Agentic AI: From Automation to Autonomous Networks

Hello, and welcome to today's expert insights series. Today's titled.00:10Agentic AI from automation to autonomous networks. We have today presenting with us is Mohammed Khan and Brian Morrissey, both our customer success specialists currently.00:16Now Mohammed Kan has been with Cisco for the past eleven years. Mohammed joined Cisco through hyperflex acquisition and he's been at Cisco since then. At Cisco, Mohammed worked at Cisco Engineering BU for four years than TAC, and recently a few years with Cisco customer success.00:36Team.00:56Brought his long tenure in compute, storage, and networking, and HCI technologies. Besides work, Mohammed loves riding motorcycles and coding in his spare time. Now prior to joining the customer success organization, Brian.00:58Worked in TAC in engineering escalations on the UCS product line. In addition to several years experience as a storage and server administrator for one of the largest municipalities in the United States, Brian holds a bachelor's degree in information systems.01:16From the State University of New York along with numerous cloud and security certifications. And here we've got our list of the sessions in the series. Today is the last.01:35Session, you'll see I beneath that at the bottom, you'll see circled that we have a quick recap in live QA coming up scheduled for 8 April. Now to the left, you've got a QR code that should produce a URL that will take you to our page.01:53Where all of these sessions are listed and the recordings should be available. So if you're interested in getting called up, watching past recordings, including today's sessions, please use that QR code now or capture it so that you can return to that page.02:13And watch those. On our journey, we've gone through an AI portfolio or overview and customer maturity model review. We've gone through a deep dive on data center networks for AI workloads. We've gone through a deep dive on data center compute for AI workloads.02:30And we've also done a review of real life use cases on Cisco infrastructure, and of course today's session will be around agent to AI from automation to autonomous networks. Now here we see that we are using Slido.02:49For our event control, and if you will, use that current current QR code that you see to go to our Slido or notice that it pops up in your Webex.03:09Session itself. Now the session code is gonna be agentic-AI, and the passcode is gonna be the same, agentic-AI. And as a start, we've got our 1st question posted out there of where are you joining us from today?03:26Now if you're able to join that, please do give us some sense of where our attendees are coming from. If you want to put city, state, country, couch, cushion, kitchen, I'm not sure.03:44What level of detail you wanna go, but we'll see that pop up and we'll share our results here in just a second and we'll take a look at that together. So far we see we do have attendees joining us.03:59From London specifically, UK, Mumbai is making a big hit. We have Washington DC we have India showing up, looks like we've got a couple of folks still typing.04:18We've got Raleigh here where I'm at in North Carolina. We see Contessa, Costa Mesa California, excuse me. And with that, we'll continue on. Please continue typing and, and putting in.04:39Your location there for the next minute, we'll leave that poll open. We'll review that with the team later to see where everybody joined from. And with that, we come to our 1st slide of today's presentation and I'm gonna hand the ball over to my good friend Mohammed Khan.04:57And I'll let you take it away Mohammed. Hey Joe, thank you so much for providing warm introduction for me and Brian, and I wanna thanks all these attendees join this session today taking your valuable time and want to stay.05:13Do us for the entire session, really appreciate it. Thank you.05:33So today the flow of the session will talk about different things such as starting with intro to the agent tick AI. We'll show you how, we'll explore the agent tick AI builder run it together. We have a wonderful demos.05:37I also will help you how to succeed live walkthrough like a prompt to tool calling action validation, and also please feel free feel free to ask your questions in the live Q and A chat or in the Slido as well.05:56So the quick roadmap for the session, 1st of all, we'll be talking about the AI agent one on one concept and core building blocks. We'll talk about MCP use cases, why tool enabled agents.06:13Matters and how MCP simplifies integrations. And then we'll be talking about in in a slide or two about autonomy ladder, how to scale from assistive ops to closed loop, and also have a demo, a two demo in this session regarding any MCP. So.06:29Need in is AI agent and workflows. You can see and control. On the other hand, on the other hand, the MCP is a model context protocol is it's an open source standard created by Anthropic that allows AI models to seamlessly connect with external data sources and the tools and software libraries.06:49So let's start with asking the big question. Are AI agent the next big thing or just the next buzzword? If you ask me, my take would be their real value especially when they are connected to tools.07:16Constrained by policy and measured by outcomes. We'll separate the height from what actually works in netapps, in netops, and then secops day to day basis.07:33So going to the next slide, I'm gonna talk about the AI agents and they are quickly moving from hype to mainstream. You can see this slide in different headlines.07:51And in Google trend, the interesting AI agent is rising fast, which usually signals more product shipping, more enterprise pilots and more budget. But trend trends don't prove RI.08:06So the improve momentum. The point is in agent solve everything. If that customer and vendors are investing, so adoption will show up in real projects and expectations. So the question is like, why now?08:21The three things made agent practical. E.g., measure tool or function calling, better reasoning, longer context for multi step work and an ecosystem of integrations. So agent earned smarter chat. They actually workflow with autonomy.08:38For Cisco and networking security, this fits naturally because opsy is already a loop like with trusted data, controlled tool policies validation and roll, the rollback, closed loop operation with governance.09:02Autonomous network becomes the realistic.09:22Now we are moving on to the new slide which talk about why for networks now and also the automation 1st workflow 1st agent, what are the key differences? So if you look at this slide.09:29We talk about the different automation workflow and agents, so what exactly the differences? So in the automation it's deterministic fast, narrow, break on unknowns. On the other hand, the workflow is like orchestration, it's structure run book.09:49With approvals, still relies on humans for intent and decision making.10:09And the agent is like at reasoning, cool choice, adoption and outcome verification. They decide do and verify. On the top of the slide, the operational reality, it's, if you think about the the operational reality of.10:14Like the agent AI for networks. It's more dynamic environment, you could use the cloud apps security AI workloads, data and tools all across the domains.10:35Humans spend time sorting context not fixing issues, and change velocity increased risk without stronger validation. And what agents enable sell natural language, intent structured action.10:46And then we have a slide for that as well. Later on we'll show talk more about it, tool driven execution with audit trail built validation verification, pre and post checks and faster MTTR and more consistent operations. So now we're talking about the autonomy in modern.11:04Networks. If you see in this letter, you have L1L2L3L4. So to quickly glanced over what this means. So in this case L one is assisted, it suggests summarize and draft action L two supervised executions such as execute with the approval gates and evidence.11:24And L three conditional autonomy, auto executes inside quick policy boundaries and L four is a closed loop. So here to give you some more context about L four is a full loop, it detects decide, act, verify, and learn.11:44With rollback if verification fails, the system proves all outcomes and measures impact, otherwise it reverts. So closed loop without verification and rollback is just automated risk, right? So the practical guidance for it start with L two or critical changes.12:01Then expand to L3L4 in low risk domain 1st e.g., non production read only actions and well understood limitations. Hey Mohammed, sorry to interrupt. Looks like the slides aren't advancing. Okay, I'm sorry about that. Thanks. So yeah, so I was talking about these four different.12:20Current the autono the pectical maturity ladder, autonomy in modern networks, the L1L2L3L4 as referring all this. Thank you, Brian. I really appreciate that.12:40So starting the AI journey, I wanna ranking the use cases, look at these X and Y axis. In the X axis we have technical complexity and y axis we have business impact will rank a business impact.13:00And how we start, what you plan next, and what we would prefer to differ, to avoid.13:19So if you, for a ranking use cases, so always like we recommend start here with high impact and low complexity, it's quickest wins to prove values and get adoption. And then the plan next is the one on the top right corner, high impact high.13:27Complexity. So what that means, the bigger problem, right? So break into phases and add stronger guardrails.13:47And actually I'll tell you this, the high impact and high complexity, this is the big price, but also where projects fails, it treated like a hackathon. So more into stronger control, bigger blast radius, the right approach.13:53This two like this paste is read only supervisor execution and narrow autonomy.14:13And then bottom we have low impact or low impact low complexity, low impact, high complexity. So these are the use cases we recommend to avoid, so don't spend engineering cycles unless it enables a higher.14:19Impact roadmap later on. These are just a guideline, you know, the ranking use cases, how you gonna, what you're gonna approach, which cases you are putting more effort 1st. Joe, so I'll have you run this slider for, for the audience here.14:36Excellent. Thank you very much Mohammed. See you've got our audience tuned up for the basics on agenda ki so far, and that's exactly what this Slido question is aimed to get feedback on. So the question here.14:56For you as an attendee is where will Agentic AI have the most impact within your organization? And I'm gonna open up the voting here and we're gonna see that we've got a couple of answers coming in.15:11Among those choices, you're gonna have IT and network ops. This is gonna include AI ops, troubleshooting, and automation. You're also gonna be able to choose customer experience, and that will include support.15:30Chat box and CX within your particular organization. Another of your, of your options is gonna be internal ops, and this will include HR, finance, and employee workflows. Now you can also choose cybersecurity.15:45This will be for threat detection and automated response. Not sure how you handle that today. And you can also choose sales and marketing. This might be a big one, and this is gonna include lead generation and personalized outreach.16:03To your customers. So if you will, review those answers, determine where Agentech AI is explained today, is probably gonna show up 1st or at least have the most impact within your particular organization. So far we've got votes coming in and we've got three of those choices being selected.16:19We see so far the most votes going to IT and network ops. So this might be internal so far. People anticipate agentic AI is gonna have a big impact internally as we understand it right now.16:39With that being said, I'm going to return it back to our wonderful presenter today, Mohammed, and I'm going to let you take it away, Mohammed. Thank you Joe. Hey, running the slido, it tells me like around 70 % we are looking into.16:56The AI agent for workflow automation and troubleshooting exactly where we point these areas, even not only in our presentation also in our demo, so it's great that we're addressing the concern here. Awesome. All right, so now we are we gonna move on to the agency one on one and some key concept that.17:15Building blocks of a single AI agent, the memory requirement stuff in nature. So here, let me move on to the next slide.17:35So an AI agent is an autonomous software entity that can generate content, make decisions and interact with the environment to complete a task, given task, right? The key differentiator is interaction with the environment using tools.17:44Api's and the ability to take action. So API is a manual like you know when you call API you have to configure and then you have to know exactly what you want and then you call the API, but in in the AI like use cases, we have like an MCP it's like it does it for you automatically calls the.18:04Tool whenever needed, make decision for you. So we'll, we'll go over in the demo and you'll exactly see what I'm talking about.18:24In networking terms, not just answering question but running checks, collecting evidence, proposing changes and validating outcomes. So the billing block of a single AI agent, we color coded the.18:31Yeah, like a different layers. If you look at these blue light light blue orchestration loop, it has planning, reasoning, reflection, and action, and based on the AI models, tool and memory.18:51So planning, typically like the cycle through four shifts like planning, it decide what to do next and in what order that's the planning phase. Speaking about reasoning.19:06Interpret the request and choose the best approach. Reflection, check progress, validate results adjust if needed. And lastly, the action, it executes, either respond or call it tools as the action it takes.19:23And then the orchestration loop is powered by three foundational underneath. Yellow, we have AI models, green we got tools and the red you got memory. So AI models it provide understanding.19:43Generations and decisions support. On the other hand, the tool which the agent interact with the system, with the API database tickets, automation, the memory, keep the context.19:59Like the session state history, and retrieve knowledge like a rag. So the key idea, the loop coordinates the model, tools and memory, reliably turn user intent into outcomes.20:14And I just covered in this slide the core building blocks of an AI single AI agent. And at the center, it's orchestration loop, the agent's brain that runs continuously is running the orchestration loop.20:34Planning reasoning reflection action. All right, so now we are moving on to our next slide. I'll quickly go over on this orchestration loop.20:51No, not the orchestration loop, the agent framework pattern, right? So let's talk about this. So we got different kind of agent framework or what you'll see in the real system, e.g., react loop, planner executor, grab based state machine, multi.21:09Agent specialist.21:29So I will let you like do more research in this area, looking at the documents, but I want to give you quick review. So the react loop is great for open ended troubleshooting and then planner executor, like you plan 1st, then execute step by step with validation.21:30Graph state machine is explicitly workflow, so best for production safety, approvals retries, fallbacks and like a testable path. And lastly, the multi agent specialists.21:50Separate agents for netops, secops, apples with coordinator. And then the takeaway from this slide, I'll tell you this. These are control patterns and.22:06Teams often combine them. Okay, so now keep diving more into the react framework. So it's a common pattern for agents that use tools instead of gasing the model loops.22:20So like here you can see the state machine here, right? So it's like a 1st here instead of casing the model loops as I mentioned, the reason why should I do next?22:38Or what should I do next? Act like call a tool like API search database automation, absorb like a read the result and repeat until the answer is clear. So in this diagram, request comes in, model decides the step, who runs.22:54Result comes back and model uses the, uses that as a new evidence. And why it works well, it collects evidence instead of relying on memory. It reduces hallucination because tools can verify.23:10Reliable information if needed. It creates a trace pool calls plus out plus output so we can troubleshoot. So operationally, we usually keep the model internal, but we show action evidence at the final answer. So the takeaway, the react is the baseline.23:28Agent group.23:47The reason act, learn from the result and convert with evidence. Alright, so I think we went a lot of information about the framework now. I know we all know familiar at this point about AI models, how to choose the right AI model.23:48I will quickly go over as well. Here you see the large language model. It could be general purpose model, could be multimodal LLM, fine tuned, and choosing the right model is very, very important.24:07In our next slide I'll talk about how to choose the right model and also like training data deployment, like is it on prem cloud or could be a hybrid actually. It's interesting to know that. And now model section playbook.24:27Here how to choose the right model for you and it's a practical playbook. There is NO best model in general. We match the model to the job based on the quality speed cost and risk. Think of it like network design. If you are familiar with the networking and design, you don't pick one.24:46Architecture for every use cases, you pick what meets the requirements and constraint.25:05So you do pick your what do you pick, right? And when you're based on the task type, latency target, context size, tool use, what is it for API database, MCP tools?25:14And the risk level and also of course cost, right? The Tokens besides GPU CPU footprint as well. So you, there's a whole different like ball game you know how to pick and choose the LLM model selection. So I just, this is just a start but you definitely recommend to.25:30Go deep dive and learn more about it.25:50Okay, now the fun part beguns. So I'm gonna be talking about the tool calling. Also, it calls like function calling as well and e.g., basically these are the same, the function calling and the tool calling but what happened.25:54And it means the model can ask for an external action in a structured way instead of just generating text.26:14And how it works in in practice, like we define tool with the name, input is really JSON, the model decide, I need a tool and output a tool request, our app execute the tool and return the result.26:23Then the model uses the result to continue and keep the final answer. So the way it matters because it connects the model to real system, e.g., APIs, database, automation, start.26:39It improves reliability because results comes from tools not casing the real data. Take away, the tool colleagues is the breach from chat to action. Again, we're gonna have a demo that will deep dive calling the tool and how to keep it.26:55It's coming after my presentation.27:16This is the concept of tool calling, and the flow would be that you should ask a natural language on the left hand side. LLM selects the correct function. E.g., in this case, get device uptime from a catch switch.27:20And then tool execute against the device/API, and lastly, the LLM summarized result in plain language. This is the foundation of the safe operational automation with AI. And then this is the one slide I want to quickly go over, but about.27:38The memory. So what happened here, the memory is the is what keeps an agent coherent across multiple steps and sessions. So two types of memory in this case, short term memory and long term memory. The short term memory, tool outputs and.27:58Intermediate result inside the current loop that short term memory. On the other hand, the long term memory, it's got a fact and learn preferences. E.g., environment conversation or conventions past incident.28:18Known good config. So these are the long term memory example and the caution here I wanna mention and say say it out loud that treat memory as a government asset.28:35About storing secrets, use retention and access control. I wear like, you know, after a few slides you're gonna have a demo, but I'm gonna I need to finish like couple of more slides for you all. So these are the interesting slides again here if you see, you know, the structured output and.28:50And how LLM actually helps to shape or or sort of output from a.29:09Like like in this case from the output from my Cisco iOS 60 software at the device and and and and so what it does, it actually structured the output turns the messy CLI.29:19Or telemetry data into typed data. In this example, parts iOS XE output into a schema such as vendor, iOS version, uptime hours etc. So the benefit would be that downstream automation becomes level easier dashboards and training analysis.29:39Support policy checks and compliance reporting. And this slide talk about like you know how the the AI network agent, like in apart from a troubleshooting. Again, this is like something where focusing the demo you know demo.29:58Well. So here, e.g., there's a problem, right? Let's say why can't the host 190-21-6802 which is the host IP address? Why can't it connect to switch port on gig one/one interface? Why? It's not connecting.30:18The admin like you know he got this question, right? He tried to figure out typically what do you do, we do our manual troubleshooting, we check the can you ping our default gateway, can you, you know, do this and that basic check interface up or down, but here like the way the AI networking agent works.30:37Is 1st of all the thought action and observation, right? And then thought action action observation and then output. Action output. So here like the step would be the action would be the generating a step by step troubleshooting guide, and then number one thought, like start with checking the port config.30:57So for that matter, it actually called the tool using tool here port config check.31:17Take the port configuration, e.g., what kind of configure the port, all the basic port configuration, and then if everything everything looks good then also next action would be, ok, port looks good. Now check the configuration, so it does the check and then find out if he's on the right vlan.31:24And then take it from there. This is one example but of course in the demo we have a really good showcasing how actually we can using the agent, how we can troubleshoot problems like that.31:44All right, so now a quick break from my end. I'm gonna pass the ball back to Joe for running our, you know, the next Slido for the the attendees here. Thank you Joe. Thanks a lot Mohammed. And for our attendees, if you would.31:57Make sure you can go ahead and use that QR code to access the Slido URL so that you can vote in our ongoing poll. Let me share that with everyone so we can look at it together. What we're gonna do is review the question here about.32:12Your current level of familiarity with agentic AI. Now the answers here are structured from top to bottom, from just learning the basics, that's the minimum level. Next you can vote to.32:29Know the concept, know and recognize the concepts surrounding AI part of today's topics in our session, but you don't have a plan yet. That's garnered the most vote so far.32:46Next, we're gonna see that you're currently testing or piloting AI in your environment. That's great news. Excellent news if that's where you're able to vote at. You'll also see that you can indicate that you're identifying business cases within your environment.33:02That is, you know, the concepts, you've got the basics down, you've done your testing and piloting and now you're looking for a great place to apply a gentic AI within your business environment. And the last one is indicating that you're fully integrated into operations.33:21And that's wonderful news. If you've already done the concepts basics, you're piloting tested and you've identified where it's gonna have a high value impact, start small but measurable, and you fully integrated AI into your operations.33:40That's where you can vote. Looks like for most folks now, we're, we're still at that you indicate you know the concept. We don't have a plan yet, but going forward slow and steady, very good. I'm sure that's gonna help our upcoming.34:00Demonstration specialist, Brian, along with some more content from Mohammed that will help guide these guys into giving you the accurate information that you're gonna need. Time wise, it looks like we're doing great. We still got about an hour of our allotted time.34:19So, prepare your questions, ask them in Webex chat or Slido if you're able to access that at this point, looks like we've got some more presentation to give to our folks, so I'm gonna turn this back over.34:38I believe to Mohammed. Okay Joe, thank you for running the Slido for all of us. Really appreciate your time on this matter, and as you mentioned we'll be diving into next couple of slide about AI agent frameworks and before we go to the demo any ten.34:55So here, the AI agent frameworks, like the big question like what the framework is suitable for your need at this point and the pick what accelerate your team without logging into any specific framework. So that I'll talk about the criteria to consider what framework available currently and what's most.35:13Look at the different framework here we have auto gen small agents and QAI, identity AI and graph. As you see on the right side, the GitHub stars, we got the most popular right now and regarding the lang chain is.35:34Actually extension of stateful graph based agent workflow.35:54And we got others like agent frameworks such as auto gen and then different framework, you know, they have a strengthened weakness, so in this case autogen creator is Microsoft and they are really good for research and enterprise scenarios.35:59On the other hand, the auto gens, they are like minimal lightweight agent framework, also it has ecosystem. It focused on simplicity plus small model and the AI.36:17It's a lightweight as well. It's mostly for role based multi agent for the teams specifically. Down below we got AI framework and it's strong for production APIs.36:33And build production great application with AI, and the lastly, you know, I already talked about it, the lengthen is most popular ecosystem for building LLM apps and agent with tools, memories, and integrations.36:49And one information I found by doing my research like the market, but are really hot right now, so you can look into it. So now the low code framework for AI, so why low code for agents?37:11So it's epic prototyping.37:31Lower barrier to entry faster iteration, cost effective, focus on logic, and this is one of the example we got for local framework for AI.37:34And the next slide here we got the example n8N sample. So any n is the open source visual workflow for automation, useful for weekly wining together and iterating on.37:58On prompts.38:18And branching logic. For production, treat it like any automation platform, road RBRAC role based access control, secrets management, logging and change control. And then for additional information about any ADN, what is the NADN, right? So.38:19It's an open source visual workflow.38:39And automation platform designed for building AI agent and autonomous with the minimal coding, minimal coding. And for additional information you can go to this GitHub page for more information about any Joe if you can, you know, copy paste this link.38:41Link to the chat for audience, I would appreciate that, please. Sure and while Joe is doing that, I'll tell you any if you go to any.io.39:01It's a website to learn more about the workflows and some additional information and any stands for node measurement. So a node based automation tool. So yeah, I don't want you don't want to be want you to be confused with the naming convention here.39:13And at with Cisco we have a local framework example which which is called Cisco workflows here and this is an example on the we got a screen copy paste on the right side, the Cisco workflow. So it's a workflow automates manual time con.39:30Assuming task across Cisco and 3rd party apps with a simple drag and drop user interface.39:50Natively located within the Cisco Meraki dashboard. For additional information, you can actually go to this website and learn more about it. Don't, don't mind copy paste this link and then paste it for the audience, I'd appreciate as well. Hey Mohammed, sorry to interrupt. Looks like the slide didn't progress.39:59Yep, this is the thanks Brian again. So this is the Cisco workflow and it talk about what is Cisco workflow and this is the example that our internal Cisco workflow tool we use and Joe is going to copy paste the link for you all to learn more about.40:16For this word cloud.40:36All right. So before we go to our demo, I wanna, hand the ball to back to our demo specialist. Brian, and he will show an any day in best flow to illustrate how quickly you can build a tool enable agent workflow. Brian over to you.40:43Great, thanks Mohammed. All right, just wanna confirm you're able to see the screen that I'm sharing? Yep, I see it there. All right. Thanks Joe. So in this particular demo, we're gonna use n8n, which is a low code orchestrator.41:03Framework. We could also use line chain, auto gen or some of the other tools that Mohammed had mentioned in the presentation. I just like this one it presents a little more visually for a demo. So what we're gonna do in this particular demo is we're gonna have a change management agent that's gonna take info.41:23Information from our change request system and then it's also gonna have an AI agent that's gonna use MCP tools to connect to our Cisco Intersight instance to grab all the log audit log entries.41:43What it's gonna do is it's gonna correlate the changes in the change request sheet against our audit log entry and then it's gonna identify any non compliant changes. So if there's any un uncompliant changes, e.g., someone deleted a policy but didn't create a change request for it. We're gonna have a second agent that's gonna be responsi.41:57Responsible for drafting up a non compliance email to that user.42:17So over on the left, those are our triggers over here, so we can have different types of triggers to kick off this particular agent. So we could have a webhook trigger, so we could have a webhook being sent to Naden which will kick off this flow. We can do it manually or in something like this particular case where we're doing the.42:22Change management agent a scheduled trigger, so which is kind of like a cron job so maybe every hour.42:42We go ahead and run this and we check the last hour of audit log entries. So the 1st thing that we're gonna do is we're gonna get the rows in our sheet, so in this one we have a very simple Google sheet that we're using as our change management system. Typically you'll have ServiceNow or some other.42:48The software as well that you could pull those change requests from. So over here we've previously defined our credentials to connect with the Google Workspace for our Google sheet underneath operations, so we're gonna get the rows from our worksheet.43:08And then the document and sheet, so the document is called change request and then inside that there's a sheet called change request where it's gonna pull each of those rows. The next thing that we're gonna do is we're gonna use this built in aggregate function. So typically with any done it's gonna treat each of those rows individually and.43:25Run through each one of those at a time. But with this aggregate function, what we're gonna do is we're just gonna combine all of those rows together and then pass that over to our agent.43:45So this works in our particular scenario, but in other scenarios, you may want to do the individual rows in the sheet. One thing that you have to keep in mind is like the context window. So if you have a million records in your change management.43:56System, then this aggregate function may not be the right way to do it. So here we have our AI agent itself, so this one's gonna be responsible for checking the changes. The 1st thing that we're gonna do is we're gonna set up our chat model. So in this case we're connecting to our open AI account and we've.44:12Previously provided the API key for that.44:31The other thing that we can do as well is select the model. So in this case we've previously defined GPT four.one mini, but if in the list if we hit the dropdown we could see other models that were available within our account. Now we'll take a look at our MCP client itself, so.44:36This is a tool that we had previously created using Python and fast MCP, so it's available on internally on our network at 192160 eight.1. 01:18 forward/MCP.44:55So what this does is, it provides a tool to the LM that we had previously defined called get audit entries. And what this will do is it'll, when the LM request to use this tool, this tool will actually go out to our inter site instance and then pull off the audit log entries back.45:10So in this case, under here we have tools to include, so we specified get_audit_entries, which is the tool that we had created. We could also have additional tools in there as well, so we could have it utilize any of those tools if needed, and we could just remove that.45:30And it would use all of the available tools. So now if we go back to our canvas over here, the next thing that we'll do is we'll take a look at the agent itself.45:47So we'll go ahead and define a prompt on, sorry. Joke, do you see it moving or is it lagging? I do for me, it's showing your screen and I and I see things moving there.46:06Okay, looks like we might have at least one person that that's not the case for. So anyone else have feedback? Chime in if you do. Yeah, it looks good.46:21Okay, thanks Mohammed. So over here we have our system prompts so what we're doing is we're just telling it that it's responsible for auditing change request using information that we pass from the change management request spreadsheet, and then if there's any changes in Intersight that aren't part of a.46:36Responding change request that it's gonna go ahead and flag those as non compliant.46:56And then down here we have a placeholder for our change request data. So let me go back to that real quick.47:04Oh over here we have a placeholder, so any uses these placeholders with curly brackets and then we're just taking.47:24With the dollar sign JSON.data to JSON string and that's from our previous request. So that was to grab all of the change request data from our Google sheet. So then the next thing that we're gonna do over here is we're actually gonna.47:44Set it up to use a structured output or a specific output format using a structured output parser. So we're doing that because each time we go ahead and rerun this, the LLM may provide us something different. So if we say go ahead and output this in JSON format, sometimes the attributes maybe.48:03It maybe status e.g. or it maybe changed status like it could change each time and that's gonna mess up the rest of our workflows. So what we want to do is require the specific output format with a structured parser. So here we have the structured parser and then under here.48:24Here what we're doing is we're just telling it to follow this format. So we have an array called changes and then under that we have each change and then a status for those change. So whether they're compliant or non compliant, and that just makes it easier in the next steps to go ahead and identify whether our changes are gonna be compliant or non compliant.48:43So over here we have an if statement that we're gonna go ahead and configure and then this will define what we're gonna be doing with those different change requests. So if the change request is compliant or not compliant, then we're gonna take different paths. So I'll go ahead and open this one up.49:08And then over here again, we're just doing a placeholder where we take the information from the previous output, and then we're looking for item.status and then whether it's non compliant is true. So if it evaluates to true, we're gonna take that one path. If we're not gonna if it's not evaluating to true, then we're.49:27I'm gonna take a different path.49:47So down here we have the two different paths. The 1st one is if it evaluates the false, we're gonna, NO operation do nothing, so that means that all of our changes that we saw in the inter site audit log have a corresponding change management request. So that's good.49:51If it evaluates too true, what we're gonna do is we're gonna have actually go through and have this second AI agent draft a non compliance email for us. So we'll go ahead and open this one up over here and what we're gonna do is.50:09We're just gonna define a similar system prompt or user prompt for this one just saying that it's responsible for ensuring changes in Cisco Intersight have a corresponding change management request.50:28And then we're gonna pass it the below JSON items with the status of non compliant that don't have the corresponding change management request. And then what we'll do is we'll tell it to draft up an email in a certain format for us.50:40So what we'll do is we'll have an email with the details, the remediation steps. If it was a delete action and we know what was deleted or modified, we could take information from the audit log and show the user how to recreate those.50:55And then we're just passing an additional instructions like don't include a subject line or any signature placeholders because we're gonna provide those in the next steps. And then at the bottom we have another placeholder, so this goes back to our agent and then the change request and then their status, whether they're compliant or non compliant.51:15So over here, what we're gonna do is now we're gonna send a message, so this was just drag and drop from N eight den. This was built into n8n. So we're just providing our credentials. We're sending a gmail message, we specify the two addresses, in this case had specified my lab account. You can also use a.51:39Placeholder in there so you could look at like the email address that you extracted from the audit log for the change and you could potentially put that in there.51:59You can put a subject line in here as well, so non compliant change is detected. And then what we're gonna do is the message is just gonna be from our second agent with the message body in there with the non compliant change. And then over.52:08Here, so this is just a generic placeholder, so it this one's not actually doing anything in this particular demo, but what we could do is we could have like a human loop action here so maybe the person responded back with go ahead and revert the change.52:27Then we could have an approval process here or maybe they said go ahead and create a change management request for me. They responded back with that. We could potentially have it go ahead and create a new change request in our system. So now what we'll do is we'll go ahead and run this.52:41But before we run this, we'll just take a look at our change request sheet over here. So here's our sheet, very simple, we have, three change requests, we have the title for those and then the description and then whether they've been approved or rejected. So in this case, all three changes have been approved. All three of these changes.53:01Have occurred in our environment, so when we run this, it shouldn't return anything, so it should see everything as compliant.53:21So we'll go ahead and run this manually, and we can see that it's running through. And then once it finishes running in the bottom, what we can do is we can go ahead and we can take a look at the different steps in the workflow and the output on there.53:31So here we can see the rows from our sheet, so we can see it was able to get all of that information from our change management sheet. So we have our three change requests. Here we have the 1st AI agent itself. And then what we can do is we can take a look at the prompts and then the substitutions within the prompt.53:50So we can see it has our original prompt and then it substituted in the change request information from our sheet.54:10Here we have our MCP client, so this is actually reaching out to our MCP server, which is then reaching out to Intersight and pulling audit log entry and returning that back. So we can see that it did return back a couple of different audit log entries from Intersight.54:18And then here, what we're doing is it's the final correlation between the rows in our change management sheet and then the audit log entries, and then we're adding that to our structured output parser. So here we can see the different audit log entries in inner site and then the status, whether they're compliant, they have something in our change management.54:36Request sheet or non compliant. So in this case, they're all compliant, which resulted in NO operation do nothing.54:57With the if statement. So now we'll go ahead and we'll just run this with a rejected change just to see what that looks like.55:06Oh then here if we execute the workflow again, so it'll go through analyze those changes versus the audit log entries and then it should flag it as a non compliant change, which will have it go to our second agent.55:26Which is responsible for drafting up those non compliance emails along with remediation steps.55:46So we can see that looks like it was successful. It went through that path and it sent a message, so then if we go over to our gmail, and refresh this. So now we have non compliant changes detected.55:55And if we drill down into there, we'll have the details of our change. So here we can see that it detected that somebody had deleted the ABC 123 policy at a specific date and time, and then it provides information on remediating this particular issue. So either submitting a change management request for the deletion.56:14An event or if the deletion was performed in error or needs to be reverse reversed, we have information from the audit log to help reconstruct that. So in this case, that particular policy was consistent of two NTP servers, 1234, and 7891. So if we wanted to, we could recre.56:34Create that policy by making a post to that particular endpoint.56:54And then with that, I'll go ahead and I'll pass it back over to Mohammed and then and the next demo we'll look at the MCP server in more detail itself. All right, alright Brian. Thank you so much for walking us through any and demonstrate.57:03Thinking how we can use in practice, really appreciate it.57:23Let me take over as a, as a presenter control. Okay, so we'll be talking about MCP model context protocol. We have a couple of slides to share with you all before we dive into the demo.57:29So I'll focus I'll mainly focus on the concept and with the example and how the architecture works. And the quick clarification here, let me go like.57:44The next page, before I go to next page, I'll tell you one thing really quickly what the problem it addresses, like every LLM or tool integration being a customer standardized our models and clients talk to tools. So integration becomes reusable.58:00And the API calls like if you think say hey what is the difference between API calls and MCP, right? So API calls are hard coded instruction While MCP lets AI choose, let AI choose like not the human in this case, let AI choose.58:21And used tools dynamically like a smart assistant. With APIs, you tell the system how to do it step by step manually, but with MCP, you tell the AI what you want, what your intents are, what's your intents, and AI figures out the.58:38The process how.58:58So let me go to the next slide. So, ok, this is actually a very interesting page. I'm sure you all can see it. So I'm gonna showcase like the difference between LLM rack and MCP and that will actually tell you exactly how MCP comes into this picture in this agent AI workflow. So e.g..59:01If you look at the LLM limitation, right? E.g., you ask any LLM, let's say as a user, so you're asking as a network admin, check if OSPF is properly configured on router R one interface, right? And then if you ask this question, the LLM like, ok, I cannot directly access your.59:20Networking device.59:40You would need to SSH into the router, run in this case show IP OSPF neighbor, you get the local and remote neighbor information, and also you can find deep dive next command like show IP OSPF database, which will provide you the database information for the.59:41OSPF like different type of lss and stuff in nature.01:00:01So once you grab manually this information, you just copy paste in the interface and then you let the LLM the LLM to provide the analyzer report and what to do next. So, but it's not giving you the question you asked, right?01:00:05The list limitation of LLM, but next if you think about the in this case you, same question you're asking check if OSPP is properly configured on router out of one, the rack system like I can search through your network documentation, Cisco documentation documentation e.g..01:00:24And previous configuration sample configuration files you have provided, but I cannot verify the current live configuration.01:00:44I can only show you the intended OSPF setup from index documentation, right? But does it answer your question? Answer is NO. With NCP, how it solves the problem, you should ask the same question, check if OSPF is properly configured on router R one. And the MCP enables it.01:00:53What he does.01:01:14It actually connect to the router via SSH, and the OSPF is running, it figures out. Also it knows it has two issues. Number one router R one has NO OSPF neighbor in the area zero, and the LSA database shows missing type one.01:01:15Lss like linked state advertisement, right?01:01:35So yeah, so the interface gig zero one is in the wrong area it figures out. So now we see how MCP helping us to really solving problems from a live system. So that's actually the example, the big picture where how we can use MCP in our.01:01:40So now we're gonna deep dive into some more on the concept about MCP. You all can see here MCP is not an AI agent. It's not an assistant.01:02:01It's not a LLM either. It's a protocol. It's just like the standard way for an agent to talk to the tools. If you are from networking background, think of it like a GCP or UDP, like transport protocol or EDP.01:02:15So it defines how messages are actions, right? Not what the system thinks. So the agents and the LLM are on one side, tools are on the other side and MCP is the bridge between them.01:02:30The takeaway from this slide, MCP does not provide intelligent, it provides connectivity and standardization. And this is an interesting slide as well. So the evolution of MCP.01:02:45And, without MCP, every LLM, like, calling every tools, so like N times M integration is expensive. And with the other hand, with MCP.01:03:03It's an N plus A model or integrations. A tool exposes an MCP server, client speak to the MCP server directly, and then the MCP server, call the right tools needed for the job done. So think MCP server as a gateway or translator that normalize.01:03:19APIs and can enforce security policies.01:03:39And how MCP works is like the USB C for AI agent. I'm looking at the slide MCP client example like cloud desktop, Cisco AI agent, cursor, these are the MCP client.01:03:50E.g., and this is a software agent that integration with integration to LLM models, it orchestrate conversation flow, initiate connections to MCP server, it handles user request and responses. Using MCP protocol, it connects to the.01:04:06This MCP server. MCP server what it does, it connects to the tools and functions as he spoke before.01:04:25Act like a translator between the tools and the client and MCB server can act as a secure gateway. It could be local or remote HTTP. And this is an, this is an example I wanted to give you like we, if we use the Webex.01:04:33So e.g., in this case, before I have pass the ball back to Brian for the demonstration, I wanna just give you a quick example.01:04:52Here, e.g., the admin, right, the virtual chat bot assistant, the prompt is like usual prompting like why Webex is so slow right now. And the workflow, the way it works.01:05:03So the agent determines what tools are needed. With MCP MCP protocol, it connects to Cisco MCP server. And then from Cisco MCP server, we got, Webex.01:05:18Thousandeyes plan. So the pro to the Webex, the API call to the Webex to pull contextual data, API call to thousandeyes to get telemetry information.01:05:35Also from the MCP server, there's API call to Splunk to pull network data and other relevant log. In this case, the MCP makes the multitual workflow.01:05:50Cleaner and more consistent, and the agent returns a single narrative with evidence and next actions. And then it returns back to the answer back to the user with the root cause.01:06:05Okay, so now it's time for the demo again. I'm gonna pass the ball back to our demo specialist Brian for building MCP server. Brian, take it away. Over to you.01:06:23Hey, thanks Mohammed, can you see the screen? Yeah, I'm seeing it. Okay, thanks Joe. So in this particular demo, previously in the original, the 1st demo what we had was we had n. And we had our agent calling tools which called Cisco intersight. So in this one we're basically gonna show you how to easily create a.01:06:38A MCP server that's gonna talk to, in this case we're gonna do a Nexus switch. You can build it with a thing called fast MCP. The other option too is a lot of these have already been created by other people, so like if you go on to our Cisco devnet GitHub repositories.01:06:58Or I think for like Splunk and some other ones, if you go to Splunk base, there's also MCP servers that people have already built and certified, but in the case that they haven't, this is one thing that you can easily do with building an MCP server.01:07:18So the 1st thing that we're gonna take a look at is our Python code itself. So here we just have some normal Python imports, but down here is what we're gonna do is we're gonna import this fast MCP module, which makes it a little bit easier to create that MCP server. And if you're not that familiar with Python.01:07:35Python has modules and they have, you can install them with tools like pip or UV and they're also placed in a file called requirements.text, so like if this particular.01:07:54MCP server required fast MCP version two.o e.g., I could put that in my requirements.text file. The next piece that we're actually doing is we're actually gonna use netmiko. So Netmiko is another Python module and what that's gonna do is gonna handle the connection from.01:08:07Our Nexus or from our MCP server to our Nexus switch. So that'll handle the connections and then the commands.01:08:27Down here what we have is load.env. So what this is gonna do is gonna load environment variables from our command line. So instead of hard coding credentials and IP addresses in our code, we're gonna use a vault or some other tool to populate these environment variables, and then we're just gonna load those up. So it'll have.01:08:37Our NXOS IP address and then username password and some other things as well.01:08:57Further down what we're gonna do is we're gonna initialize our fast MCP server itself, so where it says initialize fast MCP server, we're gonna actually name this MXOS space switch, and what that's gonna do is just set up the MCP server itself.01:09:06And then below that we have our netmiko call, so this is a run show command blocking and then it's gonna accept the device payload and then the command. So this will basically handle the communication between our MCP server if we wanted to run like show IP interface brief and then our Nexus switch.01:09:25And then return that output back to our MCP server, which is gonna return it back to the requesting LM or client.01:09:45Down here we have our MCP tool itself. So here we have the MCP decorator that fast MCP uses to denote this as a tool. And then below that we have our tool name, which is gonna be mXOS_show, and then it's gonna be accepting a string for instance, show version, e.g..01:09:55And then below that we have the details of what this tool does. So this is actually used by the LLM. So in this case, it's gonna return, ok, return a show command on a Cisco NXOS switch. And then here we have the arguments that this particular tool is expecting. So a full NXOS show commands.01:10:15Execute e.g., show IP interface brief. So this gives our LM context or our agent context on what tools are available and what their purpose is.01:10:35Further down below, what we're gonna do is we're gonna use the get environments. So what we're gonna do is we're gonna get our nexus host, our usernames passwords and port numbers. So those are environment variables that we had previously set up, and we're just gonna read those into.01:10:49Strings.01:11:09And then below that, what we're gonna do is we're gonna use this device payload, so we're just substituting information in from our environment variables into this JSON payload, and this JSON payload is used by netmiko to decide which Nexus switch to talk to and how to authenticate to that particular switch.01:11:14And then right below that is what we're gonna do is we're gonna actually run this command, so if the LM sends us, maybe it wants to run show IP interface brief and then it'll go ahead and run this command on our NXOS device and then return that back to our agent or LLM.01:11:36And then down at the bottom, so this is actually starting up the fast MCP server itself. So what we're doing is we're defining the transport type, which is HTTP, the host, which is it's gonna listen on all available interfaces on this machine on port 8080.01:12:02One other thing to keep into consideration too is this one right here is just a demo but in like if you were gonna use this in like a production environment, FASTMCP does have authentication mechanisms that could be set up with OAuth and other things so that it's.01:12:22Requires authentication to be able to send those show commands or whatever your MCP server's doing to that NXOS switch. So we'll go ahead and start this up so down here we can see our fast MCP.01:12:37Server is running and then we have our server name that we had defined, so this is just called NXOS switch.01:12:57And then below that we can see that it's listening on all interfaces on port 8080 forward/MCP. So the next thing that we want to do is we just want to kind of test out this MCP server that we've created, so we've created in less than.01:13:0455 lines of code. So what we want to do is use the chat built into VS code to test it out. So within VS code itself, they have an mCP.JSON configuration file which is used to.01:13:21By the chat to determine which MCP servers are available and their tools. So this will vary by the different things. So like cursor will have different settings. Cloud code may have different settings to add an MCP server, so whatever you're using, you just follow those instructions. But in this case, this one's specific to VS code.01:13:38And we're just telling it that, ok, we have an MCP server running on local host 8080 forward/MCP. So what we can do is we'll go ahead and start that up and then what it'll do is it'll query the tools that are available, just make sure that it's.01:13:57Able to get connectivity and that it's these tools that are published.01:14:17And we'll go ahead and open up the chat window and in the bottom, what we'll do is 1st we'll set it to a new chat, but then we'll go and we'll make sure it's in agent mode and that our tools are available. So here we have agent mode.01:14:21And then under the configure tools, what we'll do is we'll just confirm our MCP servers available. So we'll remove pilots, but this one over here, we have our my MCP server and then we see our tools, so nxo nXOS_show.01:14:37And then over here, we have the information on the details of that particular tool. So we can see that it runs a show command on an XOS switch and then the arguments as well. So what we'll do is now we're gonna just go ahead and test this out with a really brief example.01:14:54So we'll just ask it a simple question like are there any NTP servers configured on my switch?01:15:14And then here it's gonna think about it. It knows that it doesn't have any information in its model about my NTP servers on my switch, but it does know that it has a tool available to call, to make show commands on my switch. So here it's just prompting us to do that. So it says, ok, I need to run a show command.01:15:26On the switch and I'm gonna go ahead and run show NCP.01:15:46So what we'll do is we'll just go ahead and allow that to go through, and then we see that it's running, it wasn't able to get the information that it wanted. So what it's doing is just reiterating on its thought process and it says ok well now I need to run show NTP.01:15:51Peers to answer this question. So we'll go ahead and allow this and then here it got some information but now it wants to run show running config NCP to fully answer our question, so we'll go ahead and allow that to go through.01:16:11And then here we get the final answer. So NO, there's NO NTP servers currently configured on the switch and then the running config has NO NTP settings. So this is an accurate response based on information it grabbed from the tool, but let's go ahead and let's test it one more time, but we'll give it a more complex example.01:16:34So in this case we have a server and what we're gonna try to do is ping its default gateway. But in this case the default gateway is not pingable. So what we'll do is we'll see if it has the tools needed to troubleshoot this. So.01:16:55Here we'll just check the interfaces and grab the MAC address of the interface in question. So in this case it ends with 1104 as the Mac address ending of the MAC address. And what we'll do is we'll add in a more detailed prompt here.01:17:10So what we're gonna do is we're gonna tell it that users are reporting issues with connectivity on a host with this Mac address communicating with the rest of the network in the past day. And then below that what we're doing is we're just providing an additional contact. So here's Cisco networking engineer. If you need to determine Mac history.01:17:31Three you can use the following commands and we kind of gave it a couple of hints.01:17:52Now this may or may not be necessary depending on the LM that's being used. So in this case I think we're using GPT four but if you're using like a newer one like Opus four.six, it may have this information available or if you had a model that was fine tuned just on network troubleshooting commands then.01:17:56It would most likely have this as well.01:18:16And then we're just providing it some additional instructions as well. So if the issue was the result of a change by someone on the switch to provide details from the show accounting log. So we'll go ahead and send that over and then.01:18:20We'll see here it needs to run a bunch of different commands so it doesn't have what it needs inside like the model itself to make these decisions, so it needs to call our MCP server and our MCP tool, and it decides that it to start with, it's gonna run these couple commands. So typical like L one troubleshooting, show Mac address table and then the Mac address.01:18:36Question. So we'll go ahead and allow that and then some additional commands as well. So like the show system internal L two FM L two debug commands, so this will provide the Mac address history.01:18:56And then the show accounting log. So here it's getting all that information back from our switch and then analyzing the results right.01:19:12So here it provides some recommendations, so check the interface where the MAC address is being learned, verify the link status, the host is.01:19:32Disconnecting and reconnecting repeatedly and then it asks do you does it want us to run some additional checks? It will say yes and what it'll do is it'll go ahead and run some additional commands. So here it wants to look at show interface status and then show VLAN ID as well as the interface index.01:19:41And then down here, it looks like it found it so Ethernet one five is disabled, that's the interface in VLAN 2300 where the host is connected, and now it wants to run some accounting log commands to determine why that may have happened. So here it didn't get anything so just reiterating on it with different greps and inclu.01:20:03Ludes to see if it can find the root cause.01:20:23Right, and then here it wants to just include all shutdown commands now it wants to look at the running config, so just iterating on the results of the previous commands. And then here we have the final answer. So looks like.01:20:30This particular host, the last change was made on 3 March at 2114, and then it looks like someone may have intentionally shut down ethernet E15 around that particular time and then to restore connectivity, check who made the change and then undo that.01:20:49So if we go back over to our leaf, and we go over to that interface and we do a NO shut on it, and if we try to ping, if this was correct, then we should be able to ping our default gateway.01:21:08So in this case it identified the root cause of our issue. So it looks like that particular port connected to that particular host was disabled. Once we re re enabled it, we were able to ping our gateway. So it looks like this particular MCP server is good. So what we could do is now we could go ahead and we could integrate that into like the.01:21:25Previous demos with Naden Or chain or line graph or auto gen or some other tool that's needed.01:21:45And that concludes this particular demo. I'll pass it back to Joe and Mohammed. Excellent, great. Thank you very much, Brian. That was a thorough demo. I'm going to advance the slides here, see where we are.01:21:53I believe that maybe our final one. Mohammed, anything else you had to present? Or you good? I think I'm good at this point. Thank you so much. Ron while I get to work on sharing my screen here for our attendees before we close.01:22:11There was an outstanding question about where they can find a Cisco provided MCP server, perhaps devnet. Yeah, I think it depends on the specific product. So I think on.01:22:29Google, e.g., I think there's one for Splunk. Splunk Base has one and then I think there's some for various products floating around and we can send some examples. Excellent, great. Yeah, anything we have, we can.01:22:46Throw in the Webex chat for our attendees. Before we go, do another quick check of any questions in Slido. I don't see any. We do have a participation survey there for all of our attendees in Slido if you're able to access that. Please go in and add comments, questions.01:23:01Teams provider rating for us. It's a great place for us to get feedback.01:23:21And as we started out with, there is an upcoming Q and A session that we are going to be hosting coming up on the 8th, should be able to see that on my screen now.01:23:27It's gonna be 10:00 A.M. just like central time there and there's a QR code if you want to scan that, screenshot it, capture that QR code. That should take you to a link where you can see all of the previous sessions, including today's.01:23:43As well as where the quick recap in live Q and A info is going to be stored. So with that, let me do another quick check of our chat in regular Webex.01:24:02Make sure all of the questions there got answered, see one from Keith, looks like there was a reply in an agreement, if there's anything in chat, the.01:24:20Participants here, today's session want to post for our attendees, please do so now I'm not seeing much else. Thank you for all who participated in voting in the events earlier, as far as where you were joining from, what.01:24:42Level of agentic AI.01:25:02You have in your current environment, see a couple of votes coming in from our participation survey. Thank you very much, helps us gauge our activity. That will remain open for the next few minutes.01:25:04So while I'm not seeing any more questions outstanding here, unless a panelists breaks in and tells me there are, I'm gonna say we probably pretty much concluded today's session. I hope the information provided was helpful to you. I know we had a very.01:25:22Thorough presentation from Mohammed, an excellent demonstration from Brian. Thank you very much guys, and that will conclude it for today's expert insights series. This has been a Gentech AI from automation to autonomous networks.01:25:38