Driving operational simplicity: Catalyst 9K to cloud mode migration in brownfield environment

Good morning, good afternoon, good evening, everyone. I hope you're having a good day and welcome to today's APJC export insight series.00:08Our topic for today is driving operational simplicity. And I'm last year your host and demo specialist for the day. Along with me I have. She is a customer success specialist.00:18Who has overall ten years of experience in networking industry. She has worked in routing and switching and wireless technologies and now engages with customers for catalyst center and adoption. I am also a customer success specialist also focusing on enterprise networking.00:36I'm also currently working for customers on cisco catalyst center and Meraki. I do hold several certificates like CCME and CCBA. So that's about us and before we actually start the session, let me just give you some few rules so that we can have a smooth and seamless.00:55Meeting so for everybody's comfortability we have muted everybody, but if you would like to speak, please raise your hand and one of our panelists will assist you. We can ask your questions at the end of the meeting as well.01:15But we do have an option Slido which is available in the app on your right bottom of your screen, so you'll be able to ask questions that please put your questions on that or on chat as well and our panelists will respond. And if you'd like to use the closed captioning, it's available in the left side bottom of your screen.01:27There are many caption languages available, so please if you would like, please do use so.01:47And then hand raised is available. If you'd like you can also use emojis to share your feelings and this session is being recorded, summarized and transcripted, so you will be getting slides after the session and at the same time the session slides and the recording will be posted on cisco community page.01:53So have a look at on that particular site. And also at the end, once you end this particular session, you will be directed to a survey page, so we request you to please share your feedback to improve our future offerings and yeah.02:13Next slide. But before we actually jump into the main topic, I would like to ask you one thing. Are you aware about Cisco IQ and have you onboarded? Next slide.02:28So Cisco IQ is a new tool that we recently released, but what it does is we have lot of data and you have a lot of data and we have lot of guides, documentation like that is release notes.02:46Vulnerabilities, field notices, troubleshooting guides and many more. So you have data and we have many guides that are obviously available now what and everything is working silos. None of them have any connectivity. What we have done here is we have brought.03:01Everything together so that you get this personalized insights based on your network. Now let's say there is a new vulnerability that is released, and if you want to know if any of your devices are gonna get affected.03:20Because of that vulnerability, you can get that information directly on Cisco IQ. So Cisco IQ will be doing these assessments for you and give you asset inventory. All your inventory will be there in one place and not only there is this field notices configuration and security best practices and many more.03:35And also all these insights will be available proactively. You don't need to do anything. All you need to do is log into Cisco IQ and you'll be able to see everything in that dashboard. And most of them are predictive so that you can optimize your network.03:55Every time that you look at that dashboard. So that is a very brief overall overview of Cisco IT, and if you need any help, we, you can leave your email and we can reach out to you and we can do an onboarding and.04:12And with that, I would like to now hand it over to Padma to take over the session. Okay, thank you. Hello everyone. Good morning and good day to wherever you joined from.04:28So, this, as you see in the screen would be the agenda for today. We will take a complete look at the onboarding process of initially of the modes that are available. What is a cloud native configuration that we have? What are the other capabilities that we support? What are the benefits using?04:43Each of the configuration modes followed by which we will also see a little bit about AI and the automation capabilities. So with that, moving to the very 1st slide, a quick introduction. So looking at the foundational architecture.05:02Historically the cloud management used a container based application container based application model. Starting with iOS XE 1715 one, Cisco transitioned to a native containerless architecture where the cloud agent is embedded directly in the iOS XE.05:18With the release seventeen.eighteen.two, we bring a full cloud managed configuration to support the catalyst 95 hundreds. We are like we are flight BGP routed ports and rapid PVSD and so forth.05:37We'll be taking a complete look at all of that in the upcoming slides. So a quick update on the firmware as well as on the models. This platform span or supports the entire catalyst, which portfolio like catalyst 9293 and 95.05:52And the next ten modeler switches all run in a unified Cisco iOS XE image with iOS XE 17 three.four as a stable enterprise baseline and 1718 is adding advanced L three features where like you don't have to NO longer worry about compromising between the.06:10Those X capabilities running on a legacy version.06:30Now this makes the operational simplicity even more easier with the cloud. So different types of modes that we support to maintain the operational flexibility, we support two modes. One is a cloud mode and the other one is the device mode.06:33A single line of difference to say cloud mode is that your UI would be, like in the cloud mode I'm saying in UI is where you will be able to do the configuration, you'll be able to make all the changes to it and all of them, wherein in the device mode where the configuration source being a device mode.06:51You can still retain your local CLI wherein all the conf configuration that you do will be backed up in the cloud and you can also leverage utilize the cloud monitoring live telemetry and troubleshooting visibilities from the dashboard. This would be a primary difference.07:08With respect to the cloud mode, in cloud mode configuration, the network changes are provisioned directly from the cloud GUI or through the APS. So for whoever needs a direct verification, we provide read only cloud CLI direct in the browser itself, which means you can execute the standard.07:26Commands like your show commands, your show IP router, show IP interface, these commands can be executed where you can without having to open a local SSH terminal, which you which means you can do it from the UI itself. That is with respect to show commands, but the rest of your configurations you can do from the UI directly.07:45Unlike you do on the device mode. The steps or the workflow of having these devices moved the Meraki dashboard is made very simple. Though it looks like step eight, the process that you will have to do is all that simply you have to do is you have to make sure if you are in the supported platform.08:02And if you're doing through the CLI, service meraki connect is a single line of command which is going to make the entire process easier, and that generates a cloud ID, which you will need while moving the device or adding the device to the Meraki dashboard.08:23And in the Meraki side, all that you have to make sure is like if your device is within the network and then you will, you'll be asked to add a cloud ID which you have generated by executing the service command, and once you add that, you will be good to go from there and all that you will be required to do is to choose the mode or the type of configuration or the operation modes you like to.08:38See whether it is a cloud or a device mode. On having the cloud mode chosen, your switch will undergo a factory reset before voting into the cloud mode. Yeah, so this is how the command line configuration would look like. Service Meraki Connect.08:58Is a command that you use where you will fetch a cloud ID as you can see. And once this is done to ensure or to verify if the tunnel on having this cloud ID added by adding the device to the network and adding this cloud ID there to verify and enable if the tunnel is being established.09:16You can use this command, service Meraki Connect, you can once you do the service it's gonna show you the output. Oh, sorry, I'm sorry show Meraki Connect was gonna show you the status of the tunnel, whether the primary tunnel is up or the secondary tunnel is up, what is the timing of it, and all of that.09:33Through which you can verify the connection status. We have something as a benefit called as config analyzer which is similar to the catalyst environment itself. You will be able to easily verify.09:52If the configuration that you already exist is supported or not, which means you have three options here as you can see from the snapshot, you can either upload paste or choose from the device itself to check if or to order if the configuration provided is clear.10:07And it is going to give you an actionable insight on that, whether it requires any kind of review or a compliance verification or even if any changes that has to be done to ensure the optimal network performance, this can be validated from this step. So.10:25Quickly moving on to the entitlement part. Cisco recognizes that the license transition can sometimes slow down the modernization projects. To accelerate this or to accelerate the cloud adoption, Cisco offers an entitlement.10:44Any active Cisco DNA essential or an advantage essential license holder on catalyst 9000 switches or a Wi Fi six EAPs is eligible for a three years of cloud management via Meraki dashboard at a zero additional cost.10:59Which means there's NO additional or NO new licenses required with NO extra cost or NO hardware purchases required. With an existing license for the next three years, which means up to 1st of February 2029 with the existing license, you will be able to do the onboarding process easier.11:14With that, we'll take a look into the 1st demo. I'll quickly hand over this to last year for the initial part over to you last year. Thank you for explaining us the theoretical part on the onboarding site. Now team it's the time to see how it actually works in the dashboard.11:32Now this is a recorded. Now what I have done here is this is a basic switch catalyst switch and all I'm checking, gonna check here is if all the prerequisites are met or not. So for that, I will run all the commands that are required, show run.11:53By AAA, so my AAA is configured with the authentication authorization. So that particular prerequisite is satisfied and then we have to also check if the DNS is at configured or not. So that is also done. And now the very important thing version.12:09Your version should be about 17 or 15 or three and also it should be in installed mode. If your device is working in bundle mode, it is important that you need to convert it into install mode and then do the onboarding.12:27So since all these are done, what I'll do is I'll just try reaching to dashboard.com to check if I'm if my device is able to reach internet and that is done. I will also ping catalyst.Meraki.com just to reassure.12:42And that is also successfully sent. Now since all the prerequisites like DNS and the internet reachability is satisfied, we can go ahead and check for the Meraki compatibility.12:58So for that, what you can do is you can run a command called a show compatibility, which will tell you your device compatibility for cloud monitoring and cloud management. So now as you can see, the cloud monitoring is compatible and cloud management is also compatible.13:14Now one thing that you need to observe here is, let's say, if you, if your device is in bundle mode with seventeen.fifteen.three or other version, your monitoring status would be compatible, but when it comes to management it would be saying non compatible, incompatible.13:32It's because the device image should be always in install mode if you'd like to onboard it in the dashboard. So since my image is in install mode, it is compatible and everything is good. So now I can go ahead and enable service meraki connector, which will give a cloud.13:50ID which is like a Meraki serial number for catalyst device which can be used to onboard the device on Meraki dashboard. So once service connect is enabled, it might take at least two to 3 min for all the tunnels that is the primary and secondary tunnel to be up.14:10And to get the cloud ID. So you can enable the logging and check what all is happening. So if you observe here that my particular device is up both primary and secondary ones and the configuration is also successfully.14:29Needed. Now once everything is good, you will be getting the cloud ID. So here you see we will be having the serial number that is for cloud ID we will be but cloud ID will be used to onboard it in the dashboard.14:46Once that is done, once we enable service connect and have a cloud ID with all the channels up, we can come to dashboard and navigate to organization inventory and claim the device. Now what you need to do is you need to click on this claim individual devices there is a.15:02Enter orders that is individual devices, you need to go to claim individual devices and give the cloud ID. Now one more thing is you can add swing to cloud ID or you can add hundred cloud IDs at a time.15:22All you need to do is just add all the cloud IDs one core line that is you can have hundred cloud IDs so it should be hundred lines and once that is done, you can click on this claim device and it will be present in the inventory. Now, when you add hundred cloud IDs, it might take at least.15:37Two to 3 min for that particular addition to be done and once that is done, you have to add it to a network. You can do it in two ways. You can go to a particular network and go to switching and then add a particular switch or else you can do it directly from this organization either.15:56Next week.16:16Now I will select an existing network or if you would like to create a new one, you have that option as well. And here we will be selecting device configuration. So there are, I mean, as you might already know, there is device configuration mode and then there is cloud configuration mode. So if you are going to onboard it in the cloud configuration.16:16It's only, only thing that we need to majorly need to check is that the configuration which is existing on the device is supported or not if it's a brownfield device. So for that there is config analyzer which we will be seeing in this demo.16:37But we need you need to remember that if you're going to onboard it in the cloud configuration mode, then the device will be rebooted and reset it. So for that reason, it's very important that you choose the correct mode based on your.16:52Requirement. Once you give the configuration more, you need to give the username and password and enable password is optional. Once everything is done accept the terms and conditions and next. And within.17:09Three to 5 min everything will be done. That is all be able to collect the configuration from your device and will be up and online on your device. So if you'd like to see the onboarding status of the device.17:25So there you will be, if you have just initiated the onboarding, then you will be seeing this onboarding tag beside your device. But since I have forwarded that part, I I'm not able to see that but since you will be doing it online, you'll be able to see that onboarding tag.17:42Beside your device name. And you see it's successfully onboarded, but currently is in dormant state and the configuration source is device. So for the device to come from dormant state to online state, it might take three to 5 min. That's what I mentioned one.18:01While I was telling about configuration collection. So during this particular process, the Meraki will be collecting your device information and once everything is done, you will be able to see that device is online. And.18:20After the device comes online, you can check this launch terminal. I mean, if it's still in dormant state or online state let's say you just onboarded it and then you go to this particular dashboard, then you will be able to see this launch terminal. But if you wait for like maybe 10 min, then you.18:35To be able to see the cloud CLI option tab which will enable you to configure the device like normal CLI. You don't need to SSH to the device or you can all the read and write whatever you wanna do, you can do it directly from cloud CLI, which we will be seeing in the demo.18:55But, yeah, I will show that in a moment, just one moment yeah so if I go to any of this.19:14This should not be able to see that cloud CLI I mean, you'll be able to see but you'll not be able to push any configuration.19:34All the configuration that you would be doing will be through all the form side of things so let's configuration.19:50Device configuration more and by the way, I only have access to this lab, so I will not be able to push any configuration but I would want you to.20:11See how cloud CLI tab will look in the dashboard. Yeah, you see previously in that recorded demo, we were able to see that launch terminal here in this left side, but that will become here as cloud CLI.20:23And you will be able to see this launch terminal option once we click on this cloud CLI, it is taking a moment to load yeah meanwhile this happens I'm gonna show you that we were talking about. Now what usually happens.20:41Is when you onboard a device in cloud configuration as already mentioned, all the configuration will be erased and the device will be rebooted. Now it is important, right? That you need to check what information is supported on Meraki and what is not.21:01So for that reason, what we have done is we have added this new feature called as config analyzer where you can enter your configuration and check, and check what configuration is actually supported, what is not supported and requires a review and what is and.21:19So for that we need to go to organization and inventory and switch config analyzer. So here we have three options, upload paste from device. So upload is if you have a config file or text file, you can upload that file.21:40And paste this you can paste the whole configuration and from devices, let's say you have onboarded your device in device configuration mode that is device in device configuration mode and would like to now convert it into cloud configuration, then all you can do is you can just select the device option and give the device.21:55Yes and it will be since it already has the configuration details.22:16It will be able to give you the analysis report. So I will just use paste in this particular demo. So I have a configuration and I pasted it. So it would take maybe two to 3 min for the whole analysis to be done.22:19I will forward that part. Now you see we have three categories in this particular report. Again, you can download this or you can just view it in this particular case. Now if you.22:37Observe I have a dropdown beside each of this category of the configuration. Supported configuration is all this configuration is supported. You don't need to change anything. All you need to do is like just have this configuration aside and configure everything on your GUI, so everything is supported.22:52But then there is this needs review which means this configuration is not supported, but we can check for alternatives. There might be alternatives. E.g., now let's say you have configured application visibility on your device. It is not supported on but there is this deep packet inspection which is supported.23:10So what you can do is, this is actually another workflow, I mean, it's not there on but what you can do is you can just download this report and give it to any chatbot that might be, that you have access in your organization.23:31And ask a prompt like give me the alternative options for this needs review configuration and it would be giving you all the available alternative options on the and also you can ask another prompts like now you have that supported configuration, right? You need to understand how to configure.23:47Not also on your dashboard. So for that you can give another prompt like give me workflows for all the supported configuration so that I can configure this configuration on my dashboard so that it will give it will give you a whole report telling you how you can.24:07Configure each and every configuration. So that is how you can use AI here, but if you need any help, we are there you can reach us out. We will share an email, you can reach us out through that particular email. And then there is this ignored configuration, which means this particular configuration is.24:24Will be there when you onboard the device, but again team if you observe here, there is this ignore configuration. So if you click on that, that particular configuration will be going to this ignore configuration in the last segment, but that will not be available. So it's like you are considering, ok, I'll not be adding this configuration anymore.24:42But team, I also want to emphasize one more thing. We are working on bringing this CLI templates to the dashboard where you can add this unsupported configuration using the CLI templates and have the.25:03Team capabilities like the one that you have previously. So that is about the and again team this config analyzer isn't beta version, but you can get the early access. So that is about the onboarding and config analyzer.25:18And now I would like to hand it over back to Padma to continue with the presentation. Thank you for the demo last year and starting off with as I explained in the initial part of the presentation, starting with 1781, we have few advanced routing capability. Historically, one of the biggest.25:35Concern around the cloud management network was feature parity. Starting from this version which is the iOS XE 1718 one.25:55Cloud managed catalyst switches support some of the core enterprise capabilities such as stackwise virtual, which is the SVL on catalyst 9500 series in service software upgrades, which is the ISSU for the sub second downtime.26:03And the routed access BGP VRF VRF light, so forth. We'll take a complete look at each of this individually, starting with the VRF, which is the.26:22Virtual routing and forwarding. The virtual, the VRF light primarily enables macro segmentation, getting the routing traffic for each separately, which means guest traffic.26:36IoT or the payment segments remain strictly separated at the forwarding plane. This eliminates having a lot of bloated ACLs and it prevents the unauthorized route leaking and confines a network fault within the specific virtual routing domain.26:53This is how the config would look like in the dashboard, the vrfs are defined globally under the organization, under the vrfs can create a VRF by providing the name and the route distinguisher. Defining the vrfs at the organization level guarantees a consistent segmentation policies across all the distributed.27:13And the campus location. Once the vrfs are established, going on to switching, routing on on dashboard, navigating to switching, routing, and the DH DHCP to assign svis or the router interface to your VRF domain.27:34Is simply done by selecting the target VRF from the dropdown. The dashboard automatically builds the underlying VRF routing table and binds data plane interface very seamless. Moving on to stackwise virtual config.27:51Stackwise virtual config on catalyst switches combines two physical places into a single logical entity with a unified control plane. SVL eliminates spanning tree bottlenecks on distribution uplinks and enable multiple chases ethernet and provides a sub second deterministic failover across your.28:08Code layers. This is how dashboard would look like, would give you a comp the dashboard would give you a complete operational visibility like this lets you track the health of virtual switch, your dual active detection links, the power failures, fun modules.28:28Now this helps you in allowing standardized high availability deployment across your entire campus distribution layers. Quickly about the in service software upgrades. Now, in in service software upgrades.28:46What we achieved primarily is hit list or the zero packet loss failover upgrade is achieved. This dashboard lets you coordinate upgrading the standby chases 1st failing over state gradually moves.29:03From the active, this lets the traffic takes the whichever plane is active, the traffic takes that particular plane and the failure eventually happens to the one which is not upgrading, which means in case if you are upgrading your sandby chases 1st.29:20Your active tunnel keeps traffic going and gracefully vice versa happens. So in this scenario you will face zero packet loss, which means you will not even know that the transition is happening. This is how the dashboard would look like.29:38You have the option to schedule this and scheduling in the simple. In former management, you'll have to select the target is XC release and choose the upgrade mode and the dashboard runs a set of precheck or the pre upgrade checks and all that is done.29:52And the activity takes place. So moving on to rapid PVSD. Rapid PVST here provides a dedicated spanning tree instance for per VLAN. This enables in a granular load distribution across redundant links.30:10Sub second convergence during the link transition. In cloud managed catalyst switches now offered native rpvsts plus configuration directly from the dashboard itself. This is how it would look like the configuration screen would look like to configure.30:29Initially navigate to switching, switching settings and set the STP mode to rapid PVST. You can specify the bridge priorities for switch and for VLAN directly on the table.30:46Moving on to BGP quickly so that we can take a deep look at this in the demo part. In the cloud managed catalyst switches like the catalyst 9395 or 92 CX supports a full stack dynamic BGP routing, whether running IGP across campus cores or.31:03EBGP pairing with edge routers, you can standardize scalable dynamic routing with a full API support. On the dashboard, you will be seeing this under switching BGP routing. You can define your local autonomous system number, which is the ASN.31:21Router IDs, your neighbor IP adjacencies, the dashboard provides a real time peering status, like your session uptimes, your receipt prefix counts, all this can be checked from the single web UI dashboard itself.31:38Not just that, the BGP engine supports again granular route filtering as well. Define a prefix list of control inbound, outbound route advertisement. Configure the AS path ACLs to manage the path selection.31:56And create a peer groups for rapid standardized neighbor policy and deployment Software management in the device configuration mode. Now, this dashboard in specific.32:09Centralizes a formal life cycle management by providing a unified visibility into the current version. It gives you the flexibility to schedule the upgrade availability for cloud monitoring switches, which significantly reduces the operational overhead.32:27Now this can be achieved in same way as we do in the other setups like you have the option to schedule it, make the changes to the schedule, and you can take a overview of whatever the configuration which is done. This team streamlined approach minimizes the manual traction effort and enhances the overall network.32:42Reliability through simplified and data driven update network flows. This web view also includes CAI assistant which is in the dashboard itself. This accelerates troubleshooting by processing natural languages queries.33:01It correlates the telemetry across the switches that, that leverages using and you know the troubleshooting process easier, that helps in identifying the root cause and it also recommends remediation actions to minimize mean time to the resolution.33:20The monitoring part, cloud managed switches continuously stream the telemetry to the dashboard. Now this provides a live insight into port utilization, the client association datas, the PoE power budgets.33:36Transfers your optimal metrics, the alerts, the automated alerts, any security flags or any link flaps, all of this gets notified in the monitoring dashboard itself. Not just that for the for the governance, the dashboard tracks configuration changes.33:54Verifies the software compliance against whether it is a gold service or it requires in case there's any kind of a device reboot or any in case of a crash is generated on a device reload or a reboot, the logs get generated and you can simply view this from this dashboard itself. It simplifies.34:11The network order process by doing this. With that handing over this to last year for 2nd demo. Over to. So team now what we would be seeing in this demo is we will have a look at how to configure the features that we just discussed.34:30So let's start with, for that you can go to organization and here you would be seeing VRF data and if I go to that particular it will take me to the VRF.34:49And I'll be able to see all the configured vrfs already configured vrfs along with this route distinguisher and route target and the network and you can edit it. So if I click on that, you can particular settings.35:08Can save the changes. Now let's say you wanna create a new one, add a new add a new VRF, click on this add new VRF and then give a name and all the other settings and make the change. Now you wanna associate these vrfs with the interfaces, right?35:24That can be done by going to switching and routing and the HCP. So here you will be able to see your interfaces or the interfaces routed interfaces.35:40There you can go ahead and associate any of the interface with the created VRF or already existing vrfs. It's taking a minute to load yeah so you can search based on any of the switch stack.35:56Which orgs which mean and the IP address. I'll just give this back and you see that I'm able to see all my interfaces here. And if I click on this and go to this and select one, I will be able to see all the settings for that particular interface.36:13I'll be able to see if it's an interface or router or group back and then the name VRF you see here, this is the VRF. It is currently default, but if you would like to update it, you can update it with the any of the existing ones.36:30And then you can also view other settings in this particular page of the particular interface like IPVF, IP address, and you can also assign the DHCP settings, OSPF settings, all the, all these services for this particular interface can be configured.36:46Directly from this particular and next thing that I want to show is BGP routing. So how you can configure BGP on by going BGP.37:04And here you will be able to see all the existing BGP routers. You can click on any of the switch and it will take you to the particular settings. You can see the switch name and if the BGP routing is enabled along with the autonomous system number router ID.37:19And if there is any that is configured, that also can be seen here and now you can configure the neighbors statically or you can give based on the approved, so now my this particular SJC 9500 is.37:36In paired neighborship with these particular devices. So there are two devices MS 3901 and MS 3902. So this particular device is in fair neighbor relationship with these two with these two devices.37:52So in this way you can configure the neighbors in this particular page for the BGP. Also, again, you can add the static networks and if you would like to add any other peer groups, you can do that by clicking on this add peer group.38:08So that is about BGP routing, and now if I want to create any switch stacks here for that I can go to the switch stack. Now what I can do here is I can view the existing stacks.38:25And at the same time I can create or edit any of the existing stacks. So let us take a moment to load. I think it knows that I'm delivering the session and it knows that it should do some.38:40Loading in the back end. Now, yeah, you see this is one of the stacks which and you will be able to see the stack members. So that means if I click on this particular stack, I'll be able to see the stack members, I can add.38:58Remove any of those or basically add any layer three configuration and also we'll be able to see all the ports of of all the stacks basically what is the role and status of the stack features.39:15So you see these are these are all the ports that are available on both the members and the role is also can be seen here and the model. You'll also be able to see the DAD link and the virtual links. Now if I just manage members.39:32I'll be able to remove switches or add any of the switches under the switches to this particular stack and layer three routing, if you would like to configure the OSPF router ID or any of the layer three routing, you can click here to configure further.39:48Now if you would like to just edit this particular name, you can do it by clicking on this pencil icon and change the name of this. Now, also if you would like to configure the ports in this particular stack, you can click on this configure ports in this stack and.40:03Take you to all ports on this particular stack in the switchboard speech. Now we would be seeing, so this is the switch ports dashboard team and all the ports that you're currently doing here are for this particular 9500 stack.40:21But in general, if you open this particular page from switching all the ports, basically all the ports on your all your devices in this particular network. But since we have clicked on that particular switch.40:39It has filtered, that means this page has a filter option which I'll be showing in a moment. So you can go ahead and any of the port and just directly take you from the switch and switch ports. So then it will not be making any filtering here. It will not be filtering anything here.40:57It will show all the ports that are configured on this particular network. Now you see these are all the ones and now go ahead and search based on the device name or any.41:18Filters that are available here. Now what I will do is I can go to any of the port here and we'll just show you what are all available here. Yeah, you see these are all the things that are available.41:34RSTP, STP card, port isolation, PoE, UDLD, you can configure all these directly from here and also can view the port status and the interface more in this particular form. And, then.41:50The upgrades. So we do have upgrades, right? Now, mostly in organizations, the most time consuming part is software upgradation. You get any vulnerabilities if any of your devices are affected by any of the vulnerabilities, mostly the work around would be to do an upgrade.42:08So to ensure that your organization is always in safe and not compromised, we would need to do an upgrade, right? So we have option to upgrade your catalyst devices directly from my Meraki dashboard.42:25That you can do by going to organization and so previously we only were able to do the upgrade configuration source devices. But recently we have added this device configuration devices as well.42:40That means whatever devices that, whatever devices that you're going to onboard on Meraki dashboard.43:00All those devices can be upgraded directly from dashboard. Now I'll just show you how that will look. So again, if any of the devices support the ISSU upgrade.43:06That also can be done directly from here. So, yeah, in this page you'll be able to see all the latest software versions for all the device types and if there are any recent changes that you can view here and the schedule changes.43:21Now, if I go to the schedule upgrades, I'll be able to see two options, cloud managed, cloud monitored. Now cloud managed in the sense all the devices and the catalyst devices which are onboarded in cloud configuration source.43:40So now if I click on any of the network and click schedule upgrades, it will give me the target firmware version and I can select that and next, so here you can select if you would like to for the minimized update time.43:55Or minimize client downtime, that means if you would like to minimize the upgrade time, then your clients will lose connectivity. But if you if you are going to choose the minimized client downtime, in that case upgrade would be taking a little overtime, but the clients would be staying connected throughout that.44:13Most most of the part and then here you can ok not this one. I will search for one of the cloud device configuration devices. So this is one of those. I'll just select any of those.44:32And schedule for the upgrade, so here I'll be able to see, I'll just select the latest recommended one and perform the upgrade and confirm. Okay.44:48Just a moment, I think I assist you, they will find it for some other thing I will select this one.45:05So there would be an option for ISOS to upgrade in this particular page. I'm not able to find that network where we have catalyst devices, but you would be finding that option when you start the workflow. But again, you can, these are the devices that are onboarded in device configuration mode.45:28If I click that and schedule for the upgrade, then I'll be given an option for target version and next to perform the upgrade now or I can schedule the upgrade. So if I schedule it, I'll need to give the time at which the firmware should start the up installation.45:46Also I saw a question on the chat that if I can do a pre download option as well. Yeah, that is also available. While you start the upgrade, if I just show you here schedule upgrades and next you can you have this enabled pre download option.46:04Which will download the firmware 24 h before the scheduled upgrade, so that you can do but it's only available for devices. I'll have to check if it's available for catalyst devices, but you can do it for the device. So that is for.46:23The upgradation part, but also I would like to show you one more feature here. So if you would like to configure the RPVSD, that you can go ahead.46:39And configure from this so you can go ahead and configure directly from here. So here you can configure the as well.46:55And this way you can configure these few features that we mentioned and also I would like to show the AI assistant part. So I do have three small demos, I just asked few prompts here.47:12Now you see I just asked what did I miss in my organization over the last 4 h, so this is an actually create already created prompt. I just selected that and I'm able to see all the issues that are there critical address.47:28Recent changes. So basically whatever has been done in the last that will be seen here and now then I ask like what are the top issues and prioritize them based on the impact those issues can create. In that manner, it has given me like there are six APs that stopped communicating with WLC.47:44And it has the highest impact. So now it also has given me like two points for that particular issue. And what I have done is I have asked to elaborate on the AP stop issue. Now then it has given me all the APs that are.48:03Not able to connect to the particular WLC and it is giving me the this alert start time and if it's already resolved when it has been resolved and severity and the network. Now let's say if it's not resolved, then you can ask like how to resolve this particular issue and it will start giving you some suggestions which you can.48:20Try to remediate the issue, to try to troubleshoot the issue. So that is one where you can use AI system to troubleshoot your particular network. Then there is this other demo where I just asked like how many clients are having wireless issues.48:39So then it has gone through this particular network and given me all the clients that are having wireless issues and then I asked like how to actually resolve these issues. So then it started giving me like, ok, you most of the.48:57Failures is because of the authentication and DHCP and it has given me like check the SSID authentication settings, investigate the previous site for and some other steps which would be helping me in actual initial troubleshooting instead of directly going to tech.49:13So that is how you can use and also let's say you want to configure anything. Now here I asked like how do I configure a new email alert for a specific network? Then it has given me the workflow which I can follow directly and configure the new email alert. Not only this, let's say you wanna configure any workflow or you wanna create any.49:31Automation here. You can just ask like, ok, this is my particular requirement and how do I do that? It will give you step by step process. It will not be able to do it for you, but it will give you the workflow.49:51So in this way you can use AI assistant to troubleshoot your network, monitor your network and also configuration. Configuration is just to know the workflow, but the other two you can get deep and deep information in natural language.50:03So that is about the features that we have discussed in this particular demo and most all these features are available on seventeen.eighteen.one. Some are available on 9500 and some are available on both 9500 9290 300.50:19So that is about the features and I would like to now ask Padma to continue with this presentation over to you Padma. Thank you Larsia.50:37So starting off with the smart port automation, what is the smart port automation and how do we benefit because of this? So this smart port automation option right is aims to solve the problem of highly repetitive or error prone port configuration. In scenarios like where we.50:55Do a very highly repetitive port configuration scenarios like where we see a likely a very minor error when we do a lot of port configuration.51:15Is easily overcome by using this smart port feature smart port automation feature. Now this lets you create a set of attributes, a profile maybe, and you can bind them to more than one ports.51:23While you're making the initial or the ongoing configuration is made very much easier because of this. With this smart port, a profile can be bound directly to a port from its configuration UI or it can be dynamically assigned with the help of automation.51:38What is an automation here is that an automation in this case is a user defined sequential logic that allows the switch to detect and identify the type of device it's connected on the port and based on which it modifies the port configuration using this profile.51:53Which mean, it will identify the type of device which is connected to the port and it will modify the configuration where according to it using the parameters that you have defined in this profile. There are certain limitations or requirements or guidelines that is there for this.52:10The smart ports allow profile and automation to be created and managed at the organization wide or in the network wide. A user can access this feature either via the organization menu or on the switching menu depending on the administration privilege which is assigned to that specific user.52:28Automations are currently only supported in the organization wide scope, only organization wide profiles can be used or can utilize the automation feature. Automation and the organization wide profile do not support any network level configuration components such as the access policies.52:45While multiple automation can be applied to a single switch, but only one automation can be assigned to a single port. There there's a small difference in here. You can use a multiple automation in a single switch for multiple ports, but only one automation can be assigned to one single port. That would make a difference.53:04Smart ports are currently not supported in configuration templates or any network which is using the configuration templates is also it's not supported. Let's quickly take a look at like how this.53:23What is the workflow or how this smart automation works? So you have two sides like how it works, key benefits and where it works. So I'll start off from the dashboard view that you see. So this is at the center you see this, the Meraki dashboard. This is where the intelligence sits.53:38It's cloud managed so everything is configured centrally and pushed down to the switches. Below that is where you see a Meraki switch. That's what we have taken, e.g.. That's where the actual automation takes place in this case, in the access layer. Starting off from the workflow, what we do is create a profile.53:55Define the automation, apply to a ports and the automatic configuration such as instead of configuring ports one by one, we define them once as a profile and next we define the automation rules. This is where the intelligence will come. The switch can identify.54:12The type of devices, things like LLDP or like Mac address patterns, lets it identify the type of device it's connect based on which this could be a single port or like assigned to a thousand port across your network. It can identify the type of device.54:29And system and this system automatically applies correct configuration to that specific port where NO manual intervention is required at this stage. Now, if you look at the bottom right, each of these ports have individual devices or a different type of devices assigned.54:46One is an IP phone and wireless AP, an IP camera or a laptop. Each of them has gotten a different VLAN assigned to it based on the type of device it is or however, the automation is defined there. Now this approach saves a lot of time.55:02Okay, like there's NO lot of manual intervention is required, it reduces a lot of error. It simply uses the logic to identify the type of device and it applies the automation there which eventually eventually makes it uniform, like each of such similar devices will fall under same category.55:20A configuration overview. So what we do is basically create a smart port profile under switching configuration smart ports and profiles, you'll be able to see add profile, you will define the parameters required While the step two here is optional.55:40Enable application via radius AV pair. This is one of the way where you can achieve it, not you can move to switch three like apply to the switch, apply profile to the switch ports here you can apply to the apply to default profile.55:55Then trigger the automation, like you can define the rules there. Like you can create the automation rules like if and then whatever rules has to be created applied or created there can be done and then apply the automation to the ports. Applying automation across port ranges and monitor.56:09The traffic like monitor the automation, monitor the like show check the port status, do the configuration comparison. You can check the even logs to see, to see if whatever configuration you have done is taking effect or not. You can easily cross check and validate by doing this.56:26So that is about smart port automation. We're moving on to adaptive policy. Adaptive policy introduces the identity based micro segmentation using sgts, which is security group tax, which means.56:44Using the security group tag directly within the data plane enforces the security policies based on the users and the device identity unlike how we did on the previous time by using the IP address or a separate network topology.57:02It uses the device identity and the type of user to apply the security policies simply. So we spoke about SGT previously. SGT is security group tags commonly known as sgts. Scts here is essentially an identity.57:16A Label which is assigned to a user, device or a traffic flow. Instead of how we do in the earlier times like relying on an IP address range or a VLAN assignment, the network identifies what type of user or what type of traffic is it? E.g..57:35Traffic maybe tagged as an employee traffic and IoT traffic or a server traffic so forth. In the above example as you can see in the picture, the packet carries an STT value identifying it as an employee traffic. The major advantage is that the security policy can now be enforced.57:51Consistently based on the user identity of the traffic, which it is flowing. This becomes extremely useful in a modern enterprise environment where the user move between different locations and connects dynamically. Rather than applying a lot of complex ACLs and administrator can find it difficult to switch between the groups.58:09Sorry switch between the devices or different, this can simply be defined on the groups, like for whatever group it is, whether it is employee traffic or it is an IoT traffic or a contractor, like it can be applied to unique type of traffic.58:28In this example again, the employee device maybe allowed to access the business application while the IoT devices and other devices can be led to communicate with a specific service only. This is primarily done to achieve scalability.58:43And simplify the policy management process. Group assignment technique in in like two ways how the security group tags are assigned. The two primary approaches here like one is static assignment, the other one is a dynamic assignment. In case of static assignment.58:59It involves, like manually associating the scts with switch ports VLANs, ssids and so forth. This works well in an environment where the roles are properly defined. Yeah, like what works best is a dynamic assignment in a more flexible and a scalable environment.59:19In this model, as you can see the STDs are assigned automatically using in the dynamic modeling I mean to say using the radius authentications and the identity information. The network can make decisions based on the user credentials, the active directory groups.59:36The posture informations, the locations or the device type is what is basically used in case of dynamic assignments. This slide also highlights the support across multiple platform Meraki platforms including Meraki switches, wireless routers, and the other appliances. The overall objective.59:53Is to have a strong foundation for the zero trust security. This very last slide here is combines all of this. It brings all of this together. This shows like everything together by showing how adaptive policy delivers a consistent security.01:00:12Enforcement across the network. The key idea here is that the policies are centrally configured in the dashboard and are automatically distributed to adapt policy enablement to enable devices, which means in the same security intent can be applied consistently across both wired wireless and in the multiple network locations.01:00:31In this example again the employee device maybe allowed to access the business applications while the IoT devices may only communicate with the designated IoT service because the policy is based on the identity rather than the physical locations. The enforcement remains consistent even if the user is moving to a different location.01:00:51This eventually or significantly simplifies the security operations in the overall network, wherein the administrators NO longer need to maintain a large number of VLANs or specific ACLs across different devices. Instead, they define policies once and the infrastructure handles its enforcement automatically, like once if it.01:01:09Specifically identifies the type of device, whichever locations that you move to, the policy would remain uniform and consistent. So that is about policy across network. We'll quickly hand over to Lassia for the last time. Over to you Lassia.01:01:29So we will 1st look at how to create the smart codes for that organization and smart codes. So you can create profile to profile to one quote or thousands at a time. But one way you can create smart codes is.01:01:45If you would like to apply those particular smarts for all the networks, then you can go to organization and search for the section and it will take you to the smart ports for the whole organization. But if you would like to configure smarts per network basis, then you can go to switching and here you can create.01:02:05This market. Now we are currently in the organization page, so that's why I'm able to see two profiles here. Now, if I go to any of the profiles, I'll be able to see what is actually configured there. Now you see this is what it is mentioning. You can configure.01:02:25The I mean the type of the particular smart code if you would like to enable PoE or you can configure all these which switch piece configurations for a particular port.01:02:41And can apply it throughout. Now you see this application via radius AP pair, if you enable that, what happens is based on the ICE configuration, the port configuration will be configured. So in this way you can integrate your ice also and from that you can get the information and the port.01:02:57Configuration will be done assignment will be done. So that is about how you can create a particular profile and now we already have discussed about this automation, right? Like you can create automation that is you can use if then statements.01:03:16And based on that the configuration can be done. Now if I go to any of this particular automations already, you can see there are ok so there are two types here like there is this match, two types of match type. One is LLDP system description and other is.01:03:32Mac address. So based on LNTP system description or Mac address, you can create this automation. So let's say you feel that ok wireless AP should be given data VLAN data of access, then in that case.01:03:49You can give the LLDP system description as wireless AP and then assign a particular profile. So you we have created the profiles, right? You create the profiles there and then assign that particular profile to this particular automation.01:04:04Based on this match type, it will be giving you the, it will be assigning the particular port. Now, the next thing is you can assign this particular automation directly to the devices, networks ports from here. If I click on this pencil icon, you can select the network devices and give the port.01:04:21And assign the or else there is other option you can go to switching and switches and there you can configure the port per I mean ports be port basis.01:04:40If you'd like to configure a single port or multiple ports, you can select those and do the configuration from here. If I go here, I can select a particular port that's just loading.01:04:59So here you can give you collect the profile option and automation option so that you can configure a single port based on your requirement. Now let's say you feel that you need to configure this 1st 1st port basis, you can go to this ports.01:05:16And give the profile based on each port or else if you feel that you can give this to whole to I mean if you would like to assign this particular profile to make multiple ports that you can do directly from here. But when it comes to automation, it is dynamic, that is you can assign the ports based on.01:05:33The Criteria that you create and the profile. Now if I go to any of this particular port, click on it, I'll be able to assign the automation that I created and the port profile that I have created.01:05:52And also you can view this port information that is the profile ports and the automation port information from switching switch ports. We can see that as well. So I'll just show you this edit selected ports. Now you see here we have this port profile automation, whatever automation that you have created, those can.01:06:09Reviewed here and you can select. Now let's say you don't want to do that. You only want to do.01:06:29For profile I mean you just want to assign the profile, you can click on enable and then you can view the profile that you would like to assign. So you can do this for the switchboard and now if you would like to see what automation has been assigned to particular port, you can do that by going to switch.01:06:35Both and since we'll be able to see all the which.01:06:55In this particular network, you will be able to see those. So what I'll do is I'll just filter one of the ports which have automation. Yeah, you see this particular port has automation enabled. I'll go to this one. It is.01:06:59One of the stacks which now you see we will be able to see the profile name here and also there should be automation information that is not loading. So this is where you can view what particular profile and automation has been actually assigned to a specific portal.01:07:15And, that is about the smart. Now I wanna show you how to configure the adaptive policies. So that is again available in organization and adaptive policy. So you will be able to see the metrics like what is the current adapter.01:07:35Few policies that are created here. Those in the page that and when you see we have many groups here which either have custom or allow or deny rules.01:07:55Now what I'll do is I'll just go to these groups and you see I'll be able to see all the groups that are already created. And if I click on this add group, I can create a particular group with its SGT value. And if you'd like to add the policy object binding, this will be for the traffic which doesn't have SGT tags so.01:08:13For any of the traffic that is not tagged with the SGT that can be done using this particular policy object binding that you can do from the if you click on this create a new.01:08:33Policy object, you can go there and create this particular policy object binding. Now you can just create the group. All I I'll do is I'll just select one of this and edit it. Now you see, I'll just give value and a description for that.01:08:47And I can update it. Now once you create it, you can go ahead and create any of the custom ACLs. So as of now this the there are two custom ACLs here, one is deny any ICMP, so if there is any ICMP, we will be denying that.01:09:02And then there is other one. Now, if you go to this networks since this is organization level, you can go ahead and enable it based on the networks level. So mostly some are enabled, some are not. If I just click on any of the networks, again, all the networks that are.01:09:17Under this particular organization will be available along with its enablement status. So if I click on this and click on enable, I'll be able to enable the adaptive policy for the networks and all the policies that you create will be assigned to that particular network. Now if I go to this policy and click on this add policies.01:09:35I can go ahead I'll just do the and employees engineering. I can either allow or deny the traffic or we have created the custom ACLs, right? So I can assign those custom ACLs here. If I just click on this add and.01:09:54Entry and you I mean select the ACL that I want to give it. Then automatically the rules that have been assigned to that particular ACL will be appearing here. I'll just save it and you see these are the rules that have been selected and I'll just review the change and apply it. Also, if you would like to create the.01:10:11Invoice policy also you have an option, you don't need to create it separately. You can just select this policy option and it will be able to create the invoice as well. So in this way, you can create the policies, adapter policies and have segmentation in your network.01:10:31So that is what and we'll now finish the presentation, just a moment. So we.01:10:50Want to ask you to leave with these few points. These are the main points that are important for actual onboarding. So.01:11:09For the delay?01:11:28And yeah, so these are the few key points that we would want you to leave with for from this particular session. You can manage your iOS and devices directly from your dashboard. All you need is any active DNA licenses. I saw there is another question regarding the licenses. So if you have.01:11:31Either essential or advantage, you can use those licenses and they are valid.01:11:51Till 1 February 2029. So you can use those existing licenses and onboard your devices on and get the features that are available on the America dashboard. You can choose between cloud configuration or device configuration based on your operational needs.01:11:56And also the new feature which is available for all the devices is software image management. You can upgrade your catalyst devices and devices directly from the dashboard both cloud configuration mode and device configuration mode devices.01:12:14And team yeah that is for today's session and now we are open for live Q and A If you have any questions, please do ask in the chat and we will answer those questions. Also, if you do not have any questions please while you leave the session, you will be getting a survey option.01:12:31Request you to please fill that particular form so that we can improve our future sessions. I will also share a particular email through which you can reach out to us if you have any questions or if you need any help with onboarding on Meraki you can reach us out through that particular email.01:12:51So yeah, I added up added a mail to which you can so the smart codes support on catalyst switches as well with yes so it is available for catalyst switches as well.01:13:36Be there for five more minutes team. I know we ended the session.01:14:16But if you have any questions, please do ask doesn't seem to be are you sure when I try to apply the analysts.01:14:21I think it is available but can any of you confirm yeah I'll send the link regarding that.01:14:36Hey Manoj, yeah, I have sent you an request to unmute. Yeah, please do ask your question. Yeah hi, good morning. So actually I want to understand regarding Miraki license model as per my knowledge we have two license model, one is second one.01:15:07Is a subscription base, right? So under the subscription we have DNA advantage as well as essential and in quotem we have advanced as well as enterprise. So my query is am I right ma'am?01:15:27Yeah, please, yeah. Okay, so suppose I have advanced license portal, right? And I have procured advantage DNA advantage as well as advanced license as well as enterprise, as well as.01:15:45Essential. So I cannot claim all the device in one portal, right? I didn't get your question. Okay. I have I have portal.01:16:05Yeah, but I have different type of switches and access points. Some some switches has a suppose C92 double 00:24 YC, which and I have procured a license DNA advantage.01:16:22Right suppose I have seen nine three double zero I have procured a license Miraki advanced, right? And I have some access switches.01:16:40Which license model has a essential? So I am not able to claim all the license on my portal due to different tier of license model.01:16:56On your single portal. Okay, so your question is you have different licenses. Can you onboard all the devices with different pair of licenses on a single dashboard? Is that correct? Yes yes.01:17:12Yeah, so you can do that. You can have devices with advantage licenses essential licenses, everything can be onboarded on a single dashboard ok but as per a Cisco take and as per our Cisco pre sales team.01:17:27The guide us you you cannot onboard all the devices in single dashboard due to the different license tier. I'm not sure on the licenses part, but I'm.01:17:45Confident on the catalyst licenses, so if you have DNA essentials and advantage, you can onboard both the devices in single dashboard. Okay, so I need So I need to use two dashboard one is for D DNA advantage DNA license and second portal form license, right?01:18:01I don't think so, but can somebody confirm team? Yeah, so you can just reach out to us on email we will take this further. So we have to check it internally and get back to you on this because we support DNA essential advantages in the same.01:18:23The dashboard, but for the Meraki one we have to check and get back to you. So you can reach out to us on the email, so email is also on the chat window, we will take it further on that.01:18:41Thanks at this so I will share my query one email and we have ok thanks ok thank you ok if NO more question, we will wrap up the session.01:18:54Thank you team. Thank you for your time. If you have any questions, please do reach us out through that mail that we have shared in the chat and have a good day. Thank you ok so there is another question from Gautam. Can we add different.01:19:12Which is like HP.01:19:33And other dashboard team if you have any insights on this, please do share or else we will reach out to you on this after checking. Yeah, so on the Meraki dashboard we will support only the cap nine case and the Meraki models.01:19:34And there was another question, can we use both Meraki dashboard as well as the traditional CLI? If you onboard a cat nine K on device configuration mode, you can use the Meraki dashboard for the assurance and the traditional CLI can be used to do the configuration changes.01:19:53I see there are NO questions, so thank you so much team, thank you for your time and we will see you in another session. I'll give back 4 min of your time. Thank you so much. Have a good day.01:20:12