DeepDive into configuration group and policy group

Oh, Hello everyone, and welcome to today's EIS session. We'll be going over configuration groups and policy groups.00:00Today and we'll be diving deeper into how do we configure QoS and application of the routing and some of its additional features that SD WAN provides in today's session. To set level expectations, we'll be briefly going over configuration group.00:20And we want to spend majority of our time, over how do we create and what are some concepts of.00:40QS, how do we create it from policy groups and then we'll be going into AR, what is enhanced AR and topology. My name is Tushar. I'm a customer success specialist at Cisco and.00:49I'm joined with joined by my colleague Nester to do all the demos, right? And we also have Aris and as panelists who will be helping us answer any questions that you have along the session. So please feel free to put your.01:06Questions in the chat and we'll try and answer all those questions. All right, jumping into today's agenda. So we'll be going over configuration groups. 1st we'll have a brief overview.01:26Great, how do we create configuration groups? I will not cover that in the slides. Nestor is gonna cover the cover it in demos, right? And then we will go into migration tool. And after that we'll go into policy groups. What is the struct.01:45Oh, and then we'll go into QoS policies, AR policy and topology, and we'll have demos for those as well. All right, let's dive into that with them. All right, 1st configuration groups, right? Why are we making.02:06Or migrating to configuration groups. We have been hearing from hearing lot of customer feedback, right? The.02:26The way we were configuring templates for devices was really complex to understand we had to go back and forth between various feature templates and various dashboards, right? To create a conf a configuration for a device, right? So that's where.02:36Configuration groups was bought in, right? It's simple, reusable, and it's a structured structured approach for configuration, right? It is a workflow based configuration that guides the user with step by step instructions. It clearly identifies what is necessary and what is optional.02:56And what is recommended, right? With Cisco best practices. It's reusable. One of the major limitations that we had with templates was that it was bound by hardware, right? You had to create like even if the configuration was same.03:15It was, we had to create multiple sub templates for various hardwares, right? That is not the case with configuration groups. You can create one single profile, right? Like system profile or so on, and it can be reused for.03:34Any other devices that are present in your environment. So it's reusable, right? Configuration comp components can be reused.03:54And it's not tied to, hardware model, then the structure, right? You would definitely like it initially it's a little bit of a learning curve, but once you get used to it, right? And once you explore it a little bit, you can definitely feel the difference, right?04:03Everything is structured very in a way that you have, you will find all the configuration easier, right? And to navigate and.04:23Configure the device. What are some major changes rate? In UX.one we had device specific templates bound to hardware, whereas in configuration groups, it is gonna be based based on.04:35A read like set of devices right that you group together based on similarity, right? You can use all the pre configured profiles in any of those devices.04:55Alright, so what are some terminologies, right? Now we have been hear hearing all these terms, right? So we just wanted you guys to be familiarized with this, right? Configuration groups is the main template, right? Like basically which consists all the configuration similar.05:11To templates. So configuration is logical grouping of devices that shares the common purpose within the van.05:30The user can define or or can customize this grouping based on their business needs, right? It can be east, west, Americas region, Europe region, Asia region, it's gonna be group based.05:37Divide or so on, right? Then in configuration groups, there is feature profiles, right? What does configuration group consist of? It consists of various feature profiles, right? These are flexible buckets of configuration that can be shared across configuration groups. You.05:55To create feature profile based on features that are required and then they are put together to complete device configuration like building blocks, right? So you have basic profile which consists logging, banner, your system configuration, right? Your global configurations. Then there is one profile, which we.06:13Basically consists of your WAN VPN, right? Or VRF which is VRF zero.06:33And under that you will have your van interfaces like colors, MPLS LTE internet, right? And then you have your LAN profile, which consists of your land side configuration, right? Or vrfs, and then.06:40Those feature profiles, right, are then subdivided into smaller blocks or parcels, right? Which are called feature parcels. Feature parcels are construct feature profiles are constructed of feature parcels, right? They are individual capabilities that you wish to share across.06:56Right, it could be logging, banner, this subset of configuration.07:16Right. So these are some of the termino terminologies that you need to be familiar with when you are working with configuration groups. In you in classic classic way of building configuration, you would see templates, right? Device templates, feature templates.07:20Which was basically subset, then you will have localized policy and centralized policy, right? What UX.two, what we have tried to do is basically club together all the control policy or any policy that we are implementing on device, right? So initially you had to build a local.07:40Localized policy and attach it under templates, right? We have, we are parting away from that.08:00And basically grouping all the policy together, right? So you will have network hierarchy, configuration groups, policy groups, rate and topology. So policy groups with your all of your policy, right? It could be your localized policy centralized policy.08:07Security policy, a SIG policy, all of that. And then you have your topology, right? Full mesh, any custom topologies. We have been receiving, we have been having conversations about migration with customers and I have received a lot of questions around can we have our environment.08:27Halfway on templates and halfway on configuration groups. Yes, that is possible, right? You, any customer cannot directly migrate all of their devices to configuration groups, right? It has to be a consistent migration process and it could take months or so, right? So you are half of your devices can.08:48Can be on configuration group, configuration groups. And you can still be using your.09:07Localized sorry control policy that is in place. For your localized policy, like your QoS policy or so, you will have to have a CLI add on until you create a policy. So here is a structure, right? So.09:14What are the major differences, right, that you would find out when you are comparing it with our templates?09:34Your system profile consists of all of this, all of this sub configurations. In addition to that, right, you will see, as you would know, right? Like you would have your access list configured under your localized policy and add on, right?09:42Now, any policy that is needed for, let's say your SSH access SNMP, that will be under your system profile, right? Under your global settings. Let's say you are trying to have a ACL or route map or route policy.10:01On a transport interface, right? That you will find under your transport profile, right? All other configuration is kind of similar, but these are the major changes that you would see. Then similarly under service profile, you would see your route policy and ACL.10:21Subconfiguration that can be done. What is the major change, right? When you're moving from templates to configuration groups is, your QoS and security policies is moved into policy groups, right? And your app visibility flow is a flow visibility configuration is.10:39More under collectors.10:59Right, basically those two commands rate app-visibility and flow-visibility that are moved under global setting what are some ways to create device configuration with configuration groups, right? There are four ways.11:02Using workflows using manual creation, using export import and installing from catalog, right? Workflow is basically your guided workflow, which it which goes through creating every set of configuration, it guides you through the process of creating your VAN profile land profile.11:23System profile and all of that, right? Manual is basically you're creating all those profiles, system profiles, transport profiles, service profiles individually, and then you're calling it out under main configuration groups. Export import is basically, let's say you're creating a configuration groups in your lab environment.11:43Once you are fully developed it, then you are basically exporting it and then importing it into a production environment. Installing from catalog is basically you have predefined Cisco verified configuration.12:02Configuration groups in those catalogs, which are based on let's say single side dual side with MPLS and different sets, right? So you can basically download those and you cannot make changes to those, but you may do duplicate it and then customize it based on.12:17Than it.12:37I will not be covering creating this. Nestor will cover this going into the demo. What I'm gonna cover next is migration tool, right? I know a lot of the customers are trying to migrate to uX.two to use configuration groups.12:38And policy groups, right? And I have seen a lot of questions around.12:58How does it happen? What happens in the background? Is it, is it stable enough? Do we see any errors? So this tool has been around for more than two years now and we have been, Cisco has been consistently improving this, right? I have walked through various customers.13:04Using these tools and they have seen good results to migrate from their templates to configuration groups. When we are using this temp way using this tool, right? What it is doing is basically extracting your templates data.13:24Putting it on that tool, migrating into configuration groups, exporting all of your subset rate like let's say your VPN list VPN list, let's say your data prefixes, ACLs, whatever you have, right? And then it's basically migrating that configuration.13:40Migrating that configuration to configuration groups, and then you can export it, right? Or the tool can automatically export it to your vmanage, and it is not basically attaching that, attaching your device once it's converted, right?14:00You it is by just giving you configuration groups. After that, you can plan your migration windows and try to migrate to your configuration groups and alright how does this tool work? You can access this particular link, right? Where there are two.14:17Two ways, right? You can have, you will have to enter your SD WAN manager IP, username password, and, your manager port, right? If you see here, if it's a on prem on prem controller or we manage.14:37Controller, then you will have to have this.14:57Firewall rule in place which is allowing 70 420-710-3254 traffic to be allowed, right? So, yeah, keep that in mind and it's very, very easy to go through this, right? Once it goes collects all the information.15:02Imports all the templates, right? As you can see it is importing network hierarchy, centralized policy, localized policy, policy definitions, all of that. Then you have an option to select, right? Which template, let's say you just want to have three, three templates that.15:22Like let's say you have three standardized templates that you just want to migrate to configuration groups, right? And reduce the clutter that you have had with templates. You can do that. And then you basically convert it.15:42And upload it, right? Which basically uploads it to the V manage. Second way is like this upload templates exported from your SD WAN manager, like from version 2015 five and 20 eighteen.X.15:57From your V manage itself, right? You, you have an option to go to that tool or export your conf templates and then upload it here and basically then again download the converted configuration groups and upload it to configuration groups.16:15Policy groups and upload it to be manage. So yeah, this is the process you can go there 1st is you will see a configuration group icon, export the files and basically you can upload it there. I'll hand it over to Nester for a quick demo of.16:35Of configuration groups and migration tool.16:55Alright, thanks so much for explaining all the different concepts that are key to understand all the health concept of the configuration groups. As the mentioned there are different part of elements, so it's important to understand those before to actually have the opportunity to work with calculation groups. So I will share my screen.16:59See that here screen one. Alright, so so this is a good demo so the purpose of this demo is to actually show configuration group 1st and second to do a demo of the configuration comparison tool.17:22Which is inside of the SSP portal, ok?17:41So I'm gonna start with the clear the configuration group demonstration. So for that we're going to follow the manual approach, which I think that is gonna demonstrate all the different capabilities. You can still using the automated way using the workflow, but it will be a little bit more limited in the time of.17:45Of the options or details that you can actually provide, but it's still good for beginners.18:05For the users, ok? So I'm gonna create this one called CHG lab demo as lab, and so I'm gonna create this one. Remember here that it's gonna be.18:11Be asking you for this type site. I'm going to in in my case I go to select the single router, but you can also use the case that you have two in allocation with two routers using the station or those kind of things, ok?18:31For the purpose of the demo session I'm gonna keep it simple. Okay, so once you add it you will notice here that it's gonna ask you for system profile and also for transport profile but you will notice that as, as also mentioned.18:48The magic happens on the configuration groups through profiles. You will notice that there are a lot of profiles, so, the 1st thing that you need to consider about the profiles are that we have five primary profiles, which are the system, transport policy profile, service profile, and also.19:04The CLI add on profile. You will notice that there are other two which are the EUC voice profile and the older profile, but those are good to be covering some specific use cases like the thousand eyes agent installation or cyber vision also installation. So this is gonna be more for the next.19:24Cases that are not typically common deployed, ok? So that's why we are we will be focused on today's session on the primary ones which are the five that I mentioned earlier, ok?19:46So I'm gonna start with the system one, I'm going to select this one and I'm gonna show you all the different details that you will find on this system profile feature, ok? So this is the profiles as an identity of your device where you will configure all the.19:57Additional things and settings you will define how the, the device will be accessed, how are those BFD parameters or those OMP parameters that can be also customized here. So essentially you will also configure things like NTP or.20:17Also, if you click on the add new feature button in the top right.20:37You will actually see more options like the banner SNMP configuration, which is quite important. So it's pretty much how the device is going to be identified, how it's going to be accessed, and how's those global parameters going to be defined, right? Like the BFD one P and those things that I have mentioned, ok?20:44One important thing is that as, as to has mentioned in previous slides is that we don't have more any more the concept of localized policy. And the reason for that is that the localized policy has been divided into certain parts of these profiles inside that is gonna be.21:03Part of the configuration group.21:24So you will notice that we now have the option to configure a, a device access list to define who can access, who can who can have the right to access this device and those kind of things indirectly on the system profile itself. So you don't actually need to define it in the localized and.21:26Going to import it. So with this, the purpose is to avoid this unused information that we is gonna be carried over, so you will actually import what is actually needed on every single device. So that's the intention of the system profile and that's why we are offering that.21:46Kind of level of detail inside of the profiles groups, ok? You will see also there are some elements that are also part of the localized policy that are going to mention in the in the other profiles. So let's move on and have already selected this one and let's talk about the transport.22:05And management profile, ok?22:24Inside of the transport and management profile is where we actually define how gonna be the management VPN connection, how it gonna be where those what are gonna be the secrets that are going to be part of that given location or that given devices.22:28So here you will define things like what is gonna be the the management VPN type of permission and by clicking on the add new feature button, you will actually notice that management and transport VPN has been already selected. And this is one of the key things that that is gonna be provided.22:45Like this profile is the definition of what are the oldest transport and management VPN settings, interfaces, type of routing protocol if is there any type of protocol needed for that specific VPN?23:05And also all the the different type of connection, right? Inside of the transport VPN or inside of the regular transport VPN, you will encounter all the different settings that were available if you remember on the underlay configuration, right?23:22Internet interfaces, yearly IPsec, all the available options as you see here, the the list is long when it comes to the available interfaces type and and that is because we know that for sure that the underlay level you now have quite an option, right? Might be an LTE connection.23:38Multi link or can be annual, so the the list is actually big, ok? You will also notice that is one of the older elements that is coming as by moving away from the localized policy concept, which are the.23:59In protocol definitions, right?24:18BGP or OSPF OSPF version three is also is now inside of the transport VPN itself. You don't actually need to to define any other place. It's going to be in line while you are configuring all the parameters for your VPN itself. It's gonna be now part of here, ok?24:20Now, the interfaces level, what we see on the interface level, we see the common features that are related with the interface configuration, which are the trackers, the access list that helped us to define and to prevent and and and.24:40And unauthorized access if needed for a given one connection or secret connection and that's pretty much it is pretty much what the transport have, ok?25:00So, I'm going to add the other two profiles remember, in here the idea is to start adding profile as needed. You don't necessarily need to add all of them. You are using just the service profile and the transport and the system profile and you are good to go. That's fine, but if you are the.25:13You see service profile and also the policy and also any other other profiles available there. You can also add it, ok? So I'm gonna add the service profile, which is the next one, the email list. Okay.25:33And by clicking on the pencil we will see all the available options. This one is very straightforward to be honest, it's pretty much all the features that you saw on the underlay is also available in the service VPN. Of course, what is the idea here is we are now talking about the overlay, right? Because it's NO underlay anymore, right? It's service.25:50VPN. So, on here the idea is to define all the service VPN that is gonna be part of that given locations or or location or location. Remember that the configuration group is intend to be used for multiple devices.26:10And, inside of the VPN configuration, you will expect things like the routing protocols as we mentioned earlier on the transport VPNs as well, the available interfaces, now here the links is a little bit more than because.26:24The service VPN related or supportable interfaces is is a little bit small, right? But, when it comes to the other things like the tracker role policy is also available here, ok? Notice as well by clicking on the app plus a new feature.26:42On their the interface inside of the service VPN, you will also have the ACL configure the ACL available elements or the feature parcels for the acl's definition and also the tracker group configuration or the tracker elements if you want to keep monitor the state or a given.27:02Interface, ok?27:22What is the other one? It's a policy profile, ok? The policy profile behaves more like a kind of container of all the different elements that has gonna be used as part of the policy definition in a given device, right? So you will notice things like the class map definitions, the data prefixes.27:26And all those different elements that are going to be pretty much used on a policy definition that can be a QoS policy or can be a road policy or data policy. It's gonna be also defined on here, ok? So it's gonna be a kind of container to to carry over all those elements.27:46That are going to be necessary for a policy execution, ok?28:06So this one is quite important and that's why you notice is is something that is gonna be necessary for for the devices especially because the majority of them are gonna have of course a policy definition.28:12Okay, I'm gonna finish up with the CLI add on, ok? On the inside of the CLI add on, it's it's pretty much you won't see the 1st thing that you will notice is that there is NO plus new feature button or anything like that available because inside of this, the idea is to.28:29Replace the purpose of the CRI add on templates that was earlier in the US one point oh.28:49Oh, here, this concept is is now being replaced on the CLA add on profile but essentially the purpose is basically the same, right? To provide this support for those commands that are not natalie support on their QE option or the feature parcels on.28:55On the profiles itself, ok? So that provides that one and also any kind of automation in case that you want to do certain to define some variables.29:15And you want to do it this way because it's more aligned to your needs. That's also available in here, ok? Alright, so now that I have defined it, how can I make sure to apply this? The way that we apply this is to.29:271st associated device in our case, this is the topology that I have. It's a single topology with just two transports and the idea is that to associate this device, this device is the one that is not being assigned yet to a configuration group.29:44And so I'm gonna do it right now, and we're gonna click save, and it shows as a out of sync it's because.30:03It's actually a device that is not yet being deployed, ok? So I'm gonna do deploy it's gonna ask you for the all the values on.30:19In the parameters that we have selected according to the profiles that we have defined.30:39So this is a quick demo. The idea here is not to take a lot of time to define it. Okay, so all the information has been populated. You will you will need to do it manually or using.30:47The CSB approach.31:07I think that's at this point everyone is familiar too because it's the same concept of the templates and now you click on deploy. All right, while doing this, we are going to demo 2nd part of the demo which is to go to the configuration tool wizard, ok?31:09But 1st of all, I would like to show you a kind of a shortcuts that we have for this. So you go to the classic templates and assuming that you don't have yet initiated your journey with the configuration groups, you click on configuration conversion and you will see two options the export file and go to the SD one portal.31:29Did you click on the SD WAN portal, it's gonna create you to the SSP portal that I have already opened, ok?31:49In my case, I'm gonna go ahead and do an export file to actually have the information ready to show you, on the further on the further demo, ok? So it's gonna ask for file. It's gonna take some time, ok? It just take a couple seconds.31:56And, on here, so it's gonna relate you to this part, ok? Which is called as mentioned, you have two options, right? One is doing online, which is going to ask you for your URL or the IP address, the public IP address in this case.32:13Remember here, it should have cloud access. The tool itself is gonna have access to all your SD one public APIs and you just need to provide their credentials for that, ok? Let's say that you are running in a gap.32:31Environment or you don't actually want to do it in that way, right? And you want to do it offline. That is possible. And for that you click on 2nd option and upload templates exported to and remember I already asked using that borner.32:50So it's gonna be just matter of uploading, ok? We click on next and we can select all the files or all the different templates that you want to convert, ok? I'm gonna select next, all of them.33:05And all the configuration has been now translated, ok? You can start to just clicking on download, download converted configuration and as simple as, go to configuration groups.33:22You can just click on import button and import the export file directly in your I'm not gonna do it right now because it's not and it's gonna scroll down a little bit the information that I need to for 2nd, ok?33:45Thanks so much pass the ball to share again and see you in the next demo. Thanks so much. Thank you, thank you for the informational demo Nestor. I'll take over are you guys able to see my screen?34:05Can anyone confirm? Alright, alright, i'll jump into policy architecture, right? So, we have three different types of when it comes to SD WAN policy architecture, right? There are three.34:23Three different functional domains, right? There is control policies which are applied at vsmarts, right? Which are trailer tailored to route your information, advertise that to your endpoints, right? Then there is app route policies which are applied at vanages, right? Which are basically our SLA driven path selections for.34:43The applications, right? And then there is data policies which are applied at vantages which extensively drive routing, right? So, in SD WAN architecture there are three types of policies. So when it comes to to further drill down a little bit, right? Then.35:03And there is centralized policy and then there is localized policy, right? Centralized policy consists of your topology, which is your full mesh, full mesh, could be hub and spoke or customized topology, right? Which is in your configuration comes comes under topology, right? Then you have.35:23Your application of a routing, data policy.35:43Which is coming under in your application priority NSA, right? And this is basically defined on your V manager. And basically it will be pushed to your centralized policy basically lives on your right or your controllers and basically all.35:47All the, all the actions, right? And rules basically set in your.36:07Routers policy routing information piece, right? So that is how a basic basically how centralized policy stores and how the structure looks like. For your localized policy, it consists of your TOS policies on this firewall policy.36:13Local data policy rate, your BGP IGP route maps, not route maps, but any routes not needed to be advertised also can be can be put on localized policy, right? It's defined defined on the manager.36:31V manager or SD WAN catalyst manager and is basically pushed to your device directly and it will show up as configuration, right? When you do show SD WAN run, you will see all that configuration present on the device.36:51Alright, what are the building blocks of centralized policy, right? You have your group of interest, right? Or on 2015 you would list, you would see it as group of interest on 2018 it has objects and so on and policies. So you have prefix, site lists t locks.37:06And all of your objects under those, right? Your subsections or sub parts of those. Then you have your actual policy definition, right? Which consists of your control policy like AE, your data policies, right? And then you have you have your direction, right? And apply direct.37:26Direction where, where you are applying the policy, right? And all that together enforces or con brings together your centralized policy.37:45So as I mentioned on the previous slide, right, direction of policy is very important, right? When you apply a policy in the inbound direction, whatever, whatever routing of updates that are coming to your controller, right? Or we smart, your policy takes action on those, right?38:02The routes, let's say you're blocking certain logs from a particular site list, then it would not be advertised to certain sites. If it's outbound, then basically your best path selection is already done on the, on the V smart.38:22And then the policy takes takes action, right? So keep in mind that policies direction is important when utilizing centralized policies. What are order of operation, right? When, when we see rate lake.38:36So what we have is we may have the same rule applied on a centralized policy and or data policy as well, right? What does take, what takes precedence, right? Or what overwrites what? So that's where this comes, this picture or this order of operations come into picture, right?38:56When a packet comes in, you have your local ingress policy that takes that basically makes changes to it, applies classification, marking on the packet itself, and then it basically goes through centralized app route policy, data policy, routing and forwarding.39:17Right? So let's say you have something defined on second centralized wrapper policy, right? And then you have something that is defined in data policy as well. So your data policy is gonna take precedent. So remember to not have conflicting sequences making different.39:36Decisions.39:56What are some use cases, right? Based on these policies that we are seeing, right? When it comes to centralized policy or topology, it defines basically your VPN topology, right? It could be customized customized topology or hub and spoke, right?40:01Then you have your data policy basically which helps you manipulate local routing information routing updates to your neighbor or so, right? Then yeah, it helps you and helps you mark the traffic queue, queuing, shaping policing, all of that.40:21Right, then you have application aware routing, which is basically SLA based traffic steering, right? Let's say one of your circuit is not performing as based on your SLA that you have defined, right? It will help you redirect your traffic to, let's say your best backup path or so, right?40:41And then you have your QoS basically which is helping you manage or avoid condition, guaranteed bandwidth, right? And traffic queuing and so on, right? So these are some of the, some of the use cases that we achieve with policies.41:01All right. What is a policy group framework, right? Basically a user defines the intent, right? Using policy group, which is combination of your centralized and localized and security policies, right? And then the policy group creates corresponding configuration to the edge routers or the control.41:18Right and send it to the. What are the prerequisites for it? Deploy configuration groups, right? When you are using policy groups, we'll have to have configuration groups to the router and then assign device template or configuration group to your controllers, right? That is necessary or else you would not.41:38Be able to send, forward or apply centralized policy or any place. Okay.41:58What are some components of policy groups, right? It is divided into four components, one is application priority and SLA which consists of data policy, QoS, AR, then you have security part of it, right? Embedded security which consists of zone based firewall, IPS ideas, AMP URL filtering, then.42:07You have secure internet gateway, right? Yeah, you have let's say you have a zscaler tunnel secure access tunnel.42:26That is implemented through this particular segment of the section or component of the policy. And then you have your DNS security, right? Those are the four key components that you would see that needs to be defined when creating a configuration policy group.42:36All right, I know a lot of us have like what is going well, right? We are very familiar with New York's dot one centralized policy. Here is a diagram, right? Like your topology is going into, let's say, hub and spoke full mesh custom topologies that are basically pushed into topology.42:55Right your list, all the parameters, small small parameters that you have defined.43:15It goes into group of interest, right? In 2015 it is named as group of interest on 2018 is a little different, right? Objects I I can, it is present on next slides, right? Then you have, you have your traffic policies. R data policy are part of application priority and SLA, right?43:20And then your C flow diff basically which is app visibility and flow visibility goes under your collectors.43:40Right, so these are the groups that it's migrated to. All right, jumping into QoS, right? When working with QoS, we need to be familiar with class maps, right? Which defines how traffic is classified into different forwarding classes, right? Then you.43:46Have your classification and DSCP remarking, right? Basically you which uses ACLs to match incoming traffic based on IP protocol or DSCP values, right? And then you have your policy which can be optional, which is basically controls your bandwidth.44:06But for specific clues.44:26Right, by limiting both sides and defining the action when limits are exceeded, right? And then you have your forwarding classes and QS scheduling, right? Which basically defines how queue behaves on their interface, right? And then you have your QS map.44:28Which is basically bringing all that together, right? By binding the class maps, the queues with scheduling types of bandwidth, right? Bandwidth allocation, and it also can reinclude include like DSCP rewrite rules also, right? So these are the some of the things I I'm not gonna go into detail.44:47Feels about this as it's pretty standard standardized policy or.45:07It has been around for a long time, so everyone knows about what is it, right? So how do you create QoS policy using predefined variables, right? In policy groups, there are two ways. One is a pre with predefined variables where when you go to configuration policy groups, application priorities.45:16You have a standardized predefined rules, right? If you see, it has SD WAN fabric traffic policy which consists of gold, like this is based on business relevance. It consists of various predefined applications, right? Predefined SLAs and.45:36Parts as well. So you can utilize this to create, it's like few few clicks creating a policy, right? Then it has internet offload traffic section where you if you have SIG, you can define that. If you have DIA, you can define that. And then you have where you are applying the policy, right?45:54Get direction VPNs and which interface you are applying your QoS to.46:15Right, in this predefined variables, when you go into business rate, like let's say you can basically, there is this section and you can basically maximize this and you can see what are the used used application under that, right? What is the SLA? And you can edit.46:20Those right basically and you cannot delete the traffic, delete the application, but you can move the application from gold to silver. Silver, right? And move from silver to gold as per your environment.46:40Then your SLA SLA can also be reconfigured based on your environment and then you have your QS queues, right? You can basically redefine your bandwidth percentage based on your queue model or so on, right? So.46:58So that that is the 1st way, right? This is a quick.47:16Quick understanding of where do the applications or that business relevance comes from and if you are interested to look at it, you can go into configuration, application catalog and up in applications rate you can find that information. Based on business relevance, they have predefined application lists and so on.47:23Right, which can be utilized. And you can create customized application list if needed as well. Let's say you are creating and you are very used to the classic way of creating it, right? You can basically enable the advanced view, right? So.47:41Right here you can see advanced layout, right? When when you enable that advanced layout, you will find a similar option, which is kind of similar to classically, right? So, to create that, right? To create that you need to have some predefined object.48:02Right you need to have forwarding class policer QoS scheduler, which can be configured under group of interest or objects and profile, which is the exact same thing, right? So here you can create a forwarding class policer list, also you have to create a qs policy.48:22Right, which is under application priority and SLA. Nestor will go over that in his demo. So once you go into policies and application priority SLA, right? You can 1st add traffic policy and in that you can add a match condition, right? It can be based on DSC DSC.48:42Be value if you have a, if you are if you have traffic being already marked.49:02Or it can be based on application list, right? And then you add an action, right? And based on action provided to forwarding class, right? And if you want to have a DSCP value, that is an option, right? Under that you can have add the QS policy, right? You can define the QS policy.49:10So, yeah, so that is how you create a QoS policy or QoS configuration under policy groups.49:29And once that is done, you can basically go into policy groups, select the particular created application priority SLA policy and then basically attach the site you want to push it to and basically deploy it out.49:37Alright, what are some of the QoS features, right? There is per tunnel QS which basically allocates the bandwidth on per tunnel basis, right? Then what are some additional features that SD WAN provides, right? These are the like per tunnel QoS adaptive QoS, and per VPN QoS, right? I'll go in.49:59The details of it a little bit. So what are we trying to solve with per tunnel QoS, right? Qos on hub could be shaped only, could shape only the aggregate traffic on its WAN interface. It couldn't tell how much traffic was going to each branch, right?50:19Hub in the data center often on a large circuit could send more traffic to the small branch than the branch link could handle. For that we we can utilize portal QS with adaptive shipping, right? So this solution provides.50:38Provides granular traffic shaping on data traffic sent over IPsec tunnels, right? From hub routers to hub routers and data centers to branch sites.50:59Then there is adaptive QoS, right? It's part of your portal QoS, so they basically what we saw is the shaping mechanism mechanism was strict, right? And may not reflect the actual bandwidth available at the remote spoke, right? With per tunnel QoS. So.51:11So this adaptive QS basically.51:29Allows us for efficient, allows us to use bandwidth efficiently, right? By allowing hub site to reduce sending speed on, to basically remote sites, right? Or spoke sites. So that is adaptive case.51:33And then, there is per VPN QoS, right? Initially SD WAN solution only had limited QoS models, right? Which was your physical interface and portunit QoS, right? And one interface is not aware of VPN traffic.51:51Which means all the VPN traffic still shares the same SD WAN resources, right? That's where port VPN QS came into picture, right?52:11It was our interesting seventeen.six, so it has been around for a long time, right? So traffic throughput could be differentiated based on VPN, right? Does providing capability to regulate throughput ratio among among the VPNs, right? And also.52:22Three D VPN is limited and how much output bandwidth it can use and therefore it limiting the hogging of the resources, right? So that's where per VPN QS can be utilized.52:41Alright, yeah, I'm not gonna go into details of the configuration for this, right? You can go into configuration group transport and management, management profiles, transport VPN, Ethernet interface and under tunnels and the.52:59QoS, you can find tunnel per tunnel QoS, right? What is the mode?53:16Same on the spoke side, you can find adaptive QoS, upstream minimum max bandwidths, adaptive QoS default upstream bandwidths, all of that configuration, right? So this is under configuration groups.53:23Alright, I'll hand it over to Nester for a quick demo. Alright, thanks so much for explaining the concepts of the policy groups.53:38I'm gonna just do some some demos about it. This one is the specific is gonna be about QoS, ok? But the intention here is to simulate the kind of simple scenario qs, but of course you with the benefit of understanding how's that in the.53:53The configuration and the policy group configuration.54:14That's gonna look like and demystify a lot of kind of questions or concerns about how you can achieve ECQS using policy groups, ok? So I'm gonna share my screen. All right, hopefully you can see now.54:17So, this is the the the policy group configuration scheme. You will notice that inside of this we have the policy group, which is the 1st tab. This one is actually the tab that specifies what is the, the policy group.54:35Policy group think the policy group was a kind of container of policies, ok?54:55What are the policies that we're talking about, application priority SLA, next generation files, security to that gateway or secure service age and the DNS security, ok? These are the full policies that we now have, ok? And, not necessarily you need to exclude all of them. I mean similar to the configuration group, it doesn't mean.54:59That you need to use all of them at once, ok? It just means that you can just include it as.55:19To meet the certain requirements in your network, ok? So that's, that's the purpose of having it this way, ok? On the demos we are going to be focused on the most important ones where which is the application priority and SLA because this one is is the one that you will be doing as, Asher mentioned, a centralized.55:27As all the centralized policy is starting from application aware routing policy QoS policy and also a data policy centralized.55:47It's gonna be part of here. So that's why it's quite important to understand a little bit what this application entails, ok? So, as this is I'm gonna show you 1st, we have already find policy group as you see here.55:55The only policy that is in in use on here is the QoS application and application priority.56:16And nothing else, ok? So let's review, the QoS policy, ok? So this is the QoS that was gonna be used. So let's deep dive on what are the elements or how's that defined, right? So, the 1st thing to notice is that you will get an empty plant.56:22I mean this one is this one that's the moment that you create from scratch, ok? And you type on the traffic policy, you need to specify a name and then a VPN and then a direction or a default action, ok?56:42I'm going to actually edit this one as you were entering from scratch, ok? So that ACL version one. The VPN that are gonna be applied to is through the three VPNs service VN that I have in my environment, ok?56:57I'm gonna do it from services because I'm going to make sure that all those application that is coming from the service side has going to be actually classified and also in putting in their respective queues, QoS queues to match certain criteria that we want to preserve through passing to.57:14To this one that has some bandwidth constraints, ok?57:34And the full action here is because I don't want to just drop the traffic. I just want to make sure to classify it and put it in the markings corresponding to what I want to do, ok? So, and and assuming also, I'm sorry, the idea here is to.57:39No, it's it's just doing classification and queuing, ok? The marking is actually pretty fine in the lab by the traffic is a simulated traffic.58:00I just gonna show you very quick that's gonna be the profile that I'm using, ok? So I'm basically sending and simulating packets with the DSCCP 46 DSCP 41, the thin ten, and also the DCCP zero, ok? To match some certain classes that you will see that we were going to.58:15To talk about in a moment, ok?58:35But the traffic is being simulated also between branch one and also the DC one, ok? Why? Because the simulator is connected between these two locations and I am going to simulate the traffic between these two, ok?58:37I want to also configure an NWPI capture to to see what is the, how is the queuing working on the gig one and gigabyte two interfaces, ok? So that's why that's the demo it's actually to look.58:55If the router is actually pulling those packets inside of the respective queue corresponding and matching the DCCP values that were that we're sending and marking using the generated traffic, ok? Now, let's see what is the traffic the different rules, ok? So.59:121st mean you define the the policy and you start to do that some rules, ok? Inside of the rules, it's important to notice that it's not gonna be a different rule for for QoS policy or for application, NO. It's gonna be the same rule, ok? So what is gonna happen is you will see.59:31That's the list of matching options is a long list, ok? And the list of action is also a long list. You will notify things like forwarding class, which is the purpose of this demo, ok? But you also have an action for a SLA class if you want to match.59:51The corresponding em.01:00:11Application aware routing says, ok? So be aware about it because at the end, what we're going here is to actually show you that this is a multiple policy, right? It can be application of our routing QoS owner, right? So that's, that's basically so this is.01:00:15Sequences basically matching the CCCP packets with with 46 number and is sending to the real time, ok?01:00:34Before to jump into that, I would like to show you 1st the different policy definition that I have in my setup, ok? Clicking on the edits, you will see that I have defined it for queues have also defined it with internet one and two.01:00:44Okay, and I have defined this the four queues as I mentioned earlier, and you will see here what is the kind of the mechanisms of the scheduling type that I'm going to use for each of them, ok? Of course at the Q06 is gonna be the our main queue. The idea here is gonna be our low latency.01:01:03That one is is gonna I gonna assign the real time forwarding class, you can define them here on the create view if if you want to do it online or inline, sorry. And if you want to do it.01:01:25As a kind of predefined steps, you can do it on here on their forwarding class and the group of interests and add a forwarding class that you find here, ok? So that's also an option, ok? Do you want to do it in the offline approach or do it inline, that's ok, ok?01:01:41So, once you define all the different models, ok, I'm doing here as just a machine and with the corresponding classes, ok? So.01:01:59I'm gonna apply it right now so this is before six is gonna be assigned to the real time class which is the class number the QE number zero. Business is gonna be our QE number one best effort is gonna be our QA number two.01:02:14And default noise DCP is gonna be our Q3, ok? So that's that's basically how it's gonna look like the numbers and I have put here a name with the DCCP name to actually match what happens in the cache, ok?01:02:31So let's go for it. Once you define it, how do you actually apply this policy is to go here to the policy group and associated the device that you want to apply this policy to.01:02:47In our case I'm going to select the branch one as the one that is been with the traffic generator, and remember this is a centralized policy, so as now it's gonna be the configuration is gonna be between.01:03:11Or the old cold bismarks and the one each, right?01:03:30So we wait for a second. I'll while deploying is successful, ok.01:03:36And I have here an NWPI capture. We just need to wait until the policy has been effectively applied, ok? So we just wait a couple of seconds here that's gonna have some.01:03:52Times so we just wanna make sure that.01:04:12To give enough time to the capture to reflect the policy application.01:04:15Oh alright so let's see we can start and now see it what's going, ok? So on the policies was just gonna show you very quick.01:04:36The idea here is just to convert what we have discussed. So packets with express forwarding or NO sorry AAF eleven which corresponds to the DSCCP ten, which was supposed to be following the best five.01:04:54Which is the class number two, ok? So the way that you see it on the NWPI is on the SD one QoS output, and you will see that this has been assigned to the QoS number two, ok? Which is matching the current corresponding policy.01:05:15Let's verify one more packet for the expressful wording, ok, which is one of the most important critical applications e.g. in this case. The expressful wording is matching the DSCCP 46, ok?01:05:34And let's see what says the queue been assigned, ok? So in this case it says that the QoS queue assignment is the seal, ok, which corresponds to the real time queue. So that's basically all for the QoS then. Thanks so much Dean, and let's move forward with the.01:05:49Other two demos and and let's cover the other topics. Thanks so much. I'm gonna pass the ball to Tusher again.01:06:09Thank you mr. for the good demo. Let me share my screen. I'll be rushing a little bit because we are we are short on time. I'll be COVERING ENHANCED and we'll try to cover topologies but alright?01:06:15Jumping into this, right? What is aar, right? Enhanced sorry application of the routing, right? Which is basically configured on controllers, then basically it helps us advertise and execute advertise.01:06:32Advertise the policy and execute it, get it executed on the edge device itself, right? What does it do or how it has been done, right? It basically monitors SAV on active overlay parts.01:06:49And direct application along qualified ones. It can identify various applications using L3L4 keys or SI, which is basically our deep packet inspection, right? And it basically is giving us a distributed SLA driving.01:07:04Right? Let's say you have a critical application and you don't want to lose any traffic for it. And if you have two paths, you can utilize SLA based application of a routing policy in that scenario, right? If your primary path is.01:07:27Has a lot of loss, jitter latency it automatically forwarded over the secondary path or tertiary path if you haven't if you have that in place.01:07:44What are some components right that are being used in application of the route policy, right? The 1st is BFD setting, right? The hello interval and the multiplier per color, right? Only the hello interval matters in AI, right? Then there is.01:08:01The app route algorithm which I'll go in the next slide, right? It is basically it uses app route multiplier and poll interwear, right? Which defines how SLA data is used for path selection. And then you have your app route policy definition, right? Your SLA class.01:08:21Application association and VPN applic appli applicability, right? And, and the action, right? What to do with the traffic that is being matched. Yeah and it is based on matched on based with right yeah I realized.01:08:41On site, right? When you have your app visibility and so visibility enabled it is used for application recognitions and so on.01:09:01How does the, what is the algorithm that is being used? Here's, like how does it been defined, right? BFD basically periodically polls the tunnels on SD WAN and then collects packets lost latency, and jitter.01:09:11Other statistics, right? For AR routing. You may have seen this configuration, right? BFD configuration and app route multiplier, right? So that is being used here, right? And by default, your hello interval is your 1 s.01:09:30Right. So by default the poll interval is 10 min, right? And, at each pole interval, right? AR calculates the average lost latency and jitter. As you can see, right? Like if you see the poll interval is 10 min.01:09:48And every second a BFD packet is sent, right? So that means information from 600 BFD hello packets is used for one pole interval.01:10:08Right to calculate loss latency and jitter, right? How, how is it configured, right? It is using BFD approach pool, right? Poll interval command, right? And that is how like usually it takes the six.01:10:19Six buckets comparison, right? And then determines the best path, right? And determines the loss latency and jitter for AER to use. What are some, like how is the approach policy definition?01:10:37Work, right? There is your SLA classes, applests.01:10:57App route policy and app route logging, right? If you need, right? In your policy you have your SLA class defined and in your policy you have a predefined policy that is being called out. You can basically use customized policy as well.01:11:01And then in app route policy, you have, you have like if you are matching the policy, right, what happens if SLA class is dissequalified, what would happen to that traffic, right? And if it's gonna be load balanced or if it's gonna be.01:11:18Strict means it only follows that particular color or it is dropped, right? Load balancing if you have two, it's gonna load balance between those two and best path selection rate like if you have all three determined it's gonna load balance on all three, right? And if you want to log that.01:11:38You can enable app route logging as well. Here is an example. 1st you declare declare an app list for a policy match, right? VPN list, VPN one.01:11:58You have your site IDs and you have your app list, right? Which consists of audio video, right? And SFDC consists of your Salesforce traffic. Then you basically define SLA classes, right? I have your SLA EF which has loss and latency of 100.01:12:13You have this app which is like two and 01:50 which is basically utilized rate. So these two are utilized in the actual policy. So if you look at approach policy rate, match match condition is your app list and action is SLE EF, right?01:12:31That is it, right? Here you just have an action, right? So, these are, like this is an example of app route policy, right? Then you have your action as well, right? Here you are just matching it and then you have action as well in your app route policy.01:12:50So, here is an example, right? Here is a practical use case of application pinning with SLA across your, let's say you have four transport, right? MPLS public internet, private, a private and red transport, right? And LT.01:13:09Let's say your app one uses business SLA class, and it, what it's gonna do is it's gonna load share across MPLS and public internet, right? It uses red as a backup and falls back to routing if needed. I'm gonna showcase how that looks like internal configuration, right? I'm not gonna.01:13:28Over all of those but you can have application pinning using AA as well. So.01:13:48Here is an example, right? You have your primary as MPLS and public internet and backup as red, right? You're matching based on VPN, sequence ten, your app one is matched here. Action. If you look at this rate.01:13:57You have backup SLA preferred color as red and your SLA class is business and preferred colors are MPLS public inter internet. So this is an example after you have defined all of your list SLA class and then you have your actions, right? That you can define using application aware of.01:14:13Alright, how do you configure it using configuration groups? Sorry policy groups. So you go to application priority and SLA, similar to what you saw, right? Adding a traffic policy, right? If you have a quality QoS already defined, you can add another sequence there.01:14:34And under that sequence, right? You can match, you have a match condition based on application or whatever right like ports, right? Protocols, whatever, and once you have that, you can do an add action, right? And under add action, you have to select your SLA.01:14:53Which can be predefined, right? In objects, objects and or group of entrance. Here you define preferred color, when SLA is not met, what do you want to do with it, right? Fall back to best path or if you have strict action it's gonna drop the traffic.01:15:13And then if you want to select your remote color, you can then do that as well, right? And under your objects and profile you have your SAV that has been defined, right? So that is how you create a sequence here.01:15:31There are some shortcomings to, right? Which is taken care by ENHANCED policy, right? What, what was the problem, right? R takes like few minutes to de detect the degraded path, right? And it takes and faster time.01:15:50This causes false positive, right? In switching the tunnels. That where that's where enhanced application of the routing comes into picture, right? It basically, it measures real traffic per queue and it can detect degraded and fail degradation and failover in second.01:16:07Right While dampening unstable.01:16:27Unstable parts also, right? So what are some of the capabilities it provides? It basically improves the PFR measurement, right? Used for data like forwarding or switching your.01:16:31Color, right? Yeah, like ability to quickly take over and switch to better parts ability to dampen the tunnel, and improve the PFR measurements, right, which are being used for making that decision.01:16:47Without enhanced app application aware routing, right? Your de default BFD hello interval is 1 s and after our pool interval is 10 min, right? And multiplier is six, right? So basically our tunnel degradation detection is ten to 16 min, right? With 36.01:17:04Hundred samples. So yeah, like these are some of the shortcomings, right? Most often fields recommends to pull every 2 min right and having a multiple of multiplier of five, right?01:17:22So, these are some of the things to take in consideration, right? Measurement of every BFD hello interval and is average to bucket over a pole interval.01:17:37Rolling average of multiplier buckets, right? And then reducing the pole interval rate pole interval and multiplier will improve detection time, but can lead to false positive with small numbers. So you can basically try and play around with.01:17:54The multiplier setting right the pool interval, but it has some limitations and shortcomings.01:18:13Compatibility scenario, if you have enabled on site A and on the old site if you have a old AR policy in place, then it's gonna use your STANDARDIZED configuration right to measure, do any measurements, right, be used for AR, right? If you have.01:18:24AER enabled on both the sides then it's gonna use the new measurement capabilities.01:18:43Configuration is basically pretty simple BFD enabled approach, right? And then the multipliers and all of that. So on SD WAN manager, you can go into configuration groups and.01:18:51Under basic profile, you can find an answer option, right? It has three modes, right? Aggressive it's based on how the polling interval is gonna be.01:19:10Alright, going to topologies, right? It it is a pretty important topic as well, right? Here you define if you want to have hub and spoke topology mesh topology or a custom topology, right? A single topology can have multiple hub and spoke policies and a mesh policy as well, right? Customization.01:19:22Then you, you will find this particular option where it has hub and spoke or a full mesh policy. One topology can be active at a time, right? Similar to one similar to what we see in centralized policy.01:19:41Right? So topology is basically creating a hub and spoke or customized or a full mesh topology for your overlay. How do you do that? You go into configuration topology, right? And here if you can see I have.01:19:57I have mentioned like this is 1st screenshot is hub and spoke where I mentioned site 1001 and ending with 015 as my hubs and then I have selected four total sites to be as my branch, right? 1011012 and some of those, right? You can, if you switch to customized topology.01:20:14Then here you can see it automatically is asking you to select rules, right? What.01:20:35What routes can be advertised, right? What is gonna be the direction, inbound, like inbound sites and all of that, right? So it's a, here's a quick overview of topologies as well. I'll hand it over to Nestor for a quick demo.01:20:44Alright team, so since we are going to bring a little bit out of time we'll be faster on this one, ok? So we're going to cover here the application and I have here in my screen the configuration inside of the application for the VPN ten.01:21:02The idea behind here is to classify and to give assign an SLA class for every, for DSCCP values similar as we did for the QoS. Remember, inside of the same application you can configure any of these two or the both together.01:21:21Okay in my in this example I'm just configuring application, ok? Because I am matching the matching options or actually providing an SLA class and doing some specific actions on it, ok?01:21:40So I want to be focused on the route two, it's gonna be the one that is gonna be used for the demonstration. We have here that the backup we have the preferred caller which is this internet. We are able to see right now in a moment that this is the one that I'm using. And once I.01:21:53Increase the I mean I make an network impairment on the we should be able to see that automatically shouldn't it should be falling back.01:22:13To the MPLS input as the best available route, ok? It should be sticking to it despite that they have another available option, which is the the public internet and also the LTE is gonna stick to the MPLS.01:22:23Once it's falling back ok to to the once the misinternet got with a little bit or and matching the criteria which in this case is more than latency of 50 milliseconds and and a jitter more higher than the five 100 milliseconds.01:22:38So I'm gonna do it right away, preferred I'm gonna show you one of the packets that is coming and the application that we're routing as now, ok? As you see here, this is 43. Let me see. Yeah, this is 43, this is aP43.01:22:59We can see it here on the policy and we can see here that requested CLI SLA is critical apps and the color is this internet, so we should be able to see that it's falling back to the QoS once we added some networking environment in that circuit, ok? So give a second.01:23:19So I wanna hear on the internet circuit on the branch one, which is this one big one and I want to enable these conditions, which is basically to unmatch that SLA criteria, ok?01:23:41So you have here a loss of 1 % and latency of 01:50 and jitter of 102 which is basically higher than the the site for this SLA class SLA class what was ok?01:23:58So, we need to wait a little bit as part of the timing process that we need to wait a little bit on to the capture reflects the actual fallback, ok? Let's see if we by chance we encounter.01:24:15Okay, it's now being falling back, ok? And we see here one focus on this is that on the feature on the NWP architecture, you see here a red color inside of the policy title. That means that something happens when the SLA criteria, right?01:24:31In this case is the state preferred color is down, which means that it was unable to match a preferred color condition for this SLA and it's now pulling back the actual color is FMPLS, which match.01:24:51And the corresponding application the policy behavior that we expected according to the SLA criteria that we defined for the that needs to be matched by the ok? So with that is the basically the example for this one.01:25:06On the topology that has mentioned, this is the topology so basically on this one, I am basically assigning for the VPN. I am assigning that.01:25:23I'm gonna create a open spoke just for the VPN eleven, so we are going to see that before to actually apply the policy, the age, should be sent the routes the route coming from another spoke, which is the.01:25:38Branch eh five.01:25:59Could be from the exactly from the T lock AP of the branch five, ok? Which is the seven.seven and.eight, ok? But we should see, we should see that once we apply the topology, the T lock now should be the corresponding T logs IPs of all the.01:26:01Our DCs which are four ok this is 1H1, this is 1H1H2, and so on for 2nd DC, ok? So I'm going to activate. Okay.01:26:20Apology, deploy, ok? Let's play a little bit, let's see if we are able to see that.01:26:36All right. It seems that the the change has been applied successfully, so we see now that it's now open spot because we see the same route coming from the branch five, but in this case, we now see that the T lock is actually pointing out our DC headings, ok? So with that is.01:26:57Thanks so much for for attending the session, we hope that the information provided is quite helpful for your daily operations. Thanks so much.01:27:18Thank you team for attending the session and please you will receive a feedback, let us know how we did on the sessions and also what you would like to hear from us on various topics as well. So please put that into the survey that you will receive after the session. Thank you so much. Have a good.01:27:34