Deep-Dive on Orchestrator and Telemetry

So good morning, everyone, good morning, good afternoon everyone who are joining us from different parts of the world, and thank you so much for joining the expert insights series.00:10Today. Today we will cover a topic deep dive into Nexus Dashboard Orchestrator and Nexus Dashboard insight. This is presented to you by customer success team and today we have two key speakers, Naveen Kumar and.00:20Both of them are highly experienced in data center products, be it ACI Nexus dashboard, automation, and compute products like inter site and hyperflex. They have high highly experienced in this domain.00:37And they are here to guide you through the details of this nexus dashboard Orchestrator and inside sessions. So hope you can interact with us as much as possible during this session and keep your questions flowing so we can all make the best out of this session.00:54And feel free to reach out to us in case if you're having any audio issues and with that, I'll move on to the next slide, the flow of the session. So during this session, we will mainly have three main segments. So 1st we will talk about ACI multi site data center. We will also.01:12Talk about what are the requirements for setting up ACI multi site fabric, control plane and data plane considerations within it, and we will also talk about Nexus dashboard in terms of telemetry topology and custom dashboard. We will then move on to 2nd segment that is where we will cover ASA fabric and Nexus dashboard.01:32Put together like how we can bring it up.01:52And how we can like configure ACI objects using schema and templates of NDO to manage multi site configuration, and we will cover some detailed telemetry related topics like traffic analytics, congestion insight anomalies, pre change analysis and more and.01:54In the end we will have some time and some like dedicated time for questions to come in. Also throughout the session, feel free to reach out to us using the Q and A panel on the webpage.02:14So that we can make the session more interactive. So as I mentioned in brief, so the agenda will mainly be in these six main segments. 1st, we will start with introduction multi site connectivity department consideration.02:28Then we will cover a bit about Nexus dashboard orchestrator. We'll cover ACI multi site and control plane related configurations and considerations, provisioning about policies on demo and finally Nexus dashboard telemetry. So stay tuned, there's a lot of things coming in this session.02:44And before we start, we have a short poll. You can join this Slido using the QR on available on the side of your screen and feel free to you know join this.03:03Because then we will get an insight about where you are on your journey when it comes to data center networking product like Nexus dashboard and ACI what you're using. So we will have some of questions which will be there throughout the session. So make sure to join this.03:20Using the QR on the left hand side of your screen.03:39And put the password at as ND deep dive, so ND type so we have some answers coming in. I'll just wait for 20 more 20 more seconds and then I'll hand it over to Apoor so that he can take up the.03:43Session delivery part. So we have a lot of people who are on Nexus dashboard three.two and four.one. We have one board for nexus dashboard four.two, which is the latest Nexus dashboard version.04:03In case if you are planning for upgrade and in case if you already have planned and there are any issues or anything like that, you can again reach out to the customer success team for that. So yeah, we have some votes.04:20Just five more seconds and then I'll close this poll ok ok.04:34Thank you so much everyone for voting, so I can still see lot of people are on three.two and four.one. So we will we recommend like to be on the latest version as much as possible.04:52So definitely that is something we can discuss in the session. So with that I'll pass the ball to you to start with the introduction. Thanks actually. Thanks for the introduction yeah.05:08You are able to see my PowerPoint?05:28It's visible. Yeah, thanks. So, yeah, so we will get started with the introduction about ACI multi site deployment. So, yeah. So what is the major difference between ACI multi site and other.05:31Architectures that are supported by ACA. So, very basic we have ACI single pod fabric where you have leaf and spine all connected in the same premises and next comes ACI multi pod fabric. So in a multi pod fabric.05:51The Apic cluster, a single Apic cluster is managing multiple ports. Maybe they are geographically separated or.06:11Maybe it's a large scale deployment which it requires multiple parts. Both are supported. And then there is ACI remote leaf where you can have a small remote location where you want some switches but not.06:20Much enough to have a apic cluster of its own dedicated. So their remote leaf is kind of a helpful design option.06:39But in all these options, right? There is a single apic cluster which is managing the fabrics, maybe spread across different locations or in a single location. However, in ACI multi site, you have two different apic clusters which are spread across.06:49Geographically. So you have two different failure domains, not a single point of failure domain as far as the Apic controllers are concerned and you can have all the L two and L three extensions across the sites which are managed by the APIC controllers, right?07:09So, to manage those geographically separated sites having different API apic clusters, NDO comes into picture, right? So, going forward we will see how NDO comes into.07:29Comes into the picture. So, yeah. So, as we mentioned, so ACI multi site is a kind of loosely coupled PC. Why we say that because like both the sites have their own underlay.07:48Protocols Both the sites have their own coup protocol instances running on between the leafs and spines. So, they are kind of independent of each other and and impacting one of the DC does not have any impact on the other DC as far as the underlay and.08:06Encapsulation and other things are considered, right? So, this is a highly redundant architecture, right? And at the same time you also get all the.08:26L two extension and L three extensions across the sites, right? So, this is what we call loosely coupled data centers. However, when you have multiple data centers, so you need a single pane of management which will configure both the DCs and since this.08:39Two APIC clusters are are not indirect.09:00Not directly accountable for each other's fabric nexus dashboard orchestrator comes into the picture here, yeah. So, yeah, yeah. So what is.09:07What is Nexus dashboard, right? So that will, just be a controller who will talk to both the apic clusters on your on your apic, and it will program whatever is necessary for all the L two and L three extensions. Once the configurations are done, right, then.09:25The leaves will have all the necessary routes and.09:44Underlay overlay control plane considerations to have the L two and L three extensions across the site, right? So, yeah, so then your hosts and.09:51All the other devices will be able to reach each other. However, in multi site or in multi site fabric, right? We do consider these two are independent dcs. So they should have their own firewall and their other peripheral devices like load balancers and.10:07Whatever is required for the fabric to work, right?10:28So, yeah. So what are the common use cases for ACI multi site architecture, right? So the, why, why is it needed? There maybe a very large data center deployment that needs.10:33Multiple spines and leaves because one spine can only handle whatever number of leaves that are present on the, like whatever number of ports are present on the spine, right? So there can be one big data center deployment which.10:52Needs too many fabrics independent of their own. That is one use case. There is another use case where multi site comes in handy is, data centers in multiple locations, right? And you want to have all the.11:12L2L3 interconnectivities and IP mobility across the data centers, right? And a 3rd use case can be in a telco environment where you, where you have a telco core network and your data centers are spread across the geographies to handle your.11:30Internet and call traffic and where you can give all the, access to all the internal applications kind of, of that telco to the MPLS subscribers, right? So.11:49Yeah, so, there are few considerations what, what is needed for your inter site fabric to come up. So, the 1st one is there should be a inter site network which can be used to interconnect both.12:05The ACA fabrics.12:25This is considering if there is a, if these are geographically separate locations and your spines cannot connect to the spines of the other fabric. However, going forward, if, if they are present in the same location, even the spines can be directly connected.12:30Back to back to the other fabric. But if you end up using inter site network for your.12:48Multisite fabric, right? That inter site network needs to have some requirements to be supporting the multi site traffic. Those are like it should support OSPF or BGP neighborships between the spines and the inter site routers.12:57ISN network routers and there are NO multicast support needed for inter site network between the sites so that is a kind of relaxation and it should support MTU a jumbo MTU if you want more traffic.13:17To be sent between the multi site fabric. However, we will also discuss about MTU in upcoming slides.13:36Yeah, that's pretty much about it. Okay, so yeah, as we were mentioning MTU, right? So, when you have ACI multi site fabric, right? There are two MTU terminologies that you need to be aware of. One is data plane MTU.13:46Where you will actually send the data that needs to be encapsulated across the sites and you need to forward it to the other site. And another one is control plane MTU where you will have the control plane messages in BGP VPN across the two sites which needs to.14:06Be sent from one site to another. So, we recommend jumbo MTU to be supported on the ISN network. However, if you still.14:25Have ah inter site network which does not have jumbo MTU support. You can go in your Apic controller and you can change the MTU values that you, that the ISN network supports. So you can go under system system settings and.14:38TCP MSS policy, and there you can support like you can put whatever MTU value is supported by your ISN network. Keep in mind that you need to keep 50 bytes of.14:58MTU value to be kept less on the APIC controller so that the vxlan encapsulation will use the 50 bytes of overhead when it goes into the ISN network, right? So, and the supported values are 6808 minimum is 6808 and maximum.15:14Is 9104 ok so if there is any question that you would like me to answer please interrupt me, yeah. Yeah, sure.15:34Yeah, we will let you know yeah thanks so coming to the control plane and data plane requirements for the multi site to work. So if you see here like there are two sites and the traffic will need to.15:50Go via the ISN network and the underlay protocol can be a OSPF for BGP between the spines and the ISN routers. And the overlay protocol will be MPBGP like EVPN address family of the BGP for the routes to be exchanged across.16:10Fabric, right? And then there will be a VXLAN packet which will be encapsulated from this spine onwards to the other spine and vice versa. So.16:31The inter site networks just need to have the routing reachability between the spines and the packet encapsulation recapsulation will happen on the spines of the like ACI fabrics, right? Okay, so how does the.16:44Receiving ACI fabric, NO, what.17:04What is the BD EPG and other things? So that information is carried out across the VNID and the class ID of the of the fabric, right? So VNID will give you the EPG number or like a VLAN number basically it will be mapped to a.17:09And class ID will carry the like zoning information based on your EPG and the contacts, right? So.17:31Yeah, so digging deep on the class ID and BNID, right? So if you see since there are these two sites which are being managed by NDO, right? And then both the apex are managing their own fabric as well. So.17:42So whenever a BD or APG or any ACI construct is configured on the sites, the.18:01Apic of site one will program it on the leaves of spine one and apic, controllers of site site two will program it on the leaves and spines of the site two and these values can be different basically the vnids and the EPG.18:13IDs and other things inside the VXLAN packet can be of different values. So if you see here.18:32Like EPG one EPG EP one here is having a different VRF ID and a different bridge domain ID, but the same EPG here is having a different.18:41Number value, right? So to maintain the consistency when the traffic is sent from one endpoint one here to endpoint two here on the remote side, we need to translate the values of.18:57When it is sent across the sites, right? So who does the translation? It is the spines who do the translation for you, right? So both the both the spines will have their own translation tables which are.19:12Maintained and programmed when the apic is programming the EPGs and BDs. So when the endpoint one sends the traffic to endpoint two, the spine in between will have a remote site VNID as well as the local site v.19:30And it will translate when the traffic transits from the spine here to the remote site, right?19:51So to support this translation, if you observe here EPG two is not like EP two EPG is not getting configured on the site one fabric and EP one EPG is not getting configured on the site two five.19:59But to support.20:21The the trans like the traffic from one side to another we need to like create shadow EPGs that the NDO will create on the ACI fabric. So we will dig deep on the shadow EPG concepts in the upcoming slide.20:23Okay, so, Okay, so what is a stretched object and what is a shadow object? Now now we will cover a stretched object. In the next slide we will see a shadow object concept. So this is only relevant in multi site ACI fabric.20:43If you see here, there is a EPG which is getting configured on both the fabrics like site one fabric as well as site two fabric. So both the like so basically this is a stretched object which will have a configuration pushed on both the apex. The class ID can.21:02Can be different as I mentioned the class ID of EPG one here on site one and class ID on site two can be completely different and the spines will maintain the translation table. So this is a case when the EPG needs to be configured on both the.21:22Sites, right? But what if we configure EPG one on site one and EPG two on site two and there is a contract in between EPG one and EPG two, which we want to allow the traffic. So in that case, the site two.21:42We'll have a shadow EPG one created to support the traffic to be switched or routed from.22:01Any other EPG to this EPG, right? So, so even though there is NO endpoint that is going to be connected on the site two still it will have a shadow object of EPG one which will be used to program the contracts and the other logical constructs that is.22:08Is needed to send the traffic, right? So, so this is called a shadow object where the object may not be relevant in terms of end host connectivity, but it is required for ACI to program the contracts and traffic forwarding.22:28Right. So since there are too many like if you have a fabric which has too many EPGs and there are many contracts between the EPGs that needs to be created to allow or.22:45Drop the traffic, and if you had a multi site fabric on top of it, there maybe many shadow EPGs which you may need to forward the traffic across the different site, right? So this creates a resource like this uses too much resources on the AC.23:05A fabric, right? So to to use your switches TCAM very wisely and not to exhaust the TCAM you can also configure a preferred group.23:24Which is like you combine multiple EPGs in a preferred group, those don't need contract between the and host of the preferred group EPGs and you can directly send the traffic and you only need a contract when the, when there is another EPG which is outside of that.23:39Group, right? So this will reduce your TKM utilization in case you end up having too many shadow objects in the multi site, right?23:58So this can be a good design consideration. Okay, so now we have the knowledge of shadow objects and stretched objects and different things. Now we will see how the underlay overlay control plane comes into picture, right?24:09So, till now, like if you have deployed any ACI network, you would know the spines are not yours, right? So spine does not have a VXLAN and happening on them, right? They just forward the traffic across the leaves, right? They only need.24:28But with the EVP like with multi site you need spines to act as now. So what would happen when the endpoint sends the traffic across the site? The leaf will encapsulate it 1st and then it will reach to this by.24:49And then it will, this spine will again decapsulate and encapsulate into a new packet and send it across the multi site fabric, right? So to do that now the spines need to be configured as vtep. And also to send all the.25:08Control plane information across the remote site. You also need a.25:28Key VPN neighborship to be done between the spines of site one and the site two, right? So this is where your control plane and data plane considerations come into pitch. So, now, like since we need the VTAP configuration, you also need a like.25:33Pool in which he will assign the IP addresses of the.25:53Spines and to handle the unicast spine there will be a dedicated IP address on each of the spine. However, on the multicast tab, it will be a single address that will be used by all the spines, right? To handle your broadcast and unknown unicast traffic.25:58And we will also have EVPN peering across the.26:18Across the spines of this site and another site so we will give a EVPN router ID which will be forwarded to form the BGP neighborship across the sites, right?26:25So, how will we achieve these things, right? So to support BGP VPN peering across the two sites, we also need underlay reachability between the spines on both the sites. So we can configure OSPF or BGP.26:39Between the spines and the router of the inter site network. Similarly, you can configure OSPF for BGP between the other site and the spines.26:59Okay, and we will exchange the underlay reachability between the spines and other spines. Once the underlay reachability is there, the spines will form the BGP VPN neighborship directly, so your inter site network does not.27:11Need to be EVPN supported. However, if you have a very big design like you have three or four DCs you may also use a inter site network as a route reflector for all the sites that is also supported if you if the.27:30Design is needed like that.27:50So, yeah, and then we will advertise the IPs, the spines will advertise the IPs to the inter site network so it will have a, when the VXLAN packet comes, it will be routed across the inter site network.27:52Okay, so your inter site network will also have all the routing addresses in the routing the pool and the EVPN router IDs. Okay, and whatever you configure OSPF or BGP towards the inter site network, that's fine.28:11Will also do the redistribution of the leaf Vtep IPs and other routing whatever is necessary into.28:31Isis, right? So it will mutually redistribute from OSPF to isis or BGP to isis. So if you see the leaf, we'll see the routing table when you see the next hop of the end host, right? When the leaf wants to encapsul.28:41Delete the packet and send it across the spine across the site. It will have a next hop entry as OU type B, basically.29:01It will the leaf will send directly to the remote addresses right so ok yeah so going in detail on how the control plane would look like, ok?29:13So, when an endpoint tries to communicate with another endpoint on the remote site, how will it communicate and what all are the things needed? So, the leaf will send the traffic it will have a site, ok, it will have.29:33The Spine as the proxy if it doesn't find the endpoint in the in its own database, right? So then, just a minute.29:53Yeah, let me build on the yeah so when when endpoint one sends a proxy to the spine it will it will be knowing the endpoint two location because of BGP VPN peering and the spine one will update the endpoint two information to the.30:07Leaf one that it is present on the remote site that is the OU type B address of the spines. Yeah Naveen, you are saying anything?30:27Yeah, the quick time checks yeah yeah ok ok yeah sure I really yeah so ok so those were the control plane and data plane concepts that were needed to be aware of while doing the multi site. Now we will move to Nexus dashboard orchestrator.30:38So, previously in version and 3.1 and 3.2 of the Nexus dashboard, you would see different.30:57Applications being installed on top of the nexus dashboard and you would have to select what application you want to use. But now in Nexus dashboard 4.1 onwards, it's completely unified. There are NO different applications that.31:07You need to switch on from one to another. So it is a unified nexus dashboard and you will have a apic cluster as well as your VXLAN EVPN based fabric man managed using a single nexus dashboard.31:27Right, and here are the capacity planning tools and the licensing guideline. So this is a publicly available URL URL where you can go and input all your parameters, what nexus dashboard release you want to go.31:46What all features are you planning to use, lance and and how how is the ND cluster being deployed to this physical virtual? Based on that it will give you the recommended cluster size and other resource information that are needed to deploy.32:04And for NDO or for using NDO you need advantage or a premier license so you can refer the ACI licensing guide for the same. Okay, so you can deploy your nexus dashboard as a physical cluster or as a virtual.32:21In virtual, you can also get a on prem virtual cluster or you can get a cloud based.32:42Cluster so you can deploy it on your AWS or Azure cloud as well. So, yeah, so now we will quickly go through how the data plane communication will work when the endpoints will communicate from one side to another.32:50So when we deploy the BDs and EPGs across using the Nexus dashboard, we will select L two stretch or L two not stretched across the sites. Here in this we have assumed L two stretch will be deployed.33:10So when EP one generates a broadcast frame, right? Because it does not know where the EP two is. So then the leaf will broadcast the traffic across the leafs and spine as well as the spine will now also.33:26Broadcast one like it will do a head end replication across the site and it will send it to the remote spine as well, right? So one of the spine will be elected as a designated forwarder and it will send the traffic to the remote site.33:48And then, when it is received on the other side, it will be flooded again like here one of the spine will act as a designated forwarder and send it to all the leaves in their fabric and then when the endpoint two receives it and it sees that it is the.34:04Destination to which the flooding is happening. Then it will respond we will see how it responds, right? And then the tables will be updated across the leaves and spines to have the entries propagated in the.34:25In their lookup tables, right? So now onwards when the endpoint one sends the traffic to endpoint two, so it will have a what is it? It will have a hardware proxy enabled or not, it will send it to one of the spines.34:44And then your endpoint like the spine here knows that it the endpoint two is present on OU B, ok? And then it will, as we mentioned, it will also do all the translation of the vnids and the class IDs for the packet to be sent.35:03Across the site. And that's how your EPG and contracts will also come into picture, right? And during all these transitions now the leaves are also updating their lookup tables.35:23To send the traffic directly to the spines of the other site, right? So, yeah, so now when the reverse packet is coming from site two to site one, now this leaf already knows that the packet has come from OU.35:40Step A so it will directly send it to the spine and not broadcast it again, right? So, and then this spine the spines of site one will make the relevant translations and it will send it to leaf of this.35:59Endpoint one where this is connected and that's how the traffic will work. So you can also see all the encapsulation decapsulation happening so in between the spines, right? Okay.36:15So, yeah, so now going forward like all the endpoint one to endpoint two traffic will be directly sent to the spine of the remote site and then it will be forwarded to the leaf and reverse traffic will also follow the same pattern. It will be sent to the spine of site one.36:33Then it will be forwarded to this.36:53Endpoint. Okay so yeah so as we discussed like the stretched object and the shadow object, right? So how will it look like on the NDO? So, here we are assuming that we, like there are different scenarios where.36:56Your BTs and EPGs can be configured on any of the fabric and your traffic needs to be sent, right? So in this case like both the EPGs are being configured on both the fabrics like site one and site two and there is a contract in between, right? So.37:16Yeah, in this case you will be able to like do L two stretch as well as.37:36L three stretch as well in between the sites, right? So, next is there is BD and EPG stretched across like the EPGs are stretched across the sites, however, the BDs are different, right? So on site one.37:42And this EPG represents is a part of different BD.38:02And on site two, the same EPG is part of different BD and you want to have a contract between another EPG which is also having the same pattern. So in this you can just disable the L two stretch option on your BDs and then and then you can create the contracts and allow.38:06The EPGs to talk directly, right? So in this case also there is NO shadow object being created because your EPGs are stretched across the sites, right? Now coming to 3rd scenario which maybe more common so here you have.38:26EPG red and EPG Red being configured on both the sides. However, their their name is same but the like this is a shadow object, right? This is not created by the user. It is created by NDO for the contracts to work. So.38:46Your site one only has EPG red as end host connectivity and site two has a EPG green which is part of your end host connectivity. However, you create the shadow objects to make the contracts work, right?39:04Okay, so we will quickly see how the application templates and other concepts are needed for NDO to work and then we'll jump onto demo, right? So, ok. So here we have like a new concept called multi site templates and.39:20Schema.39:40Right so what is a schema? It's, basically a group of templates put insider like insider container is we can call it as a schema. And what is a template? So template each individual template.39:41Plate will have the BDs and EPGs which are needed to be configured on the ACI fabric. So the templates can be a site local template or a stretched template as you can see here. So this stretched template will be passed on to both the sites.40:01However, site local template can be just locally significant and your site configuration will be a combination of site whatever site local template plus stretched templates that you have put into the NDO configuration. So.40:21Yeah, ok. So now we will go to demo and before we go to demo, we are trying to see what the demo is about. So basically we are willing to create a tenant across two sites and.40:42The tenant is stretched across the two sides. The VRF is also stretched across the two sides. However, the BD and EPG are locally significant and there is a contract which is binding both the EPGs to allow traffic. So now I will.41:02Share another screen of mine and then we'll see the name 41 ok we we need to completely quick.41:24Okay, so you are able to see my Firefox.41:43Yeah, ok. So, we will start from scratch and we will see how do we enable, my multi cluster and ACI multi site connectivity. So this is my nexus dashboard and there are.41:57ACI logins as well which are present on my other tabs. So I will, 1st of all, I will go to admin system settings on my new Nexus dashboard and then I will go to multi cluster connectivity.42:14And here for saving the time I have put one site already onboarded, but we will select another site here and onboard it. So this is a ACA site. I'm just clicking next. I'm giving the.42:32Apic IPs only so this is the username and password of the apic cluster.42:48Yeah, so it is able to establish the connectivity this fabric is named as San Francisco. It is a premier license fabric and we need to enable orchestration and we are not.43:17Enabling telemetry in this lab environment, However, if it is a real environment you can enable telemetry as well and we'll just click and submit.43:34Okay, so now we can see there is this San Francisco cluster also now connected and we have done the New York one as it is to save time. Okay, and then you can go to.43:53Names and then fabrics you can see here, ok, you can click the new York it has four switches and one Apic controller. You can go to San Francisco, it has four switches and another controller. It will also show you all the inventories and other things.44:10And all, what all the links are up or down and how many of them yeah so this is basically done. Now as a prerequisite we also need to enable BGP if you have not already done on the fabric. So.44:29Here if we, Okay, so in this San Francisco fabric we have not enabled BGP, so what we'll do is we'll go to quick start.44:48Fabric set up.45:08Okay, so if you see BGP is not yet configured, so we know we need to give a BGPS number of six five double zero one to this spine and then we will select both the spines as route reflectors.45:22And we are good to go. So, ok. So this was one of the prerequisite and then now we go back to our Nexus dashboard and then ok so now we want to do the orchestration part. So we just click.45:39Here and then.45:59Okay, so we'll go to interfabric connectivity. So here it is showing two sites, new York and San Francisco. For the New York site, I have already done the changes, so it is showing changes saved, and then we.46:00For the San Francisco side, we are yet to do the changes, right?46:21So we we expand this general tab and it will allow allow you to configure BGP full mesh or with the external route reflector and other things. So, so we go to San Francisco, we enable the multi fabric tab, we give it a ASN number.46:28Whatever the same we had given on the.46:49Site and we don't have a BGP password, we overlay multicast step pool is 100 or 200. So this this is the multicast step IP which we have decided for this fabric, and then it is going to be configured with OSP.46:53If.47:12Regular area, and then we will have two policies. One of them is the multi site policy which will be used later. And then in part one, so we also give the unicast type IP pool so which is here ten.47:14Dot one.one hundred.one.47:33So you just click save. Okay, and then next. So here the new York part is already configured with the links that the spines are going to connect to the inter fabric network. However.47:36For the San Francisco is recently onboarded and we have here yet to do it. So we'll add.47:56Links of the San Francisco fabric which we are connecting to the inter part network, so here by/thirty two is being configured and the IP address which it is going to use for the point to point link is 1010.48:05One/twenty one and we will enable OSPF here. We will not enable BGP here that will be enabled directly between the spines so yeah and similarly we will add one more linked.48:25San Francisco spine two, the spine two is also having five/thirty two as the link towards the interpod network.48:45And we are enabling ok one thing I needed to do, we need to do MTU 9216 here in the previous.49:03Okay, now we will be able to edit the BGP parameters as well. So spine one will have a EVPN router ID OF one hundred.one.49:22If you have an external route reflector, you can also select that as a peering, but here we are directly peering between the spines of all the fabric. And then here we have the EVPN router ID of ten.49:42One hundred.two same so we this is what we need to form the OSPF and BGP neighborships. OSPF will be formed with inter part inter site network and BGP will be directly formed between the spines.49:59As we have selected in the full mesh neighborship. Yeah, so we can just do deploy now and yeah, so those changes have been deployed to the fabric.50:17And then, we, we also can verify whether the changes have been pushed. Also, we need to perform one more change here in the fabric on the ACI fabric directly. This change cannot be done by NDO, so we'll go to tenant.50:33We need to go to infra tenant.50:54And then policies, protocol, there is a fabric external connection policy which we need to.50:58Update here. We can just give a, so this is the community value which will be used for your BGP routes to be sent across. So here we can just give extended AS two.51:13And if you see the whatever multicast type address we had given that is popping up here. This is configured by.51:40Yeah, NDU and we will also give a.51:50Data plane type IP. This is the unicast IP that we are going to give. Okay, so.51:55This IP I know ten.21.two hundred.two hundred/thirty two update close and submit changes.52:13Yeah, so, yeah, so this brings the control plane readiness for the multi site traffic to be done. And then you can also go to networking L three out. There is this inter site L three out that is configured by the.52:28Yeah, NDO object. So now like we'll proceed forward and do the template creation and then on the NDO. So, yeah, Naveen it will be seven more minutes and I should be able to complete.52:49Yeah, so now we go to manage orchestrate and then there are NO tenants which we have created using the fabric. It's just a common tenant. So.53:07We can just click here, actions, create tenant, and then we can give pseudoco, which is as per our design that we had to create and we select both the fabrics and then we click just save.53:22So, if you now see here, there will be a tenant also created called pseudoco, on both the fabrics and it is created by NDO. So similarly we will create schemas now.53:40We come to the homepage and then we click on, fabric templates here so yeah so tenant templates and fabric templates. So we will create on the.53:58Tenant templates and then we'll create a schema inside the application. So, this is going to be the container for your L three stretch example. So here we are extending a VRF.54:16Which is going to be configured on both the fabrics. It's aL3 stretch. So I'm just giving it a name L three stretch schema, and then we will since this is a schema, it should have a combination of templates that are.54:32Going to be configured as the template. So here we will create multiple templates. One is called a stretched the template which will be provisioned on both the fabrics, so that is we are giving name SF and NY template.54:52And then we will create select which tenant it should go to and here we will select the multi fabric deployment and ok so then in this template now we will create an object called VRF.55:11And then we'll give a name VRF one and we are keeping all the other things as default, ok. So now the VRF is part of the template but still it is not pushed. So to push.55:30We need to save the schema.55:50And then, we need to go to so the scheme schema is saved now we need to attach the fabrics on which the template is needed to be pushed. So we'll select both the fabrics since we are going to deploy it on both and right now.55:54It is not yet pushed, so we are just going to deploy the template.56:12Once the deployment is done, then there will be a VRF created on both the template, on both the AP clusters on the switches, ok. So now this is done. Now we will create one more template because that some configuration need to go to only.56:18San Francisco site, right? The BD and EPG, so we will name the template as San Francisco only and we'll select the tenant as Pseudoco and continue to template. Now we will create a object in that.56:38We'll create application profile. We, we need to give it a name web and then that's it. And then we create a BD which needs to be bound to that.56:58Application profile, so we give it a name WEBD and we need to select it as part of VRF one and here we are not doing L two stretch because it is locally significant.57:17And then, yeah, just click ok and then we'll also create a EPG here. We need to select the web application profile at.57:34And then the EPG name is web PG. So we need to add the contract. However, we'll come back to this contract later and we'll just select the BD right now and click.57:50Okay, and then all this configuration is not yet deployed on the fabric. So we'll just select the fabric that we want and since we only want to give the configuration to San Francisco, we select San Francisco and deploy a template.58:08So, yeah, and similarly we'll create one more template called N by only.58:34And the steps keep on going. Yeah, so we'll create a application Profiles.58:45So That's what I see. And we'll not allow the L two stretch here again. We'll select the VRF and yeah, let's see here.59:03So this and then again we'll create a EPG. So.59:22Okay and we now need to create the new fabrics. So this needs to go only on the new York fabric and we'll just.59:47Save schema and deploy template, deploy out of scheme. Okay, so now we still need to create the contracts how but contract is needed to be present on both the sides, so we'll go back to the SF.01:00:00And then by template.01:00:19We will create a object and a contract. Okay, so we will go to contract we will give it a name to and then scope is VRF and then we know.01:00:21Also need to create a filter so we will just give it a name.01:00:41That filter name is any e.g. and yeah we are allowing the permit between the two EPGs, so name is any.01:00:48Okay and so this is a contract in which we'll just map this and create ok.01:01:04Yeah and then yeah ok so here some inform this entry is missing in the filter name, so we'll just give it another name, any name.01:01:18So we are just allowing everything basically, so we'll just click ok. Now you can save the schema and deploy the template.01:01:35Okay so now the contract is created, however, we have not yet mentioned what is going to be the provider and consumer for that contract. So we'll now go to.01:01:55Individual templates SF only and then we create object contract, so.01:02:09Okay, let me go back to.01:02:35So here I can now add a contract here, web to app and here the San Francisco is acting as a provider to this and then deploy.01:03:03And then we go to New York and use the contractors consumer. So we click on the EPG and then we add the contract and then we add web to web and it is a consumer.01:03:26Sure same schema deploy template and now if we go to any of these fabric we can go to tenants and then we can go to.01:03:41And then if you just see the contract standard contract. So if you see this this contract is created on the fabric and if you see on ACI also it should.01:04:05Knows that this was created by NDO, it is recommended too.01:04:20Be modified using NDO only. So this was the demo for policy creation ok and yeah ok so Naveen you can skip the part and then move to your.01:04:25Your Nexus dashboard telemetry.01:04:44Yeah, thank you. Thank you, Apurva. Hey, hello everyone. Thank you for joining. So as showing how to onboard the sites and create the contracts between the sites, the shadow objects, all those stuff. So let us now go to the demo of the telemetry part. So which is.01:04:47It's the day two operation. So once you onboard your sites, how do you, use Nexus dashboard for the day two operations like troubleshooting and monitoring purpose and the compliance also all those stuffs you can do it using the Nexus dashboard. So.01:05:07In the interest of the time, I'm quickly jumping onto the demo. So where I will be covering the topology, the, you know, the topology part and the custom dashboard teleme traffic analytics connectivity analytics, so all those.01:05:25Features I will be going through. So we also have a new feature called live protect, which is for mitigating detecting and mitigating the vulnerability in your fabric. So I will be also showing that as well, ok? Okay, so this is the Nexus dashboard page. So once you log into the nexus.01:05:46Dashboard so this is going to be your, the landing page. So where you can see the overview topology and the dashboard. So the 1st use case I'm going to show is the infrastructure discovery and the overview. So infrastructure discovery is where you know it is kind of quickly access your health.01:06:06With identity, identify the potential issues and understand overall infrastructure and infrastructure layout, right? So this is the overview page where you can see the anomaly level.01:06:25Of the entire entire fabric, right? So not only the entire infrastructure, not only the single fabric, so, and also the advisory level for the fab infrastructure and what is.01:06:37It is there in your infrastructure, right? So you have two fabrics or in my case I have two fabrics and the eight switches and the 21 endpoints and this is one of the sustainability energy management wizard. So this is also a new feature in four.two, right? So and also the recent time.01:06:53Activity you can see whatever the recent activities performed by the users, right? So under this one you can see the fabric that's been onboarded, so I have one nexus fabric and another ACA fabric.01:07:13And next comes the topology. So topology is where you can see the topological view of your fabric. So as I said, I have the ACA fabric and I have the Nexus fabric. So you can click on this fabric or any one of the.01:07:26Fabric and see the topological view of your fabric, right? So here I have two spines and two leaves and I have three controllers, so how this connectivity is connect how the links are connected. So you can quickly access this information without logging into the devices and you know the.01:07:44Showing the show CDP neighbor and manually creating your diagram. So this is all, you know, dynamically created using the information, the telemetry information from the devices. You can also click on the devices and see the connection as well. So which ports are connected to which ne.01:08:04Devices.01:08:24So this information you can see if you click on view details, it will take you to the complete view of the switch, ok? So for now I'm just skipping this part I will be showing in a different scenario. So then there is a dashboards, right? So this is the custom dash.01:08:27Dashboard.01:08:47So where you can create your own custom dashboard and you can have your own results. So this is the dashboard that's been already created. You can click on that one like so you can see what are the things that I have created in my dashboard, so you can see what are the top five.01:08:47Fabrics by anomaly summary, so if there are in in so which are the top fabrics by categorying the anomaly severities, ok? So anomalies are something like which are the deviation from the actual operation, right? So if something is.01:09:08Wrong. So that will be categorized as anomaly from the normal operation. So those anomalies are categorized as a critical warning and.01:09:28You know, the major, ok? So you can also see the devices by conformance status or how how well my devices are confirmed in terms of conformance right so and you can see the fabric by connectivity status, my fabrics are all showing.01:09:39So there is NO issue in terms of connectivity to the fabric, and this is a traffic analytics. So traffic analytics score is very important in terms of troubleshooting, so we'll be having I'll be showing different scenarios how you can use the traffic analytics score for, for troubleshooting different issues. So for now.01:09:59We see three, these three like congestion latency and drops are the three metrics that's been used for creating this, you know, evaluating the traffic analytics score of your fabric and you can see the devices by software conformance whether the software.01:10:19Which is running on the the which is running on the devices or NO it's not end of end of life or end of sale or there is NO vulnerability which is there is NO bug which is hitting those.01:10:39Versions, right? And you can see the top five interfaces and energy management the sustainability metrics for energy management. So this is the dashboard you can create. So if you want to have a full screen on your knock dashboard.01:10:58You can put it on a full screen in your NOC dashboard and monitor it. So auto refresh is by default enabled. It's been it will be by default refreshed. So.01:11:17It in a certain period of time ok yeah so this is about the initial landing page. So now we can go to the different scenarios, right? So where you might have the.01:11:29You might have the situation where you need to troubleshoot the slowness, ok? So how do you, so in a, in a general slowness so you have been reported with the general slowness issues by by the users, right? So which is the applications are very slow, so you want to identify what are the top.01:11:46Talk to us, what is the bandwidth utilization of the particular interface and if there is any unusual traffic pattern. So all these things you can do it using the analytics. It's like we have under analyze, we have analysis hub, so this is where you have.01:12:06All the features, right? You have traffic analytics, you have connectivity analysis, you have data analytics and the conformance for all these things.01:12:26So to to do you know these slowness issues or backend drops or the latency issues, the best place is to go to the traffic analytics. So traffic analytics, if you go.01:12:36You can just so select your fabrics so it will list all your fabrics so for now my interest is the ACI fabric and also I'm going to select the time duration as 6 h, so I want to see for the last 6 h, is there any anomalies?01:12:52That's, that's causing the slowness in our environment, ok? So I'm just clicking this one. So I can see there is there is NO, you know, you can see this traffic analytics score has reached two major, so because why because it reached two major is.01:13:11So that as I said traffic analytics is our traffic analytics score is measured by traffic analytics metrics, which is latency congestion and drops, ok? So if any of these metrics are critical or major.01:13:31Critical or major, it will automatically, evaluate that score based on this matrix, ok? So now my score is major, so which is which which might be the reason for the general slowness that our users are reporting. So you can go and see.01:13:48The, you know, this service category by score. So these service categories are the port numbers so whichever the port numbers are having the critical major or warning healthy, so that's been categorized by service category, ok? Then we'll also have the number of.01:14:08Service endpoints by category.01:14:28So here I can see in storage category I have three endpoints in database category I have two endpoints, but I can also see there is unusual gaming category which is having one endpoint. So which I am not expecting in any, any production, right? So, so these are all normal like storage database where.01:14:30But the gaming is not normally it's unusual, right?01:14:52So yeah, let's be let let's take a note of this one and then you can scroll down. So here is where you can do some filtering based on endpoints, service point, service port category, so all these things. And also these are the top talkers. So these top talkers, if you take, I can.01:14:56You see one top talker which is having the major major with related to the drop.01:15:16And you can also go through the number of, I mean the transmit and receive traffic under the TX rate RX rate for all these details in the top talkers, ok? So this is how you can go through, you know, the top talkers and identify.01:15:23If there is any issues, so you can just.01:15:43I'm going to filter it with the category because this is the unusual category I'm finding and I'm going to see which endpoint is causing this issue or which endpoint is sending this traffic for the gaming category. So I can see this is 1726.01:15:50In one.twenty, right? So this is a port number, this is the endpoint, and now the traffic analytics is healthy for this.01:16:08This endpoint, but it was having, you know, it was sending it was receiving highest traffic, right? So that is for GB, so, ok, so we can just click on this one and see.01:16:17Where this endpoint is connected and, you know, you can take note of the which interface this endpoint is connected, all these things and what are the endpoints which are talking to this endpoint, right? So you can filter it out, you can filter this port to avoid this traffic and check.01:16:35If the slowness is reduced or not, right?01:16:55So these are the general, if you want to troubleshoot a general smallness, you can go through this traffic analytics and see if there is any unusual traffic that's been generated in your family. So next, next you know there is a scenario where the customer is reporting.01:16:58Packet drops, the floor drops for the particular IP address. So if they are giving the particular IP address on the port number, how do you troubleshoot that one using the traffic analytics, right?01:17:20Okay, so 1st is you need to get the IP address on which the customer is reporting the packet drops, right? So in my case, it is 17216 zero.seven and the port number 8080, right?01:17:30Okay, so, so I want to check if there is anomaly for this particular IP address which has been reported. Okay, so I am going to the you have to go to manage and then go to fabric and I'm going to ACA fabric, so this.01:17:46This has been reported for the fabric, so I am going to anomalies, ok, so here you go, you have the tab called anomalies. So where you have to.01:18:06Grouped, so this will be, you know, these anomalies are grouped as a category, so I want to un group ungroup it to see a particular anomaly, right? So next I'm going to select the time range for the last 6 h.01:18:17And I'm going to use the filter called what's wrong contains under IP address which has been reported on 72.16.0.7, right?01:18:37So here I can see there are there are many anomalies, ok? So these are the anomalies I can see there are major 18 anomalies which is reported, for different IPs, but I can also see the IP that has been reported by a customer, right? So which is saying that.01:18:52Six four is not healthy and that is due to the buffer drop on detected on leaf two.01:19:12Okay, so you can click on this one, right? And see ok see this traffic score is not healthy, the same thing and you can note down the leaf too. So this is happening because of the.01:19:18Leaf two and you can see what triggered this anomaly, so this is triggered due to some buffer drop detector on leaf two. So why this is dropping, so we need to analyze. Then we can see the report, so far now this is fixed, so.01:19:38But you need to analyze why this happened, right? So it might be the intermittent drop, so you can just click on view report and see if there is any any information you can find. Okay, so I can see this service endpoint which is connected on leaf two and one/thirteen interface, so you need to note down this one.01:19:55In order to troubleshoot further at the switch level, ok? So these are the.01:20:15Endpoints which is communicating with this endpoint, ok? So you can see there is ok you can also see these are there are major major traffic analytics score for the drops, ok. So since the customer is also reporting the drops, so which is which we are able to correlate because.01:20:22Because we are getting the major, anomaly major anomaly so the for the drops, so the traffic analytic score is major for the drops, ok?01:20:42Okay, so now we have the leave switch details on the interface, so you can go to fabric again, fabric again and go to inventory, go to switch.01:20:53Go to leaf switch, so here also you can see the anomaly is showing critical, which is for the leaf two. Okay, let's go to leaf two and the interface was one/thirteen, so you can click on one/thirteen and see.01:21:13The general information, so which is one where this is connected the description which is connected to UCSC series which is associated with the hypervisor and here you can see the operational speed is one GB, so one GB is very less, right? So operational speed of one GB is less.01:21:32So let's dig into further. You can go to trends and statistics, so where you can give the, you know, the real time data is being captured and see the information about the status, operational status and the if there is any error.01:21:53And you can see, here you can scroll down so you can go through this different packets which is received on this interface and you can see the bandwidth utilization before that before that you have to.01:22:12Select the timing for last 6 h or the time frame which you want to analyze, so I'm just applying on the timeframe. Okay, so now you can see.01:22:31This utilization went to hundred percent frequently, ok? So this is the problem, right? So because of this, the customer experience that drops, ok? So either you have to.01:22:46Increase this speed of the interface or you have to create the QoS for the traffics which are to be prioritized. So these are the two ways you can mitigate this issue, right?01:23:03Okay, so now we have another situation where there is a congestion is happening. Okay, so because of that the latency is increasing, so again this is reported, so how do you troubleshoot the congestions and the microbe.01:23:211st so there will be a sudden traffic that's been that's been received on a switch buffer, so how do you identify those issues, right? So again, so here in this case I, the IP address reported is 17216 one.seven. So the same thing.01:23:41So you can go to.01:24:01The fabric and go to the fabric manage fabric and go to the fabric and go to anomalies and here you can post this one. This is un grouped already, select the time frame for the last 6 h.01:24:04Okay, so here again you can put the same contains the IP address on 72.16.1.7. So here you can see this IP address which is reported how the traffic.01:24:24Big health score not healthy that has happened due to the congestion.01:24:44Okay, so you can click on this one and note down the leaf interface and you can see this has happened due to condition and you can view the report and take down let's say like the same leaf one and the one/thirteen.01:24:49So, so here you can see, so this is connected on leaf one and one/thirteen. Again, you can go to the leaf one.01:25:07And one/thirteen, the same thing like so it has it has less bandwidth on the interface. So let's go and over the last 6 h.01:25:26Okay, so let me go to the other fabric. You have to go to the next fabric.01:25:42Okay ok so this one again the congestion one, so here you can see the report and see if there is if.01:26:17Can find the switch details on the interface. So here the switch detail is Nexus fabric, nexus leaf one and one/three. I'm going to click on this one where it will take you to the switch details and one/three. So here one/three.01:26:27So you can click on trends and statistics and see the utilization if there is anything so for the last 6 h. So the utilization wise I could see there is NO nothing much Utilization is normal.01:26:48But I can see this congestion score. Congestion score is now healthy, but if you see, here, you can see that statistics for the W red AFD drops and the PFC ECN, right? So here I can see this PFC ECN.01:27:04Packets are not generated. So that means, so there is NO marking happening so because of that, the congestion is happening, right? So if you have created the QOS policies of in order to prioritize so where you can see this, some packets will be generated.01:27:24The ECN packets and the PFC packets where you can you can say this has been prioritized or if there is more traffic that's been queued and and marked as ECN packets, right? So to avoid the congestion, but this is not happening, so here you need to create that.01:27:43QOS policies for the PFC under the ECM, right? So also I can see some microbust traffic here. So microbust traffic also detected using Nexus dashboard using the telemetry feature.01:28:04So you can see that there are some intermittent bursty traffic on that interface, right? So these are the things you can you can make use of traffic analytics under anomalies, right?01:28:17So for the troubleshooting purpose right so and ok so next thing is yeah.01:28:36Okay, so you want to troubleshoot some CRC errors so interface level CRC errors are also sometimes causing the issue for the performance related issues, right? So how do you troubleshoot that one? So.01:28:53Similarly, you can go to, go to the fabric, manage fabrics under then and then go to fabric and go to anomalies anomalies which is.01:29:13You can select un grouped and you can select last 2 h and here if you want to see any traffic, I mean if you want to troubleshoot the CRC errors you have to provide.01:29:30What, what's wrong contains CRC. So it will give you if there is any CRC related anomalies, right? In your fabric. So here I can see this anomaly is triggered on one/fourteen Leaf two is receiving, so on leaf two on one.01:29:50One/fourteen, we are receiving some stormed CRC packets, right? Stormed CRC packet from the neighbor device. Okay, so I'm going to click on and see what is that neighbor device.01:30:08Okay, so here you can see the same information leave two and one/fourteen and you can see how do I fix it? So here you can see, please check neighbor UCS N55 so there is some N5K device.01:30:21So N5K device which is causing, which is causing this tom put crc. So the corrupted packets from one/thirty, ok? So this is where the originating device, so originating devices UCS five K So because of the cut through cut through behavior of five K device.01:30:40So which is sending this, you know, the CRC errors, right? So you can also find in case any SFP related issues also you can see.01:31:00Okay, so I'm just going to that, the leaf switch two and I'm going to analyze one/fourteen. So click on this leaf, it will take you to that leaf switch. Here, I think it's one/fourteen, right? So one/fourteen, I am just.01:31:16Forwarding on this one, I can see this is a neighbor which was mentioned in the anomaly. I'm going to click on that one.01:31:36Right, so, ok, so I can see this anomaly too critical anomalies and going to click. So here you can see SFP diagnostics, right? You can just click on this one and you can see the transmit power and receive power. So usually.01:31:45This transmit power receive power should be.01:32:05You know between -13.922 dBm so where I can see which is in the correct range. So that means this port, this port, this port is not having any issue, any CRC related I mean the CFP related issues so you.01:32:09We need to check the other end device and see any physical related issue like cable side or the SFP side, right?01:32:29So this is how you can use these anomalies and traffic analytics for these troubleshooting or CRC errors, right? Okay, so, ok, so we now have seen this.01:32:39Traffic analytics so traffic analytics, so now we can go to the analysis analysis how under analyze. So we can now check the connectivity analysis. So connectivity analysis is used to do troubleshoot any any.01:32:56Any connectivity issues between the endpoints, right? So you can create your own connectivity analysis report and you can troubleshoot if there are any issues for the particular source and destination you want to troubleshoot, right? So usually you can use the trace route.01:33:14In a traditional environment you can use space route.01:33:34And see there has any issues between the endpoints, right? Similarly there is so this connectivity analysis is based on Elam tool, ok? So this you can see analysis option is done by Elam. So Elam is hardware level hardware level.01:33:38Packet trace, right? So it will simulate the actual packet between the source and destination and.01:33:58Do all the lookups, right? The routing lookup, the Mac address lookup routing lookup and contract lookup, and it will provide you the complete details of the you know the connectivity analysis of the source and destination, right?01:34:07So here this has been already created for this particular source under destination, so both are same in the same EPG, same VRF, same EPG, same tenant, ok? So now you can also see the path where this path is like so from source it is connected on.01:34:25Leaf one and the destination is connected on leaf two and if you want to see the complete analysis details, so what is happening on the particular switch level, right? You can click on that switch and you can click on analysis details.01:34:45So where you can see this general path information, source destination and what is the local ingress port and what is the egress port, right? So egress port is one/thirteen and ingress port is one/fifty 04:53.01:35:08Okay, so because it is connected to both the spines and the address which is connected to the destination endpoint. And you can also see the data plane complete information about the data plane that like what is the outer header like what is the mac? What is the source Mac, what is the destination mac? What is the inner.01:35:26The header, what is the outer L three header, source IP destination IP, and.01:35:46If you want to see the full report, you can click view full report and this is what most important the contract lookup, right? So contract lookup is where if the if the endpoint is between different EPG, it will have the source tag, source PC tag, destination PC tag.01:35:53And it will show you the contract results so here we don't need to have the contract because both are on the same EPG. But if you are troubleshooting the you know the different EPGs, so this is what you have to look at whether you.01:36:11Not having any contract drop, right?01:36:31Yeah, so this is about the connectivity analysis for troubleshooting the endpoints, endpoints connectivity, right? So, ok, so next thing is, you know, next thing you can do is the conformance, right? So if you want to do any compliance on.01:36:34On your infrastructure, whether you want to see all your hardware and software life cycles, right? So life cycles are within the supported life cycle stages and adequate capacity.01:36:54For your devices, so you can use this conformance thing, right? So it will give you the complete summary of the devices by hardware conformance. So I have zero critical, so all my hardware is having in compliance, so but yeah I have three warnings.01:37:08So which will remain same for next six months so next is I have eight healthy. So you can click on what does what is the three device which is having the hardware conformance issue. So I have only 01:47 days for the end of life announcement for this M four servers.01:37:28Also which are the M four which is going to be end of life in next 01:47 days. So before that, I need to do the replacement so you can plan your.01:37:49I know the hardware refresh, right? So software also it is it will be given, but now I don't have any critical or warning. I have all healthy. So in this case my my software is all healthy and.01:37:59There is NO vulnerability so you you can see that, right? Okay so the scale performance also you can see the scale performance meaning so each harder will have different tables, right? So those tables are.01:38:19All right so ok so those tables I saw there is NO violation for those tables like my Mac address table and there is NO limited, there is NO violator limit that's been reached for my MAC address table IP table.01:38:39So that the tcamp tables all these things. So if you have anything that's, that's you are utilizing high there is high utilization of door, those scaling objects, then that will be reflected here, ok?01:38:58Okay, so this is the demo about the Nexus dashboard different you know the different features that I want to cover. But one more feature that which is very interesting is, the live protect which is available in four point.01:39:18Two versions so I'll be showing the recorded demo of her.01:39:38The particular feature. So let me play the recording hello and welcome to live protect on access dashboard. Are you able to hear the audio? Once you log into next.01:39:42This dashboard with version four.two, you would see a new security card for advisory levels.01:40:02If you click on those, this one will give you the current active advisories. If you click on the impacted devices, it will show you the list of devices which are impacted by a security advisory. You can directly navigate from the home page by clicking any of the filters.01:40:08If you remove the filter, you will see the list of security advisories and their current status, as well as what their current protection status is. Now in order to check if the devices have.01:40:24Live protect enabled or not. You can go here and just use the filter saying live protect not enabled. In my setup, I have two devices where live protect is not available. I'll simply go ahead and click enable live product.01:40:40While live product is being enabled, I wanted to navigate through a couple of other screens. So we now have a new device security tab which brings you back into the same view which you can come from the home screen. What we also have is a topology.01:40:59As we saw previously, fabric one, all the devices were protected, so that's why the status here is green, and it will list all the devices with the compensating control. If I go back to my fabric two.01:41:16You would see that the device are currently either in monitoring mode or not protected. That's why you see them in the gray. Now this is a good and quick way to get overview status of your fabric.01:41:34Now coming back to security advisory, as you can see here, this security advisory is fully protected. And once I click on that, you would see that as well. Now, we've enabled.01:41:52The feature unex secure or enable life protect, but now it's time to deploy the compensating control. Once I go and look at the security advisory, as you can see here, I have few which are failed to deploy, but I have few which has live protect enabled.01:42:08And composity control enabled. Let's select one of them and we go and say protect mode, either monitor mode or disable mode or you can do composity control and protecting more. So let's go ahead and select monitor mode.01:42:24And once you click on that, that's it. If you want to see the status, as you can see here on my fabric to leaf two currently live product is being deployed. And if there was an exposure to the security advisories, you would see hit count increasing.01:42:42In an ideal scenario, it count should be zero. But if you see hit count, that means you are someone was trying to exploit this security advisory. Once compensating control is successfully deployed, you would see this as well.01:43:00Since not all the devices are protected, you will see the status as partially protected. If all the devices in the fabric are protected, you will see as protected. So this concludes the demo of using Nexus dashboard to manage live protect. One last thing I wanted to show is.01:43:17Nexus dashboard can talk to inter site and get the security advisory.01:43:37And live protect directly from inter site. But if not, you can manually update the metadata by going here and pulling that file and uploading the metadata. This concludes the presentation.01:43:42For Nexus dashboard with security advisories and you can see here this change from available to monitoring and if needed, we can go and make it in a different mode as well, which is protect mode.01:43:58Thank you. Yeah, so this was the demo about live products, so I hope this demo helps you to understand what are the different features for ND, particularly in the 4.1 and 4.2.01:44:15Yeah, thank you everyone so yeah I'm passing ball to so thank you Naveen, thank you. I think we are over 15 min, but I hope.01:44:32You got an insightful session and with that I just want to let you know we have also pasted, pasted a link in the chat panel which you can reference in case you want to check out this recording or any previous recording and if you want to reach out to us you can email us on the email mentioned in the chat.01:44:51That panel and with that I wish you the best and hope to see you again in our next session. Thank you so much.01:45:11