Catalyst Center Device Onboarding

Welcome everyone to another expert insight series that we have for today. It's catalyst center device onboarding, very crucial one when it comes to the automation.00:10Quickly, I'll introduce today's presenters. Our experts Akshay Tavan and will take you through this session. Akshay is a customer success specialist on Cisco Enterprise Networking in APJC region. He is CCNP wireless certified.00:20Actually has overall experience of ten years in enterprise networking. In his past years, he was working as network analyst and as a project implementation engineer for several customers in health, education, enterprise, banking, and government sector.00:37His current technical focus is on Cisco Catalyst Center, software Defined Access, Cisco Meraki and Cisco Spaces. Lasa is also a customer success specialist. She is focused on enterprise networking with the specialization in Catalyst Center.00:55She is also Cisco certified devnet Associate and Network Associate with extensive knowledge and experience with programmability and automation of Cisco's product. Some housekeeping rules here quickly.01:12All microphones have been muted for all participants and you are locked out for comfort of all. You may see a Slido button. Try to use it for Q and A If not, you can put in the question in the chat, but we highly prefer.01:27You putting the question in Q and A so that we won't miss it. The closed captions are available in the bottom left corner of your screen. Please do use it to reach out to please please do use it. You can raise your hand if you face any issue.01:43During this webinar and I'll reach out to you back. The session is recorded, it is transcribed and summarized. All contents are posted on our Cisco community site that we that link we will post. So today's session as well as the previous.02:01OI sessions are recorded there. And do, do let us know your feedback post this session, post this webinar, you will have a brief survey link that will be sent from our side. Do let us know if there are any other topics that you want to cover.02:20Before we start, let's dive into the talk of the town, which is Cisco IQ. If you haven't heard about it, this is a great opportunity to start because today's never let. If you have already heard about it.02:40Check if your network team knows about it or have started working about it or not. So, just quick few things about the Cisco IQ we will discuss. So this is like a short trailer that we, that we have for you, but you can dig in into.02:57More. So what is Cisco IQ? It's basically a platform where all the knowledge from your infrastructure of the Cisco portfolio will come and aggregate to give you understandable insights.03:17So as you manage your network infrastructure, you are generating massive amount of data every single day. But this data is not enough, you need some intelligence into it. So that is exactly where the Cisco IQ will come in. This is our dedicated digital hub. It's specifically designed to turn your.03:32The network.03:52Data into clear and actionable insights. Now you can think about, think about it as a personalized advisor for the Cisco portfolio that you have, Cisco environment. Instead of guessing where to optimize, the Cisco IQ will provide you the roadmap, it will help you benchmark your current performance.03:53Identify specific optimization opportunity in your network and then apply the industry proven best practices. This is everything all in one centralized dashboard.04:14Whether you're looking to improve the network stability, you want to reduce some operational friction that you have within multiple teams or multiple domains like network security and everything. Or you want to simply get some more value from your existing investments that you have done in Cisco portfolio.04:26The Cisco IQ will help you to bridge that gap, between that, just having the technology purchased and mastering it or optimizing it for yourself.04:45So this is really a great tool. We all are using it and advising it for customer. So hope you take a look at it. Now, here I'll hand it over to Akshay. Akshay, I'll stop sharing my screen over to you.04:55Yeah thanks for that quick introduction and a quick glimpse of what Cisco IQ is, right? Just just confirm if you are able to see my screen with the presentation. Yes.05:13Great. Good morning, good afternoon everyone from wherever you guys are joining. Thank you for joining. A quick agenda as to what we are going to cover today. So we'll start off with a quick introduction of catalyst centers, NetOps journey map. We'll look into the prerequisites on how.05:30How to onboard and what are the processes that you need to follow before onboarding your devices onto the catalyst center. And then finally, we'll look at a couple of methods through which you can onboard your devices onto the catalyst center, including the green field and the brownfield versions both. Yep.05:49So quickly jumping, before we jump into the actual onboarding process, I want everyone to to look at this slide as a bigger picture, right? So when we talk about catalyst center, device onboarding is really just the beginning.06:08Okay, think about your network life cycle. So day zero is where we bring the device into the environment and then day one is where we configure and provision in it and then comes day end where the real operational work begins. So we start with plug and play.06:24Or discovery, bring the devices into the inventory, we'll talk about it in our in our next slides or upcoming sections of this session as well. We build our network hierarchy, get configuration visibility, provision services, manage software, monitor compliance, detect configuration, right? So there are multiple objects to it.06:42Now this is an important mindset shift as well. Catalyst Center is not simply a tool that tells you yes, your switches exists. The real value starts after the switch exists in the inventory because once the device is onboarded correctly.07:01We can start building automation, assurance, life cycle management and operational visibility around it. So as we go through today's session, keep this journey in mind as well. We are going to start at the very beginning, how do I get this device into the catalyst center and then we'll see what needs to happen around it to make the onboarding successful.07:19This window.07:39Now, before we onboard anything, there is one very basic question that we need to answer, right? Does catalyst center actually support this device, right? So and and I know this sounds obvious, but this one, this is one of the things that can save you a lot of troubleshooting time later for current catalyst center platforms or catalyst.07:40Platforms. Catalyst Center provides supported functionality across the platform itself. But then we also have legacy devices and this is where we need to be careful. Catalyst center provides limited support for a number of legacy devices using device profiles, but limited support does not mean exactly the same functionality.08:01That you get with a fully supported device. So if someone says my old switch is Cisco, therefore catalyst center should manage everything on it, that's not necessarily true. The 1st thing I would recommend is, go and check the catalyst center compatibility matrix. Don't discover 1st and and in.08:21And investigate later. Check 1st, then design the onboarding approach and.08:40A quick question to everyone here is if you have say a 9300 catalyst switch and an old catalyst 2960 sitting in the same network, would you expect both devices to provide exactly the same catalyst center functionality?08:46So the answer is NO, and understanding that distinction is extremely important when planning brownfield onboarding processes, yeah? I just saw a message if you guys have any questions, please do put them in the slido or in the chat section and one of our panelists.09:03This will definitely, respond, yeah?09:23Now, let's go on. Catalyst center essentially categorizes devices based on the level of support available. Supported means the device profile has been tested for catalyst center applications. Limited means you have a defined subset of functionality, things like discovery.09:27The inventory topology, reachability, configuration ordered and certain software or template capabilities.09:47Then we have, 3rd party as well, right? So, e.g., you might have an HP or a Palo Alto device in the environment. Catalyst Center can provide visibility into things like inventory, uptime layer three reachability or interface status, and some basic assurance information, but.09:55And, and this is the important part. We shouldn't confuse visibility with full management.10:15And finally, we have unsupported so if a device isn't in the relevant compatibility matrix, whatever functionality you try is essentially best effort, right? So my recommendation is very simple. Don't start with, can I onboard it? Start with what level of functionality do I expect after onboard?10:20Thing, and is that functionality supported for this device? That small change in thinking prevents a lot of surprise later.10:40Now, we'll quickly now that we we kind of understand device support, let's let's move into the actual onboarding process and this is where I want to make one point very clear. Most onboarding problems are not really onboarding problems. They are prerequisite problems, right? The device maybe perfectly held.10:48The catalyst center maybe perfectly healthy, but if the credentials are wrong, if, if.11:07The the connectivity isn't available or the required protocols aren't configured. The onboarding workflow is going to fail. So before we click or check into discovery discover, we need to make sure both sides are ready, right? We need the network hierarchy and design in the catalyst center.11:14To be to be available. We need our network settings, we need our credentials, we need telemetry requirements, and most importantly, we need the network device itself to be prepared. So think of onboarding like a handshake, so catalyst center is said is is kind of saying that I am ready to manage you. The device needs to respond. Yes. And.11:34Here are the credentials and protocols you are allowed to use. So if either side isn't ready, the handshake doesn't happen, right? Now, yeah. Now let's let's again talk about one of the most important concepts in catalyst center, which is the site hierarchy.11:53Now, a lot of people initially look at the site hierarchy as simply a way to organized devices, but it is actually much more than that. The site hierarchy becomes a framework for applying configuration and operational intent. So we can structure our our environment into areas, buildings and floors, and once the.12:11Device is associated with the site, that site can provide the context for network settings and other configurations. So, imagine you have 50 branches, right? So you don't want to individually configure every device with the same DNS server at NTP servers syslog settings or other network parameters.12:31Instead you would define the appropriate settings at the right level of the hierarchy. Then the devices inherited, inherit those properties, right? So that's where catalyst center starts moving us away from device by device administration towards intent based operations, right? So here's another question, right? So if I have.12:51If I if I add hundred switches across 20 branches, do I really want to configure every switch independently? Probably NO.13:11Right, so I want the, the, the site hierarchy to do some of that heavy lifting for me. Yep. Moving on, now, now let's connect the previous slide to what actually happens operationally, right?13:20So when we assign a device to a site, the site isn't just a label attached to the device, right? So the device can inherit the properties and settings associated with that site. So e.g., there are telemetry settings that can be pushed based on the site configuration. The site assignment can happen during.13:36Or it can be part of a larger provisioning workflow as well. And importantly, the management interface through which the device was discovered is used as a source interface for telemetry.13:56Another useful, capability here is the configuration preview, right? So before pushing changes, you can review what catalyst center intends to send and depending on your workflow, route that for approval through the ITSM or the ISM teams, right? So this gives us an important.14:08Operational model. Design 1st, assign context, then provision. So instead of saying let's push something to the switch and see what happens, we're saying the switch belongs to this particular site and therefore these are the policies and settings that should receive. That's a, that's a much more scalable way of upgrading.14:27Yeah. Now, designing network settings and device credentials, right? So when we let's let's talk about credentials here, right? So the, the part that looks simple until it isn't right now.14:47At the system level, we configure our CLI and SNMP credentials. Then we can assign those credentials globally or to specific sites, but there is an important distinction here between local credentials and AAA credentials.15:03If you're using local credentials, Catalyst Center can push those credentials to the device and update the inventory. But if you're pushing triple AAA, we need to make sure the credentials we are providing to Catalyst Center actually match what the AAA infrastructure expects.15:19And here's a very practical point as well. So if you're rotating passwords, don't randomly change the password in catalyst center 1st and then wonder why everything broke. The recommended sequence is to update the AAA server or service account 1st.15:38And then use the apply credential workflow in catalyst center. So in other words, credential management is part of the design, not something we troubleshoot after onboarding fails, right? So and I'm sure everyone has seen at least one network where the documentation says one password, the device has another password.15:56But AAA server has a 3rd version on itself, right? So that's exactly the situation we want to avoid.16:16Right? Moving on, next we have our server related network settings. So this again is another area where planning before onboarding makes life much easier. Why? Because these settings maybe required during site assignment or provisioning workflows, so if you.16:23If if if you know that your environment requires specific services, configure those network settings ahead of time. Okay, the idea is very simple. Don't wait until you're halfway through provisioning a thousand devices to realize that your NTP or your DNS or any of the other.16:45The server settings were never designed into the workflow. So catalyst center works best when the design is already defined, right? So I I like to think about it in this way that if the design is correct.17:05Provisioning becomes execution, not improvisation, ok? Now, now he come to telemetry and telemetry is absolutely a very critic is absolutely the most critical part because onboarding a device is only half the story.17:18Okay, if catalyst center knows the device exists but doesn't receive the right operational data, we've basically created an inventory database, not an assurance platform, right? So we need to think about the telemetry sources and collectors.17:35We're talking about things like your SNMP syslog, netflow, along with streaming telemetry and other mechanisms depending on the platform and the use case. There's also an important brownfield consideration here for brownfield devices.17:52The recommendation shown here is to keep wired endpoint data collection disabled to avoid overwriting existing IPDDT policies. So that's a very great example of why we shouldn't blindly push configurations into an existing production network. Brownfield means the network.18:10Already has history, right? Now there are existing configurations, policies and dependencies, so our goal should be onboarding intelligently.18:29Understand what already exists and then introduce the catalyst center configuration in a controlled manner. Great. Again, if you guys are having any questions, please put them in the chat section.18:39Now another quick, quick question that I have for you guys is, what is the point of onboarding a device if catalyst center can't tell us what's happening on the device, right? So exactly that is where telemetry is what kind of turns inventory into operational visibility.18:56Now with telemetry catalyst center can provide visibility into, network and client health, application health, triple AAA DHCP, and DNS services wireless readiness, PoE, EOX as an end of end of support, inventory.19:12The Insights and network trends. And notice something very important here. We're not talking about just device health, we're talking about the relationship between the infrastructure and the services running over that infrastructure. So e.g., if a user says the network is slow.19:32We don't want a troubleshooting method methodology to be, let's SSH into the switch and start typing commands. We want to ask, is the client healthy? Is the network healthy? Is the application healthy? Is there a service issue? Is there an RF problem, right? Is there a device issue? So that's the operational shift telemetry in it.19:48The device stops being is an isolated box and becomes part of an observable network.20:08Right? Now, the next question that you might have is how do we do this, right? So, we understand why telemetry is important, but how does it actually get configured? There are two primary points shown here. Telemetry can be configured as a part of the.20:14It's probably, workflow itself so or or it can be configured during site assignment.20:34So, this is this is important because it, it gives us the flexibility depending on our onboarding model. So e.g., if you're doing a brownfield deployment and discovering existing infrastructure, we may use the discovery workflow.20:43If you're building a more structured provisioning model, telemetry can become part of the site based configuration workflow. So again, the important principle is telemetry shouldn't be an afterthought. It should be a part of the onboarding design itself.20:58Right. Now, another common concern that that we see a lot of customers having and and honestly it's a fair concern as well. Someone may say that, wait a minute, I'm onboarding a production switch. Are you telling me catalyst center is going to start pushing configuration automatically? The good news.21:17This is that device controllability can be disabled.21:37And, and, it is enabled by default, but you have control over this behavior. And this is particularly useful when you're onboarding your brownfield environments where you want visibility 1st and configuration changes later. So you can onboard the device, get into the inventory.21:39And then push the telemetry settings later. So telemetry can also be customized at site level under your design network settings and telemetry section or you can just update the telemetry from the inventory workflow itself and by by selecting.22:00In the specific device and going through the actions and telemetry functionality. So this gives us an important operational choice. We don't always have to go from device discovered straight to full configuration control. We can take a staged approach, visibility 1st confidence, second, automation part, right? And, and for production.22:18Environments that can be very sensible adoption strategy. Yep.22:38Now, let's look at credentials from another angle, right? So catalyst center has global device credentials and by default SNMP polling is performed at a 10 min interval. That interval can be modified under the data platform and collector section.22:45And and one useful point here is, the changing this polling interval doesn't itself cause a configuration change on the network devices. So if someone asks if, if I change the polling interval, am I pushing configuration to all my switches? The answer is NO. We're talking about how catalyst center collect.23:03X information and this is a good operational distinction to remember that configuration pushed to a device and information collected from a device are two different things.23:23Okay, so under understanding that behavior helps when you're troubleshooting catalyst center behavior itself, yeah? Okay, now let's bring several of these concepts together.23:33Right, so the site is really going to be the focal point in catalyst center. We create a site hierarchy, we map profiles and network settings to those sites. We associate devices with those sites, and then those devices inherit the properties associated with that site. So this is where the architecture starts becoming scalable.23:49Imagine your, you're managing hundreds of hundreds of thousands of devices.24:09If every configuration is device specific, your operational model becomes very difficult to maintain. But if your network settings and intent are associated with the appropriate site site structure, you can standardize the environment. So the model becomes site.24:14Profile, network settings, devices, provisioning, and that is much easier to scale than device one, configure manually, device two configure manually, device three configure manually, right? So nobody wants to do be to be, to be doing that at 02:00 A.M. and certainly not for 500 devices. Now, we'll quickly.24:32He look at the the prerequisites again, right? So.24:52Now now what I want to show here is let's move from what we need to do on the catalyst center to the device itself. So before we onboard a device, we need to make sure that the device itself is ready. And this slide shows the key requirements for that.24:56You need to check the CLI credentials, your SNMP credentials, whether netconf is required and your AAA configuration that is configured. For CLI access, catalyst and center needs appropriate needs the appropriate privilege level as well. So for SNMP we need at least the required SNMP access. In this example it will.25:13Is the SNMP version two C read access.25:33For your catalyst 9800 wireless LAN controllers and your catalyst 9000 series switches, netconf is an important prerequisite, and for wireless controllers, a significant amount of data collection is performed using streaming telemetry. So if someone comes to you and says, my device is reachable by ping, why can't I.25:38Listen to manage it.25:58Don't stop at ping. Ping only tells you that the IP connectivity exists. If that it doesn't tell you that the SSH works. It doesn't tell you that the credentials are correct or the SNMP is working or the the netconf is available. It doesn't tell you that the required telemetry is function. So remember reachability is necessary.25:59But reachability is not onboarding. Yeah. So with that, let me quickly call upon last year to take us through a quick showcase of of the prerequisites in in a quick demo as well. Over to you Lassia.26:19Hi team, so now in this demo we will be discussing how to create a site hierarchy and how we will be going to the how I'll be creating the credentials and the telemetry settings where we can view these and how we can enable those.26:38Right, the 1st thing is design, which is to design the right hierarchy in your catalyst center. For that go to design next and as you can when you go to the go to this particular dashboard, you will be going to a global one.26:57But you can create your own ones. So as of now there are many areas in my network. I will create one just for testing purpose for this demo. So I'll just name it as testing EIS should add it.27:17Now it will be added. So area is a like it is just like the meaning itself, so area is a big area and in that area you can create sub areas within an area you can create areas and buildings.27:33So now let's see how to create a building and for a building it is important that you give latitude and longitude. So you can search the address of your building and automatically the latitude and longitude coordinates will be taken or else you can directly view the coordinators.27:50So I'll just give Cisco it's and here I will search for Cisco India, I'll give that and longitude coordinates are taken and I will add those.28:07So now if it's a which then a switch or router you would be assigning it to a building. But if it's an AP, it's important that you have to create a floor within a building and then only you will be able to assign it. So why are we talking a lot about assignment of the site?28:24As already mentioned only and when you assign the site, the telemetry settings will be pushed to the device. If not then, then you'll have to do a post configuration push that is you can update the telemetry settings to a device and you'll have to firstly push the telemetry settings. We'll see that also, but by default.28:42If we want the device to be managed by catalyst center monitored by catalyst center, in that case, we'll have to assign the site. Now, that's how you create a area and a building and now once that is done, you create a floor. So creating a floor.29:02Yeah, building this there should be a building in this one. Yeah, and here I will add a floor, I'll just name it close one and then you can give the global unit system based on your floor.29:21Layout and the floor type and you can either give the floor image now or you can give it later as well and the supported formats are available here. So that's how you create a building floor and an area on the site hierarchy page.29:41Now after that it's important that we create all the credentials as well. So if you go to global, also I would like to add one thing here. Now we have these specific sites rate if let's say you have.29:57One credential for a ten sites and other credential for other ten sites. In that case, you can go ahead and create your own credentials per site as well. So when you do this, the current site credentials will be overridden by the global ones.30:13So by default, when you create a credential, it will be for the global ones and let's say I have Africa here and for Africa site there are different credentials here. In that case, I'll come to this particular site and we'll create the servers and device credentials here. In that case, the global settings will be over.30:30And this follows for all the settings. It can be image repository, servers, device credentials. Whatever site credentials that you do, whatever site settings that you do, will be overridden by the global ones. Now, I you see these are all the servers that are available and these are for your device. These are not for your.30:51Atlas center, there might be some confusion like how to add the DNS for Atlas Center is this where but NO.31:11When you if you want to add your catalyst center DNS server, it's through but these are all for your network devices, DHCP, DNS, image distribution, entity, and just for purpose, let's say you want to add a new one. You can click here, but let's say you don't have any DHCP server.31:17In that case, you just uncheck this box. But again, whatever credentials that you add here will be pushed to the device. Let's say you mentioned that there is NO server in that case a command called command like NO IPHDP server will be pushed to the device because.31:37What Center will try to do is it will try to match its settings with the device configuration. So it's very important that you make sure that the settings that you add here are same as the one that you have on your device.31:56Now that is the about service so what happens when you discover a device is that it will 1st try to ping the device and then it will try to log into the device using SSH credentials.32:14And then it will do a SNMP polling. So for this purpose, it will check the reachability of the device and then it will check the CLI credentials it will require and it will also require SNMP read to read. So these are the three.32:29Prerequisites just for onboarding the device. Now let's see how to create. You can create your credentials on this page or you can create those while you actually discover the device. We will look that also in the next demo.32:45But I'll just show you how to create a credential here, global credential. Now, as of now, these are the credentials that are assigned to this particular Africa site. I'll just go to global.33:01Here I will create credentials so add as of now these are the SNMP to write read and CLI, but let's say I want to add a new one I'll go and add CLI, so just give the credentials.33:25E LA S now.33:41So once you give those, you can apply the credentials directly from here. If you observe, you have an option to apply those here or else you can do these while you actually provision the device as well. So that is about the device credentials.33:57And now telemetry settings, these are all the telemetry settings that will be pushed to the device to collect the data from the device for the monitoring. And that would be SNMP tracks, this log.34:16Netflow collector and wired endpoint data collection and streaming telemetry. So what, what are we doing here is in this page, if you observe, we are using the catalyst center as our SNMP track server, and let's say you have another SNMP track server in your environment, then you can give that SNMP track server IP here.34:31And it.34:51Automatically, that server also will be getting all the SNMP apps along with catalyst center and this applies for syslog as well. And then this is a new one that is recently released in two.three.seven. That is if you would like to apply the application visibility.34:52Telemetry to your wired devices when you actually onboard them.35:13That you can do by enabling this checkbox. So whenever you onboard your wired devices automatically it will apply the center will be applying the application telemetry as well. So now these are all the things that you'll have to enable to ensure that all the data that catalyst center requires.35:17For the monitoring are updated.35:37So that is about the prerequisites and yeah, for the device controllability, you have to go to system and settings, device controllability. So this is also we have discussed, let's say you do not want to.35:40Want the configuration to be pushed to the device when you actually onboard it and or assign it to the site. In that case, you can disable the device, but again, since catalyst center requires this data, you will have to do an auto post configuration.35:58So that you can do by going to provision inventory and this only not applies in this case, let's say by some reason your device is not managed. So instead of directly opening a tag case, what you can do is you can just try pushing the telemetry settings because.36:18Sometimes telemetry settings might not have been updated.36:38So in that case, you can just select the device actions telemetry and update telemetry setting. So here you will be having this post configuration push and it's required that you check this box. So even if you observe here, these are all the settings that will be pushed while you assign the device to site as well.36:41The syslog server, basically the same ones that we saw on the telemetry dashboard and be able to see the configuration that will be pushed here. It Seems like I'll open another one, open some other device.37:01And we can do it, apply. So here we are seeing that there is a pending operation so what we can do.37:22We can go to manage in activities and discard that activity if it's not required. Mostly I might have done that. I might have scheduled something or started something. So this it is giving me this option, so.37:43I'm going on, but I don't want to do it anymore, so I'll just discard it. These checks will be, these checks are very important that if you'd like to continue with the workflow. So I'll do and recheck and this should go.38:00Let me do it again. Yeah, now it's done and then there is this device compliance so I will ignore it, but if let's say that device compliance have to be I mean if you'd like to work on it, you can click on the manage compliance and it will take you to the.38:17Compliance summary page and you will be able to see which particular compliance element is not matter. And now here, here you will be able to see all the telemetry configuration which will be pushed to the device when you actually assign it to a site.38:34Okay, you see these are all basically the monitoring ones. We are enabling the SNMP trap and then we are mentioning the catalyst center as the SNMP host and then we are updating the certificate for the purpose.38:55And basically the monitoring ones. So in this way we will be updating the telemetry settings if let's say the device controllability is disabled on your yeah. So that's it about for the prerequisites and now I'll give it back to actually to continue the presentation.39:15Hey great. Thanks. Thanks. So again, let me just quickly bring up my screen. Yeah. Okay, now we'll move into the deployment or the device onboarding workflow itself.39:39So, catalyst center gives us several ways to bring devices into the platform, right? So we have discovery, we have the option of manually adding devices into the inventory, we have.39:55Cisco Prime infrastructure to Cisco DNA Center migration. You can also use a bulk import through CSV and for ground field deployments we have plug and play. So the question isn't which one is better? The question is what type of environment or.40:13Are am I onboarding, right? Existing brownfield network or discovery maybe a natural choice. Large number of known devices, bulk import maybe useful, brand new deployment PNP becomes extremely attractive. So let's split our discussion into two worlds Brownfield and green greenfield.40:31Because the workflow and more importantly the operational considerations are quite different as well. Now, let's make the difference very simple.40:51Okay, Brownfield means the network already exists, ok? Now there are configurations, there are users, there are dependencies, there maybe years of operational history sitting inside these devices. So the workflow is generally check prerequisites, discover the devices, add them into the inventory.41:00Assign them to a site and then enable the appropriate application telemetry.41:20Greenfield is a bit I would say a bit different. So we are starting with a new deployment, so we can leverage plug and play. We can add the device to inventory, we can provision the site and network settings, we can apply day zero and day in configurations. We can upgrade the device to the desired software and the.41:26Then Enable application visibility at the end as well.41:45Brownfield so here's the easiest way to remember this. Brownfield is about discovering and bringing existing intent into catalyst center. Greenfield is cloud is is about creating and enforcing intent from the very beginning and the distinction and and that distinction becomes very important when you're designing a large scale.41:50Deployment altogether.42:10Yeah. Now let's focus specifically on, on the brownfield side of it 1st, right? So the 1st step is like we've discussed and we've talked about is going to be the prerequisites. Then we discover the devices.42:11So there are different mechanisms or different options of discovering the devices, which obviously will take us through in the demo as well. Once this, once these devices are discovered, it gets added to the inventory. We assign it to the appropriate site, and then obviously we enable whatever settings.42:30As we want to enable, e.g., in this slide, I'm focusing more on the application visibility. Notice what's missing compared to a greenfield. We're not starting with a completely blank device, right? So we are dealing with an already configured production device. So we have to be much more.42:50Conscious of configuration impact impact, right? So this is why I always recommend doing a pre check before onboarding. Ask what is already configured. Is SNMP working netconf configured or required for this device? What telemetry is already configured? Are there existing.43:09IPDT policies. What happens when I, when I when I assign this site to assign this device to a site, right? Because in brownfield environments, the safest onboarding strategy is not.43:29Push everything and get everything onwarded. It is understand 1st and automate second. Now, let's look at the discovery process itself, right? So discovery is one of the most common ways to bring existing devices into your catalyst center and this.43:41It's an important wireless specific point here as well. So for a WLC, we should discover it using the management port of assurance port for assurance, sorry. And for APs, there's a nice operational advantage. So if the APs are already joined the WLC, they will automatically get added into the inventory, so we don't need to go around and around.44:01Discovering every EP individually?44:21Think about the scale of that, right? So if I have hundreds of access points behind a controller, manually onboarding them or onboarding every AP would be a completely unnecessary exercise. So instead onboard the controller correctly and the APs that join it can become part of the inventory automatically. Also remember that the management interface.44:24This matters.44:44A lot, ok. Especially when we are talking about assurance and telemetry. Now, as you can see here, there are multiple options available for you to use the discovery tool itself. So you can do a discovery using CDP IP address range, LLDP, even CIDR, right? So these are the different tools.44:46Options available to use the discovery mechanism itself.45:06Now, this is where we would normally demonstrate the discovery workflow. So the important thing to understand is that discovery is not just about entering an IP address and just clicking next. Catalyst Center needs to establish communication within the device.45:10Using the configured credentials and protocols, ok? And so when we are troubleshooting discovery, don't immediately assume catalyst center is broken. Work the path logically. 1st, can catalyst center reach the device, right? Second, can it establish the required management connection?45:293rd, are the place CLI credentials correct? Is SNMP working? And if required, is netconf available and using the expected port, right? So, and and finally, are there any device tied restrictions such as ACLs, AAA issues or management plane policies?45:46So this is the troubleshooting philosophy I I want you to take away. Don't troubleshoot the symptoms. Trace the communication path, right? So if you follow that approach, the device discovery failures become much easier to isolate.46:06Yeah, so we'll quickly check this quick quick walkthrough of of the discovery workflow here. So for now what I'll do is I'll just pause it as obviously we'll have Lassia take us through a live demo for that.46:23Now let's compare discovery with manually adding devices. So catalyst center gives us the ability to add either, a single device or use bulk import. So bulk import becomes particularly useful when you already know the device information and want to bring a larger set into inventory.46:44But there is one important note here that if the CLI or your SNMP credentials don't match what is configured on the device, the device edition fails. And if the netconf port require requirements don't match, the device can end up in a state such as managed with.47:04You might have seen this. Now this is a very useful troubleshooting. So don't just look at the final status and say, ok, catalyst center couldn't onboard my switch. Look at which communication mechanism failed because the failure itself is telling you something. E.g., if it is a CLI mismatch, think of credentials, if it is a netconf issue.47:25Think of the protocol port or device configuration. So that makes troubleshooting much more systematic is what, what I think.47:44Now the device is finally in the inventory, but we are not done yet, right? So one of the things I recommend recommend checking at this stage is the device. A quick question there would be why? Because some telemetry and operational behavior depends on the role assigned to the devices. So don't just.47:54Celebrate because you see a green check mark here?48:15Take a few seconds to validate, is the device identified correctly, is the device role correct? Is it assigned to the right site or the management credentials correct? Management details correct, whether the device is reachable, are there any management related errors? So this is one of the small operational checks that can prevent bigger problems.48:19Problems data because the objective isn't isn't simply.48:39Device appears in the inventory. The objective is device is correctly represented and ready for the next workflow, yeah? So with that, let me quickly bring back Lassia over to you Lassia. So this is a continuation to that.48:42The team demo team. Now what I'll do is let's go to the discovery tool page for that we need to go to tools and discovery and as you can see.49:02There should be some discovery already done here. Yeah, there are few discoveries that are already done, but what and you can rediscover those. So let's say as of now here, there are many IPs, right? And one of the device is not discovered. In that case, what you can do is you can just click on this app.49:18Actions.49:38And rediscover in that case what it will do is it will be able to onboard the devices that are not discovered. So in this way you can just repeat see use the same discovery again. But now what we will do is we will add a new discovery, we will onboard a new device.49:39For that we'll have to go to add discovery, click on this add discovery and discover devices. So again, the discovery types there are 414 PDP IP address range, LLDP and.49:58And you can select any of those, but for this demo I will be selecting the IP address range and in this current discovery, I will be discovering, so what I can do is I will just give the same IP in starting and ending IP address.50:16And let's say you have 20 devices in your/twenty 4th subnet. In that case, you can give the whole subnet, but center will only be able to onboard those 20 devices because those are the only ones that are actually there in your network and are reachable to catalyst center. So in this way, you do not actually.50:32You need to give separate IPs. You can give the whole subnets but only be able to onboard the ones that it can reach SSH and do a SNMP. And now I'll give the IP address also same one and next.50:52So I already have created few credentials on that network settings page that we have seen. I let it read those, but again, you can create some job specific ones that especially for this particular discovery. What you can do is you can click on this add CLI credentials.51:11And job specific. Click on this job specific and here you can give your username and password. But if let's say this is these credentials are seen for your for all the network, in that case you can go and give it for create your.51:29Credentials in the network settings page. And again SNMP read is the prerequisite SNMP write, it is your wish if you would like to if you already have, you can add those as well. And I will schedule it for now and I only want to discover the new devices.51:46Now, you can opt out sending the devices to a existing site now. You can do it later as well which we will be doing but again you can do it right away by clicking on this assigned devices to an existing site. Now next and here we will be getting the summary of the credentials that we select.52:02And when you hit that start discovery it will go through the discovery process and will within maybe 1 min less than 1 min we will be able to see the device in the inventory. But again, discovery doesn't doesn't mean that your.52:22Device is fully managed by catalyst center, it's important that you assign it to the site as well. So you can see how long it took for a discovery to be done and how long it has been started.52:41So I'll just forward it and within few minutes like you know it took like 46 s for the discovery to be done and it is finally done. What I can do is I can go to inventory and here I should be able to see his IP.52:56Yeah, you see, it is there, but it's the whole information is still not available because after the discovery catalyst center will be trying to collect your whole configuration, which is called as thinking and that will take at least two to 3 min.53:14So and that again depends on the number of devices that you are doing the sync. So what you can do is you can do a resync whenever you want that and that resync will take based on the number of devices that you do the resync for.53:32So it took me around 2 min for the reason to happen, but what we will do is we will add a device here as well. So there are two ways you can add a device to that is through the discovery page.53:47Again you can go to that discovery page from here as well, add existing device discovery, and you can follow the same workflow that we discussed here or else we can add a single device with the validation that actually was mentioning. So an add device and single device, here you give your IP address.54:02And click on give the credentials that you would like to give and you can click on this validate option that you're seeing. And then what it will do is it will just try to ping and SNMP will again see, but it here it will not actually onboard the device but it will check if it's actually able to reach.54:21It's the device and.54:41SSH to it. So in this way you can confirm if the credentials are correct or not also. I'll just give you the SNMP credentials read once and similarly, you can create a specific credentials here also and you can customize the retries and timeout.54:44And add. So again, this will take two to 3 min for the whole reason to happen. I will again forward it here, yeah. Now, I will just assign these devices to site. So again, if you observe the same.55:02Configuration that we have we have seen.55:22When we check that post configuration push will be seen here as well because basically both are same. We are just applying the telemetry settings to the device. So both will be same. I will just yeah i just pass over.55:25So now you see here all we are doing is we are mentioning that this particular catalyst center is the syslog server SNMP server, SNMP graphs is enabled, basically all the monitoring once that catalyst center will be pushing to the device and also the wire data collection.55:43So when you click on that deploy, it will deploy the device. Again, this will take maybe one to 2 min. So that's how you actually discover the device either through the discovery dashboard or the inventory page. Yeah.56:01You see it's done. And with that I'll now hand it over back to actually for the PNP process. Hey, thanks thanks Lassia.56:20Let me just quickly bring up my screen again here yeah quick time check because we might have to yeah we might have to go overboard by maybe five to 10 min. Sure yeah please bear with us guys for some time, yeah.56:37Let me quickly try and bring up my screen second.56:58Okay, yeah, just a second guys.57:13Is my screen visible by any chance? No, NO actually 1 s.57:32Yeah? Yes yes. Okay, great. Sorry, sorry for that guys. Yeah, we'll quickly move on to the brownfield side or the green.57:49Feel side of the picture here, right? So we have a brand new device, NO need NO production configuration, NO legacy configuration to preserve. This is where plug and play becomes very powerful. The basic workflow is check the prerequisites, leverage PNP, add the device to inventory, apply the day zero configuration.58:08And upgrade the software if required, Enable application visibility, add the device into inventory and then continue with your provisioning. So this is where we can really take advantage of automation. So instead of shipping a switch to a branch.58:29And asking an engineer to connect through the console, configure management IP, configure credentials, point the device to catalyst center and then start provisioning. We can let the device participate in the pro PNP process itself. And that's the real greenfield advantage. The device can arrive relatively.58:44Close to zero touch and can get and catalyst center becomes the orchestration point, right? So we'll, there are three ways through which actually four, but three are the most common used mechanisms through which a network device can automatically learn about the catalyst center.59:05The 1st is through DHCP option 43 and option 46, sorry option 60, sorry. So when the switch has provided an IP address, we can embed the IP address of the catalyst center server right inside the offer itself. 2nd is through using DNS lookup, so.59:23The network device is, does not receive a DHCP offer with option 43, it would perform a DNS lookup for PNP server.local at local domain and we can make that result to the catalyst centers IP address to start the PNP process. Finally, if neither of those.59:43Methods are available, we can utilize cloud redirection. So in this scenario, we, the, the network device will reach out.01:00:03To a Cisco hosted cloud and attempt to learn the catalyst center IP address that is linked to the same smart account that it is. If this method is used, then the network device will need access to internet. In addition, you will need a smart account that is linked to your catalyst center and your.01:00:10Network device itself. So for cat nine K switches, we have a 4th option that is not fully automatic though. You can plug in.01:00:30USB flash drive with the bootstrap config, and this will provide the switch with an IP address, which we learn to use and the IP address of catalyst center. This is, this is the only option if DHCP is not possible in your network Regardless of the method that the network device uses to learn about the catalyst center server.01:00:41The rest of the process is identical, right? Now, let's walk through the PNP sequence like we're watching it live happen live, right? So the device is powered on, it gets the IP address, right? It learns that the catalyst center PNP server location.01:00:59The device validates the server information and establishes communication with the catalyst center. From there the onboarding workflow can can simply continue and think about what this means operationally, right? So the remote installers job becomes much simpler. Mount the device.01:01:18Cable it, power it on, the automation takes over from there. So this is the difference between traditional deployment and a zero touch oriented workflow. Traditionally someone might have to console into the switch and start configuring it. With PNP, the device can bootstrap itself into the management ecosystem. And that's why plugin play is partici.01:01:39Really powerful for distributor enterprise environments, so if you're deploying ten devices, it's convenient.01:01:59If if you're deploying hundreds of devices across multiple location, it becomes a completely different level of operational efficiency. Now let's continue the same process. Once the device is established communication with catalyst center, we can move through the onboarding workflow itself.01:02:04Right? Now the biggest gains though are that we can automate day zero configuration to nearly zero touch while retaining complete control of the configuration and making it as customized as needed. This is a tough line to balance as most methods that automate configuration do so by.01:02:21Removing the ability to customize PNP goes a different route where you provide the templates exactly what you want and just tell center how and when to push those out. In addition since these templates control what is configured, we can remove inconsist inconsistency between device deployments.01:02:41PNP takes what used to be the complicated and multi step process of staging a device, configuring and upgrading it, shipping it to the final location, having a technician install the device and troubleshooting any possible configuration issues down to just plugging in the device, right? So everything we cover.01:03:01But today was focused on individual switches. I do want to leave you with an impression that PNP cannot with cannot be used with the stacks. All these features and benefits we have covered also apply to stacks, ok? And in addition, you can also renumber the stack and.01:03:20Apply licensing during the PNP workflow as well.01:03:40Right, there are different mirring mechanisms which are supported with stack renumbering catalyst center will automatically identify. So if you guys want to have a deeper look into that mechanism as well, please just let us know in your feedback and your and, and, and the question section as well so that we can also create maybe a session revolving.01:03:44Around that as well, ok? So with that, let me quickly bring back last year to take us through our last demo on PNP. Over to you Lasya. I will quickly take us through the PNP one. Let me just share my screen.01:04:04So this is the topology. I hope my screen is visible, so this is the topology and my core device is actually the DHCP server. I have configured the DHCP pool there. So what I'll do is I'll just quickly show you the DHCP pools that we have.01:04:22Configured on core device. Yeah, so here you can see there are many pools available, but the one that we'll be using for this demo is the PNP 1st one, PNP CP border one where.01:04:42It is under that hundred.one 20 six.zero.zero. So now and if we go to the plug and play dashboard that we can do from provision inventory, I'm sorry provision and plug and play, and here there is NO device, there is not I mean NO our device currently.01:04:57Now I'll go and do a reset for the device that is already configured because that is already configured, so I'll just do a restart reset, but in your case since you will be onboarding it for the 1st time, all you need to do is just plug plug in the device power in the device.01:05:17And yeah, I will do a PNP service reset and it will do a reset. We can see that the whole reload is happening and the yeah reload is happening, and we also saw that the hardware information is also coming up.01:05:35And the DHCP is happening on 20, so that is because the upstream switches con configured to do the PNP on VLAN 20 that you can do using PNP startup VLAN VLAN ID. So once the.01:05:52IP address is retrieved using the DHCP service. We will also be getting the catalyst center IP address. So that how we got this because if you observe here in the four device in the DHCP pool, we have configured this option 43.01:06:09So here after we have this 5A1DB2A4 after this five whatever this IP address that you're seeing these four objects is the catalyst center IP address. So that is how this device, this CT border is able to connect to the device.01:06:29Or else as mentioned, you can give your domain name when you get the DHCP, I mean in your DHCP pool and the DNS service also can be used like PNP server.domain name, in this case it could be PNP server.01:06:46PNP server.self serve.lab and that has to be converted to the IP address so that that record has to be created on your DNS server. But that is how you can use DHCP and DNS for onboarding PNP process.01:07:01But now it understood the catalyst center IP address and we should be able to see the device in the catalyst center PMP dashboard. So yeah, here you see it is currently connecting.01:07:17But soon we should be able to see that the device is ready to be claimed. I just do and now we are also configuring all the telemetry settings which we have discussed. I'll skip that part and should be ready to claim yeah now.01:07:33Once you get this device is ready to be cleaned, you can click on you can see here.01:07:53Only the device PMP certificates and basic default configuration will be there. Other than that there will be NO configuration because we have not configured it yet. But what we'll do is we will just compare this configuration after onboarding it using PMP process.01:07:59As you can see, every all the basic configuration is available PNP certificate interface and interfaces. Now I'll just copy this to the flash, this current running configuration to the flash.01:08:18And now proceed with the claiming process, select the device and claim it. Here again you can assign it to a site directly or else you can do it later as well. I will do it now only because I I wanna push the telemetry settings also directly now.01:08:35And you can give the name that is host name of the device as well and here in this assigned configuration, you can push the software image and the templates also but in this demo we will not be doing that. And as as in the.01:08:54That yeah you can push D zero and D in templates as well. So provision templates here we don't have anything in the provision templates because we have not selected any templates. If let's say use we have selected few templates and it has any variables.01:09:11In that case that values have to be added here in this particular page in the summary. So you can click on the preview configuration and view the configuration which will be pushed to the device and claim it. So you can just click on claim and.01:09:28Catalyst center will be starting the onboarding process and will push all the configuration that we have configured for this PNP process. I'll just show that yeah it is onboarding and it is now provisioned. So previously it should be in the unclaimed category of devices but now it will be.01:09:44In the provision and it will be also there in the inventory but again this you'll not be able to see the whole configuration now because it requires the re sync to happen finish. But what we'll do is we'll just check the configuration before and after the.01:10:04PNP process so before PNP process, we only had that basic configuration like PNP cert and the certificates, other certificates, but now you will be able to see it will be having this STN.01:10:25Network infra Ivan which is for telemetry and then for the trust purpose.01:10:44And then there will be the device tracking also enabled because we have enabled that wire data collection. So in this way it will be pushing all the telemetry settings to the device along with the configuration that we have created and it will onboard the device successfully.01:10:50So that is how you can onboard a device using PLP process and you see these are all the telemetry subscriptions that we have enabled and done. So, you can also, let's say you have ordered new devices and you know the serial numbers.01:11:05But they are still yet to be a shift to shift to your.01:11:25Data center. In that case, you can add the device like pre plan it before you actually onboard it, give the serial number and product ID and add it. And then when you, once your device is in the network and doesn't plugged in, then all you need to do is just click on.01:11:29Check the device and click on the claim and the provisioning will be done automatically. So in this way we are planning the provisioning also a bit ahead. So, and then there is another way also which is PNP connect. So for that we need to go to the system settings in the catalyst center and we'll be going to this PNP connector.01:11:46And create a controller profile here. So what you need to do is you can click on, you need to click on this register.01:12:06And select the smart account and virtual account so that whatever devices that are newly added to the smart account, I mean to this particular virtual account will be checking for the controller profile which we will be creating here and we'll be finding the IP address PNP server IP address in that controller profile and will be onboarded.01:12:13To the catalyst will be onboarded to the network using that PNP server automatically.01:12:33So you can just click on that register and need to give the smart account and the virtual account and also the controller IP. Yeah, so FQDN is anyways already given.01:12:38Now, when you click on this register, it will be added to the smart account so that we can view it in the software.software center. So we will go to this network plug and play and if we go to this manage devices and here.01:12:54You'll have to go to the controller profiles and as of now there is but once you connect your smart account with your catalyst center and create a controller profile in the PMP connect dashboard, you will be able to see your catalyst center profile as well.01:13:11So that whenever a new device is added to a virtual account, it is automatically added to your network. So in this way you can use PNP for the zero touch provisioning to onboard your device through the network automatically. And with that I'll hand it over back to end the presentation and we will.01:13:29Also be taking any questions that you might be having.01:13:50Yeah, thank you last year. Thanks team for the wonderful presentation. So just revising what we learned here in the key points to remember slide. So 1st is we have to design before you discover the network. So build the site hierarchy, build the networks.01:13:54Getting the credentials, server settings and the telemetry 1st. Nothing beats to the well designed catalyst center environment and it makes onboarding very much scalable.01:14:12So second point I want to emphasize is know your device support. By that, what I mean is always validate the device against your compatibility metrics. The link has been shared for the compatibility metrics. Do choose your type of deployment as in either is it SDA fabric is or a non.01:14:25Fabric device and then select the version because.01:14:45The version is very specific and important here because you will get to know how your device is supported by selecting the controller version. Now, brownfield and Greenfield we discussed here. So the workflows are different, they're not same. For brownfield, think it as a discover the device, then in.01:14:50Inventory, then site management, then telemetry.01:15:10Because we don't have to override the existing production configurations. Now where it comes to the greenfield, it's more on leveraging the plug and play than provisioning, then we have day zero configuration, we put a golden soft golden image or software, and then we have.01:15:14Telemetry to drive the automation and and if needed day one templates as well. The 4th more important point I want to emphasize is onboarding is just the beginning, so what we saw today was just the start of using catalyst center to automate your environment, getting devices into inventories and.01:15:32Very 1st step. The end goal is more on like getting the telemetry, getting the assurance use cases, observability, the config management, the provisioning, the swim workflow, even the compliance for the life cycle management. So all in all don't think the.01:15:52Listen center onboarding as simply adding the device into the inventory. Think it as a bringing the device into an automated and observable and life cycle managed network.01:16:12Now with that, we will take the question answers. 1st of all, thank you for all the question answers. I see there are many question answers in chat as well. Let me check if we were to able to address everything or not.01:16:25I see there are few direct questions also. Hope you got the answers for them. Okay, for all the unanswered questions, we will, have you replied over mail since we are shooting on time. There is just one which I want to take.01:16:43Okay, where can I view the recorded sessions for this webinar? I'll put in the I have already put in the link on the top chat if you can see that robin. And, there is one more question I want to take.01:17:05After provisioning, I noticed the IP HTTP client command configured on the switch. Could you please confirm whether this command is mandatory as a part of provisioning process? Also can it be modified to use HTTPS instead of HTTP? Can we take this.01:17:18The panelist.01:17:38Yeah, so I can take it up. So this command might have been configured as part of device controllability and the provision part, but you know admin you can always you know change it to HTTPS because you know we can we can configure it using.01:17:41You know the the security point and for test points and suites that are you know available within the platform.01:18:01Okay, I understand obviously HTTP is not allowed in many of the enterprise standards so but I I hope that answers the question use HTTP. Yeah, ok. I see there are a couple of big questions but let.01:18:13Let's answer those offline if that is ok. Participants will reach out to you over mail.01:18:33Thank you. As a part of this, like if you have any feedback for us for any other topics, please let us know in your survey mail. So survey will be there to you from CX, Cisco CX side. It will be quick and easy survey.01:18:39Let us know what all things you want us to improve. Thank you so much team.01:18:59Thank you for your time. We will be here for next 10 min. If you have any question answers, like questions, we will try to answer them. Please put it in the chat. Thank you for your time and thank you for your patience.01:19:05