That can be done. The values there are recommendations, but of course if you have a specific business case that that can be modified. So the idea here is to map that which profile to a consoler, right?01:13:44Well, what I'm what I'm basically doing here is that I cannot modify the the the values, but if then I want to assign my custom profile, I need to go to the profile workflow that it will matches the profile to the controller, it will push those signatures on my profile to the, to the APs.01:14:01And then I, I see that it is being assigned, right? Now, I can see if I look for, for any way with threats I I should be able to see a match.01:14:20Having that condition. Let's see if I can find it really quickly to expedite that part. And yeah, I think if impersonation might work. Let me just scroll up just.01:14:33Do this faster, really quickly over here. Okay, so if we're, let's say that I pick the broadcast proof, right? This is the one that I I want to analyze. I have a higher count, so.01:14:49I go to my threats, I not identify the Mac address of the device and then within this menu, I will see that the detection was made by a specific access point and because I I had the matching condition for forensic capture enabled, I will see that the file is already in catalyst center, right? This is.01:15:05Again using intelligent capture, right? So intelligent capture is a prerequisite for the forensic capture to be able to be used to the controller, to meaning the controller, meaning catalyst center. So, this gave me the possibility of downloading a.01:15:25File and, you know, doing the forensic analysis is required. In this case, the type of proof or the type of packet that I should see in my packet captures are, specifically related to the proof. Again, you can pick conditions, you should down or not specific for.01:15:45Types. If we open the capture, what we will see is, you know, basically proof under proof happening matching the the conditions.01:16:06It's not only the amount of packets, it's also the amount of packets on a specific amount of time, right? That's what triggers the alerts. You can see the proof response really, you know, probably matching the conditions that we had in in the in the profile. So.01:16:13Having said that, the way how it works is because we already have intelligent captures, something that Alex mentioned prior, and basically it automatically sends the, you know, the, the collection of the, of the wireless traffic over this ERPC tunnel. It's the same that we use.01:16:31For intelligent capture. So intelligent capture becomes a brexit for this particular scenario, right?01:16:51Now, nice. It's really good to have a dashboard that detects, ok, something is there, nice to have a file to analyze, but if I cannot locate what I'm detecting as a threat.01:16:57I'm basically just monitoring the bad guys, which that's basically what I'm doing. So the best action we can do for those particular threats are to locate them.01:17:12And determine if they are inside or outside or physical organization. And because of that, we will require a location engine. We may have you if you're using wireless controllers, you can just bring the data to a space connector, the space connector will send the RSSI information or the angle.01:17:28Of arrival information depending if you're doing hybrid location or not. Two spaces, spaces will be doing the the calcus.01:17:48For the location and then Catalyst Center will locate that threat within the map, right? Here is how you set the, the location engine on Catalyst Center. You need to have an account and all that. Well, that's basically how you activate it. Now, it works also with CMS, by the way, but.01:17:56Obviously CS spaces is the recommended approach.01:18:16Something important and it's what what people maybe don't see is like, hey, but I don't have CMX and I can see, you know, my catalyst center locating the, the threat on the map. So what we're doing here is.01:18:20Or, when you don't have location enabled, we will attach the thread to the close to the the AP that has the strongest signal. So if the AP that detects the thread with the strongest signal, you will see this happening. Like the thread is right below, but it's not the.01:18:38Cases because we are doing that condition, right? This is the one who reported with the strongest signal. In other case, if you have vacation enabled in the right hand, what you will notice is.01:18:58That the location will appear exactly what it is, obviously if you have a specific location design in place. Besides that, we have another, feature that allows us to whitelist.01:19:07Certain vendors. Why do we have this? Because maybe in you have some IoT devices, you may have something that it is not an enterprise, you know, endpoint, but it's part of your infrastructure.01:19:23And but it does not connect to the Wi Fi, but it maybe uses own protocols, Sigby, BLE, whatever, and you want in a way to just know knowing the vendor, adding that vendor to a wireless so that the row engine does not count it towards a trend.01:19:38Or something bad, right? But still it's nice to have visibility of it, so you will put it here and then you, you will, you know.01:19:59Put it as, as you like with potential or informational. That's that's something possible. Now we have we have been discussing, ok, what are the threats? How Cisco and Cisco Catalyst Center can help you visualize them.01:20:07And, and take actions over the threats. We have also seen how to locate the threats based, you know, using locations and forensic captures to to be able to route root attack, let's say that specific threat on our enterprise, but it's something.01:20:22It's important that we may have forgotten is the fact that the hard work matters.01:20:42All the Cisco access points do, role detections. All of them are doing a webs, at least the most advanced ones, is how they do it what matters. So this is a bottom and top view of a 9138P It's not.01:20:48The flagship, but because I wanted to show you it's like the the picture is what what really like is, you know, the in the right we have the diagram of the antenna array. So basically how is the antenna distribution within the access point? You see the amount of antenna we have for for this access point.01:21:06Right? And in the top, in the bottom view, we have the dedicated RF ASIC chip, right? This is a chip that it is used by the feature clean airport that allows us to, so what are we waiting here, right?01:21:26Is normal APs will do scanning through stop serving clients, going off channel, listening. Oh, there is a row going back serving clients and reporting to the controller.01:21:44Having that tip in the AP allows, allows you to keep continue serving clients while still with the RF ASIC radio getting reports from rogue or, you know, a spectrum analysis. This.01:21:59Just just because of the fact that you don't need to go off channel and, and do all this, give you a client throughput efficiency of 25 %. Why? Because basically doing that, you know, back and forth, it's it's basically airtime, only for a scanning of 1.5 to 3 % of, of, of, of doing that.01:22:16Right? And besides the fact that you don't need to go off channel, also the detection speed is higher. You have a dedicated hardware scanning the environment all the time. You don't need to wait until you go off channel to go and report so that you can report it right away. So this is why the hardware maps.01:22:35Now, now that we're talking about reporting, right, you should also know that we have the reporting capabilities for row and A widths. You can find this in the, you can trigger it either from the row and A width dashboard or you can just go to the reports.01:22:56And then, you know, go to the report template. There are some templates there that are dedicated for detection, but also you can do flexible reports if you want. This is just an example of how it's the look of a CSV file. You can, you have several formats here CSV, PDF.01:23:13I'm sorry TV and Jason, right? Those are the three formats we are handling. Now, for the more centric customers with still some you know several APIs at your disposal, so you can, you know, extract information on demand and maybe you do.01:23:30That's your own, you know, dashboard.01:23:50By using a Splunk, e.g., or Grafana, right? That's also possible by collecting APIs. And it's probably faster than a report only static report, right? It's up to you, it's up to your preferences. You can search for more information in the development developer.cisco.com website.01:23:52And continue with this just to, you know, we're almost anything in the row and A with part, the row collection is important, right? And the the interval in how the controllers or how the catalyst center tells the controller to send the data is also important. Remember, back in the days we saw a subscription happening of four things.01:24:10Those are the four things here. But what's happened is the delta of the interval, and that happens every 10 s by default, you know? Then we have an update, every 5 min and then a full update every hour, right?01:24:31Unless you have, something like intelligent capture, we may send more information, but, those are the default values, they are there, they are not modifiable. Why I'm telling you this? Because at scale.01:24:48You know, you have catalyst center it has a hardware limit and there are customers that really have big deployments, not only of APs but several controllers attached to Catalyst Center. So eventually, we will be reaching the scales of of the physical appliances or not virtual appliances.01:25:02As well, and what I want to discuss now with you is how we optimize this performance on those, you know, deployments. We have some settings again for those clients who needs to go to the controller on on board only.01:25:22And we will need just to modify the detection of minimum RSSI, so, if I don't detect my row at certain level, I won't be sending the reports, right? That's basically what I'm saying. In, in the detention interval, but basically what tells me is, ok, if that AP.01:25:39Stays there for more than X amount of time, should I then consider it or not? By default, we have several seconds. So whatever the interval, the amount of time that row is, we'll be sending the report. That may not be, you know, useful if we really want to filter it out what is important. We want to to to to.01:25:59Send what it is.01:26:19Constant, right? And then we have other three things and just to to go quickly on this, we have the deviation. Go ahead. Sorry, sorry to interrupt. We are almost on time. So of course we will continue. Yes. But.01:26:21I want to apologize to people, it seems that it's very interesting and we will continue. If you cannot stay, the recording will be available in a few days.01:26:41And you can find it in the community page. I hope you can stay and hear Adrian but also let's let's keep going. Thanks. Thank you Alex. Yeah, I'll go quickly because also interesting topic, right? So.01:26:53So we're almost ending the idea is to again optimize at scale for and now with these three items over here, what we want is.01:27:13That the notification be as important as possible. E.g., we have deviation of RSSI for raw APs and row clients. What that means is only send a report to Catalyst Center if the.01:27:23Difference or if the delta in RSSI or RSSI is higher or lower than ten dbmiss, right? It means ok basically that the device either move a lot or or basically disappear at some point in time. But what's gonna happen is that only.01:27:39Those who are higher or lower than ten dbmiss are gonna be reported. Again, this is for upscale.01:27:59If you don't have really, you know, performance or you don't want to optimize it, you can let the values as they are or you can maybe put five, e.g.. The idea is, is because, you know, people moving in the environment only can affect the perception of the, of the top of the of the thread.01:28:06And that will be, you know, every time being sent to to to catalyst center.01:28:26And well finally, the, the last one is the row timeout is basically, ok, up to one point, the controller should not detect that threat to just basically delete it from, from the table, right? We recommend a timer of 20 min. That's, that's the standard. Now.01:28:31I think with this, this is basically our repre our representation, but then what we can do is continue with the with the with Jorda, ok Jorda, are you, are you there? You can, you can be joining me back again with this.01:28:51I will share my screen just a second, share and call. So yeah, thanks Adrianne and we are at the 3rd advanced feature and actually I believe it's pretty important especially in the context of which is coming with Wi-Fi.01:29:09By seven and you need a tool which will help you really to better manage the RF performance. So just again set the right expectations at the very end or set the stage honestly.01:29:29So it could happen that sometimes you can hear that six years coming, maybe five years also many many channels, it should be very simple to just plug and play everything, get gigabit speeds or even over gigabit speeds, phone bars, seamless experience, everything's nice, but.01:29:45The reality in the enterprise network is totally different in many cases. The reason is your home network is.01:30:05Something else in enterprise networks you need especially a component which will, which will tune RF radio frequency, it means it will assign the right channels, transmit powers and so on. So the reality could be that even you are you should be able go.01:30:13Over one gig, maybe you have just 10 mbps. You have sticky clients. It means that clients are not roaming across the infrastructure. It could be that you have some some clients with bad drivers in the network and you have NO visibility if you use 3rd party in.01:30:33APs and yeah, there could be some random disconnects.01:30:54So how to mitigate those pain points? The answer is radio resource management. So you will see just RM abbreviations so it means radio resource management. And what is it about? So both the standard Cisco RM and ARRM are.01:30:59A collection of algorithms that optimize virus resources for efficiency and performance of the RFB. So, yeah, what is it exactly about? I already mentioned it's it's mainly about assigning the right channels to those APs actually to radios in those APs plus transmit power comp.01:31:19In some cases especially when we are talking about five and 6 ghz, it's about dynamic band selection. So 20 mhz or 3 mhz, maybe 80 mhz in the US, maybe in 6 ghz.01:31:40You can go up to 160. So something like that and those parameters could be dynamically changed by RN. Also, I have flexible radio assignment on on the slide. Yeah, this is also one of the algorithms you can assign different roles to different radi.01:31:52Radios in the AP. So if you have enough radios.01:32:12On the floor, you can change the behavior and and move from you know radios actively working with clients to monitor more radios. About be careful in some situations, yeah, it could be used in some.01:32:17Situations, it's much better to maybe do some changes manually. One prerequisite and I added one one screenshot here, radio resource management can help you really.01:32:38To, to really miss the efficiency and performance, but there is one prerequisite. Good RF design. If you don't have good RF design enough APs on the floor, actually the magic could not be the magic could not be applied. So RM have some limitations, it could not go over.01:32:55Transmit power limits, it could not just, you know, select some hidden hidden channels or something like that. It could use only channels which are available for your countries and at transmit power again limited by by the.01:33:15Regulation authority. So once again, good RF design.01:33:35Required for the RM to to RM work correctly. Some, some more points RM runs on the RF group leader. If you have more controllers, one of those is selected.01:33:42It become RF and manage whole RF network. In case of ARRM, it will be catalyst central. We will we will get to that. It all changes are done on per radio basis. It's not per AP actually it's per radio.01:33:57Something like that. And in most cases we are the the main metric we are using is the overall interference from other APs but also including non Wi-Fi interference or traffic.01:34:16Okay, so I would like to run RM, I would like to assign right channels right powers. I need something. I need to know what is the RF distance between those APs, so so how good those APs can hear each other. And for that we are using NDP protocol. NDP.01:34:34It's a broadcast message sent at the maximum transmit power, all our APs can can set it, can listen to it. And based on that we can create vectors which are really.01:34:55Showing the the RFD stance between between those APs. So that is one prerequisite, very important one, not all vendors have something like that actually. Now, why, why not just traditional RM which is therefore from very beginning on all wireless controller?01:35:08Actually, you need to be really an expert to, to be able to understand all those knobs settings and so on. There are many screens, DCA, TCA, TPC, RF grouping and so on. It's hard to manage for someone who.01:35:28Really is not an expert. In some cases, even the visibility serviceability is somehow limited. If you want to do some optimizations, it's about, yeah, do some change, wait for feedback from, from your users, which.01:35:47Maybe it's not so positive so you will return back to the previous config and try something else. So with that, here is the interaction of AIRM. So what you can get and how it works, feel starve is the architecture. So we are adding catalyst center as an additional component plus the AI.01:36:02Cloud again, same as we had for AI network analytics. So the reason here is that as a group leader, we can select catalyst center. Catalyst Center and AI cloud in the background, we have good enough.01:36:22I'd say power on those levels, Moreover we can run again, some machine learning and based on the historical data instead of just 10 min which is used by by controllers, we can go up to 14 days back, and design different channels, different transmit power based on data.01:36:43Of the week or something like that. So that's the architecture, what you will get. So 1st of all, very simplified configuration is possible. Just one one slide one screen. Yeah, still there are some technical constructs and so on. You need to at least know a.01:37:03A bit about what it exactly can do, how to set the RF and so on. On the other end it is much much more simplified than than, than you compared to when you are using.01:37:23RM only control Plus, and this is very important, you will get full visibility. So from summary page up to insights, same as we had root cause analysis for some things plus.01:37:37Actionable insights means that you are able to really assimulate how the change will looks like in the real network and then if you are ok with that, you can, you can directly provision. Plus you will get some assurance and performance data about the RF, how the network looks like.01:37:56If there are some changes, issues and so on. So that's, that's AIRM which is running on catalyst center, but this Cisco AI in the background. So, yeah, table side by side comparison between personal and AI and answer I will not go through.01:38:15All details just the most important part. We we said that a traditional RM is snapshot of last 10 min. Here we have 40 days so we can differentiate based on different days of week, weekends and so on.01:38:35Manuel, many many settings, you will be lost with all those settings, so here you have AI assisted minimum knobs simple simple configuration.01:38:52What else? What else? We we have something like business hour construct, so so we can say that during the business hours, we would like to do minimal changes only in case there's something important. Let's do it. On the other, on the.01:39:09Case, if, if some change big changes are needed, do it outside business hours, something like that is also possible. We have RM simulator already mentioned it and in general, if there are any troubles and you need assistant, we have very simplified workflow.01:39:29So to collect service bundle and you can send it to to doc.01:39:49So, that's about how how it works, now some details. Here you have, not four but most important parts of the configuration. It's actually one screen as I mentioned from basic settings like which band, business busy hour.01:39:54Busy our sensitivity. Here I would like.01:40:16To recommend start with low. So it means as I said during the business hours or busy hours you really want minimal minimal changes Plus some settings maybe disable flexible radio assignment up to you. It really depends on the design of your network plus you can select channels, maximum.01:40:20Be aware that for us, you will see maybe 40 mhz for five, 80 mhz for five in six even 160. Here in Europe definitely we don't have so many channels, so go down a bit, maybe 20, maybe 40 for 5 ghz in.01:40:42In 06:40 or 80 definitely not 160 mhz wide channels in in 6 ghz in the enterprise environment.01:41:02How to enable it? Very simple process. If you already enabled the AI network analytics, I already talked about that, you can just add the AI enhanced RM, and then.01:41:13Create a AIRF profile and then during the workflow, you can assign it to a specific specific site and provision both 1900 and APs. Yes, this is provisioned enabled deployment, so so for those networks where we are.01:41:28Provisioning, wireless network from the catalyst center. And actually, that's the reason why it's why it's yellow here. It was a problem for some customers because many customers are using catalyst center in the assurance only mode. So what if.01:41:48You have assurance only mode and you would like to use AI and answer because you find it as very useful starting 2379, there is another option in the workflow and it is enabled without device provisioning. So even if you have.01:42:06Wireless control onboarded just in assurance mode, you can still enable AI and answer yet. There are still some some configuration that needs to be pushed on the wireless control but it's definitely not about full provisioning of the device. I mean wireless controller or the.01:42:28Key.01:42:46Just for reference, what is needed to run AI and answer them one one node here, if you are running especially Wi Fi seven APs or any of those new new wireless controllers go directly 7923710, even eleven is now available or suited one directly.01:42:47You'll need support for those APs and those those controllers. So that's my recommendation and by the way DNA license is required.01:43:07If you like it, maybe you would like to read something about our customers. So here is one case study about ARM from frustration to exceptional Wi Fi at University of Otago. Well, yeah, definitely worth of reading even.01:43:19In such cases like this very open bathroom in some university library library, it's kind of nightmare if you want to set everything manually, but here can can can.01:43:39At least at some level help you help you to better set the the environment. And because it is experts inside, I want to give you some more technical insights, at least something what you need to know before you start enabling it.01:43:53So 1st of all.01:44:12If there are more sites connected to one wireless controller, if you are using e.g. flexconnect or you have, you have campus, more buildings connected to one wireless controller, all those sites need to run AI and answer. The reason is, it's not possible to run legacy RM for.01:44:14Small part of the network, one side or one building in the campus. You are switching the controller from the legacy RM into ARM at once. So that's pretty important. Also.01:44:34All APs, as soon as you apply the AIRF profile, all IPs will flop or dump up at the end. You need to set or the system needs to set radios into the new mode, so be aware of it, do not enable it during during busy.01:44:49Course.01:45:09And what you will see on the, on the wireless control instead of auto leader for the standard or legacy RM, you will see a remote member and it will be remote member to the, to the catalyst center. So this is, this means that group leader is.01:45:10The catalyst center itself, you will see the name plus IP address and as a group name you will see open open RM. Plus the list of all controls which I which is which are managed by, by, by that group leader.01:45:30Okay, maybe a question of what will happen if I, if I will lose connectivity to cloud or maybe I'm updating data center or migrating from old appliances to new one, what will happen with RF?01:45:45In such a case, NO worries. Controllers are prepared for such a situation from very beginning we have the ability to select new group leader and in case we lose catalyst center, we will switch back to the standard RM directly on controls, so you will see one of those.01:46:00Group leader and everything works as expected. The only thing is sometimes you need to tune those RF profiles which are on, on those wireless controls not to have a big, big differences between what you have locally and what is pushed by by air.01:46:21Where I'm from the cloud. And with that, very short demo, so just a second, I will switch to switch to the demo. So 1st of all, this is again the cloud, so partially.01:46:40Emulated demo, NO real data, but NO worries you'll get get the point. So here assurance and AI RM under the network analytics menu.01:47:00So when I click on it, you will see a menu like this. If you don't have any AI enabled sites this is the only option. If you have already some, some AI enabled sites you can go directly to that, that menu and start monitoring those particular.01:47:16But at the very beginning of this part, I said that there is one prerequisite. So once again.01:47:37RM can work and it's not about AI. Yeah, maybe AI can help a bit, but in general, AIRM RM cannot run without good RF design. So please use.01:47:44Or request from your partners, go to site survey using some site survey tools like or and so on or at least use catalyst center, import full plans, and then try to predict the coverage, use three D models those insights to check SLAs.01:47:59And so on. It's very important. We know that RM will not work and AI will not help you. So let's start with the workflow.01:48:19So, just a second, assurance, AI enhanced RM and let's enable AI enhanced RM for one of the sites. So here, as I said, starting 2379, you will have two options. Enable it without device provisioning.01:48:30For this device provisioning. Video device provisioning is new. Let's, let's try. So in the next steps, prerequisites will be checked will will be checked. So AI analytics must be enabled, as I said both network analytics AI and answer in the settings page.01:48:50Plus all devices, I mean APs in that that case must be assigned to sites. Why? Because still we need to create those dashboards per site and so on. We need to know which RF tags needs to be changed and so on. So, yeah, we need your APs to be assigned.01:49:09Plus we still need device controllability. It's not required actually, but anyway, there are some changes which needs to be done on the wireless control even when you are in the insurance mode. It's about telemetry, we need to collect the data and also it's about some changes. So not required, but in case.01:49:29You will not enable device controllability, you have to do it manually.01:49:49So let's continue with that. Next step is to select locations. So I have already one of those locations enabled, the 1st try this one. You can see already assigned primary WLC so.01:49:54Yeah, you need to know which controller will be in use. Here a warning I already mentioned it. If there are other additional sites connected that wireless controller you should enable all of them. But just for the purpose of this demo, I will continue with the current selection.01:50:09And here you can select the RF profile. If you don't have it, just click here, create new one, and you can see this is exactly what I already showed to you on on those slides, so I will skip that part. Let's say we created.01:50:28RF profile, it's exactly describe the the network I have and here I will select one of the RF profiles which I prepared. So with that, we can, we can start with the overview of the network, profiles and everything.01:50:47Thing and the next step, next step, you can preview and deploy, deploy the conflict. So I will skip that because it's yeah it takes some time to really.01:51:07Provision everything and I will show you directly what we have here on the, on the overview view page for AI enhanced RM. So 1st of all, side the right band, 5 ghz is probably most critical for your application, so I will use 5 ghz. You can check the.01:51:18Profile here, the AI RF profile which we created and then you have summary page, you can run the simulator here, but I will show you how to how to use it as well in the insights. Plus you have all those charts from the overall performance number of changes. You can, you can click view.01:51:39Details for many of those KPIs.01:51:59And check additional details what happened, why that happened and so on. You will, e.g., see runner detections, radio resets because of radio radio even so pretty important in case you are close to some some real radars like like.01:52:01Public.01:52:21Public error traffic control or army army sides also spatial density and power distribution, those charts are pretty important just to to know what is the status of your network. But also what you will get and its last last point, you will get insights. So let's try.01:52:25By any of those, it will show you the list of all options. You can do some best practices or recommendations. Let's.01:52:45Try this one. So, yeah, the recommendation here is to move from 20 mhz to 40 mhz because of that you, your clients will get much better. And here, yeah, you can directly apply it and and do changes or you can run the simulation.01:52:55And it's sometimes pretty useful just to check before you apply instead of waiting for the feedback for your clients, how it works, what will be changed. So you will see it for some of those charts, you will see updated for some others you will see you will see not simulated, but at least though.01:53:14Those those updated charts could could show you what could be the benefit to going to AIRM.01:53:34So I think this is everything from my side and yeah, back to you Alex. You are on mute, you're on mute. Alex?01:53:43Yes yes yes yes, I am on mute. Thank you, he took us 30 more minutes to cover those interesting topics, but the funny thing is that all three of us could stay here for the day and keep talking on those on those topics. Anyway, inform.01:53:59Question for next sessions and other technology sessions as well can be found in the.01:54:18Community page of the series, the expert inside series, CS.CO EMEA does EIS does Q3, specific to catalyst center, we have the page that I posted a few times EIS that.01:54:27If you want to connect us, you can send us an email@nx.CSS dot EMEA@Cisco.com. Please, please please please when we close the session, you will see a post webinar survey, the information is very useful to us. Tell us if you liked it, if not.01:54:48If you want to be conducted and if you have any suggestions.01:55:07It will take a minute or two, but it's very important for us. So what other type of content you want in next sessions, right? That's also really important for us. Any, any feedback, anything is very useful?01:55:12With that, apologies for running late. I hope it was interesting for you. Thank you for joining. Thank you for staying till the end and we hope that we will see you in the next session from Adrian, from and myself.01:55:29Goodbye. Have a great rest of the day. Thank you very much.01:55:47