Cisco SD-WAN as code: Driving Automated Compliance across your WAN

Oh, before we start, I would like just for all the others to make sure that you are aware for our latest vehicle.00:00For support services, which is Cisco IQ. I hope you're all of you already onboarded and using it. In short, what is Cisco IQ? It's a unified simplified interface which is providing back to you personalized hyper.00:20Personalized views where you can see all your valid entities for your setup, asset assessments helping you in troubleshooting, learning. It is proactive and predictive. So both of your getting call.00:40Three elements directly for your infrastructure and the services what you are having. How you can do it to onboard yourself. So if you are already a customer which is using six cloud, then you can log in using.00:57Your CCO account to Cisco IQ and as a step one, then a step two, find your name and select your Cisco cloud account and ask for a migration towards the Cisco IQ, then in Cisco IQ create an account and migrate the data and.01:17The with the migration completed, you are able to start using the Cisco IQ.01:37If you are not already, if you're a new Cisco IQ customer, then you can again log into Cisco IQ.com with your CCO account, create name, select your primary storage where your data is just going to be stored.01:43And you can launch the Cisco IQ launchpad and from there using self guided account configuration, you can start onboarding your devices and the services to the Cisco IQ. With that, a short introduction from my side like hello.02:00Welcome you all. I'm. I'm product management architect responsible for network as a code. We primary focus on SD WAN as a code and I'm very happy actually to be presenting the today this is happy to interact with you all. Drop your questions.02:20We are having, we will also have at the end.02:40Small amount of time just for Q and A so to be able to answer lives and with me is also Michal. All right, good morning also from me. My name is Michael Navarka. I'm working in the customer experience as a customer success technical leader with the specialty.02:43For SD WAN and I will also guide you later on after what regarding some success success stories, some, some use cases regarding how to, how to handle SD WAN as, as a code and those type of stuff. So what we start and then we will follow up.03:03Thank you. With that, what's going to the agenda for today? So we will go through introduction why the code matter for your van infrastructure and how you can use it to, to scale.03:22How you can get started with SD WAN as a code, how you can do a pre request for the for the success, then we will touch a little bit on SD WAN in brownfield environment and then we will close it with Q and A and.03:37So, why SD one as a code? So this is as a code approach is not something what is from today. It is already like four years back used by the software development part using different.03:57Approaches how their software or the release of application is dependent and your is validated depending on the change of the.04:17Of the new code, what is introduced and so on. That's having impact on also the quality what you're going to have of your application version control if something is wrong to go back and so on. Why this is relevant for, for, for SD WAN? Well, from.04:27The market trends and from the customer challenges what we were exploring over the past years.04:47These are some what they shared with us. So as a network operator challenge main one of the 1st main part is lack of version control. Difficulty really to track your existing configuration, how you're managing it, changes over.04:54The time.05:13Sometimes it's in CLI, sometimes it's in in text files in different locations stored and multiple people are working on this. And this version control is very critical because it's resulting actually sometimes it's increased risk, hard to try.05:15Troubleshoot and then when the issue is happening after a small change, how you can roll it back fast if something was done maybe two, three days ago or you're not aware. Then it's very manual process. So the manual process is resulting it's really hard to.05:34Track your day to day status of your environment and also to scale it. If you need to scale it to, it's ok it's an easy maybe if you do it 123 devices, but then when you need to scale to hundreds or thousands, this is becoming very complex and not easy. Especially if you are having already standard.05:54Like if you are not having standardized services, how they are working, then this is having a problem into the your day to day implementation. Human errors are very often and deployment of what you did in this, in the, your staging environment comparing to what.06:14You pushed into the your production environment sometimes can be significantly different.06:34And the last part is lack of testing and validation. So, yeah, depending on how you're doing, even in the GUI or on the CLI, if you are putting the the new configuration, even just maybe performing a simple change.06:40Specific interface, you still would like to see if after this change and before this change, how your setup is working.07:02Are you validating that the syntax is really following your naming convention maybe or parts like that for a compliance? It's, you're doing it before even you start this implementation. So that's also like the part like after you implement something.07:11You run a set of tests which are robots, maybe potentially to validate are your infrastructure back.07:32Into the normal or is it before and after into the normal state as you would like. So this is something what is, what they shared with us that that's lacking in their environment. So testing and validation before and after implementing the changes.07:39These problems are creating, let's say around 80 % of the outages which are happening are due to the misconfiguration. What is having impact of around nine percent's total amount annual revenue of misconfiguration.07:59And then 25 % of actually issues can be solved with with TAC exactly are are coming from from this type of of data. And this is not something what we did it as a Cisco, this is something what we were doing together with Gartner, Titanya and and force where this was a.08:16Exactly explored by them into the past few years.08:36So, what is expected or how we can help you or also yourself if you start moving into this part. So one is that you need capability and services to, to do this parties 1st is.08:42Simplified management, automating the and reducing the experience needed to plan and deploy the configuration, which means like you're having very predefined process how you're going to perform all the, the data.09:01Before you start and do the changes. One part what we are also offering as part of the, this process is that we, if you're having a contract with the professional services, then you can with Cisco then you're having also digitalized intellectual capital. So Cisco is.09:19Creating.09:39Validation rules, tests, updating the model depending on the technology, how it's moving with the customers, so how they are using it, we are implementing and enriching the, the digitalized intellectual capital constantly on.09:43Daily basis. That is helping you to accelerate your rate of the success, which means like now you are capable to do much more in less time with less risk and more accuracy.10:01So before, because before we move into the deep dive, how this is actually working, I will do also a demo, we'll show it how how this is going we'll go over all the steps. Today, what we are seeing is different types of automation. So one is GUI approach, which is also in.10:17As the one we are having like part of the automation where you're using templates to optimize your configuration deployment, the task, you're going to the controller, so controller is automating the deployment towards the.10:37Apologies towards the your infrastructure, but this is still prune to the human errors and if you are combining too many different procedures, then sometimes this could be could deviate from depending on who.10:52Is doing the the implementation. Then there is a procedural option where you're using tools like ansible, Terraform or Python, where the tasks are specifically executed, but usually in these procedurals once one you're running once and then you are forgetting like how this was.11:11Done or maybe you you run it multiple times repetitive, but it's always ex executed with one outcome. So it's not really tracking your progress on development of your infrastructure, how it's really moving forward. And then the last.11:31Part is declarative, which is infrastructure as a code where you are trying, where you are implementing embedding the best practices what you are having like naming conventions standards for validation post validation after the implementation, and you are not any you are putting all of this in.11:48So once, one.12:08Act set up which is always executing, NO matter if you are doing small or big change, you are always following your best practices and you are validating that your operator is is NO.12:12Is is using them in each of the changes. That's leading to a minimum errors, smaller mistakes, high accuracy in your change, detecting the issues before even they are happening so proactively detecting any misconfigurations.12:31And also you're having always the options to roll it back to the infra, to the infrastructure where you were after. So.12:50Infrastructure as a code is solving all of the problems what we were talking before. So one is declarative configuration, we are using the source of the truth is now laying into your Git infrastructure. And when I'm mentioning Git.13:00To use some terminologies, that means I will I will use Git interchangeably, NO matter if we are talking for GitLab, GitHub Bitbucket or any other Git solution which is exactly existing today on the market. So from that perspective, just bear with me that when I'm.13:17Mentioning GitLab or GitHub or even just Git.13:37I will I'm assuming that you're using your Git infrastructure. So all of your configuration or your infrastructure as for the for all the data what you are having is actually stored into the Git.13:41And that's will be will be treated as source of the truth. That's this is the place where we are going to define the intent and, how your services you would like to look. Then the.13:572nd pillar which we call it automation engine is execution using open source tools which are in case of SD WAN is terraform, but we still have, we are using also Ansible for NDFC and for ACI. These are all open source source part, which is more or less than just.14:13Your standards for how you're doing your actual deployment into the infrastructure. And at the end, we are having full digitalized process which is the pipeline definition together with the validation rules and the tests which are confirming that what you are.14:33Declared an automated implement configuration is really matching your business processes and your validated best practices what you would like to have it in your infrastructure. I will go over this slide.14:51Like pretty fast, but just I keep it.15:10Just to link it with what is happening today in the industry. So infrastructure as a code is a pre request or a foundation for AI OPs. If you would like to start using the latest and so on, with your infrastructure for operational part.15:14Then, there are to be the to be accurate and to have always outcome, what is really representing your setup and your need.15:33The accuracy to be very high, then you need to have an automation in place, which is in line with infrastructure as a code, where it is the deterministic and reproducibility is very easy to be done. Also, the source, the trust source.15:49Yes we I was mentioning is exactly into the.16:09Git infrastructure, so central source of truth from which you are able to pull your infrastructure. And then pre and post change validation. This is something what for what is even giving much more accuracy to the LLM, so they will be able to or AI tools where they will be able to.16:13To make the decisions with very, high.16:32Probability. Okay, something is wrong, I need to roll it back or I need to, to, to change it so this changed to be performed successfully. By putting these guardrails with infrastructure as a code or for the or for other technologies also valid, you are putting in place.16:36These guardrails where you are allowing actually your human experts always to be there and quite easy to control what the llment or the AI tools are doing for the, for the infrastructure.16:55With that, I will, yeah, I will just skip it this one. What we are offering or what we are expecting is that you will start implementing five, five times faster your changes into the configuration.17:13Around 98 plus percents change rate success. So imagine that you are having now, your maintenance windows are 98 % successful comparing to let's say the into the past.17:29And you are, if you are having much more successful maintenance windows, and imagine that you are twice now capable to do it faster, which means like in the same maintenance windows, now you can perform twice more changes, then your infrastructure, you can bring it to the speed or to your.17:46The desired state your infrastructure much faster. With that, I will move to SD WAN as a code and this is very busy slide. I will go over it to explain what the elements are here and then I will move to the to the demo.18:06So on the left side, where we are seeing like the source control, which is, as I mentioned, it's the Git infrastructure. So in that part, you as a network engineer or.18:26Consulting engineer, however we name it operator, you are interacting with your configuration data. And this is the main part where you as operator are you are editing instead of, and I will use the terminology from the CLI.18:41Like instead of GUI, instead of going into the GUI and perform click, click or going into the CLI and do the changes into the CLI, now you're, we are going to start editing YAML files. And I will I will show how this this look like now in a minute. And then the other portion, what you're seeing is.19:00Both test libraries which are.19:20Prebuilt for you and they are given for you to so you are capable to start using it. And then we have called templates which are also part of it and just not to mix what we are having the templates in these are not the same as we are having in YAML files, so the templates here and you.19:22The other partner not the sea.19:42And these templates you can just reuse it and tune it so you're capable to to to reflect into your setup. And below is the automation engine what we were speaking about is the based on Terraform modules and the Terraform providers. For those who are, I will not get into detail.19:45Person what is Terraform modules and what are Terraform providers in this for interest of time, but Terraform modules are simplifying significantly how your YAML files will look like comparing to you if you create the YAML structure what is aligned for Terraform provider.20:05All of these parts, the blue box elements are constantly built and they are open source towards you and you can just download it and start using it. Once you perform the change, actually you are triggering a pipeline which is.20:23Checking your code, is it valid or not? Validating are the rules what you have it like for naming conventions and so on valid. If at any stage of this tool, let's say or any of what you're seeing into the purple is failing, then this is going back and saying, ok, I'm having error, and this is never reaching even to the.20:41To the production.21:01After validation is performed, then we are triggering the deployment stage where it is using the Terraform provider and the all the data is performed. It is testing or pushing the configuration to where where it's your our best practice is 1st you do this into internal validation environment.21:03Before you push it into your production environment. Once the deployment is successful.21:23Then tests are triggered which are running on top of your infrastructure and validating does my configuration really works or not? Was it applied properly or not? And if something is, if we are not blindly testing on the provider which like if we manager is saying 200, ok.21:30Everything was implemented. No, we still would like to run tests on top of it to validate that everything was properly done.21:51All of the data, outcomes logs from these are stored into the artifactory where at any moment of time you can go into the past and see what were the result, what was implemented and how it was done. These artifacts, you can use it for keeping your documentation up to date.21:59And triggering like, ok, what is the.22:20At the moment, my state of the art for, for the infrastructure, how it looks like, what is the configuration and how it looks. And of course you can integrate this with your notification system like Webex, Teams or whatever else you have.22:24With this, I will stop and I will start sharing my, how this really looks in production. So I already.22:40I have like to explain, just give me a second. So I'm having already a GitLab infrastructure, so this is my SD WAN, ok, my session expired.22:56We're going to be managed and fingers crossed that everything will work as it should be. So this is my GitLab repository where all of the setup.23:13Is already in place and I opened something some of you if you are familiar, this is built in for git GitLab VS code very simplified. So this is how the yamls are look.23:32Are look like. We have in, in I'm by purpose built a setup which is covering two flavors of deployment of SD one what we have it today. One is UX one.zero as we are calling it and the other one is UX two.zero. This is not best practice just to to say it.23:48We are always leaning that to our customers to run one of these or unless they are in migration steps from UX one.zero to UX two.zero. So but I wanted just to share the both options so then you're aware that we are supporting UX one.zero and also UX two.zero.24:08So if you, we see here like four.zero, you will see here that the files, what the YAML looks like I'm having inside already predefined like configuration groups with their names, and then if we see under specific.24:29Quick part like, ok, I'm having the CLI profiles which are used for that specific configuration group, service profiles, system profiles, and transport profiles. All of them, this is just an example. This file could be one, could be broken out into, into smaller smaller files.24:48Then if we go to the feature profiles, here we will see again the feature profile, the system profiles which are defined, then what we are calling there into the.25:08Into the into the other the into the configuration group, the NTP servers which I'm which we are using logging parts and we'll just for five ok yeah maybe here it's ok transport profiles we're also here. Yeah.25:22So transport profiles are here with the VPNs what we are using, what is allowed, what is not allowed for the specific tunnel interfaces. So all the setup what you are having is actually now reflected here into the YAML part.25:41What, yeah, this is you're doing it once where you are defining this or if you're changing frequently your transport your feature profiles or configuration groups, this is where you are changing them. But then once you have it, you're going back into the specific site depending on the chassis, you.25:59You're calling the specific configuration groups with the variables what you are having for that specific site and then calling it with the services associated with it.26:19I will just, in interest of time, I will just copy this and I will move it into the data. Data folder is actually the folder from where we are starting the full setup and I will say this day zero config.26:32Just going to commit and then I will go back here into day zero, ok. I am there, I will just refresh it. And here the change what I just did was.26:57I copy all the files with centralized policies and everything and there is a pipeline which is running this is very short pipeline which is going and it's performing validation. What was validation in this we are checking if our rules like for naming convention seems.27:14Tax did I put maybe on some parts instead of IP address? Did I put it maybe a name?27:34These are the checks which are automatically pre defined. And now I see here it's already everything is passed, all the the full pipeline was was run. If I go back now, here it is saying, ok, it's ready for merch. What I.27:40I'm going to say create a merge, ok? I'm happy with this is passed, I'm happy and now.28:00I can move into the next stage where I am going to start pushing the configuration into the infrastructure. It is performing again just from the software perspective that everything is fine. It performed again that all was all all validation is passed.28:07Now I will do a merge and what merge is going to trigger is actually the big pipeline what I was talking before. So you see here it is going to validation.28:27Plan, deploy, testing and then notification. So this is how it looks like. So now it will perform again the full steps NO matter that I did before validation, it is just again going to perform the same changes. Plan is now going to execute actually.28:38Terraform plan. So this is going to check, ok, what is there at this moment running?28:57Into my V manager, is it same comparing to what I'm having before, and then it will move move forward. In interest of time, because this will take some time before it's going to be applying.29:04I yeah plan is successful, and now it will move to the to the deploy. But I will, I would like to go back to the files, what we were talking about. So, this is how the YAML file looks like and we.29:22Where the variables are pulled from, all the Webex, GitLab, the SD WAN infrastructure, username password, the URL, git setup, all of these are already predefined and all of this depending on on on your needs could be tuned because not all the pipelines are valid.29:42For every customer. Maybe in your case you would like to run it into the.30:02Validation plan, deploy test in your staging environment before you run it into the production environment, which is also a valid setup, so then your change here will look a little bit different from the pipeline perspective.30:08And the other important parts are rules. So these are the rules which are validating your pre validation parts. So in this, you will see like ok validate that everything my naming convention is really following my.30:25Best practices. So the names, how they look like, they're very unique, they're not overlapping this year. This is what you are seeing here, these three rules are just example of the of the rules which could be could be defined. These three rules. Of course we are having much more than this.30:45As part of the Cisco portfolio. And then under tests, these are the templates what.31:05We are running depending on again, it's just a small portion of the test, color lists like this is a robot test where we are checking are the caller lists for our policy objects properly implemented and applied.31:14And I will go back, let's see where we are staying. Okay, how the deployment is happening, so now you see here it is going depending on the module, it is applying the centralized policy, so if I scroll it up, you will see and by the way, this is day zero configuration. None of this was managed before.31:33By the infrastructure. So I am creating all the configuration groups, all the service profiles, everything I'm just running from zero to the infrastructure. If I go back to the.31:53To the ok I used wrong go back to the to the now we will see.32:08That sites are implemented then if we go into the configuration into the configuration groups, you see they were just implemented into the into the infrastructure with the names what we were.32:26Using before system profiles saying like this was just pushed a minute, few minutes ago when we were actually pushing the configuration.32:45And I will just go back again to the pipeline and we will see that it was successfully deployed all the changes were applied, and if I go to the.32:57To my master now, you see here 6 min ago before it was empty similar and all 6 min ago all of this was applied and performed the changes.33:15One more thing what I wanted to share show is here is successfully so we are testing tests either potassy and integration and then we have notification. One critical element what we are also having as part of the, of the.33:29Of the deployment is terraform state. So for any change, what is going to be into the future, this is actually the information where it is stored, like how the IDs, how the objects are cross correlate between the infrastructure and what we.33:49I know this is very fast, but it is just on top of it. All the steps what I was showing here from the pipeline, you are able to do it also manually.34:10Manually meaning from your laptop if you would like to get with much more knowledge and understanding, but in the interest of time, that's let's see, just sneak peek how this looks like when you are at the end stage. So any change now into the future like for day one or day two.34:20And let's maybe just I will trigger for a second how day one could look like and ok I forgot to do the best practice which is let's say create new branch. I will say day one.34:40Create, now go into the VS code. I already have for day one, I would like to.34:59Improve my centralized policy with google, data policy to, to support Google app and then these are the policy objects. I will copy both of them.35:14And I will put again back into data. So you see these are very small files which you can create it for the for the setup, ok? And I will say day one, ok?35:30Commit and now go to the project. As far as I know, this should fail because by purpose in these files what I created, there is an error which validation should not passed.35:46And if I go into the validation, you see it it cached and it is saying I'm having syntax error and exactly in which file, what is the name? It is percentage, so I catch the error that actually something can wrong. I will not.36:06Fix it in this time just I wanted just to show how this pre validation actually is capable to help you even before you move into the production to catch the error human error what could be introduced into the YAML file. So this slide.36:23Little check of your syntax, it's also part of the of the code validation. And I have, I will go back again to my presentation.36:42Okay, so what we did in the setup, how the workflow we were doing, we created a push into the Git for the specific branch, then we triggered the GitLab pipeline. We went through the input validation part.37:00The, and we skip the steps, let's say from generating deployment infrastructure because in my lab I didn't have the test as the infrastructure. In case you're having, let's say CML maybe some topology where you're capable before you go into the production to test your templates and so on, you can.37:15To integrate this is even best practice. We are highly recommending to integrate this part. You test your code there.37:35Including the validation of the tests and you get the notification once everything is there. And then you're merging this into the master branch or production branch where you are trying triggering the full pipeline, which is much bigger performing input validation, doing the deployment to your production.37:42Doing the tests which you can store as a results into your defactory store and then again getting notifications when it's done. This flow, you are repeating every time, NO matter if the change is small or change is big.38:03You're doing it always so then you are having very, you're minimizing the risk of human error and something to go wrong. But I know it's maybe it's a different way comparing to how you're doing it today, but that's.38:20Improving you and helping you to be much faster, much accurate with less errors. This is how the pipeline looks like, like, what we, what we went through, you already see this all life, how it looks like, you can integrate one important part. You can integrate any of your YAML files with your service.38:37Now maybe in that box depending where you are keeping maybe some of the variables for your sites and so on. So you can call these variables back to your infrastructure. And one use case which was let's say successful is also let's say manufacturing.38:57Company, which was doing migration. The challenge was really to mitigate the risk to perform fast migration with less errors of the infrastructure where they were moving from Ivan to SD WAN.39:16Infrastructure. This was done in a questions of minutes, let's say immigration of the configuration with the help of the six, they were capable to significantly faster migrate all the infrastructure into the new.39:32As deployment and this was also something what they find it useful once they were done with the migration because they saw the power of this, they continued using the same approach, so they are still managing their infrastructure into the way of, SD WAN as a code.39:51With that, I will give the ball now to Michal so he can give you the insights of something what I touched a little bit. I didn't focus it on it, but I know he will give you very good details. All right.40:10So let's step aside a little bit from the technical part and let's focus on one thing which is probably not too much visible from beginning when you, when you try to implement SD WAN as a code or when you think about implementing SD WAN as a code, and that's some sort of a let's say success factors, right? So those are some, some.40:27Things which you should have as a prerequisite on your infrastructure. When you try to move from the manual CLI or GUI tasks to the automation or version controlled workflows, right? So let's have a look, let's have a look why.40:48Let's have a look, what are the success factors, right? Because most of the time and what we see at the customers who are thinking about the SD WAN as a code or who are trying to implement it, the technology is rarely the problem. It's mostly because the terraform, if, if set up.41:04Properly can be really easy. The APIs are there, there is a documentation, so it can be also pretty easy, and as you saw Git operation when set up correctly, it's also very easy. But what we see at the customers, the hard part, mostly is consistent data. We will talk about it a little bit later.41:24Standardized design because sometimes the SD WAN is deployed in the multiple phases and the design is really not standardized. There is NO documentation or whatever. And then there is also problem with the governance and operational discipline. Because when you try to implement SD WAN as a code, you need to have toll.41:45Totally different approach than what you had when you are trying to do it via the CLI and GUI. So let's have a look on it. So technical depth, right? Everyone will say, Yeah, not in my document organization, right? That's not true. Everyone has it. We saw it at the customers and everyone has a technical depth. So what is the.42:04Technical depth in this case. So let's, let's.42:24Let's take one use case, right? So you have a customer who implemented like 1000 sites globally, and this deployment was done in the multiple phases. And unfortunately during the playoffs, during the team changes, it was done always by the different team member.42:29So there is some discrepancy in the documentation, there is the compliance drift, there is a security risk because the security is handled by the different team members, so the policies are not kind of the same way implemented. There is a, there is a.42:49Problem with the naming convention, with the telemetry and stuff like that. This together, it's sort of a technical depth which you have on your infrastructure. The infrastructure as such works, right? There is NO problem technically.43:08But you have a problem with with the operational layer, right? So basically, as everyone knows and, yeah, I do it also from time to time. So you have a you have a problem with the naming convention. So let's, let's take two examples. One is templates.43:23Scroll and 2nd is the object one. So from the templates is very obvious, right? So you will implement the template and then you need to do the change.43:43Right, so yeah you will say, ok, I will clone the template, so you will create version two. Then you will figure it out that you forgot one thing. Then you will create version two new. Then you think that you already finishing, so you will create the final, but unfortunately you forgot something else. So you will.43:53Loan it, and you will end up with the version two final two. So basically you have a five templates which.44:13Actually, NO one knows maybe you but other team members doesn't know what was changed and what is the difference, right? And how you want to automate when you have so many templates, right? And when you have so many wrong naming convention in this.44:20Case. So this we see a lot in the customer, so they have a lot of templates with very strange naming convention and even them.44:40Don't know, what are the differences and what is the purpose. The same is with the objects. I picked up one, one thing which I saw at the customer, which is the site IDs. And let's say that it's kind of, it's kind of following the use case when they will have multiple teams with the multiple phases.44:51This deployment of the SD WAN and let's say that they started with the, with the idea that the site IDs will be just numbers and that they will just say, ok, all the names will be just numbers and they started that with 1001 and 1002 1003 to 1010. So that were their site IDs.45:11Then, with another phase, it was done by another team team team of people deploying the SD WAN and they decided that they will use a little bit different, s.45:31Schema, so they started to use name it based on the region or based on the location. So EMEA, APEC or San Jose in this case. And then in the last finishing phase, another team again did it like site-forty 14243. So there is NO object.45:45Consistence, right? And, this can be, this can be just a consequence of multiple iterations, multiple deployments, NO documentation or whatever, right? But if you will, if you will start doing this.46:05This inconsistent object name naming, then the automation can be really helpful because it's not predictable. You don't have any naming convention. So the object hygiene is very, very important in this case, right? So.46:23How you can, how you can eliminate such technical depth or minimize it because the technical depth is always there. It's always it can be eliminated fully, but how to minimize it and how to prepare it for the automation. So 1st of all naming convention.46:41Of course, if you already have the deployment and you having a technical debt, naming convention is a little bit problematic, but it still can be handled. You can still start to follow up the naming convention and return to your objects and just change it, right? Then you should also standardize the roles of the, of the devices in your network.46:58Which means that, e.g., you will have a three types of sites. You will have a big sites, you have a medium sites and you have a small sites. And e.g., when I mean roles means that for small sites, you will know that there is a DHCP, there is another, there is a DIA, there is a cloud on ramp, and those type of stuff, so.47:18So if you troubleshoot some issue of your network or if you are doing the changes, you will know that such role of the device will have such features. E.g., for the big sides, you know that on the service side there will be routing, BGP, OSPF or whatever. For, from the automation perspective, then you will.47:38You know that if something will go wrong and you will change different role or if you will do a mistake and it will even pass the validation as was showing, you can expect such problems of of the features, right? So you should have standardized your roles on the devices.47:58And the last one, and it's also very important, you should also standardize the interfaces or clarify it. So basically it means that across the whole network, you will use gigabyte zero-zero on the routers as a primary ISP or whatever. So then you will know.48:18So that if you will change it across the whole network for some reason like you were changing mtus or you were changing whatever, some global parameter, it will affect only that ISP, right? So you should have it standardized.48:38And the last one and not least important is the templates. So, we will touch a little bit later on on the templates also, but this is also important from the naming convention and also from the functional perspective because you should.48:52Should consolidate your templates because.49:12We know, we know we have a customers who are using thousands of templates. For some reason, e.g., they have a let's say 2000 routers and they have a 1000 templates because they just didn't want to reuse the templates, but now.49:15They are in front of the challenge when they want to automate, they need to take care about 1000 device templates. So it's really not easy tasks. So the best practice and what we recommend to the customers is that you should reuse your templates, so to use them as least as possible because then the auto.49:35Is much easier and it will reduce the complexity. So also if you are using too much templates, it will not help you towards the SD call. I'm not saying it's not possible. It's possible, but it's challenging, right?49:55So let's have a look on 2nd use case which we see also very recently from the customers, and it's about, multiple connected things which are giving a good perspective for your and its hardware upgrade. So let's say let's.50:10Say that we have a second use case. So there is a customer.50:30Who has a 2000 routers and 60 % of them is the ISR four case. As you probably all know, four case are going end of life in a two years, so now they are thinking, well, in a, in a practice, they should already think much earlier, right? But now they are thinking that they will replace it with the.50:33The Generation two routers, which which are the at the moment most recent routers so they will get the most return of investment with the support and whatever, right? So they are now thinking about it. But there is one thing which is also connected with implementing the G two routers, right? So let me, let me show you. I'm.50:53Don't worry, I will not talk about the hardware. I just want to give you a little bit background before we will move before we will move for the other information but as you can see at the moment G two routers are covering the world portfolio portfolio for the SD WAN routers for the routing in general. What I want to show you is the last row.51:13At the moment. So the last row, as you can see on the routers, is telling you the minimum iOS XE. And as you can see the G two routers, there are some exceptions, but the majority of the G two routers need seventeen.eighteen.one to work in the compatibility with your SD WAN infrastructure.51:33For the newer routers even which were announced at the Cisco live email this year, you will need 20 six.one, right? So basically you need to upgrade.51:53Your infrastructure to twenty.eighteen as minimum for the new G two routers. And you can take it as an opportunity, right? Because the the twenty.eighteen at this moment is the critical baseline. We stating that the twenty.eighteen from.52:06From the UX two.zero maturity from the config and policy groups and also from the AP API consistency is the new baseline. So you should follow it. So, basically from this perspective, it should be, it should be the best starting point for you if you want to go.52:26Towards the code. I'm not saying that the earlier versions are bad. No, but the twenty.eighteen at the moment is a very nice baseline, and if you are thinking about the G two routers, it's very good opportunity to move forward with it. With that, there is also one thing. What already, NO.52:46Mentioned that, but.53:07Twenty.eighteen is kind of switching the UX one UX one.zero to UX two.zero. The twenty.eighteen is at the moment marked as a major UX two.zero versioning. What it means, so basically before, I think that.53:09Basically before twenty.twelve, we had a template driven configuration of SD WAN. So you have a template, you have a device templates, you have a feature template, you put it all together, and then you applied it to the device. From twenty.twelve, Cisco started to focus also on.53:28The intent driven configuration which is the config groups and the policy groups. And at the twenty.fifteen, it was evolved and twenty.eighteen now is taken as a, it's major enough. So basically it's.53:48How you should go with it. So what's the differences, right? We can, we will just do very quick overview so you will know how it's kind of affecting the SD WAN as a code deployment, right? So from the perspective of the templates, so the template driven configuration. So you will configure the feature templates.54:05The feature templates consist of all the things you need to put together for the device template. So service side, interfaces, management stuff, everything, right? You can even have a CLI feature template, so you will put there the CLI CLI add on template which.54:25For some reason there is not in the feature template, so you can put the CLI CLI configuration and it will be deployed. This all thing will put together at the device template and device template is put into the device itself. Then you have the config groups, right? The config groups is a new.54:42Way how to configure the SD WAN as we call UX two.zero is the logical grouping of the devices that share some sort of a common purpose, so you can, you can have it based on the location, based on the type, like the retail store distribution center, and on top of it, you have the feature profiles.55:02So the feature profiles are some sort of a flexible backends of the configuration which you are putting them to the config groups. It will include the management stuff, then you will have the VAN profiles which is kind of for the one side of the configuration, so your in external connectivity, and then you have the LAN profile.55:21Which consists of the interfaces VPNs, routing, and those type of stuff, and you can easily reuse those. So it's much easier from the perspective of the management. When we will compare it, like, like this, right? So this is kind of example when you compare the templates to the config groups. So we haven't.55:42The example of you are deploying.56:01New IoT devices with the new VPN, right? So this that will be the VPN 40 and you have three types of branches. So from the conflict templates, you need to do a lot of consequence consequence steps, right? So you need to copy the templates, you need to create the VPN, create all the steps.56:05Off then you will need to create the interfaces, then you will need to attach the interface to the device template.56:24Then you will need to attach it blah blah blah. So basically you will do 27 actions before you will configure it in the UX one.zero. From the config group perspective, you will just copy the config group, you will just modify the existing service profile to add the VPN 40, so you don't need to create.56:30Create a new one, then you will the associate and associate it to the to the device, right? So it's six actions. So even from the automation perspective.56:50The config groups are much more easier to implement because you have less action consequent actions than from the template perspective. Yes, you can still automate the templates, right? But it will be more challenging from the perspective of the configuration than from the config groups. So.57:00And we didn't start even talk about the policies, right? So from UX one.zero, the policy, the centralized policy, the localized policy, and even the security policy, there is still a lot of steps which you need to configure to implement it and to deploy it. UX two.zero, in this case, yeah, sorry. And also with the UX one.zero, you still.57:20Have the lists, you install the objects, right? So again, object hygiene, very important because then you are automating that with the centralized localized or security policies. With the policy groups, it's a little bit different approach, which is much more streamlined. So you will have the up priority.57:40Bucket or the policy group, then you will have the next gen, next gen firewall and the security stuff, and then you have the cloud security. You will then put it all together and then you will attach it to the devices. So basically it's a little bit different like the centralized policy at the US one.zero where you apply it globally based on the VPN layer.57:59Based on the site IDs or whatever. Here you are just applying to the device list. So it's much more.58:19Specified and much more easier to automate, right? So, as you can see from the SD WAN as a code, the policy groups and the config groups are much easier to automate, and that's why I'm talking about it from the perspective of the twenty.eighteen. So if you are thinking that you should you will.58:25Upgrade at some point to the G two routers. Think about twenty.eighteen.58:45And think about moving towards the config groups. So if you would like to move it, right? Just a very quick note, there is a conversion tool between the the templates and the config groups. If you are on the version pre pre version on twenty.fifteen or.58:50Twenty.fifteen and sooner. Then you have the online method through the Cisco SSP portal. The portal will connect to your vmanage, it will fetch the templates, converse it and put it back to your manager. If you are using already twenty.eighteen, you can, you can.59:08Run it from the V manage sorry from the manager and basically it will convert it by itself. Try it, see how it will work for you. Of course, if the templates are very complicated, it can have some flaws, but at least it will give you the baseline to follow.59:27Right, and this is also what we saw at the customers. So they were in this situation to upgrade the routers. They said, Yeah, well, we will upgrade to the G two routers, but unfortunately we will stay with the templates. Because we will do it later on. Well, it's a, it's an approach, right? It's approach.59:44Which, it's also depends on your workforce depends on depends on your effort, but most of the customers and what we see put the G two routers 1st to the, to the lab because they want to see how the features are working, how the hardware is working, and if you have it in the lab, why not to.01:00:04Try the config group from the start, right? Why not to try it like this and see that it's much easier for the implement implementation? Because it will save your time.01:00:24Because if you will do it later on, then you will need to, you will need to spend the time again, right? So it's much easier to do it when you moving towards then retrofit it later.01:00:35So, these, these were the two major things which we see at the customers at the moment recently. So what are the, what are the little bit other ones, right? As, as what was already showing the deployments and the technical stuff, what we see also at the customers is the will that they will.01:00:50Like to do it comp, in a complex way at the same time. So they will prepare as given as a code as some monster action and then they are disappointed that it's not working. Well, what we are saying them and what should be the best practice, start slow.01:01:10Start small, right? So if you would like to start with SD WAN as a code, you should start with something which which which is a very small change. So incrementally. So e.g., with one customer we tried SNMP, right? So they needed to add SNMP to the.01:01:29And they want to do it via the automation.01:01:49So SNMP, very easy, it will be added to the, to the configuration and it will build your confidence because the moment when you see it works, you will, you will get your confidence with the larger, large scale changes and also it will give you a feeling that it's stable and you can.01:01:52Use it day by day, right? So definitely.01:02:12Starts more. There is a one other thing, there is not much features at the moment which are not yet in the API, but there are some, so you can't really use the automation through the API for such features. So you should have a way how to handle it, how to handle.01:02:15The features which are not there yet. Cisco is still improving the APIs, so all the features most of the time will be there. And there is also one thing which I little bit forgot. So the momentum for the config groups is like that, that the the config groups from Cisco perspective.01:02:35Will be at the moment more focused on. So if there will be new feature, it will primarily go to the config groups, not to the templates. The templates will still kinda have this feature a little bit later, but the config groups will be the primary.01:02:55Configuration way for for the SD WAN moving forward, right? So sooner or later, you will stop receiving the features in the templates, but not now, not in the near future, but that's the way Cisco wants to implement it. So from the.01:03:13API perspective, there is not much features which are not there, right? But there are some. So you should have some sort of a way how to handle it without the APIs. So if you, if you will still configure it via the GUI or whatever, right? But you should be prepared for that.01:03:33Right, and, this is kind of, let's say summary of these of these things of the how you should achieve the success from the, from the perspective of that. So.01:03:52Definitely, 1st of all, you should reduce the manual task, right? To cut the technical depth because the moment when you are doing the manual task, you are bringing more possibility to human error or not following the naming convention or.01:04:09Just spending too much time on it, right? Standardized naming, of course, the naming hygiene, object hygiene, very, very important from the automation perspective. Then you should have the the baseline, so you should know how your network is kind of acting, what you can expect and.01:04:26So from the troubleshooting perspective, so you should know what, what you, what you have.01:04:46What you have in your network, right? If possible, it's not mandatory, right? But it's good best practice to pivot to the UX two.zero. So it will be much easier for you than automate from the templates to the config groups, right? Then of course scale with the.01:04:52The policy groups with the with the config groups and then when you have all of this.01:05:11Adopted the APIs. So you have all the prerequisites, so you have naming convention, technical depth is very low, you have documentation, you have used two.zero, you are comfortable with it, then adopt the API. So you will figure it out how to automate, and then.01:05:17You will be ready to really start automating the processes because you have everything in order and then just the automation will be very easy for you. All right. Yeah, I think that's, that's all from me.01:05:36And I can pass it to Vlad for the brownfield environments. Thank you and yeah, that's a great actually side part towards not.01:05:52Okay, here it is my PowerPoint, you're seeing my PowerPoint? Yes. Okay, so, we are assuming that majority of our customers are actually running are already implement have implemented as the one. So then how you actually.01:06:09Do this when you are not starting from scratch, when you're on brownfield. So brownfield, I will be very honest, it's not straightforward, something that you can just grab it and use it. That's why we are.01:06:28Propose I I put it here some incremental infrastructure as a code migration strategy and there are two parts actually what you can do. I will 1st explain why It's let's say complex. So the core challenge, what is there in place is actually that.01:06:42That it's.01:07:01Transitioning the existing life as the network to infrastructure as a code. There are when you receive the multiple parts, we have 1st dependency mapping, like NO matter we are talking two.zero, there are many objects which are cross correlated and then when you are using automated.01:07:03Once you are calling the specific object which is dependent like if I'm calling.01:07:25In a feature template, if I'm calling specific feature profiles and then all of these are related to specific site. Any change in this chain, let's call it this way, it's impacting the automation. So you need to know the object which are system IDs, which are very dynamic, they're just defined.01:07:31Actually and they're keep as part of the V manager, even you are having consistency of the names. And this mapping and it's at a similar case it's with the configuration groups and the policy object, like from that part, there is a dependency what you can have.01:07:51One critical element which we touch it a little bit, but it is also important is configuration drift. So once you start doing the changes for the specific object or maybe area of objects, let's call it this way or I will talk it in a minute like how that could look like.01:08:08It is crucial that you continuously use the automation and the approach that the source of truth for that object is only relaying in your Git infrastructure. So then you are minimizing what you are avoiding creation of drifts because once the drift is created, you need to update your state file in.01:08:26To your terraform. And.01:08:46Because we are talking for a live infrastructure which is already running and so on, we need to maintain the service services continuity so there is less impact on the, on the real infrastructure and that's why the phases should be planned properly in advance. So, the 1st option to do.01:08:49Do it is really to do, do it by yourself. So, one option is all the new sites, what you are going to use.01:09:09And if you are let's assume on what exactly was Michelle was mentioning, if you are already on UX one.zero, then you start migrating or you start implementing managing this infrastructure using configuration groups. So all the new deployments, you are using the automation.01:09:19And all your sites, you are using configuration groups, policy objects and approach like for UX two.zero. So all the deployment is new deployments are happening with that part. But let's not jump immediately in production. Let's 1st.01:09:38Build the team, your team to build actually the fluency profession of the in a controlled environment. And this you can do it into the CML topology if you're already having maybe staging environment to test the setup there. And once you are mastering this piece, then.01:09:51Then you are going, you're out of scaling your.01:10:11Deployment objects carefully. So, why I mentioned like like this go slow, so it's better to because we see that friction is very big, especially at the beginning. It's a new approach how you would like to do if you are not familiar too much, you need to get familiar with it before.01:10:16You move forward and maybe the 1st steps are just scrolling.01:10:35But then very fast you are able to start walking and then you're running with a significant pace. So in that part, let's start safe slowly and then it is going to pay off for for your infrastructure and your minimizing the risk.01:10:40The the objects, again, the biggest part is try to control the objects where you are going to perform the changes. If you are starting exactly as Michelle was pointing out with UX two.zero, starting implementing, start slow, create new sites which are with the latest hardware, ok.01:11:01Commented there because one way or another you need to go on the migration part to UX two.zero. So start step by step and then the heavy lifting, let's say this conversion from UX one.zero to UX two.zero will happen naturally because you will already be aware, ok, how my configuration groups will look like, how my policy.01:11:20Policies are going to look like. So then it's it's going to be easier.01:11:40If you would like to do it faster, there is also an option we from a perspective of professional services, we can come and help you. We can audit your existing environment. The expert will be assigned for you. It is going to work with you as part of the contract.01:11:45Will convert your full configuration including QX one.zero UX two.02 YAML files. These YAML files are going to, so this is going to be the.01:12:05Discovery. If there is maybe some feature API, which parts what you're using and they are not today supported as part of the provider, we were going to build for you. So then once we are there, we are going to.01:12:16Reduce significantly the time instead of you building it, we will help you build the full automated discovery, the full setup. Also recommend for you the best practices from the architectural perspective, not from architecture, because there is also a part like when you are scaling depending on how big is your.01:12:31Infrastructure, then we will sit together with you and we will say, ok, it makes sense these files to be broken down into smaller files and then the chunks are just going to make make easier for you to operate it. These are, these are operational parts which are working just for your team or your organization. It is not a.01:12:51Replicated for other customer which is doing.01:13:11Different let's say processes. So professional services can help you in this part to customize it and then also to you to be successful faster so then you start implementing the best practices from infrastructure as a quote and service as a quote what we were talking before much faster.01:13:15And with that, we can wrap it up. So Michelle, if you would like to cover a little bit on the key takeaways. Yes, so basically most of the things we already said, right? So there is, there is multiple things which you should be.01:13:31There before you will even try to start the SD one as a code, right? So the 1st is the standardization. So you should really standardize your deployments naming convention, documentation, template, template hygiene, and those type of stuff, right?01:13:51If you are close to the refresh, just take it as an opportunity and try to, as Vlad was saying, try to migrate to the UX two.zero because that will make your life much easier from the automation perspective, right? So in this case UX two.zero is the key, right? So.01:14:08And then you have a much more better starting position for the, for the automation, right? So these, these key points are really let's say prerequ not not really hard prerequisite, but it should be prerequisite for you before you will start, you will start going forward, right?01:14:27Yeah. Okay and maybe the last part because I know we were talking a lot, I was explaining maybe for some of you completely new setup, how it looks like one.01:14:46Part which I'm suggesting like from our experience with all the different customers globally, so I and this you will get it this as part of the of the session. So you have one central hub where you can start your journey. This is the cisco.com where you can.01:15:03See all the latest tools and documentation, not just for SD one but also for the other technologies what we are supporting. So this should be your starting page where you can go and see. Now, if I go a step down for learning and guidelines.01:15:22What I was showing there into the lab, you are able actually to go and give a try. So as the one is a call, we have built very comprehensive self learning part, which I was just showing was very tiny portion of how all this technology works like. And yes, I'm sure that this was not possible to be learned just.01:15:39You know, into the 30 min lab talk talking about it, but you need a little bit much more time how to do it. So, there is also a Netas coach, a self learning lab, but you're capable to book it there and go over it by self learning pace. To book the lab, please contact.01:15:59Your accounting team, the CSS team, we are more than happy to book a lot for you so you then go and and run it. You have all the setup, it is step by step guide how you can, you can run it and learn it all the complexity or let's say the the friction what you're having around how terraform.01:16:19Works all these robot files what we were, what I was talking about, pre validation, post validation, I plane, so all of these are is explained, so then you gain the confidence and you are able to run it.01:16:39Of course lab is not going to help you fully to understand, let's say how to create a data model for your exact case. To helping that part, we are releasing from time to time as we are progressing with the data model, we are releasing YAML.01:16:52References where you will see a small snippets for a specific service, how you are capable to to to run and to see that part. And then there are two also open source git repositories. Anyone can use it. It's a simple example repo where you can just clone it, start it if you have even with a single.01:17:11Small CML lab, you can just test initial concept, how it works and get, get the knowledge. The advanced lab environment is also.01:17:31Bigger topology with much complex use cases, what is also publicly available. It is actually what I was sharing with you with this day one, day zero. So they are also available and you are able to to start and use it. With that.01:17:41Questions and yeah, we will try to answer them Do we have any questions?01:18:00Qualifications if we were not enough qualified with the with the part. I don't think we have any questions in the chats about so if everybody's happy, we can close up a bit earlier today. And then maybe just as a reminder for for everybody else, we'll be running.01:18:17Being you know a bit more of an advanced series in September and October on some of these topics as well and just take a moment and thank you all for your time. Thank you for presenters for presenting today.01:18:37