Device Migration: From Templates to Configuration Groups

Oh, good morning, everyone. Thank you very much for joining the session and today's session is.00:00The topic which we gonna cover is like a device migration. If you are running UX one dotto, how you can use UX two.oh configuration groups. And today's session is gonna presented by Marcelo and Josen and in the panelists, we.00:18We have myself.00:38And Peter, if you have any questions, we are there to answer your questions. One request, if you ask any questions, we request you to ask the questions in the Q and A and A panel, which is on the bottom right.00:42Corner of the Webex and during, and we also have a Slido, we recommend you to join the Slido and you can join the Slido by the code and also from the QR, you know, this QR code also.01:01Next slide please. So the Muscello has already like more than 20 years of experience. He currently worked as a customer success specialist which is part of the CS organization. You also have experience in the sales and the tech, he also.01:17For the CCIE and also a Cisco live speaker.01:37Next slide, and we also have Jusan which is also have a more than 20 years of industry experience. He holds CCDE and the three CCIE certifications so I will request. So next slide please.01:42So this is an intermediate session, like if you already have a background of the Cisco SD WAN, then you will have a good understanding about like how to migrate from UX one.O to UX two.O for the configuration groups.02:03So I will hand over to Marcelo and he will take it from there. Thank you very much. So good morning, good afternoon, good evening, everyone. Welcome to our session today. As said, we are going to explore the migration from.02:19Device template feature template to your configuration group. This is our agenda for today. I'm going to split the agenda with Jose. We have a nice demos to share with you during the presentation. So I'm going to start with the, quick or quick review of the configuration based on the.02:36User experience 1.0. Then we are going to explore a little bit of the user experience of 2.0 configuration and then mapping, you know, how to map the old way to do it. Actually, it's not old because I mean the old is a weird word because it's current available, but.02:56You know this fashioned way to do it to the new new way to do it more which is available in UX 2.0 and and then Whose's going to explore the very important part, the planning and designation process.03:16So let's get started with the 1.0 configuration and this is has been in place from day one and is based on things that we call templates.03:32What happened in a router configurations that you configure the common parameters for the router, and this applies for all the routers that you have in your network. There are some details that we are going to explore in a little bit.03:47About the type of routers that you can share this configuration to with. But once you have amount of routers in your network, you can have the same template for the majority of them. What changed is the specific values for each router?04:05So I have a router in New York I have a router in UK, so they have different IP addresses, they have different router names, you know, they have different.04:25Parameters that we need to assign to that routers individually. And these devices specific feature values or variables, they are attached to the configuration, device configuration, and when this is done, we can push that configuration to.04:35The router that we we want to, ok? This is the way that we do.04:55And this is done via catalyst manager. You you also can do it via CLI template. If you don't like the GUI interface of catalyst manager. So I, you know, I'm a very.05:00Hands on engineer, I prefer to type everything. I prefer to understand everything that I'm doing in like a line code. You can do the CLI template also and enter the variables the same way. Two different ways to do the same thing. And as I said, when this is.05:16Ready you can push to the router that you you you want to, ok? So how, how does this work? You know, remember this is just a quick review of a device template and the feature template, ok? So inside a router configuration that we call device template, there are a lot of issues.05:34Features that you want to enable for that router, ok? You might want to enable OSPF, you might want to enable BGP, SNMP, whatever you want to enable.05:54And these features are all are called feature templates. So they are common for other routers. So you can have a OSPF feature template where you find your areas, everything, your OSPF ID, everything that you want.06:04Doesn't matter the type of router that you want to push this configuration to, can be a ASR 1000, can be a catalyst 3200, can be a ISR 1100, doesn't matter because the configuration is the same, ok? So feature templates, you.06:21You choose the feature templates that you want to use, and then you attach this feature templates to our device template, and that's a little bit different what happens here. The device template, as the name says, it's.06:40Particular good for a broader model. E.g., if I have a device template for ISR 1100, I cannot use that device template for catalyst 8200 e.g., because the routers, they have some particular characteristics that require.06:56Requires different, a little bit different commands, ok? So let's say that I have 50 routers model.07:16Catalyst 8200 I can have only one device template for that model of router and I can push that device template to all the routers once I enter my variables. However, this device template.07:24It's not good for the ISR 1100. I should have another device template for the ISR 1100 routers. But I believe you you are familiar with that, but it's never doesn't hurt to, to review. And here, you know, as I said, the feature templates.07:39That you can enable in your configuration and you associate that device template the feature templates to the device template and then you push to the routers, the router model that you want to. So the key takeaway here is that.07:59The device template is particular for a particular router model, ok? Don't forget that. And this is the way that we used to configure and we still configure that. E.g..08:16If you want to configure the controllers, you need to use device template and feature template. We don't, we still do not have a configuration group for the controllers at this point. It might come in the future, but at this point we don't have it. This is the release twenty.fifteen we are talking about, ok?08:32Because the release the twenty.fifteen was the release that Cisco launched the user experience at 2.0 with a lot of different features, a lot of different ways to do.08:52Things that we did before in a different way. And one thing is the configuration. We're here to talk about configuration. In the in the past before twenty.fifteen, actually the configuration groups, they were available before, ok? I think they are available twenty.nine or 20.09:05Dot twelve not mistaken, but Cisco does not recommend to use configuration groups in those versions. So this suggested release for configuration groups start exploring and using is twenty.fifteen.09:25Okay. So, what do we have here? Have the classic way to do it via device template and feature templates and now you have configuration group. Other thing that changed also, but it's not.09:37Include in this presentation, we have a dedicated presentation to talk about policies. The way that you configure policies also change it. So used to have local policy centralized policy, now you have policy group, topology network hierarchy here.09:54Why is this important? Some stuff that you used to configure via policy in the past, now you configure via configuration group, ok? I'm gonna show you, some examples about that.10:10So if you ask me, Marcelo, what should I migrate 1st? My configuration or my policies? You should 1st migrate your configuration, and of course right away, right after you migrate your policy, ok? But migrate your configuration 1st because there are some stuff that we're configuring our.10:27Policy that now are configured.10:47Via the configuration group. Okay, let's explore a little bit of configuration group. So how is it made? Remember that in US 1.0 you had the feature templates and you associate the feature templates to the device template and then.10:49Device template, you assigned to.11:10A router family model, ok? Things change a little bit here is more flexible. Now, you're not tied to a router model. If I have a configuration group, which is a bundle of feature profiles, instead of feature template to have feature profiles, I'm going to explain that.11:13A little bit different.11:33So I can push that configuration group to any router model. Doesn't matter if I have ISR 01:11 hundred and doesn't matter if I have a catalyst 8200 I can push that configuration group to this, to the both routers, ok? So this is one thing very, very interesting because.11:35Because it allows me to organize my network in a better way.11:55Let's say that I have a common configuration to a certain region of my network. Let's say in Spain, all the routers have this kind of configuration and doesn't matter what the router model is. I can push that configuration to that router.12:01In Spain. However, e.g., in UK, I have some characteristics that forced me the configuration to be a little bit different. So I can push another configuration group.12:21The routers in UK. E.g., let's say the routers in UK, all the branch have two routers, ok? Two edges. In Spain, all the branches of my company has only one.12:34Router per branch. So these are different configuration groups. It doesn't, doesn't matter again which model it is. So what feature profile is? Feature profile is a bundle of configuration grouped.12:50Logically by functionality. And in your screen here you have, let me let me do this. So you have three kinds of feature profile. One is called system profile. It's where you configure the basic stuff in your router, ok? Login, banner, the pro.13:05Protocols that you want to run, think like this like the OMP, e.g..13:25So the basic stuff. And then you have two more mandatory profile feature profile. One is the transport and management. And the one you configure in transport and management. You configure the when part of your router, ok? The wide area network, you configure your.13:31Transport, if it's internet MPLS, if LT, so you must have that configured because it doesn't make sense if you do not configure the when part of your router. The router will not work, you know, you need that configuration. And the other configuration is the LAN, the LAN.13:49That part of your router where you configure service VPNs like VPN one VPN two, VPN three. This is the minimum configuration that you must apply to a router, though, the router will be.14:09Functional up and running. And of course there are other profiles that you can add to that configuration, but with these three, you can have your router working in your network, ok? Of course, depends off your business require requirement and depends of the.14:23Technical requires that you have.14:43Once I have the feature profiles configured and chosen, what I do, I associate those feature profiles to a configuration group. Again, e.g., let's say that a configuration group called east. The name doesn't matter, you know.14:45What matters is the business behind that, that the name that was chosen. E.g., let's say that in the east, I have a, e.g., let's say in America I have a new York Boston, Miami. So at that region, I have a.15:05Kind of a configuration, like kind of routers and they they mandate only three feature profiles. However, on my at the west side of the country where other kind of branches I have in my company, they require a little bit more configuration.15:25And then the reason why you see another profile called CLI add on in addition to the system profile and transport managed profile.15:45So this is this is the way that you can plan your config groups. And then it's a matter of applying. So I push the configuration to the routers that I want to, you know, same way that I did in the device template. Of course, when I before pushing this configuration.15:54I'm going to to enter the variables for each router like IP address, router name, all that stuff that you are familiar with. So, little bit different concept, you know, the basics are you know pretty much the same, but.16:15This is a new way to do that and I can assure you that you don't need a lot of the steps that how you did, how you had before and much, much more flexible and that much easier. One.16:33Important thing here is that you must define, you must plan your network before starting configuring anything, ok? And this is a very important thing. Because this way of configuring this new way of configuring, it's based on.16:48The business, not in the router model, you might want, not you might want, you must define something parameters before starting the configuration and one of them is the net, it's called network hierarchy. Network hierarchy is.17:08Simple the top topology regional topology of your network. You define, e.g., if you're gonna have a branch in UK, if you're gonna hand, you're gonna have branches in Japan, in India, NO, you define your network.17:28Hierarchy according to your needs, ok? And at the end of the day, you're gonna have the hierarchy that reflects your network.17:48In terms of regional topology. What, what this bring to us? This bring to us flexibility to apply a configuration for certain region or to apply a configuration to some routers within.18:00City that I defined as a as a region. And what is this network hierarchy here? The network hierarch is divided in global region area area and sites. Global is the the root note. It will always be there if you do not configure everything.18:19Other routers that you populate in your fabric will be under the core region, which is not recommended unless this is just for playing in the lab.18:39And then you have a sub a sub organization called regions. The regions is only for SD WAN when you have SD WAN multi region fabric, ok? If you're not running MRF, forget about regions, you don't need that kind of element.18:49And then you have areas, e.g. an area can be Europe or an area can be Asia, you know? Or an area can be, e.g., a country. It's up to you. It happens how you organize your network. You can have an area called.19:09Europe and have another area inside Europe called UK or call Netherlands, whatever you want, ok? So it's a matter of organizing and inside that area.19:30You can have, e.g., another area like Amsterdam, and then you can have the branch in Amsterdam and you can have the routers in Amsterdam. These are the sites. So I have the sites Amsterdam, I have e.g..19:45And mr. Dan location one and Dan location one is branch one, I can have the routers inside there. So it's a lot of the flexibility that allows you to to play with these network hierarchy. This is already available in the DNA center. If some of you run the DNA center, Cisco's trying to unify.20:01The, the interface, the way that you deal with different Cisco products and make your life easier. Again, the network hierarchy you can define some major parameters on the global region.20:21And once you define in there.20:41These parameters are inherited for the other regions if you do not change it, you know, e.g., the DNS IP address would be 8888, ok? I defined this in the global region. I'm just this is just an example, ok? I don't define it here, but, and.20:44If I do not change anything for the area, if I don't change anything for the, for the site, the site to reassume the DNS address, IP address will be 8888 Unless you want to change it, e.g., for site in in Spain, I want the DNS to be 4444. You can do that. And same for.21:03Collectors for netflow collectors and some external services, ok?21:23All right, the other nice thing that you have is tagging. Let's say you have a area in Spain and inside Spain you have Madrid, Barcelona, Civil, whatever.21:30Okay, and you have other you have our routers inside these regions. And let's say that not the regions there, these areas. Let's say that in adrid, all your branch.21:47You know, some of our branch have one router only and some other branch have two routers, same for Barcelona. You can tag those branch with two routers like you know you just choose a tag, you create a tag, do a router branch or a single router branch.22:02And when you have a configuration group that you need to push your, you know, some part of your network, let's say that I have a configuration group prepare to handle configuration, to push configuration to branch with two routers. I just choose.22:22The routers that have that particular tag and I push the configuration only those two those routers with that particular tag. You can have more than one tag if you want to. Of course, you can have two routers in Spain, two routers in UK, two routers in New York, but I want you, e.g..22:39Push your configuration only the routers, the branch with two routers in Spain. I can have a tag in Spain, two routers or I can have a tag, new York two routers, ok? So it's very, very, very flexible.22:58Remember the site ID that you had to specify in the past with the UX 1.20. I want you to push this device template to site ID one, site ID 100, site ID 200. Now, it's everything based on network hierarchy and and on tags. Tag is not mandatory, but it's very, very.23:15Well recommended, ok? The current is gonna make your life very easier.23:35And now, you know, to push the configurations I said, you just use the network hierarchy to choose the routers that you want to. That's the reason why you must have your network hierarchy configured before, before configuring any.23:40Configuration group or any policy group, ok? Because sometime in the process you need to push that configuration to your router. So you don't want to push one by one, you know, you have a big network and then you want to do like you know have this process as automated as well.23:57Okay, so let me let me switch to my the to my manager and show you a little bit of it let me share my Google Chrome.24:18Where is that? Yeah, so it's not this one was this one? Oh, I will log it out. So I'm gonna show you, you know, some, I don't think.24:34That we oops, a second, you know, some stuff that you can you can do, just to be familiar with configuration group and a network hierarchy or that stuff.24:52And you can start experiencing this in your environment, ok? So this is our manager in our lab thanks to Jose that has set this up. And as you can see here, this is the version twenty.fifteen.25:08This is the where UX 2.0 is recommended, ok? The 1st one that's recommended. Of course, if you want twenty.eighteen, that's fine too. And here you can see that we have 14 one edges and let's go direct to the point that we want to explore. As you can see in the configuration the left.25:28Handside I have the network hierarchy, so the network hierarchy is already configured in my case and I have the global region here I have the controllers. So let's go to the regional region one was called east region. And in this region, you can see that this.25:48Area I can have, you know, I have a, a site inside that that area which call a region one hub site and I also have a region one.26:08This might be a branch, you know, site 21401 and site 1402. But in this hub site if I click on that, I see that I have you know one device in there, right? Oh, actually so, sorry, two devices in there.26:21So I have this router over here and I have this router over here. And, you know, as you can see here, these routers, they already have some tags configured, ok? E.g., regional one tags that makes sense. Region one hub.26:38Primary router. So region one hub secondary router. This helps a lot. So plan ahead before you know doing this test. Of course you can change if you want to. I don't know if I have.26:56If I have a right to do this, but I can add e.g. site if I want to, I'm not going to add just enter the site name, you know, A AS one, oops, sorry, AS one description, test, you know, you choose the parent, the parent is automatic.27:13Quickly here because I already created site that one and the site ID you don't need your.27:32You to enter it will be populated automatically for you. And if you want to put country, you know, all that stuff, e.g., if I put Portugal, Portugal NO if I put Spain.27:39Yeah, I put the USA United States. Yeah well, I need you, I need to find out but you know you put you if you put the address here, you know, it goes to populate and the the address.27:55As in your, in your map, ok? I can show you this. I don't know the reason why it's not taking the let me see, yeah it should populate here if the.28:14But it doesn't matter. Let me see. I don't know if you're going to take it. Yeah, NO, not taken, but maybe because this is a lab. But you know when you go to topology you can see this is on their map because it maps for you. So what else I can do?28:34So in terms of tagging, if I go to configuration one edge, so you can see that I can add a tag to a router or, you know, remove a tag. These are the tags that I created, who sent created actually and they are available for me to, you know, to tag the.28:54The routers if I want to. How do I create that tag? I go to administration, tag management.29:14And here you have the tags, a list of tags that you, you created, ok? And you can you can modify that. All right, so this is about network hierarchy. Let's go to configuration group. So the configuration group, you click on configuration configuration group, you're gonna see.29:21Yeah, this nice screen here. I see some configuration groups already configured, ok? I have different ways to create a configuration group. I can import from a catalog if I want to, there is a workflow that I can, that guide me on how to configure.29:41You can start from here or if you go to workflow, create configuration group. There is a workflow that does does this for you, ok? What I'm going to do now. Let me go back to configuration configuration or you can do this manually. Just clicking here. So let instart a configuration group expect inside series.30:01Config one, e.g., and, you know, enter the description and note here that I can choose a configuration group that we address a branch with a single router with a dual router. This is very nice to have because right away.30:21You have two different site types that you're going to speed up your process. If you got a single router, I'm just do create, ok? And here you can see the configuration group, and the user admin, of course. So if I.30:40Clicking here in this little arrow, I'm gonna see that the configuration group is asking for the system profile. Remember the system profile? So the system profile, I have some system profiles already configured, ok?30:58If you, if you want to configure a new one, just click here in system profile and configure a new one. But let's say basically system profile. Okay, let's choose this one. And then transport and management profile, this is where I configure my when, my when site. So let's say that, you know, I have some configured already.31:15If you want to configure a new one, you just come in here and configure a new one.31:36But let's say that I want this one, ok? Well, but I also need my service profile that will take care of my land, so I just click add profile, service profile and you know I have pre configured one, few, you know spy actually and let's see two VPN.31:40Firewall or DC or whatever, so if I want more profile I can do it. But with these three, I can have the router up and running. I can have a CLI, I don't know if I have one available. I have a CLI profile, e.g.. Okay, so this is.32:00Let's say that this is done. Let me delete this one. Let's say that this is done, you can change the name if you want to. And then what you have to do, you have to associate, this is another nice stuff about configuration group. You don't need to deploy right away. You can associate the profile.32:18To the routers and then you can push the configuration later another day e.g. on the during the next maintenance window. So I'm gonna associate this and this is where the magic of a network hierarchy comes. So I can, e.g., you know, you see I have a lot of routers here. Let me.32:37Find the routers. Let me see if I have a tag.32:58Well, let me get let me get a tag hub. As you can see, all the routers that have the tag hub, they are populate here and I can't, e.g., select all these routers.33:02That are different areas to push that configuration to, ok? That's just very nice to have, right? So or if I want to I'm going to apply this to the region, this region or this router and this router. So I just do save.33:21I can confirm, ok? And then when I confirm I see that the this configuration group associate before because there was still other two already associate. However, they are not provisioned.33:38Okay, if I want to provision, I have to deploy, ok? And to the I can save it. I'm not going to save it now because I don't know if you're going to screw any thinking the lab here. But if you want to to click in here, the deployment process will start. You're going to start to push the configuration to the routers.33:54And you'll be able to enter the variables for each router or if you have a CSCV file the same way that you had before in the device template in future template, you'll be able to, you know, upload that CSCV file to your CD one manager, and then.34:14The SD manager, you get that information and associate to the routers.34:34Very, very simple process and yeah, and that's it, you know, this is a basic stuff our configuring configuration group. All right, you know what? Let me, I'm not going to screw Jose's lab. So let me delete this.34:39Okay ok I I could not delete because it was already associate. I have to reassociate 1st and then I can delete. What else in here? I think that's it. Let me go back to the slides.34:59Okay, have a little bit few more slides to share with you before pressing the what you're saying. Configuration let's start mapping in let's how to map US UX 1.2 UX 2.0.35:23So, let's say I have a a router and the router has a running configuration, ok? And the running configuration is made of some device template that there are some features template inside. I have policies in that configuration, I have security policies, you know, I have all.35:36The all of these that you need to have your router up and running according to your business needs.35:56This is the configuration they wrote. I also have policies that are hosted in the catalyst controller, you know, the previous name was vsmart. So some policies that apply to the whole network are stored in the catalyst controller, and.36:03This kind of, topology policy e.g. if I have you know that the SD one, when you come up with the SD one fabric, it's a you know full mesh topology. If I want a hub and spoke topology, I can create a policy, a centralized policy with topology that makes that.36:24Network that has to do in fabric for one or more VPNs.36:43As a hub and spoke. And so what happened what changed with the OX 2.0 as we we saw before, I have configuration group, I have policy groups and I have something called topology that is separate from the the policy group. Remember that in the past the topology was a.36:47Centralized policy configured in the in the catalyst controller.37:07So what's the what's the front two? So device template, now you have configuration group. You have a localized policy like QoS. This new configuration way to configure QoS is in the policy groups. However, look at ACL. In the past, if you want to configure.37:13The ACL to push to a particular router to a localized policy, it was requested to do this via localized policy feature, not device template and feature template. Now.37:33If you want to configure an ACL, this is much easier to do in the configuration of the router itself, ok? So that's the reason why you want to migrate from 1.0 to 2.0. So pay attention in what features you have in the 1.0 because some features are configured in a different.37:45Place right now, ok? ACL is one example. So same for route policy, ok? If you have a route policy in a particular route, you'll have to do in the configuration group. Security policy migrate to policy groups.38:06And remember the topology, the centralized policy is now my topology. And the policy configuration, you know, general policy configuration like data policy, application routing, all that stuff is going to the policy groups.38:22So this is the way that you have to, this is a very important slide to to keep in mind. Just, you know, a list of features that I have before, so feature templates, so I have basic information, transport and management, service VPN, you know, a lot of stuff to configure feature by feature. And now what I.38:42Have the feature profiles, feature profile and configuration group. So remember, system profile, transport profile and service profile.39:03They are mandatory, ok? The rest is up to you if you never gonna need or not. All right, as I said, some examples, so access list. So in the past you had around.39:12Five steps to configure, now you have only two. Route policy, same thing, four steps in the past. Now you have to configure in two steps. You know, the simplification is something that came to to be a very nice feature in this.39:27New way of configuring stuff. All right, I think this is what I want to share with you and now thank you very much. I'm going to pass the ball to my colleague Jose to continue the presentation. Thank you Marcelo. Let me share my screen.39:43I hope you guys can see my screen. Yes. Okay, very good. So, so right now we will talk about some design consideration that you need to consider when you configure, when you design and configure your.40:05Migration from UX.one device templates and policies to configuration groups and policy groups. So we will start with one.40:25Design principle which is reusability. This is not new. This is exactly what we did before with feature templates and device templates. So with feature templates, we used to have common feature templates that can be used with multiple device templates and also we can use.40:37The same.40:57Feature template across multiple devices. So in this example, I have one configuration group and I have three routers. The challenge is we don't want to have one configuration group per router, but we want to do some reusability.40:59So the reusability here will be on the configuration group level where you use one configuration group and associate three routers, ten routers, a hundred routers and the difference is that between.41:19Each of these routers will be in the form of variables as you can see as you can see here. So, the same configuration group will have like multiple versions when you deploy them on the routers. And again, when you do the the deployment, for the.41:34Integration group, you will choose which router you want to to configure. And when you choose the routers, you will be able to fill the variables so each router will end up using.41:54Like a unique set of configuration again we we're still in the design principle of reusability. So in this case.42:10We are doing the usability the usability on the feature profile level. So if I have three configuration groups, and each of these configuration groups need three profiles so as Marcelo said at the system profile and the transport profile.42:25These are mandatory, and then this is the service profile of the land profile. So in this example I have three configuration groups and I'm reusing the system profile and when profile across all of them. So as you can see, this is just an example.42:44And then the land profile will be unique, so there will be land profile pair configuration group. So the idea here instead of having three profiles or three different feature profile.43:03Per group which totals to to nine feature profiles. We can reuse two of them which reduces the number of feature profiles and this will help you a lot down the road in your operations. So your operation will be.43:18Much much simpler when you deal with fewer number of feature profiles. The only caveat here is the more you use a specific feature profile you will have higher dependency. So if you have a system profile, like one system profile that you use across.43:37All of your configuration groups, any change that you want to do in the system profile will affect all of your configuration groups. So this is just the trade off that you might get. But still the best practice is to do this reusability.43:56As much as you as you're able to. So, the next design principle would be consolidation. So, so the problem that we have with device templates, we we have two, we have two problems. Device template is.44:13Device model specific, so when you, when you add a device template, you will have to choose the router model.44:33So you can have two routers that they have identical configuration, but you will end up with two configuration two device templates because the models are different or inc incompatible. So you cannot put them both in the same, in the same device template. There are some models that are clear.44:43Also to each other so you can have different models.45:02In the same device template, but in many cases larger routers and smaller routers like modular routers and non modular routers most likely you'll not be able to put them in the same device template. This is, this is not true with configuration groups. So configuration groups has been designed to be.45:06Device model agnostic, so you put any type of Cisco ISXE router in in a configuration group. So this is one opportunity for consolidation, so when you are designing moving to configuration groups.45:27Review your inventory of device templates and see where this occurred before. When did you have devices with same configuration that you end up with two device templates just because you cannot put you you couldn't put them in the same device template because of the model difference. So this is what.45:45One opportunity of.46:05Consolidation consolidation. The other opportunity is in many cases you could have one site that has two routers, but the two routers on the site, each of these routers has different configuration. So e.g., if you have one router or one site that.46:07There's two routers connected to two transport, so one router is connected to the internet, the other router is connected to MPLS and then you're using extension. So in, in many cases you end up with two device templates because the configuration on the two devices is different. So where.46:26Is configuration groups, that's another opportunity for consolidation. So with.46:46Configuration group, when you create a configuration group, you will get a window like this that is asking you what is the type so you can have a single router or a dual router. So if you choose a dual router.46:54You'll be able to configure just some names to to identify which one is the primary, which one is the secondary, which one is the 1st router which is 2nd router that will help you later on when you're doing the deployment.47:11So when you configure, when you create the configuration group, and if you start with, so this one is, this one is the transport feature profile and the transport feature profile will allow you to configure the the transport and.47:29And management VPN. So if we start with this view over here, there is a level of hierarchy that has been introduced in configuration group. So over here, once you enter the, this, this page, you will be presented with this. This is the.47:49The main parcel, the main feature parcel, which is so the the feature profile is like a container for these parcels that you can configure main parcels, so the main parcel that I have here is management VPN transport VPN as you can see over here, cellular control.48:06And and and so on. And, and under each of these.48:26Parcels, you could have subparcels and these subparcels can be configured with this plus button under each under each parcel. So what I want to emphasize here is.48:30For these main parcels, in most of the configuration, these main parcels will be shared across the two routers in your configuration group, and you will know that when you start configuring this. So if I start configuring VPN zero, I finish the configuration and I want to to save.48:47Now you can see here the save button is, it doesn't allow you to save to router one or router two.49:07As we will see later on. So when you save here, you will know that this will apply on both of the routers. In some current situations, the two routers might have different static routes, e.g.. So router one has, needs a static route, router two doesn't. So in this case, one of the.49:13Practices that you can.49:33We do in order to use the same configuration group for both of the routers and we did this also for device templates, which is to have placeholder configuration or pseudo configuration. So this is just an example. Router one needs a static route so we will we will configure it.49:37With variables and for router two we can put some pseudo configuration, so this is a static route to link local address pointing to null zero, so this basically doesn't do anything. It is just placeholder, maybe in the future router two would need a static route, then you can you can update it. But this is one of the tricks that you can use.49:56And.50:16To consolidate the configuration on your on your devices. So we will continue with the consolidation. I want to show you how to, the two routers in in this example, each device one and each device two can have different configurations, so.50:17Under this VPN, which is the main parcel, I can configure subparcel. So I'll click over here.50:37And then I will get the section which is you add the sub parcels. So over here, so this has been trimmed, but over here under the VPN you can configure interfaces, you can configure tunnels, IPsec tunnels, BGP, OSPF so you can configure a lot of stuff under.50:42Under this under VPN.51:02So, so in this example, I will be configuring only the, the interface. So I have added an interface and ethernet, interface and when I configure this interface, and finish all of the configuration elements, you can see over here, the save button is.51:04By default it will save on both of the devices. If you click on this arrow, over here, it will give you the small window that will tell you whether you configure this on router one or on router two. So this is where you can have different configurations.51:25On both of the routers, on the same in the same configuration configuration group. You can also if you click.51:45Over here on router one. So this is clickable. If you click on it and then add an interface, the interface by default will be added only over here, but still you still can edit it again and and save it on both of the routers or on a different router.51:56So, you will end up with something like this. You have router one has one interface. Router two has two interfaces plus BGP plus senior interface if that's your setup. So, so again, the takeaway here, think about.52:15The use cases that you have, that you end up using two device templates just because the router models are different or just because one of the router did have different configuration than than the other. The main use case here is work.52:36Talking about.52:55The devices that are in the same site. So if you have two identical routers, but in different, in different sites, you still use one configuration group but a single router configuration group. These are some use cases again active standby.52:56Branch router or a site that has MPLS connected to one router, internet connected to one router. So basically you have per device transport variability. So this is also one of the supported use cases, the data center as well.53:16So in the data center you have router one and router two and because the data center, there's a lot of that can in complex data center designs it's hardly to have like a router one identical to router two in a data center.53:33Environment. I usually you'll see a lot of.53:54Variability between between router one and router two, but you still, there's a lot of variability that you can do with, the dual router configuration group. So next we will be talking about some of the.53:57The migration planning recommendations and I hope you guys just keep me honest with time because I tend to extend my explanations. So, these are some.54:17The migration activities. Again, every one of you will have their own environment, their environment is unique, their type of operation is unique. So you need to think these are just examples of things that you can do, but you will do it.54:33According to what you have in your in your network. Inventory, you need to know what you have. The, the, the device templates, how many device templates are you are you having future templates, how many devices attached per device template, and all of.54:53The CLI add ons if you if if you have them and so on. You need to.55:12As Marcelo mentioned, twenty.fifteen is the recommended version for configuration groups, so we strongly recommending that go to twenty.fifteen to test and understand the.55:19Configuration groups and and policy groups. We strongly recommend that you match the controller with the devices. So in in many environments you will see that although the controller can support a lower.55:36OS version running on the routers, but still it is very recommended that you bring all your devices to match the controller of running version before you do the migrations.55:53Yeah, again, as Marcelo showed you in the mapping between the device templates and and configuration groups, you will, you will see some dependencies. So in a device template, you could have some policies.56:14You have access lists and stuff like that. So you need to.56:33Understand what other dependencies when you're moving between configuration groups and device templates moving from device templates to configuration groups. So you need to lay down what you have and how you will migrate it.56:38Do backups, so make sure that you export you can export the body of the templates. You can export only the variables, and we will talk about about the variables in the the next few slides. You can do a full database.56:56This backup, Sastry is a very good tool to help you with that but I'm sure.57:15If you have been using SD WAN for a while, you already have a mechanism to do a backup and restore. Gap analysis is very good to read the the software release notes just to understand for the particular release that you are using twenty.fifty.57:21You know twenty.eighteen, what are the features that are natively supported in the configuration groups? And.57:41If you have some feature parity that you currently have but is not available, you will need to think on how you would bridge this gap with a CLI add on profile.57:48Network hierarchy, again, network hierarchy is is not mandatory, but it is, it is very good when you are doing the deployment, it will help you a lot with the ability to.58:05Choose. So e.g., you can choose a region or a city, and then it will show you all of the devices and you can easily see how much devices have been migrated or how many devices are ready for configuration and and so on. And it will help you a lot instead of scrolling.58:22Through thousands of devices, this will help you a lot especially if you have a large deployment.58:42For the device tagging, so again the device tagging will give you a lot of abilities when you are doing filtering. So tagging and hierarchy, they go hand in hand. So they complement each other. So you if you have this particular.58:51Hierarchy. So you build the hierarchy 1st and then you think about the tags. There are few things that you can think about for a tag. So a tag could be the role so of the location of the, of the device. The the position is it the.59:11Primary router, secondary router, the type of transport that is connected to this router and so on.59:30So these are all examples of what you can think about as a tag. So the network hierarchy is you dividing your network or into portions that make sense to your operations. It could be per region, it could be per city. It could be so for if you.59:36For a bank and you have a corporate network and ATM network, so you can you can divide your network in the way that you are structured, the way the network is structured or your team is structured. So if you have a team that supports a specific part of the network, you can put them here as.59:56Like like as as an area and then under the area you have the, you have the sites. So you will have the tags and you can assign multiple tags to the routers and you will end up with, you have a device and this device has multiple tags. See these multiple tags.01:00:17Later on when you are doing the deployment, you can do filtering. So you can choose now like here.01:00:37You can add some rules. So in the configuration group, when you deploy, you can create some rules for the tags, and if you create these rules and you apply it.01:00:44To a configuration group, in the device list, once you assign a tag that match this criteria, this device will be associated automatically to this configuration group. It will not be deployed but the device will be associated automatically. So this can.01:01:00To tremendously simplify your your operation and your migration. So, next we will talk about variables. So.01:01:19When you design, when you initially designed your feature templates and device templates, you will have variables and in many cases I have seen customers that.01:01:35They don't have a naming convention for their variables. They don't have rules for using these variables. And, and this complicates the migration process a little bit. So it's very, very good that if you have the chance to.01:01:50Change these variables or the main takeaway here is you need to understand how your variables are currently designed and how will you design the variables or the configuration groups and how will you.01:02:06Do, the migration of these variables. So e.g., this is this is the variables for a UX.one device device template, and this is the same device but in configuration groups. You can see here.01:02:26That's different ways of configuring it. So here the device name, the interface name is a variable, and then the IP address is also a variable, but in your tool.01:02:45It is configured that the the interface name is hard coded but the IP address is is a variable. So you can see when you do the migration, you will be in this situation.01:03:03So you need to make sure that what is my strategy to do my variable planning? The very good practice is if it if the interface name here is a variable, it should be a variable over here.01:03:19Because you can use programming, you can use a Python script, you can develop a python script to do the copying of all of these variables values to to the new uX.two. So once you configure your.01:03:35Configuration group, you can export this as an empty file exactly as you export these view files values from device templates, and then you think about how I will be able to.01:03:54Copy these values over here. Of course, you can do it manually, but it's prune to to a lot of errors and it's much better to do it to do it with in a in a programmable way so if there is a massive difference between what is a variable in.01:04:09The device template and WhatsApp variable in our configuration groups, you will, you'll have a lot of issues.01:04:28To to do this copying of values from from device templates to configuration configuration groups. So next we will be talking about the migration process. The migration process is, is quite simple.01:04:36Actually.01:04:55All what you need to do is, like the 1st step, let's say we are just migrating one device so you will extract all the values that you have in your device template you will create your configuration group.01:04:57So in this presentation we're focusing on the the manual method. There is a configuration tool that you can use.01:05:16But there is a lot of limitations when it comes to the configuration tool. Maybe in the next expert insight series we will touch on configuration tool sorry conversion tool and what are the limitations that you can face with it.01:05:24So you will create the configuration group manually. You will detach the router from, the device template associated to the configuration group and then and then deploy it.01:05:44And then you can do some verification on on the the device after you do the deployment. Again, maintaining a consistent naming scheme for your variables, simplify a lot moving these.01:06:01Values, from the device template to the configuration group. This is just a quick walkthrough detaching a router from device template and then choosing the configuration group and and deploy it on on a device.01:06:22Again when you, when you start the deployment, you can import these values. You can export it as an empty CSV file, you fill it and then you you you import it again. You can do the recommendation, of course, to do a preview.01:06:44For your for the for the CLI. So this will, will bring the the current configuration on the router, and this is the new configuration as per the configuration group configuration. So this is the configuration that are.01:07:02Basically drive from the device template, and this is a crucial step especially when you are doing piloting just to understand what's happening. You'll need to go through this line by line and see what are the differences that are happening between the old configuration and.01:07:22New configuration. There will be some acceptable differences. E.g., the password hash.01:07:42I will be different so this is very acceptable. If if the two routers have, like if, if, if you are doing this as part of of the operation and you're moving from one model to, to another, there will be some subtle differ.01:07:50But not the core configuration of of the router. So this is a very, important step to make sure that you.01:08:11You understand what type of configuration are introduced by the configuration group, and you have line by line review to make sure that everything is in order.01:08:19Once you do the deployment, you can verify. So if you do a show SD WAN system status, this is a long output, so you can begin with personality, and the section that we're looking at or the item that we're looking at is configuration template. It's still called this configuration template.01:08:38In CLI, but over here you will see the name of the configuration group. So this is one way of doing it. The other way if you go to the.01:08:58Configuration devices and then one edge list. You'll get the list of your devices. And if you go to the column that says managed to buy, so the options that you have here are CLI of course if the device is not managed.01:09:10By the catalyst manager. 2nd option is config group, and this is when when you know that you are actually using config group because you could have the same names in configuration groups and and device templates. So you will have this prefix which is configuration group.01:09:29And also this prefix which is a template. So this is this will show you it will be able to show you which device is configured with a config group or or a template.01:09:49Also you can check the, the site topology. So this topology view is new in UX.two and you will only get this topology for a certain site. If it is.01:10:05Are configured by configuration groups. With templates, you will get an empty page, and we will see this in the demo. So once you have it, you will have this topology, this topology is very useful. If you click on the router, you will get this.01:10:22Sidebar over here that will give you quick statistics about the router. If you click on the interfaces, it will also give you some, statistics about about the interface. If you scroll down over here, you will get some.01:10:39Troubleshooting, like quick troubleshooting links like ping or or chase out. So next we will talk about some migration best practices.01:10:55Again, these best practices are just examples. However, it's up to you to figure out how you want to migrate in your environment. So these are just recommendations. One of them is to do wave execution. You don't.01:11:10Just migrate everything in the same time. You can start with the lab, you can start 1st to do to do the design and everything. You still can do it in, in your production catalyst manager if you have.01:11:30Like a test site or a router in your disk that you configure it as a site. So you don't have to have a lab but it's, it's good that you do this in a, in the lab environment. And the good thing is you can do the entire.01:11:49The design in your lab, and if the manager in your lab matches the manager in your production network, you can export all of the device templates that you created in your lab environment and you can just import it in in your production manager.01:12:04It is recommended to choose a few sites as you do the deployment and and the migration and deployment to monitor it just to make sure that everything is ok. And of course, you should have used all of the recommendation that we mentioned before you do.01:12:25The comparison for the configuration before you push it and so on. Then you can go regional regional or by city or whatever the your hierarchy looks like and then the full production. So this wave execution is is a good practice.01:12:42It is also recommended that if you you you all of your devices today are are attached to device template is the the recommendation is not to like detach all of them and leave them undetached or leave them in CLI mode for free day.01:13:02Few few weeks or few months until you figure out the configuration group. Do.01:13:21Detached the router right before you associated with a configuration group. So that's that's the recommendation deployed review, we mentioned that before have a very clear rollback path to understand how you will do that.01:13:27The rollback. The rollback will be easy. You will deassociate the router from the configuration group and then attach the template again. And it is very important that you will have the device template variables.01:13:47Exported before you do the migration. Automation, is very, is very useful. There are some new API points in points that you need to take note of. So these are.01:14:02New API in points that added to the swagger API interface just for configuration groups policy groups and and feature profiles. So all of these are.01:14:21Like different ways it depends on what do you have in your environment. So if you have CICD pipeline, then you can integrate all of this and and do the migration or rollback in.01:14:37A DevOps manners it is good to check the other trail, just go through it and make sure that there is nothing stand out as problem once you do the migration. So so next we will.01:14:53We'll have the demo, so I'll jump to my.01:15:13My catalyst manager, ok, I need to log in again.01:15:20So, so the demo.01:15:38We will be migrating this site. So, so in the site we have we have a single router site. The single router site has one interface connected to the internet, one interface connected to an MPLS link. It is running BGP.01:15:44Over here, this is the autonomous system number for the router and we have three service VPNs. So.01:16:05And the way we start migrating this site is by creating the configuration group. So 1st we will, we will give it a name the type is a single router.01:16:14And then you will have the profiles. We will have the system profile transport and management. So these are mandatory, these are the must have, and then this is optional, but we needed of course for for this for this site. System profile will have.01:16:29All of these features, we will go through them in the lab, but these are the basic configuration of of the router the transport we will have a transport VPN. We will have two interfaces and we will have BGP for.01:16:48The MPLS link over here. For service VPN, we will have a service VPN and we will have three interfaces and maybe we will have DHCP server for on each of these interfaces. So this is basically the breakdown on.01:17:08Of these the site configuration and how we will design the configuration group. So if I go to my lab, so 1st let's check the templates. So as you can see here this is this is the router that I want.01:17:27To work on, it is already attached to this template. So let's edit it and just look at it.01:17:48So this is, this is will be your process of migration, just to go through, go through the, the device template and the configuration and see what exactly been configured here. So e.g., this is this BFT.01:17:59A feature template here. This is aggressive one, maybe this has been used for fast conversion in AR policy or something. So you need to take a note and understand what particular configuration goes on this on this router.01:18:17Another important part is the additional templates. So if the router has localized policy or security policy are configured, this will not be part of the configuration group. This will be part of the.01:18:32Of the policy group. So if you have policies here, and you want to do the migration, so this means that some of this configuration will end up in configuration group, and some of this will be this will end up in policy groups. So you need to convert all of these policy and before the migration, you.01:18:48We need to have configuration group and policy group that are ready to associate the site router two. So you you must have both of them ready at the same at the same time.01:19:07Configuration group will be migrated 1st and then will be policy group. But in a typically in the same window, in the same maintenance window of your deployment.01:19:21So so in this example I have two templates. I have global and I have CLI add on templates, so I'll just take a note of that. So, if I go to configuration groups, and this will be.01:19:35So this will be my configuration group. I already configured it, but I'll walk you through the configuration because I didn't want to configure it on on the session that will take a very long time. So we have the basic profile if I edit it.01:19:55You can see, you remember the global, additional additional templates in the device template, we we had global policy. So this global policy moves here. So this is your the global policy that I had. And this is basically.01:20:10Some of the configuration. So these are main parcels, these are all the parcels that they can add on this device. As you can see on the basic policy, the device access policy or or or the implicit access list can be configured over here.01:20:28If I hit back, and I have transport and management profile. So again, this is the main parcel, so the main parcel that I have here is the management VPN and transport VPN, and under the transport VPN I have some sub parcels.01:20:46Management VPN has an interface, transport VPN has one interface connected to public color, one interface connected to private color and BGP routing. I have the three VPN service profile. This is pretty simple.01:21:05You have three VPNs with interfaces, and.01:21:24So DHCP server is not configured, but this is the way that you you configured over here. And if you remember we had a CLI template in the additional templates, so I'll put this here as a CLI adder profile, so we added for.01:21:29In here. So once, once we have all of this, I can save it. And if I build this in a lab, I can simply export it so I can choose it, export it as a file and then I can.01:21:49Come to my production manager and import it over here. So once this is done, I can associate devices. So if I click over here and try to find, my, my device, this device is in region one.01:22:06And the site ID is 14002 but if I click over here, if I go to region one, I cannot find I can find the hub, I can find 1401 but 1402 is not here. And the reason is because it is still attached to a template. So if it is attached to a template I cannot.01:22:24See it over here. And this is one of the.01:22:44Things that make some administrator like detach the router will before doing the migration. And and this is what we mentioned that try to do this in a timely manner manner to detach it and then associate it. So we will go back.01:22:49Two templates.01:23:09We'll go to our device template and we will de detach this router I think I have.01:23:11One or 2 min to finish this demo so this is still.01:23:29That should be pushed very soon, ok? So now the device will move to CLI mode. So once the device moves to CLI mode, it will be avo.01:23:47Level for configuration group situation. So this is the success, so if I go back to configuration groups, if I go back to this configuration group, if I go back here, I can clearly see that the site over here.01:24:07So I will choose the site and I hit save. So now this device is associated to deassociate it, you click here, you uncheck it and then you save, and now the device will be deassociated. So now the device is associated, now I can deploy it. So if I hit deploy.01:24:23And if I, if I associate like a hundred devices or hundred sites, it will be all be listed here. And again, this will help you with the you can see the hierarchy helps helps you with selecting these sites. So you can choose a region so you can migrate all of those right.01:24:42Doctors in in in a region.01:25:02So I'll choose the routers and then this is the step when I do the configuration. So you can see over here, so these are all the variables that I want to have. If I export them, I will export them as a CSV file, and then I can fill all of the variables.01:25:04And you can also fill all of them using import. So it happens that I have.01:25:24Other variables over here. So now I have all of this filled. So now I can just hit next and and I can do this, this is the crucial step that we were talking about, which is to see the configuration difference between a.01:25:31The two routers.01:25:51So what happens here, so right now the catalyst manager has asked the router to send the configuration to it. It will have all of these live configuration, this configuration comes from the router itself, and this is the configuration from configuration group. So you need to go through them. So e.g..01:25:53Remember the BFD. So this is the aggressive BFD profile that we configured which help with.01:26:13In your AR policy, but it's not here. So this is this is a clear thing that there's something wrong here. I need this profile to be here, so I need to go back to my configuration group and and fix it. So then I'll hit deploy.01:26:21When I hit deploy, you cannot see that there's NO progress or anything. So you need to go to deployment status to see the status or simply you can go here for the running tasks to see the running tasks that you have.01:26:38So once this is done, you can do do the verification steps that we mentioned before, but you can just for the sake of time, you can do devices. I just want to show you.01:26:57In the topology so the deployment's still running. So again, this is the device status window, so we go to monitor devices and then we choose the device.01:27:15So deployment is still so the deployment is done. So now we have, if you were quickly here and we go to 1402, you can see that this is associated with our configuration group.01:27:33So I can go back to monitor devices, and if I click here on the site name, you will, you will see the site topology. If you click on a link will give you the status of the tunnels. If you click on.01:27:51From the router, it will give you the status of the router and you can do some quick troubleshooting steps. So this is everything I have for you guys today. Please join this Slido and and give us your feedback. I'll give you a few minutes.01:28:11It's too.01:28:31Actually I'll give you 1 min to to join the Slido and give give us your feedback. This session focused on configuration groups, migration. The next is the WAN expert insights series session.01:28:34Will be a very similar session but for policy groups. So I encourage you to watch out for the notifications.01:28:53If you don't already have it, but I think you you already have it and I encourage you to join the next session to learn about completing the picture, which is the migration of policy groups. Thank you very much for joining us today and I'll.01:29:02We see you in the next session.01:29:22