Getting Started with Cisco Intersight

Hello, everyone, and thank you for joining the Getting Started with Intersight Expert insight Series Webinar Today.00:11My name is Don and I will be your host for today. This is the 1st session in our inter site Expert insight series for the quarter, all about helping you unleash Cisco Intersight and take advantage of its key features and new innovations.00:17Here you can see what else we have in store for these sessions in the coming weeks. I encourage you to scan the QR code and register for any of these upcoming sessions. I will also post the link in the chat now so that you may do so.00:38Today Cisco Intersight experts Alan Clark and Steven Mina will be leading our session on getting started with Intersight.00:57Alan has over 23 years of experience working with enterprise data center technologies. As a member of various organizations within Cisco, Alan has worked with thousands of customers imple implementing and supporting compute and storage products. Alan holds a bachelor's degree in computer science from North Carolina State University.01:04And is a dual Cisco certified intern network expert in both storage networking and data center. Stephen is a customer success specialist with over ten years of experience in designing, sizing and adopting data center infrastructure, cloud technologies, optimizing compute resources, infrastructure for hyperconverged environments, as well as artificial intelligence.01:22We will be using Slido with today's webinar and we would love for you to participate with us. You can join the Slido by scanning the QR code shown here or by navigating to slido.com and entering the code GS with Intersight and the passcode GS Intersight. If you're joining us via Webex, you can also simply just click on the three dots at the bottom right.01:45And select Slido or select the apps option in the bottom and select Slido from that list.02:05And let's go ahead and get warmed up with our 1st Slido poll and see where everyone is joining us from today. Again, you can participate by scanning the QR code or by going to slido.com and entering the passcode and the, the other code. And I will now share my screen and see where everyone is joining us from today.02:11Okay alright I see in the chat someone's joining us from New York.02:31Montreal I see in the chat.03:14I'll see a few people typing.03:34So looks like Slido is not wanting to participate with us today, so I will go ahead and stop sharing.03:58And let's just go ahead and proceed. We'll go and turn things over to Alan. Alan if you don't mind. Thank you Don. So today the the kind of flow of our session is really kind of understanding how to get started with intersight. And we're gonna do this in kind of a.04:15Our expert insight series flow, which is we're gonna show you we're gonna explore with you and then we're gonna do what we can to help you succeed. So in the show me how we're gonna walk through an inter site overview, your deployment options, how the device connector works, look at licensing, and then we're gonna explore the 1st.04:35Two thing you should really do when setting up your inter site account, which is onboarding your devices and then setting up your users with the roles based access control. And we have a combination of of both slides and some live demos from Steven today.04:55So we'll walk you, we'll kind of show you some examples and then he's gonna walk you through how to actually do it. And then at the end of this, we're gonna have our Q and A session. We'll have some key points to remember, and throughout the session we will be providing some links for all of you for your reference, kind of go along with the slides we're covering. So with all that said, let me go.05:07To get started.05:27Don, can you pass me control? Thank you. There we go. So kind of 1st off is really why, why intersight, right? Intersight's gonna allow us to answer some critical questions for your.05:30Entire UCS deployments in this single unified spot. So you're gonna be able to check your server health. Our server's healthy, we have warnings, we have critical issues? What's our hardware compatibility status?05:49We're gonna be able to see our entire inventory in one spot. We're gonna be able to see alerts and alarms from our entire fleet. We're gonna be able to see our versions. Hopefully your versions look a little bit better, a little bit more coherent than ours here. You can see we have quite a few different versions running in our lab. You're gonna be able to see your contract status, you're gonna be able to see your license usage.06:05You're gonna see all this in one spot.06:25And that's kind of our 1st step in inter site and where we get started and then we'll kind of expand on it from there. So our inter site overview, we're gonna connect your infrastructure. This means your compute. This also means, you know, with the license, we're gonna add in your networking, your storage and your virtualization to give you that single pane of glass.06:28For all of that information.06:48That is kind of really relevant and required for you guys to to maintain your operations. You're gonna have your visibility and support for global on prem and edge environments, you know, you can have inter site monitor hundreds of different sites if you need to. You can have it just monitoring that one big data center, it's kind of up to you and anything.06:51In between. We're gonna help you enhance your security posture. I know this has been a big topic lately. With the inter site with our security alerts and security alarms, you're gonna have that built in advisories for security notices for CBs.07:11That come out that are automatically checked against your specific fleet. So your versions of hardware, your versions of code that are running, those the CVs are gonna pop populated to you, and it's gonna tell you which servers could be affected and offer you that that migration plan once we've got them, so it's gonna have the resolution.07:28Plan as well all that stuff you would normally have to go to, look at the Cisco bug tools, you're gonna come to you in Intersight.07:48As well. And then we have the ability to automate, do deployments and automations. So Intersight does include our our workflow orchestrator here and we've got the ability to.07:55Build in some additional automation with that kind of to make your day zero or your day in tasks especially those repetitive ones easier and more reliable. So my next question is, are you currently using intersight?08:10So for those of you who are UCS customers, are you currently using intersight? And we're gonna give it just a minute or maybe 30 s here for everybody to respond, we'll see how Slido is doing today. So seeing some responses coming in.08:26Most people are saying yes, a couple people are saying, NO, we don't have the li we don't have our licenses yet. That's fine. You don't I i'd encourage you to try out the trial license and we'll talk a little bit about that later. Oh, thank you, Don, so it looks ok, so Slido is cooperating with us now.08:45Okay, so looks like we got a little bit of a mix here. So for some of you this is gonna be brand new and some of you hopefully got a little bit started, but we're looking to just expand your knowledge so I don't think we've got anybody else logging in here, so we'll go ahead and pick it back over the slides, Don.09:02Thank you. So with intersight, we really have a couple of different deployment options. Option one are by far our most common option is to use sass that's just intersight.com.09:22And there, all of your devices will be claimed to be into that SaaS portal via the device connector, you'll manage everything from there. We do have two other deployment options. One is a connected virtual appliance. So what that does is.09:43Basically, that appliance is claimed on inter site and then we're using all of your devices actually going into the appliance, so you just have that one connection outbound from your environment up to the up to Cisco, but you're really logging into that virtual machine to do all of your management, all of your all of your operations.09:59And then we have our private appliance. So this is our completely air gap solution for those use that, that can't get out of your, your facilities, right? We we understand that that there's a need there as well. So we have this, this private appliance. There are some.10:19Configuration differences between the the three different models. We'll take a quick look at them here. So form factor, right? Intersight.com is just Cisco hosted. For the virtual appliances you do have to deploy your own Vmiss.10:36These are supported on a variety of different hypervisors depending on exactly what type of deployment you're using, and I'll drop a link in the chat that really kind of covers all the supported feature matrix, where it's a little bit more detail for everybody.10:52The license tier for M sevens and and above, everything is gonna be the essentials license. There is the, the 90 day trial license available on SAS. For connectivity for the SAS version.11:09Your all endpoints do have to be able to connect inter site.com. It's an outbound connection. For the virtual appliance that's only that appliance that that tethers back and then of course the airgap version there is NO.11:25Looks like a question for seeing the slides. Are is anyone else having issues seeing the slide? I can see the slides Alan. Okay. Okay. So what's our user authentication, so we do have some, some different authentication methods.11:40If you're using Intersight.com, you can either use your your SAML through compliant SSO or you can use your cco ID, your Cisco ID, for the virtual appliances, obviously that Cisco ID does not work, but we can use LDAP or or AD integration.12:00Or the the SSO, you can also set up local users for the virtual appliances. My recommendation for both both of those would be to either do a SAML to compliant or an LDAP integration though. As far as scale limits.12:19There is NO limit to the number of servers you can have claimed for intersite.com. I I know of some fairly large deployments that are that are using this asset version. For the connected virtual appliance and for the air gap version, your limits 8000 if you do a large VM.12:35You can actually deploy the the VM with several different sizes that have different VCPU and RAM requirements. The smaller versions will support less servers, updates. So if you're using SAS, you know, when we push a new feature and update, you have access to that new feature.12:54If you're doing the connected virtual appliance, you can either set it up for automatic updates or scheduled updates. And then for that air gapped version, you're gonna have to do manual updates and you do have to manually move those, those new versions over to it to do the upgrade.13:12We have different amounts of telemetry data collection for intersite.com. Yeah, we do have kind of full telemetry collection. The connected virtual appliance has full or minimal.13:27And the private virtual appliance course we have NO telemetry data collection. And this is really just like version information and stuff like that so we can populate those alerts for security notices, field notices and end of life notifications. We support smart licensing on intersite.com and they connected and the smart license.13:45Satellite server for the private virtual appliance. Here's your biggest difference. Connected virtual appliance normally gets new features on about a 90 day delay. It's not always 90 day 90 days, there's generally about one, one update per quarter.14:06And just kind of depending on when the quarter falls and when the features releases to whether or kind of how long that delay is. For the air gapped appliance, there's a similar delay for picking up.14:22New features, air gapped appliance doesn't support the mobile application. It does not support automatic software downloads, it doesn't support connected tech, so those are our big differences there.14:38If you're curious about the status of intersight, what all is working, we do have two status pages depending on whether or not you are in EMEA or.14:57Using the the original Americas based instance. These are status.inter site.com and status.emea.inter site.com. And this is just gonna show you is the intersite infrastructure services working, is the workload up optimizer working, the API services working, is the inter site portal up and working?15:05And you can actually see historical data at these sites as well, and I'm gonna drop links to both of those in the chat for anybody just to check the status, you can also subscribe to updates, you'll get an update if there's a change to inter site or scheduled maintenance or anything like that if you're planning to use the sat.15:24This instance.15:44Now inter site licensing, we do have two license mod modes which are essentials and advantage, for.15:49Did we lose you Alan?16:18Hello? There you are. All right. So I'll just start over a little bit. So we have two licensed tiers, essentials, and then advantage and Advantage is gonna build on top of essentials. So the big things in essentials, we've got your global monitoring and inventory, so this is claiming all of your devices. I mean you'll see everything in one spot.16:24Globally.16:44For those of you who have deployments spread across your region local multiple states, multiple countries, really nice to be able to log into one spot and see everything as opposed to, and I got to experience this years ago before I came to this team of having to log into 20 different fabric interconnects to see.16:46All of your different estate, custom dashboards. We can actually do some really cool customizations for monitoring your different metrics, different things, and really customize that appearance to you individually. For those of you who had the opportunity to attend Cisco Live last week.17:04If you happen to wonder by the NOC, we actually had some customized inter site dashboards out there showing the, what was going on with the ucs's that were on prem real time that day for utilization traffic, CPU CPU usage, memory status, that kind of thing.17:23Policy based configuration server profiles for those of you who are familiar with UCS, you know, everything is based on pools policies and profiles, and so now we can extend that outside of a domain to your entire global footprint. We got firmware management to do firmware upgrades.17:40HCL compliance, so this is that HCL checker that everyone from UCS is familiar with. We also now have the ability for you to set your own custom HCL policies to make sure you're not only in line with what Cisco recommends but with what you expect to see on your devices.17:55Pardon me? We have 3rd party server ops if you have, if there are servers that are redfish based api's, so like HP and Dell, we do have compatibility with UCS manager. We can discover those UCS managed domains, we can cross launch into UCSM from intersight. So there's NO need to go out to those individual domains.18:15And then we have proactive support, which as a former tech engineer is actually one of my favorite features for people. One is a proactive RMA, which is for certain types of hardware failures. Those are automatically detected at cases automatically opened for you for that RMA.18:35Which really saves you some time, some effort, some energy. We have the connected tack option, which allows you to open cases directly from the device in Intersight, which can include things like automating the tech support generation and upload to the case, which again saves you a lot of time and energy and effort.18:51We have targeted advisories, so the advisories which are field notices, security advisories, end of life notifications that come up in intersight or actually tailored to your deployment, which means you get the advisories and alerts for your devices based on your hardware and your form firmware.19:09And then we've got some sustainability policies based on power management and stuff, dynamic power redistribution and load balancing, so you can really fine tune your power policies as well. And then on the advantage side, we add in things like tunnel to KVM so you can get to your KVM with.19:28Through Intersight and not necessarily having to VPN into multiple different locations. We have some OS installation automation that's built into Intersight for common OSs, things like OpenShift or VMware. We have integration with storage to be able to see your inventory for your.19:463rd party storage VM inventory, so that's, you know, if you're looking at VMware, you're looking at Red Hat, for storage, you know, things like netapps pure storage, Hitachi, EMC, that kind of thing. And then we also have our workflow designer for kind of.20:05Building your own on automation on top of that. You can actually use some of the pre built ones there as an example to get started. And we have integration with ITSM integrations with ServiceNow. So you can, for those of you who are in ServiceNow, we can also integrate there to give you another point of integration automation.20:22So smart licensing, and I think Steven's gonna go to this a little bit more detail, but when you're setting up your smart license, what you're gonna do is you're gonna go to software central. You're gonna go to your smart account, you're gonna inventory, you're gonna select your virtual account.20:43And then within there, you're gonna generate your inter site licenses, you'll have, you could have different types of licenses in there. There's if it says ES, that's essentials, if it says AD, that's advantage and SAS and CVA are gonna be one license type if it's a private.20:59Alan I think we lost you again.21:26Oh, if you will, I can take it from here for, for the demo part, actually.22:07Yeah, we're getting close to the demo, 1st demo anyway. Yeah. Okay, we can we can jump into the demo. Is that ok for you? Right? Yeah, we're gonna do that. I think Alan's gonna grab a new mic while you're doing that. Yeah, that's ok. All right.22:18Yeah, thank you very much. All right, I'm gonna share my screen real quick. The process of generating or or started using intersight ID if you haven't started using it is really easy.22:35Actually, you will need a couple of things for your inter site account. 1st of all, you need to make sure that you already have a cisco.com user ID, basically cisco.com user ID is gonna be your authentication key or accessing Cisco different services, including inter site, e.g., using your license.22:50Services.23:12You know among other service among other things that you can access using it. So in, in case of inter site, once you have your Cisco user ID that you generate by going on cisco.com and creating an account, you will come here to create to inter site.com to generate a.23:13Intersight account, alright? So in if you already have one, you can sign in with Cisco user ID here in this blue button. If you are using single sign on, e.g., that that's something that you will see in a few minutes. E.g., you already integrated your inter site account with your.23:33ID provider, you know, your, their active directory or or your authentication provider, you can use it here using your email, you know, the one that is registered here and signing signing with your Cisco I mean with your corporate ID.23:54Alright, so in this case you're, you will come here and generate an account. One of the things with inter site is that you will be able to generate multiple inter site accounts. E.g., you can access multiple inter site accounts with the same Cisco user ID, but in this case I'm generating a new one. You will select the region that is closest to you in this.24:13Case we are going to US East and next you will see the terms of conditions for end user agreement. We will accept them here and then you will generate.24:33An account name. This account name, I will recommend that you use something that is easy to remember or or significant for you. In this case I'm gonna put something like this, I'm gonna put it together in demo.24:45Alright, and I will generate this account, alright? So after generating the account, you will see a couple of things in this case you will be asked for one of the these two options.25:00In terms of licensing, as I mentioned before, you will have an option to register your smart licensing. This is something that we will see in a few minutes or start a trial, you will have an access to a 90 day trial with with all the licensing level, you know, the availability for for inter site. Normally you.25:16You will require to one of these two type of licenses essentials or advantage, but with the trial you will have access to all of the licenses spectrum that we have available for you with all of the features for you to test the environment, the platform for 90 days. All right? So.25:35In this case.25:56When you click trial, you will see here right there infrastructure and services and cloud orchestrator features and you will start the the process. All right? Now you will have here the look what you will have like a wizard that will walk you through through inter site so you can skip it.25:58And then this is how Intercite looks like in this moment you don't have any device already claimed, but that's something that we are gonna try in a minute. 1st of all you will have different sections here on your left, on your left hand. You have the operations configuration, analyze, automate, and.26:17Systems. As long as you start adding targets or devices here to inter site, you will see more options enabled, you know? So in this case, 1st of all, you will you will go to system, the section that is called system and just select targets to start adding your devices. All right? So in this case, e.g., when you come.26:37To claim your target.26:57You will see the different options. You will have different filters here. So it is already categorized, so you will again select the different options that we have for you. Remember in this case since we are using the trial, you will have available even the the targets e.g. for from 3rd party. This is something that we will see later, but for.26:59E.g., you, you will see different options from Cisco targets, from 3rd party, e.g., cloud hypervisors, storage appliances among others, alright?27:19Now in this case, e.g., we will go to the compute section. You will have initially three options in terms of compute. E.g., if you can add your, if you're using UCS manager, e.g., fabric interconnects series, 6300 or 6200.27:29They are still supported on inter site. You can still add them or e.g. Fabric interconnects that are starting in 6400 that they operate on using UCS manager or inter site managed mode, one of these two modes are selected when configuring the the fabric interconnects like.27:49When you open the box and install the fabric interconnect on the CLI you have an option to select what is the operating mode that you want to work on those fabric interconnects. In this in this case for the purpose of this one, we are going to, e.g., in a few minutes.28:09To select e.g. the the standalone it could be a fabric interconnect, I'm sorry it could be a standalone server. And in this case you will be required, and this is very similar even for the other targets for UCS manager. And eventually, e.g., if you are using inter site managed mode.28:25You will need to generate two codes that are called the device ID and the claiming code. Device ID normally makes reference to the serial number or the physical device that you're adding and a claiming code is is an expiring claiming code that you can add here to register your devices. Now in this in this matter, I'm gonna.28:44Show you how you can add, e.g..29:05I'm gonna use, let me let me show this to you. I'm gonna use e.g., I'm gonna I'm gonna show you this. This is from an environment that we are running here. This is a integrated management controller from a standalone server. All right? So normally when you go here.29:08You can go to the admin section, device connector, and you will see something like this. This is the device connector is a software component that is integrated on the, it's ok, it seems to look like it kicked me out. Let me look. Oh, it's already there.29:25The device connector is a software component that is already integrated in the, in the console, so we'll generate practically the codes that you need for connecting to intersight. This is pretty important because these are automatic codes that you can see the device ID, the claiming codes, you can copy them.29:42And you will, e.g., I'm gonna use them here. This is an environment that I am already running, but let me show this here, e.g., you can target claim code and you will go to the standalone server.29:59Alright, and then you will select start. Let me let me put this alright ok so you'll have the device ID, you will copy and paste it, you already did it, and then.30:16You copy this one, the claiming code, go back to inter site, and as well there is something that you can configure here, the location or or, yeah, pretty much the location and you can select e.g. the two options claim now or you can claim it later, but you already have the, the, the calls ready for for the claiming process.30:31Now, when you do it, pretty much the the the claiming is immediately is done immediately so you can see here right here the standalone server that is already has been already claimed. For UCS manager, e.g., I have a UCS manager.30:51Right here it's pretty pretty similar. I'm gonna show you right here how it looks like and where you can go and access the, the codes for claiming your, your target. All right? One of the advantages of this is.31:10The visibility is almost immediate, and right after you copy and paste and and paste the codes, you will do it pretty much right at the in a in a few seconds. So you will go here to UCS manager on admin section, you click on all, you will see the device connection.31:25Correct option. In this case, this is already claimed. And as you can see, e.g., you will, you have the visibility of the inter site account that is already where where this device has been already claimed, right? So that's something very important because if you will, you can unclaim it and.31:45And eventually, e.g., you have, you it will be highly recommended to check the settings of the device connector because, eventually you will need to configure the device, the DNS configuration you have DNS server or any specific NTP or proxy or certificate configuration. So this is something very important because based on our.32:05Experience most of the times when when the some challenges you know arise when claiming the device has to do with DNS or or any additional configuration that needs to be done here. And as well important is important to check maybe with your security team in order to make the corresponding configurations in the firewall just just to.32:25Allow the connectivity from the device to the SaaS environment on Intersight. In a few seconds I will share in the in the chat a document that might be very useful for you with the network requirements for allowing the targets to communicate with, with the SaaS environment.32:45Okay, now this is from from from this standing point. Now, what happened with the licensing? That's something that we we show you a few seconds ago. When the, when licensing in the e.g. in this environment we already have a, an account that is an smart account that has been already configured, and you will see in.33:01In this case e.g. the, the.33:21The corresponding licenses that are in use, the consume licenses for intersite and as well the smart license information. In this case is highly important e.g. if you are as a account administrator are going to integrate inter site with your smart account. Remember? Smart account.33:24Work in based on based on virtual accounts and this is something I'm gonna show you in a in a second because.33:44Let me, let me show you in this case, you will need to go to software Central and login using your account. All right, so in this case I already did I'm I'm logging using my my account, already log in and then you will have to come to.33:52To this website. So in this case you will go to manage licenses here and you will have access if you were were provided access to the smart account to any specific virtual account where you will have visibility of the licenses, you know, that were deposited on that. All right? The, the smart account administrator has the ability to create multiple.34:11All Virtual accounts where the licenses that you need to access and you can will will be deposited and as well the the smart account administrator is going to provide the corresponding access to a specific users. All right? So in this case you will have plenty of of different users right right here.34:31So I'm sorry, different virtual accounts.34:51So you can, you can check where the inter site licenses are, alright? So then you will have to generate, e.g., I'm going to select, you will see the the the corresponding licenses here and then you will have to see, e.g..34:54Let me see if I can check here. This is where we have some licenses, inter site licenses and you can filter here in this searching box right there. You can you can you can look for inter site licenses that you already have, right? So in this case we have a few of them, we have SAS and we have from a private virtual.35:12Clients and then you will have a visibility of the licenses you have available. Now, when you go to this general tab, you will have to generate a.35:32New and a token that is gonna be used, right, for this for integrating or communicating both platforms. All right? So in this case, I'm gonna, I'm gonna configure it right here, you can expire after 30 days I'm gonna select one used because it's for the purpose of this demo.35:43You will create a token, alright? So when you create a token, you will have to copy.36:03The calls right here, and then you will have to go to the licensing option here. All right, let me go here to settings, just a second.36:07Licensing here and then you will have in in this case, e.g., remember in this platform we're using the 90 day trial alright? So in this case we are going to register in a smart license because we are already sure that we have licenses available.36:24You hit next and then it will take a couple of minutes for this process, you know, to integrate both platforms. Intersight is communicating with the specific smart account virtual smart account when the token was generated. This is very important. You need to generate the, the token directly from the.36:40Virtual account where the licenses are deposited, so inter site is communicating requesting access and then it will have visibility of the licenses that you have right there. So once both platforms are integrated, you can go and assign licenses directly to your, your targets. E.g., if.37:00Normally it is consume one license per per server if you wanna assign license to server. In the meanwhile I'm gonna show you right here, you can go to servers and then for each server you click this three.icon right here.37:20And you can set the license tier right here. You can see set a license tier, and you will select e.g. essential from the option that you have right here, Essentials advantage or none. This is important because licenses on inter site are not attached to the physical devices. You can assign and later unassign the license.37:34To a different device. So that's something very useful and and on inter site licensing. So coming back to this platform, remember we were connecting.37:54When you enable the subscription information, you will be able to see the expiring dates for that platform. So I just enabled that option and later, well, it's not necessary, you can skip it, but in this case now the next option is which is the type of licenses that that I am consuming? I am.38:06I'm assigning infrastructure service for the servers.38:26And the default tiered of license that you are going to use, you have some of these options you can assign like for all the servers that you have or for a few of them. And e.g., you're gonna say assign advantage for all and you can assign as well, e.g., the default tier that you just configured here for all the existing servers, alright?38:29So when you proceed.38:49You will do this. I'm going to unclick this one because we have a few amount of licenses and you confirm, so the licenses that you have from now on will be assigned to advantage. So it's synchronizing is gonna take a few minutes, but that's pretty much it, right? So.38:51I think for the next part, for 2nd part of the demo, we will check a couple of things like role based access access control and we will see how you can access to configure the option to configure single sign on for, for inter site. So I'm gonna stop right here and.39:09Well let me see. Let me return to Ellen. Ellen, are you there? I'm here. Can everybody hear me? Yes, we can hear you. So back to you. Awesome. I'm gonna skip forward a little bit cause I think Steven's walkthrough is probably much better than, than some of these slides, so thank you for.39:30We're covering these. One thing I do want to bring up though is for those of you who have larger environments, looking at this, if you need to do automated claims of bulk devices, if you have dozens of domains or dozens or hundreds of servers, we, we provide that as well. I'm gonna put a link in the chat.39:49The Cisco community page that kind of describes this and it's This link will include links to the devnet GitHub repo that includes the scripts for this, so you can just.40:09Clone clone those repos and get started with your bulk device claim as well. So that is kind of covers all of our Stephen's demo for the SAS account creation claiming devices smart license. Thank you again for doing that demo.40:26Your next up is for our is a quick slide of question is what do you feel like your current knowledge level with Intersight is?40:44Oh, looks like we're getting some some mixed results, maybe a couple of experts out here. Most people think it's kind of a, they're in that basic range, which is, you know, kind of understandable given the the call we're on today. So.41:03Hopefully we can, we can help all of you kind of work through your journeys to step up in those levels we got a couple more votes coming in, but looks like we're keeping about that same ratio. Oh, little couple more intermediate people.41:22All right, this will go ahead and switch back over to the slides. Thank you, Don, and we're gonna take a look at roles based access control in intersight. So commonly referred to as RBAC and I'll probably use that abbreviation for the rest of this presentation.41:43U.42:04To start with, for Intersight, we're looking at roles based access, we start with the organizations. For those of you familiar with UCS manager, you know, we had orgs that they were very hierarchical, so you had your default org and everything was a sub org. In Intersight, it's not.42:04We don't use that structure, it's a flat structure. Each org is, is logically separate. And they are containers to hold your logical resources. So those are your pools, policies, profiles, templates, and then also connect those to a physical resources which are gonna be set up at resource groups. We'll talk about.42:23Here in a minute, and that resource group is gonna be your servers, your your devices that are, that are added and claimed as targets. It is important to note that a physical resource can be part of multiple organizations.42:43And we'll kind of look a little bit about how that matrix works later on as we go through our different components and into the RBAC piece, and then users are assigned a set of role, a role or a set of roles, which are basically a collection of privileges for different activities they can do.42:58And those roles are assigned a scope, and that scope is one or more organizations, and that intersection of the role in the organization will determine what that user can do with each different set of piece hardware in your environment. And it is occasionally common to have a user that has multiple roles. They have different.43:16Sets of access depending on which piece of equipment they're, they're looking at. We may have elevated accessed in the test or lab environment compared to the production environment. It's a really common example.43:36So, let's break these components down. We'll actually start with the organization. So this kind of enables a little bit of that internal multi tenancy by placing devices in a logical group. Only the account administrators can create an organization. A device can be added to multiple orgs.43:49All devices are part of the the default organization. We do find that a lot of customers just kind of leave everything in default to start with and then have to retroactively come back in and reorganize things out, out of that default organization. So for those of you who said you're just getting started, we kind of encourage you to start with making an initial customer.44:08Organization and making sure everything's kind of in that organization as opposed to the default to start with.44:28The other thing is those organizations that you create show up in the different operational views in Intersight, which means you can actually sort and filter your various deployments based on what organization it's a part of to get, better views or more accurate or more concise views of specific.44:34Types of deployments and what's going on with your servers, your fabric interconnects and your chassis.44:54We also have this concept called organizational sharing. So this allows you to share configuration resources, so your policies, your profiles, pools, templates, your OS installation resources, you know, where the locations of your.45:03ISOs or configuration files, e.g.. What the, the big purpose of this is kind of centralizing common configurations while the consumer organizations add some additional customization. Common things to to share out of like a golden configs organization include things like Mac pools to prevent.45:19You know, different organizations have overlapping Mac addresses on the storage sites, the PWWN and nwn pools for the same reason, same or LAN connectivity policies and then things like NTP and DNS. I'm gonna drop a link into the chat.45:38That just is kind of a white paper about sharing and cloning across orgs. It really does a very deep dive into this particular topic, so you guys have that as a reference. And then next we have our resource groups. So.45:59The resource group is a logical container for physical resources. It allows you to kind of divide up that physical infrastructure without needing like dedicated pieces of equipment, so let's say you have an X series chassis and you want to dedicate two of your blades to AI and ML work or two of your slashed AI ML workloads.46:16And two more slots to.46:35Your standard virtualization workloads and then two more slots to to Splunk Vmiss e.g., and I'm just using that cause I had a customer recently do that, and each of those can be a different resource group that has a different set of privileges for your different users to come in and make changes.46:38And then we have privilege sets. So privilege sets kind of a newer feature in Intersight, so even those you have set this up before, this maybe new to you. This gives us incredibly fine tuned permission control for different types of activities. You can build these entirely from scratch. There are hundreds of different privileges inside of inner.46:58Your site for operations however. So I tend to tell people to start with a an existing role or in a different an existing privilege set and customize from there either adding or removing specific privileges.47:18You can see on the screen it says allow for future updates, so you can make these either flexible or you can uncheck that box and then it's a fixed privileged set that you know once those privileges are set, they're set, there's NO changing it. Multiple different privilege sets can be configured and added to a single role.47:31So with that, let's take a look at our roles. So our role is just a collection of privileges. Common roles we're used to hearing about, you know, network admin, account admin, account operations. So those are some system defined roles.47:51That we that we have available, they provide access to different resources. The system defined roles are there by default in every account. There are two system defined roles that can be used to define user roles, and that's the account administrator who has all the access to everything.48:09And then user access administrators, which is a role.48:27That basically existed just to define roles and privileges. And so once we have our roles and our privileges set and we assign our privileges to a role, then we have our users, user is just someone that could log in using cisco ID, single sign on credentials.48:30LDAP if you're on the virtual appliance.48:51And then that user is assigned to is assigned one or more roles. So we can see here at all screenshot that, you know, we have our identity provider, in this case we're using Cisco, so it would be the CCO email, and then we would assign them a role, so we could assign multiple roles to that same user. They will get.48:54The combination of all of those roles. So if you assign someone device administrator and account administrator, they kind of get all the account administrator roles. The reason for multiple role assignments is because we compare our role.49:14With an organization or a role with, then we can assign them multiple roles to different organizations. We'll take a little look at kind of how that works here in a minute. And then our last set of course here is groups, which is a collection of users similar to be a resource group being a collection of of.49:30Infrastructure, we can collectively assign, you can put multiple users in a group, you can assign a user to multiple groups, and this allows you to control that role based on the group and the identity provider versus having to set each individual person.49:52This is kind of one of the big advantages for using things like LDAP or SSO is that we can say, hey, everybody from this active directory group, so everybody on Donn's team e.g. is now an account admin or a device admin. Then, of course, we have identity providers, so.50:10Do support external identity providers. They just have to be compliant, so you can kind of use your single sign on, you don't have to configure all of your individual users in intersight. And so.50:32When we take all this together, you kind of get this type of matrix. So we have over here on our far left, we have our individual devices, you know, we have a rack server, an IMM domain, a UCS managed domain, and we have two more domains down there at the bottom, and those can be parts of multiple groups, so they can be our container workloads.50:48Our production VMs, our Splunk VMs.51:08Or they can be, you know, they're fully separate on their test group, right? Or your, your lab or pre production. And then those can map two different orgs and then taking that combination of the resource group, the org, the device, we map all that into an individual role.51:12And we can have multiple roles, and then we map those roles to our users or our user groups. And you'll kind of see all this a little a little bit more in stephen's demo where he's gonna show you how kind of some of this works and what this is gonna look like for you actually in Intersight.51:31And with that, Stephen, are you ready to go ahead and give our our back demo? Yes, we're right here. Alright, let me share my screen in a few seconds. All right.51:47Okay, let me know if you're able to see my screen. Oh, ok, can I have the the rollback if you don't mind. And then if you don't mind, I'm gonna take the role here as a presenter.52:05Alright, thank you. And sharing my screen, let me know if you are able to see it, please. Can you see my screen? Yep. Perfect. All right, well have few a few things. This is pretty much what as an inter site.52:21Deployment looks like, then as, as mentioned before, when you started, when you start adding more devices, you will be able to see them here, right? E.g., when you add fabric interconnects either on inter site managed mode or legacy UCS manager mode, you know, you will you will be able to not only see the.52:38But as well all the servers connected to that fabric interconnect, so they will be listed over here. We're not exploring all the things, you know, related or all the features or all the the options they have on on this on this on each of these dashboards, but just to show.52:59Show you, you know, right here how all of them will be deployed I mean from servers chassis, fabric interconnects, e.g., you start adding a lot networking elements, e.g., ACI or standalone nexus or NDS switches. If you have hyperflex clusters or eventually.53:18The search appliances, virtualizations, e.g., if you remember, you can add vCenter, you know, as a, as a target that's supported target on on inner site.53:38And all other integrated systems. All right? So, in this, in the configure section, you know, for when when having domains in inter site managed mode, e.g., you can configure all the elements like profiles, templates, secure.53:52Resource pools and policies to start pretty much creating your corresponding.54:13Elements, you know, to configure the systems, the profiles for servers UCS domains among others, alright so and you will have additional options here in case e.g. you want to start configuring your, your metrics, your own metrics for monitoring your infrastructure, and when your info.54:21Structure is a little bit more mature, you can start, you know, working on automating tasks. Now.54:40For the purpose of this one and the discussion the conversation that we were having about role based access control, we're gonna see actually we're gonna I'm gonna start from, from bottom to top, alright?54:47In this case, one of the 1st things that we recommend to configure is the resource groups. Pretty much it's gonna the resource groups are the physical elements or the or the physical devices that you have in your infrastructure, meaning like servers, domains.55:05And that's, that can be configured when or or created when access this option resource groups, you can click right here and just you have to set a name in this case I'm gonna set this one here and.55:22And next you will have access to all of your physicals that you have already added. All right? You will have the standalone servers, rack servers, if you have installed like virtual assist, which is a virtual machine that you installed on on intersite for accessing multiple devices that may don't have.55:41UCS, I'm sorry, a device connector to communicate to inter site so you can use Cisco assist and all of the ones that you have right here, you know, Nexus Nexus switches, standalone servers, UCS domains, DCNM, ACI, so all these things I'm gonna expand here the list.56:02Can be grouped in this resource group as we mentioned. One of the thing interesting and things when you having, e.g., inter site management manageable domains is that you will have an option to select in a more granular way which of the servers you want to group or make them part of that resource.56:20Source group. So in this case, I'm gonna pick, e.g..56:40Just a couple of servers here. Let's see I'm gonna select these two and as well I I'm going to select the, the V Center and this virtual assist just just as an example. All right? So when you create this resource group.56:44It's not like it's not it's not disrupted. It's just grouped in only group in a virtual instance, you know, in, in in a, in a in a virtual folder virtual group this specific device.57:01You know? Now, the next, next step will be.57:21Configuring the organizations. All right? The organization basically can be configured in a way that you prefer, could be e.g. in in a basis of let's say physical or geographical or e.g. you can organize you can create an organization based on application environments.57:26Or and departments or physical locations or whatever you wanna do, right? You can put, you can name it. You will create an organization in this part is very interesting because you will add to this organization the resource groups.57:45But as well in a future, you will be able to add the, the, the instances, you know, the abstract the abstract objects, e.g., like policies, server profiles, our resource pools, templates as well, you know, into under the same organization.58:02In this case.58:22I'm going to, add a name here. You can add a description here and this is really interesting because this option is really powerful because you will be able to share all of the resources that you have under that organization with other organizations.58:24In the day.58:44I don't know e.g. the ones that are familiar with the UCS manager, if you remember or maybe you may know about the policy resolution, you know, that is pretty much an embedded feature that included in the UCS manager or UCS central. That pretty much it was, you know, for.58:45Sharing e.g. configuration among different sub organizations on the on UCS manager. All right? In this case, with inter site managed mode and inter site platform, it works a little bit different because you can share or you can provide access to those resources that you are depositing or or putting into the same organization with other organizations. So you will create.59:05Kind of like a general or like a central organization for sharing the different resources, you know, with other organizations on your site. So when click on when clicking here and going next, you will be asked to, you will be asked for the organizations that you want to share these resources with.59:25Right, so in this case you can go with one or two. By default, this is important. Intersight has a, a default organization and a default resource group, you know, where, e.g., if you haven't created anything like that, all of the appliances, I mean all of the targets that you claim on intersite will be the.59:45Deposited into that default organization, but in this case you can select one or two or as many as you want. All right? So when doing this, e.g., I'm going, I'm going back because I'm going to unclick this.01:00:05So I don't want to share anything with our organization. And now when I'm clicking and going next again, you will be asked for the resource groups that you are going to be under this organization. So in this case, you have plenty of them, you will have all of them.01:00:18And you will be able to select the one that you consider alright? In this case I'm going to add this one that I just created. I'm going to add this one too. All right? So I am adding two resource groups into the same organization and now it is already created.01:00:35Now, something that was mentioned in the past, but, is about the, the roles, ok, which is a collection of privileges, you know, that will be assigned eventually to a one or multiple users, right? So the roles pretty much are configured in this section right here.01:00:54Let me see. You have under settings you will have the the the roles and normally roles has different different privileges like system defined and user defined. And now that's pretty much what this is connected with the privilege sets as well because normally for.01:01:13Example when you have the roles, you can create a role.01:01:33And assign in a specific privilege, a set of privilege, and you you create that description, you go next, and then you will, you will see, ok, if you keep all, you will have access to all the organizations and all of the, the, the object.01:01:37That you're administrating. So in this case when you go, when you hit organization, you will see the access, the control configuration for this specific role. So you can select the organization that you want to provide access for this role, can be one could be, could be many, multiple organizations, but in this case you can.01:01:57See all of the organizations that have been previously created and you will select one. Let me find the one that I configure right here. Let's see, I'm going to go with this one.01:02:17And as you will see, ok, what kind of privilege I'm going to provide to this user for this organization. So you will, you can go with one or you can go with with multiple device technician, maybe device administrator in this one, right? And if I want to add access to a second organization, I can go right there.01:02:29Clicking the the plus the plus icon and then sorry going to, it's because it's the same organization. Let me see right here. And in this second organization I can provide different access levels e.g. Kubernetes.01:02:48And where is this operator I don't know. All right? So once this is created, I already have a, a role, right? And depending e.g. I create a set of privileges, right? You will see the privileges that have been created before right here, but as well I can create one or more, more specific.01:03:06Right, so this is a privilege set, let me put right here. You can select from from a set of already created privilege.01:03:26But in the in the in this case we can go and be more specific and create a set of privileges for for this specific configuration, right? You can expand them all, but as well you can see e.g. by section what kind of privileges I can I want to provide for the user where I am assigning this, this step.01:03:42Configure operation read only support or system administration. So this is very important because when you expand them, you will have the possibility to create, to be more specific about what kind of privileges are going to assign to this specific role that eventually I'm going to assign this privilege sets for any specific role.01:04:03Oh, as I as I did before, right? Now, when I have all the, all this.01:04:23You will, the next step will be going to the user, alright? None of this will be applicable or none of them have none of these have sense unless I assigned this set or or unassigned the role to a specific user. So in this case I have many of this.01:04:28The account administrator, by the way is the one that has the right the highest rank in in on either side, but in this case if you want to add a new user remember, here you will have to select the identity provider. You will see the single sign on in a in a in a few seconds, but normally by default it's gonna be Cisco because you're using Cisco.01:04:46The user ID, but if you're using another identity provider to authenticate, they will be deployed here, right? So.01:05:05When done this, you'll be asked for the user for the email and later you will be required to select the role that you want to assign to this user, alright? So in this case, I'm going to this one. This is the role that I just created. And as well if you will, you can provide a second role.01:05:12Alright to this very user, right? So in this case, I'm adding this second role and you add this user, right? Oh, ok, this account already exists. Let me see if I can eliminate this one or let me see if I can modify it.01:05:32Let me take this off. Okay, it's taken a little bit. But what what I'm gonna do in a few seconds, let me see because I can see it. Let me filter it. Let me let me see if I can I can filter this account.01:05:52And when the, oh, it's right here, right? So you can modify it, but in this case I only have one role, I'm gonna give it a second role. Let me just check right real quick and I add 2nd role right here.01:06:12Okay. Now what I'm gonna do is I'm gonna log out and I'm gonna try to access this account. Before doing that, let me let me just check something here real quick. Let me see. The single sign on is in the setting options. Remember in this case you need to configure or well you need to extract the.01:06:32Metadata file that you are going to configure in the the.01:06:52The device I'm sorry, the identity provider, e.g., you're using I don't know, I don't know, Azure or Active Directory or Microsoft Services, you name it. You need to configure on both systems each other's a metadata files, so you will download the metadata file from here.01:06:58And then you will configure it your identity provider and here on inter site you need to or you need to upload the metadata file from the identity provider, right? So that's pretty much it. You can configure as well the the domain name.01:07:18The identity provider name and then you will have access pretty much to the single sign on. Right, what I'm gonna do before we finish this demo, I'm gonna sign out and I will I'm gonna try to log in user that using the user ID that I just.01:07:34I had alright that I just configured. Let me see if I can do it from here. All right, I'm gonna use this user ID so we can confirm the access that we have to intersight.01:07:50Okay, just a second. You see now with that user ID, I have access to this to this the it's the same account but two different roles.01:08:07As you can see, this is the name of the account you see is the same, but those are the two different roles. In this case I'm gonna access this role and then I will have limited visibility to the devices. As you can see, I only have three devices visible here because that's what I configured.01:08:25So with this role based access control, you will be able to not only the limit the the device that you that your users can see but as well the privileges that they have over them. So this is pretty much it.01:08:44This is 2nd part of the demo and now I am going back to you, Alan, just returning the presenter role right there. All right.01:09:01Ellen, you have it? I believe so, let me check, right there. Alright, so thank you for the excellent demo, Steven. Just like the.01:09:18Circle back to the key points we want everyone to take away from today. We would like everyone to, can you everybody see the presentation? Okay, number one is that intersight's gonna provide you that single pane of glass single dashboard to see control and automate your, your computer.01:09:33Data center infrastructure life cycle, that you do have those three different deployment options, so.01:09:53We've got SAS, we've got the CVA and we've got the PVA, want to make sure that you're using the deployment option that matches your needs. Now we have our two different license tier essentials and advantage. We also have those trial license for those on the SaaS for those of you who are like.01:10:00You know, maybe don't have your license yet, we want to start start working with intersight. And then that Intersight RBAC really lets you assign specific privileges to users and two groups, two specific devices to really give you that fine grained control over who could do what within your computer environment.01:10:17Oh. With that said, we've now gonna open it up for a little bit of additional Q and AI know there have been some questions that have been coming in through the chat and I want to thank our our panelists, Don and Andrew and and Mark for really kind of tackling and answering those as they come in. Do we have any additional.01:10:34Questions that come in or anything that you wanted to maybe, if you guys wanted to like answer verbally? No I think all of the questions so far have been answered amazing. Yeah. If we have any questions, if anyone does have questions, feel free to.01:10:54It's awesome in the chat or the slido Q and A now we'll we'll give that a few a few seconds. Please feel free I'm gonna move the slide ahead, but please, please ask your questions what we're here for.01:11:12And we kind of have our final slido, that I think Donna has just opened, which is the survey. How do we do today? Right, Don? Yes. It is open. Awesome.01:11:30We we really want everyone to fill this out, let us know how we did, the good, the bad, the, my microphone failed. And also kind of things I know one of the questions there is what, what do you want to see next? When we design these we normally do one series a quarter, you know since the 1st one this quarter. It's based on your feedback. What do you want to hear.01:11:44Here, what do you want to see us go over it? That's what we use to build, build the next series.01:12:04So the, the more input you you all give us, the more we can help meet you where you're, where you need us to be. Also, if you're interested in a one on one consultation with customer success specialist, feel free to put that in one of those as well and we can have someone reach out to you.01:12:08Awesome. Okay, I'm gonna go ahead and move on to, we got one more slide. So this is just our reminder of what the rest of the series is gonna look like. Next week on the 16th we've got IMM some inter site managed mode key features and functionalities the week after.01:12:29That we're doing configuration policies and profile best practices, the last week of June we are covering migrating from UCS manager to inter site managed domains. So kinda for those of you who are still just using UCS manager, how you're gonna get from there to Intersight.01:12:49July we've got what's it with intersight. So these are two features that come out that have come out and be posted released over about the last I'd say seven to eight months. I we've got a Splunk integration with Intersight on 14 July, which I'm actually really excited about. And then at 21 July, so 3rd week july.01:13:08Why we have a recap of those, this session, all the others, and some live Q and A So if you come up with questions after today, after you get off this call, you, you need answers. Join us then we'll do a live Q and A with the panelists here with the our presenters and specialists from all the other sessions to really answer your question.01:13:27Questions and help you have the best experience possible with Intersight and with your, your computer infrastructure.01:13:47Oh, so with that.01:13:57Donn or Steven, did either of you have anything else? No, I think we're good to conclude. We'll leave the, the, the last participation survey open for a few minutes afterwards if we really appreciate you filling that out, that does reflect on us directly, so we would definitely very much appreciate that.01:14:12With that, I think like I said, we're good to conclude. Thank you everyone for your time and your participation, and your engagement as well and a huge thank you to our presenters and our panelists today, Alan and Stephen, great job.01:14:31And, this was the 1st session in our Cisco Intersight expert, insight series getting started with Cisco Intersight. I hope everyone has a great day.01:14:46