Getting started with Cloud Management for Catalyst

Good morning, good afternoon, everyone. Thank you for joining today's APJC expert insight series on Cisco Catalyst in the cloud managing devices with Meraki dashboard.00:10I'm Lacia, your host for the team.00:20Next slide. Today we have two brilliant experts, Satish Kumar Velachmai and so they will be taking us through the sessions best practices before we actually start our session, let me just quickly give a brief introduction about themselves. So Akshay is a.00:24Customer success specialist on the Cisco enterprise networking in APJC and is CCNP wireless certified. He is also.00:43He also has an overall experience of over ten years in enterprise networking and in his past years actually was working as a network analyst and as a project implementation engineer for several customers in health, education, enterprise, banking, and government sector, and we have other presenter who is Satish, he also has.00:53The overall eleven years of experience in networking industry. He worked in routing and switching and wireless technology and now engages with customers for catalyst center catalyst SD WAN and Meraki adoption. He also holds ccie enterprise certification.01:13Before I hand the presentation over to Akshay, let me cover a few quick logistical items. So during today's session, you'll have the opportunity to ask any questions you might have about and just type your questions into the Q and A panel, which you can find in the three.menu on the right side bottom of your screen.01:30You can also use the hand icon to raise your hand and one of our panelists will respond. We request you to please lower your hand once your question has been answered and for any unanswered questions, there will be a Q and A with our expert following today's presentation. And if you're having any kind of audio issues, please use the chat panel which you can find.01:50Find in the.02:10Right side bottom of your screen and one of her panelists will assist you. And with that over to you Akshay. Actually, you're on mute. Thanks, thanks for the wonderful introduction in the beginning of the session. Good morning, good afternoon.02:11Goodno everyone and thank you for joining today's session.02:31Today we will be looking into the cloud native iOS XE as a platform itself, right? So how do we manage our catalyst center or sorry, our catalyst switches via the Meraki dashboard while retaining the advanced iOS XE controls?02:35Then you'll also look at the onboarding and deployment workflows, so in this session, we'll be looking at the cloud managed approach. In the previous session, we looked at the device config approach of of onboarding and deployment. Then we'll also look at some of the advanced feature sets that it brings to the.02:52People starting off with the smart port automation adaptive policy and a lot of other features which Satish will take us through as well. In today's session we will be having a few slides along with that a lot of demo as well for our session. So.03:12So yeah, start off with kick off the session now. So, one of the biggest strengths of, of the solutions that the customers can now continue using the same catalyst hardware and the ISXC operating system that.03:32You already have while gaining the cloud based operational service. So the Meraki dashboard becomes the centralized management plane while your iOS XE continues delivering enterprise grade networking capabilities underneath.03:51You'll also notice support across multiple catalyst platforms including the cat 9200 series, 9300 cds, 9500 series switches and even the compact switches. This gives us the flexibility in deployment models across campus, branch, retail.04:08The Manufacturing and even remote office branches or environments.04:27Another important point here is the migration flexibility. So you do not need to redesign the entire network or replace your existing hardware to adopt to cloud management. You can simply onboard your onboard the supported catalyst devices gradually.04:32We as Cisco, we are also emphasizing on the day zero cloud onboarding. So this significantly reduces the deployment time because switches can now automatically connect to the cloud and receive.04:49Configuration from the dashboard itself, right? So from a business perspective, this reduces the operational overhead, simplifies your onboarding for new sites and also kind of lowers the dependency on highly specialized CLI. The other major evolution here is the transition.05:03From a container based integration to a native iOS XE cloud support. So this native integration improves the scale, reduces the operational complexity and enables tighter feature integration between Catalyst and Meraki.05:23So for many organizations, especially your distributed enterprises, this creates a very compelling operation operational model where centralized IT teams can manage large environments with greater consistency and visibility as well.05:38Moving on, so this slide here focuses on one of the most important aspects of of Cisco's approach towards this, which is the operational flexibility. So we understand that not everyone wants the same management model, right? So some organizations want full cloud.05:58This configuration management, whereas where everything is controlled from the dashboard, others still prefer maintaining a local configuration control through traditional CLI based operations.06:18Cisco supports both approaches, right? So on the left side, we have the cloud configuration mode. Here configurations are managed directly from the Meraki dashboard. So this provides the simplified operational experience customers associated with Meraki, centralized visibility, template driven man.06:29Movement and easier administration. This is.06:49Especially attractive for the managed service providers, retail chains, branch deployments and and distributed environments as well. On the right hand side, what we see is the device configuration method, which is one of the topics that we covered in the last session, so you should be able to access.06:54The the session recording for the same on the same portal as well. Now, in this approach, the switch remains locally managed using traditional methods while still providing cloud visibility and monitoring.07:13This is also very valuable for organizations that rely heavily on advanced CLI customization existing operational processes or strict change management policies. Now, what's possible is that you can adopt cloud management at your own spaces. So at your own pace.07:26You you do not need to completely abandon your existing operational models instead, you can gradually modernize your operations while maintaining control when necessary. So this flexibility simply removes one of the biggest barriers organizations are traditionally face when evaluating the cloud managed infrastructure.07:46Yeah, so.08:06Moving on, so before we move on to this next slide, I would like to quickly highlight that if you guys have any questions about cloud and native management with Meraki dashboard, please put all your questions in the chat or in the Q and A panel. We have the panelists aligned to answer you.08:08Questions. Moving on to our, our.08:28Configuration models, right? So as I've already mentioned, one of the models which was device configuration mode, it was discussed in the last session for which the recording is already there on the portal, but for the cloud configuration model, right? So in this operating model.08:34The Meraki dashboard becomes the primary configuration platform for the switch. So the dashboard handles provisioning, configuration management, monitoring, and even troubleshooting. So, one major important capability here is a cloud CLI.08:49Okay, so even though the configuration is managed from the dashboard administrators still retain read only access to the ISXC CLI for troubleshooting and operational visibility. So, this is extremely important for enterprise operations teams because CLI visibility remains a critical troubleshooting, right?09:05Administrator.09:25Administrators can run show commands, review running configurations and perform diagnostics without needing direct configuration access itself. So Cisco essentially combines the operational simplicity of Meraki with a deep troubleshooting visibility that enterprise engineers expect from from my.09:27Another major update or major benefit is the elimination of extensive on premises management infrastructure. So, customers do not need a large controller deployments or separate management systems for any use cases. Everything is centralized through the cloud dashboard. So operationally this.09:48Consistency accelerates the troubleshooting, simplifies change management and reduces the deployment.10:08At the same time, Cisco maintains enterprise grade capabilities underneath the simplified interface. So that that balance between simplicity and enterprise control is really the key differentiator of of cloud managed is.10:14Now, this slide here walks through the onboarding workflow itself for bringing catalyst switches into the Meraki dashboard using the cloud config mode. The process is intentionally designed to be straightforward and operationally efficient. So the 1st step is validating your platform support itself or.10:32Yeah.10:52And Cisco maintains a list of supported catalyst models that recommended ISO ISXE versions. Next step would be that the switch is then upgraded to the cloud native ISXE image, right? This is important because native cloud connectivity capabilities are built directly into these.10:52Okay.11:14Now, once the software is upgraded administrators enable the cloud connectivity using the command service Meraki Connect, ok? At that point the switch automatically generates the generates a cloud ID, ok? Now this cloud ID is then used to claim the device in the Meraki data.11:14Okay, after the device is added into the dashboard network administrators can choose the operating mode either cloud managed or device managed, right? Now the dashboard then initiates the migration and switch reboots into cloud mode after the factory.11:35Now, from an operational standpoint, this is significantly simpler than many traditional onboarding methods, so it enables centralized provisioning and creates a path towards a zero touch deployment. But for distributed enterprises opening new branches or stores, this.11:52Dramatically reduces the deployment complexity and dependency on highly scaled downside person itself. So it kind of also standardizes the onboarding procedure.12:12Across the organization, ok? Moving on, Cisco has has removed the need for additional applications or complex onboarding workflows itself. So using the service meraki connect.12:24Command. The switch automatically handles registration and establishment to the cloud itself. That means administrators NO longer need to manually configure multiple backend connectivity components. The switch securely connects.12:44To the Meraki cloud and establishes that operational communication automatically. Another useful operational capability is the show Meraki Connect command, right? So this allows the administrators to quickly verify the connection state, the cloud registration status directly from the CLI itself.12:59So this is particularly valuable during deployment validation and even for troubleshooting. Now what our our current customers appreciate most here is the operational simplicity. So traditional enterprise deployments often involve multiple management systems, onboarding steps certificates or.13:18Controller integrations. Cisco is trying to dramatically simplify that process while still leveraging the enterprise grade catalyst hardware and ISXC.13:38Now this helps to accelerate the cloud adoption because organizations can modernize operations without completely changing their infrastructure or operational expertise altogether. Now there is an incentive.13:47To this, right? So Cisco recognizes the that that licensing transitions can sometimes slow down modernization products projects, right? So to simplify the adoption, customers with active Cisco DNA licenses.14:03For eligible catalyst switches and Wi Fi six E access points receive a three year entitlement for cloud managed through the Meraki dashboard. Now what's important here is that customers do not need to purchase entirely new licenses immediately.14:19This creates a smoother migration path and allows organizations to evaluate cloud management capabilities without significant additional investment. Now, the offer is valid through 1 February 2000 209I repeat 1 February 2029, which gives you.14:37A meaningful window to plan migrations and operation transitions. From a business perspective this this reduces the barriers to entry and accelerates the adoption as well. It it also kind of demonstrates cisco's strategy for protecting our customer investments. Organizations that.14:58Have already standardized on Catalyst and DNA or catalyst center are not being forced into forklift.15:17Worklift upgrades. Instead, Cisco is enabling them to extend the value of their existing infrastructure while modernizing the operations itself, right? So for many of our customers especially large enterprises that invest investment protection is a critical discussion point.15:23So with that, let me quickly call upon Satish to take us through the demo for for cloud managed devices. Over to you Satish. Yeah, thank you for your presentation.15:40So team 1st demo we are going to focus on how to onboard your cat nine K into Meraki dashboard. You will you will just realize how simple to onboard your existing cat nine K infrastructure on the cloud with this workflow. So I do have a switch in my lab, so I'll just.15:57Try to validate what are the prerequisites in order to onboard it on the cloud 1st. So, so one of the prerequisite prerequisite is to have the local credential for the device to onboard on the cloud. And also you need to have your DNS configuration in order to.16:18Reach the Meraki cloud. So basically the switch needs to have an internet access with the DNS connectivity as well. And also in terms of licenses, as you see, you need to have a DNA essential licenses or advantage licenses to onboard it on the cloud. In terms of hardware, actually already covered like what.16:37What are the supported hardware that you can onboard on the cloud? So majorly cat nine K.16:57With respect to hardware, you need to at least have a 1715 version in order to onboard it on the cloud. So I'll I'll also cover what are the additional capabilities that we get on 1718, but to onboard the device to get the minimum feature from the cloud, you need to at least have.17:041715 version running on your cat nine case.17:24In the installed mode. So once I validated all the prerequisites, then, then yeah, I can obviously try to validate the reachability of your device to the cloud, can try reaching dashboard.Meraki.com or catalyst.Meraki.com just to add.17:28Did if the device is reachable to the Meraki Cloud.17:48And after that in order to start onboarding the devices, you can execute service Meraki connect. Before that you can validate if the device is compatible to Meraki Cloud with show command show Meraki compatibility.17:52Yeah, so to onboard the device, you just need to go to the config mode and enable service Meraki connect. So this is going to initiate a tunnel to your from your devices to the Meraki cloud. So.18:13So it will just take few seconds, then if you if you execute show Meraki connect.18:33You can see, there is a cloud ID that is generated for the devices to onboard on the cloud. Cloud ID is very important in order to client these devices, and also you can see the Meraki tunnel status is up and the config fetches succeeded.18:41So these are all the things that you need to look out in this output. Yeah, so this cloud ID is very important. You just copy this cloud ID, it is like similar to your serial number, just copy to your C this cloud ID here. So after that you can go to your Meraki dashboard.18:58Organization and inventory where you claim any Meraki devices and here you can start claiming your Meraki devices with the cloud activation key. So you just need to copy this key.19:17And you'll just need to claim the devices with this key. So with that, you will see the device gets onboarded on the Meraki dashboard, but you have to assign it to the respective network that you created and here is the important step. So when you select an existing network or you create a network, the.19:34Next step is to choose whether you need to go to cloud configuration mode or device configuration mode. So as Akshay mentioned in the presentation, if you want to preserve your existing configuration of the devices, if it is a brownfield devices, if you want to preserve the configuration, you have to go.19:54In device configuration mode.20:14So that the device in the Meraki dashboard can be used only for the monitoring and troubleshooting part. You can do the configuration through cloud CLI portal which we'll show in the dashboard, but you cannot use the dashboard API API in order to do make any configuration in the.20:17Device configuration mode. However, if you select the cloud configuration mode, your existing configuration will not be preserved.20:37It means your existing configuration will get deleted completely and the device will onboard into the cloud as like your any Meraki MS switches. So any configuration that you need to start scratch from the Meraki dashboard in order to manage it.20:45So additional advantages, not only the monitoring and troubleshooting capability, you can also use the dashboard API in order to build any configuration for your catalyst switches that is running on your iOS XE devices. So you can choose any one of this method and you have to provide your local credential of this device.21:03Devices over here.21:23The username and the password because Meraki dashboard needs to know the username at the admin level username and password and you can add it into your network. So from here you will be able to see the device gets onboarded on the Meraki, so if you go to switching and switches.21:25You'll see the device.21:45Is up on the Meraki dashboard in the device configuration source. So I'll quickly jump into a dashboard. So where I have the cat nine case already onboarded, so you can see the cat nine case, the mix of cat nine KMS is already onboarded on this San Francisco site and.21:47If you see the last column, it talks about the configuration scores that I selected while onboarding the devices.22:06So if, for, e.g., if I selected the device configuration mode, if I go to the device, I can get the monitoring dashboard to troubleshoot from the device perspective. Let me refresh this page.22:14Yeah, so I can get the monitoring dashboard, the summary dashboard, the port information, all those things, but I'll not be able to make any configuration changes over here. So I don't have an option to edit the configuration over here. However, I get the cloud CLI option where I can launch the SSH terminal for the.22:37Respective devices.22:57And I can do the configuration. So it's, it's just taking an SSH to the device and doing the configuration. So any configuration that you want to do for this device, either you can locally access the device through SSH and perform the configuration or you can access through the cloud CLI and do the configuration. However, you get all the monitoring and visibility.22:58Which we are, which we have covered on our previous session that if you have attended the previous session or else you can review the recording. So in this particular session, I wanted to focus more on the cloud configuration part.23:18So what are all the features that you get if you onboard the device on the cloud configuration part? So, so the only difference that is let's say if I go to any device which is in the cloud configuration.23:31So, e.g., if I go to this device, I get the similar dashboard for the cloud config, you can see the it is in the cloud configuration source, but over here in the port icon for e.g. any any option, you have this check mark where you can do make, make any configuration changes for the.23:47These features.24:07So that's the difference between the device configuration and, cloud configuration mode. You can edit this port from here or you can do any sort of configuration. So if you go to switches apart from monitor, you get the configuration option in order to do any configuration for this network or for the switches. So let me cover what are the.24:08A feature that are introduced on 1718 and parallelly I will also try to show you how to perform the configuration of from this dashboard.24:28Okay, let me go back to the PPT. Yeah, so if your device is in 1715 and if you have onboarded the device on the cloud dashboard in a cloud configuration mode, you will get the basic functionality of the switches like you can do, you can make.24:38Take the configuration of the port or access or a trunk or router or you can do access policies or you can do basic configuration of the switch.24:58But let's say if you are in 1718, you get an option of additional configuration option in terms of advanced routing and high availability. So this slides cover our enterprise grade switch capabilities that is powered by iOS XE 1718 one designed to bring an advanced routing and high availability.25:10For a cloud management environment. So in terms of advanced routing, so we support.25:31The flexibility of BGP VRF light in order to have a complex segmented enterprise network. Also these provide efficiency with the features like routed ports, loop free routed ports.25:37Or a scalable macro segmentation that helps you to design a network that is both the both highly secure as well as easy to scale without a typical traditional complex traditional routing complexity. So also with in terms of high availability and resilience.25:54We support features like stackwise virtual control.26:14Or rapid PVST plus in order to ensure your network remains stable, even during a hardware or link failures. We also support zero touch maintenance features like ISSU for your software upgrade in order to achieve the subsequent downtime in terms of firmware upgrade.26:18On your network. So, so by combining the agility of cloud management with power of iOS XE.26:38You are delivering an enterprise switching solution that does not compromise on performance, security or uptime. It is built to keep your business running smoothly regardless of of your scale. So let's try to deep dive into each of this feature and understand how it can be configured in the cloud dashboard.26:45So, so also all of these features are are not supported on 9290 300, whereas features like SVL and ISSU is supported only on 9500 today in 1718 one firmware version in the in the devices.27:07So I wanted to start with the 1st feature as routed port. So router port is a physical switch port configured to operate as a layer three interface for your switch that used to route IP packet instead of switching the layer two frames. So the port, the port is not associated with any VLAN.27:27And that does not participate any layer two protocols like spanning tree. So router ports are identical ideal for your point to point links like the links between your switches and the routers or switches to the firewall, which enables the layer three connectivity and also reduce.27:47Is the VLAN ID conception by creating a separate layer three segments and that that can find the broadcast traffic to a specific subnets. In the cloud dashboard, routed ports also can be configured on the supported switches, like 9300 or 9200 by selecting the port and you can ask.28:07Change the IP address or you can assign the services like DHCP VRF or OSPF like that. So this allows routing between the VLAN without needing an external router and that simplifies the network management and segmentation. And this feature is supported on your.28:28At 9200 9300 or 9500 from the iOS XE version 1718 one in the cloud dashboard. So I'll quickly jump into the cloud dashboard and I'll show you how to perform this functionality.28:47So, so let's say if you wanted to configure a port, in this particular network as a routed port, so you need to go to switching configure and routing and DHCP. So over here you will see all your switch or switch tags.29:03That you can configure the routing option. So I have my core switches a 9500 stack switch. So if I select that, here I have an option to configure the interfaces on the switches. So you can see these are all the 9500 interfaces.29:22The stack switch interfaces, e.g., if I select here, it's 9500 port number one/one, you have an option to configure the interface in three ways. One is the routed port, the VLAN port and the loop port. So if you configure a VLAN port, it's not it's non routed port, but you have to.29:42Configure it in routed port so that you can configure the IP address directly to this interfaces.30:02So, if you, if you click into this port, so here you have you have an option to select the routed port over here and you can configure the IP address on this particular interface, and also as I said, you can also configure the DHCP settings on this interface in order to get IP automatic.30:08Quickly or you can enable the OSPF on this particular interface over here.30:28So this is what I was referring the routed port of functionality on your iOS XE devices. So the next feature that I wanted to talk is the virtual routing and forwarding feature. So VRF is basically a technology that allows multiple virtual routing table.30:32To coextend your same physical router of the switch.30:52So this isolate and ensures that the traffic one VRF cannot communicate with the traffic in the other VRF unless you do it inter VRF linking. So VRF does majorly three things. It enables the micro segmentation in terms of VR VRF.30:56VRF on your network domain.31:16Yeah, obviously you can also do the micro segmentation with the help of sgts and VRF also handles the route forwarding efficiently by reducing the oversized route tables and simplifying your network management. So it also enhances the fault isolation. So let's say.31:20The issue happens on a specific VRF, you can you can identify this is not a overall issue that is causing an entire network. It eliminates also the imp impact of faults within the individual VRF instance and it improves the overall network stability. So the VRF is also available.31:40On 9200 9390 500 from 1718 one version onwards. So in order to configure the VRF on your network.32:00Again if you go to, so 1st thing is you have to create the VRF. So if you go to organization, under configure the last option you have the VRF over here. So here you have, you have an option to create the VRF, you are you're not assigning to.32:10Any network or devices, so you can create the VRF with RD and route target value. So there are already multiple VRF created over here and then you have to assign this VRF on your routed interface.32:29Again, if you go to switching and routing and DHCP, so you have an option to assign the VRF on your devices. So for the router interfaces, if you, if you go into this interface, so if you see the VRF, the device is assigned with the VRF of default, but.32:44But you always have an option to change this.33:04So if you go to this interface, you get an option to change the VRF over here. So from the default, you can always change the VRF from here. Yeah, so so in this interface I think it is assigned with a different VRF.33:08Yeah, VRF call. So these are, these are the two steps. One is to create the VRF, the other one is assign the VRF on the respective interfaces. So again, go back going back to the PPT. So the next feature that I wanted to talk is the BGP functionality. So BGP.33:26This exterior gateway protocol used to establish the inter domain routing system that ensures a loop free route routing exchange between the autonomous systems.33:46So you can configure EBGP or IBGP from your cloud dashboard. We support full stack dynamic routing between your LAN and SD WAN environment. We also support simple and scalable BGP routing, IBGP or EBGP. You can also do some filtering and path selection also with.33:58In the BGP net configuration.34:18And we support BGP for your 9293 and 9500 from 1718 version onwards. So in order to configure the BGP, you, you again you have to go to switching. So you you get an option of BGP routing, which you may not see in the previous releases.34:22So if you go to BGP routing over here, so here it is very simple. You just need to enable the BGP routing or you can add the router over here. So let me just edit the one which I already created.34:41So you can select the specific device that you want to create the BGP neighborship. So in this particular case, the 9500 over here can configure your AS number, the router IDs, and the neighbor IP address you can configure either statically or you can configure it through BGP pairs if you have multiple neighbors.34:53So the BGP pair that I'm for I'm creating is between this 9500 core switch and the access switches, which is MS three 90, so you can do it with your uplink devices like a router or firewall as well.35:14So you can also create BGP filters like AS path list or prefix list. I you can create your autonomous numbers also in the BGP over here. So this is all about the BGP. Let me again go back to the PPT.35:32Yeah, so the next feature that I wanted to talk about is stackwise virtual control. It's a feature in order to merge two physical switches into a single logical switch which shares the routing configuration and forwarding state to simplify your network. It actually creates a loop free topology with.35:48Active active forwarding. So basically this is feature that is.36:08Majorly used on the core switches. So we support high availability features like stateful switchover or non stop forwarding with SVL. We are supporting this feature from 1718 one through cloud dashboard for the devices majorly.36:12The catalyst 9500 series. You have an option to create the stack on your.36:32Like so so on your Meraki dashboard, so if you go to switching, you get an option of, switch stacks. So you need to go to the switch stacks over here. So you can see I have already configured a stack between 9500 switches. So, if you click.36:40You will also see what are all the devices that are part of this stacking 9501 and 9502. So you can manage the members if you want, you can add other switches also part of it. Also you can like if you want to edit it you can edit or you can just.37:00Configure your SVL links or that links over here in order to do the synchronization between the routers.37:20And, you can also do the layer three routings for this devices. So, I will I'll again go back to the switching. Yeah. So, so if you want to create new switches, you can create a new stack, select the switches.37:29On the next page, you will have an option to select the SVL link and VID link. So I, I I just paste the information what is SVL interface and the difference between SVL interface and BAD interface. Let's say if you want to create a stack between the switches from the cloud dashboard.37:47So if you wanted to do routing configuration for your stack switches, it's going to act like act like a single logical switch. So under routing and DHCP, you get a 9500 stack as a single switch over here. So you can configure your routing interface for your 9500 stack.38:03Over here as a single interface also in terms of ports as well, you can get for all your 9500 switches, you can get your ports.38:23In a single page. So you can configure your 9500 port configuration in a single page over here. So with that, I'll just go back to the PPT for my next slide. Yeah, so we also support ISSU in order to do upgrades.38:34Continue and and and the same time to continue the forwarding the traffic, minimizing and eliminating the downtime during the software upgrades. It is supported only install mode for and it and it is supported only for your 9500 switches from 17.38:54In 18 one version onwards. So in order to make a software upgrade, you need to go to organization, you have an option of firmware updates over here.39:14So here you can schedule your firmware upgrades yeah schedule firmware upgrades. You can select your network and schedule upgrades.39:25So here you can see what is the target version that you need to go and when you click next, if the device is supported with ISSU, you can select over here. So let's say in this case 9500 stack switches supports ISSU, so this those switches will be upgraded with a minimal downtime.39:44So let me go back to the PPT so I wanted to talk about the last functionality, the rapid PVST. So it's a it's a Cisco implementation like it's a it's a spanning tree protocol that you create per VLAN basis in order to provide the separate spanning tree instance for each VLAN.40:04To ensure blue free layer two top topology and have a rapid convergence on your layer two network. Again, it is supported on 9293 and 9500 from 1718 version onwards. So in order to configure it, you need to go to switch and switch settings.40:24Here you have an option to configure the rapid spanning tree protocol. So with that I'll just go back to my next slide. I I wanted to talk I will take like two or 3 min to talk about the AA assistant feature that is available on your Meraki.40:49Dashboard so we can so the this slides highlights how A assistant act as a strategic partner for any IT teams to focus on three core pillars. It helps to empower your IT productivity.41:08By increasing the efficiency and skill development, and also it helps to it it also helps to like simplify your network management and it also enhances the visibility of your network, with the help of this tool.41:23So you can get lot of, you can get lot of visibility with the help of systems, so this slide outlines the comprehensive monitoring suits that is designed to provide your end to end visibility in the network in terms of network health, security, and performance. So we categorize.41:41This into four areas. One is.42:00Security and compliance, you can get the security event tracking compliance verification, and then performance and bandwidth optimization. You can monitor your port and bandwidth activity, you can optimize your performance. You can also, the 3rd is the device life cycle and the health. You can, you can track.42:03The Status of the devices, interfaces, the change management status or the image management status. And finally the user experience, you can also monitor the client association details, which will be helpful for to troubleshoot any connectivity issue on your network. So by consolidating all.42:23All these critical monitoring streams into one interface, the AA assistant, we eliminate blind spots. This holistic approach allows your team to transition from reactive troubleshooting to proactive management, which ensures your network remains secure.42:43Compliant and highly performance. So with that I'll just show you a quick demo on, A assistant part. So since I don't have much time I I'm not able to query each and everything, but I'll try to show you.43:02What are all the things that I have queried just before the demo? So in so here you get an option of, A assistant, the blue icon over here. So if you click here, you will get this page, but let's say if you want to monitor your network, like, I just asked what are all my top utilized client.43:22In the San Jose network, it is going to provide those information to you in terms of top usage status and what devices it is connected to. And also if you want to monitor the interface status on this site, it also provide you all the interface status, the speed.43:42The total usage of this interfaces over here.44:02So or else you can monitor what are the configuration changes happen on this particular site. You don't need to specifically go to the dashboard. The A A assistant can fetch those details for you and it can display it to you. And you can also track what are the firmware status of the San Jose site. It can tell you what are the different device.44:05These types available and what former version it is sending and what is the upgrade status schedule status that you have.44:25Not only monitor if you want to, if you want to configure something, let's say if you want to configure BGP or if you want to configure adaptive policy on your network, you can also query those things as well. It can also tell you the steps to configure those use cases on your network with a relevant document. So you can use the same assistant.44:32The tool as a monitoring tool in order to query and understand what's happening on your network, what are the issues happening on your network. Also, if you want to learn or implement some use cases, you can query and get the documentation information also from this ASA system dashboard.44:52So with that, I'll stop my screen and I'll I'll I'll ask to share the next topic. Hey, thanks, thanks Satish for that wonderful explanation man.45:10Again, before I move to the next section, if you guys have any questions queries, do put that in the chat section or in the Q and A panel. So the next topic that we'll be looking at is a smart board automations and policies. So, starting off.45:25What, what is the need for this, right? So smart port aims to solve the problem of highly repetitive and error prone port configurations, so whether you have the same or a variety of port settings and attributes that each of your sites smart ports allow you to create a set of attributes once that.45:41Is the profile, you can then bind the profile to one or thousands of ports, right? Making initial and ongoing configuration in place.46:01Now with smart ports, a profile can be bound directly to a port from its configuration UI or assigned to it dynamically with the help of automation. An automation is a user defined sequential logic that allows the switch to detect and identify the device connected to.46:10On a port and modify the port's configuration using profiles.46:30So, what, what, what's what's the limitation, what is the requirements, guidelines and limitations for this, right? So 1st of all, role based access, right? So smart ports allows profiles and automations to be created and managed at either the organization.46:34Network wide level.46:55A user can access the feature either via the organization menu or the switching menu. I'll show you in the demo as well. So depending on their specific administrative privileges. Second comes the automation. So automations are currently supported are currently only supported in the.46:56Organization wide scope, so only organization wide profiles can be applied using automations. Then we have automations and organization wide profiles that do not support network level configuration components such as access policies.47:15Now multiple automations can be applied on a single switch, but only one automation assigned per port, ok? Hope that is clear. Then smart port smart ports are currently support. I'm currently not supported in configuration templates or networks bound to them, so smart.47:30Those are not currently supported in networks enabled for secure port.47:50More details on secure port I'll I'll quickly paste in a link for the secure port documentation as well. One quick note here is that organization wide profiles cannot be modified to network specific profiles.47:54And vice versa. So if you need to make this change, you will have to delete the profile and re add it with the correct settings. So these are the limitations that we have so far. Moving forward we, we, we look at a smaller list of these limitations as well. Now, let me go.48:11Walking through all.48:31This image that is showing right and how smart ports automation actually work in real life. At the center of all of this you see is the Cisco Meraki dashboard. So this is where all the intelligence sits. It's cloud managed, so everything is configured centrally and pushed down.48:33Two switches. Not just, now just below that we have the Meraki switch which is where the actual automation takes place at the access layer. On the left hand side of the screen, you can see the workflow. So 1st, we create profiles.48:51These are basically reusable configurations, things like VLAN settings, PoE port policies, etc. So instead of configuring ports one by one, we define them once as a profile. Then next we define automation. So this is where the intelligence comes in. So the switch.49:08You can identify devices using things like see LLDP or CDP or even Mac address patterns. And then we apply these rules to ports. This could be a single port of thousands of ports across your network, and finally, when a device connects, the system automatically applies.49:27Is the correct configuration, so NO manual intervention needed here. Now if you look at the bottom section you'll see real examples and IP phone access point.49:48Obviously an IP phone will get a voice VLAN profile. A wireless access point gets a data profile, a camera gets a camera VLAN profile and and and so so on and so forth.50:00But even a laptop, right? Can be assigned something like a guest VLAN. So the key idea here is, the network is NO longer static, so it becomes dynamic and deviceable. So on the right side is where you see all the benefits, right? Of, of this page. Now, this approach, 1st of all, says.50:15Because you're not manually configuring your ports. It reduces errors since everything is standardized, improves it it improves the efficiency because the network adapts automatically.50:36And most importantly, it scales easily across hundreds of thousands of ports. So at at the bottom, there's a simple example, rule. So if if the system detects an IP phone.50:47Using LLDP, then it automatically applies the voice VLAN profile. So in one line smart port brings zero touch provisioning to the access layer making operations much simpler and more scalable.51:05Moving ahead, so we're looking at the complete smart port automation workflow here from start to the finish. So the process as we discussed earlier begins with creation of the smart port profiles. So these profiles act as reusable templates where administrators can define.51:22The next step is optional but very powerful, so radius based dynamic assignment, so.51:44This allows the network to automatically apply the correct profile based on the user identity, credentials, device type or posture information as well. Now, once profiles are created administrators can apply them across multiple switch ports directly from the dashboard itself. So this helps consistency.51:50See, across large environments, right? Now, the automation workflow also allows administrators to define if then logic, ok? E.g., if an IP phone or a camera is detected, the switch can automatically apply the associated smart code profile.52:10Finally, the dashboard then provides monitoring and verification capabilities. So administrators can view where profiles are applied, compare configurations, check event logs, and track your automation usage altogether. So the biggest benefit here is operational efficiency instead of manually configuring ports one by one.52:28Organizations can automate the deployments while reducing human error and improving the consistency across the network. Now with that, let me quickly stop sharing and quickly move us to the a short and a quick demo.52:48On smart ports. So to, to get into smart ports, ok, I'm not sharing my screen 1 s.53:08Okay my screen is possible, I think. Yeah. Yeah, it is to get into smart ports, right? As we saw in the slides as well, there are two ways to do it. 1st one, you can go into the organization chart itself, and from there you can select smart ports.53:20And once you select that, it brings you to this particular page, which is the smartpools page. Here is where you define your profiles, right? So currently we have a couple of profiles already created, which is workstation. So for workstation, we have simply configured it as what is the type of the.53:37Port, whether it is trunk access, what is the access policy, what is assigned to it, whether there is a adaptive policy group assigned to it, right? So all of that configuration is already mentioned here. But if you want to create a profile, right? What you need to do is you just click on add profile here.53:58And from here you will be able to configure the profile name. So e.g., if I enter test or something, right? And then I need to give certain set of information, whether it is going to be a trunk port, access port profile. So if it is e.g. an access port profile, so what is the VLAN that is going to be assigned? What is the voice VLAN you want?54:17Mapped to it, right? So all of that configuration and you simply say hit save and that profile is then created, which then you can utilize it in assigning into ports, right?54:37The next part I want to showcase here is the automations part as well. So for that, we'll just click on this automation section. So here also we have certain rules already prepared, but if you want to create an automation rule, you'll have to give 1st of all the name, description and et cetera, but.54:50The most important part is you need to create your triggers, right? So for that, if I create a trigger, say e.g., the profiles that we created, right? So if it is a workstation profile, then what is the match type, whether you want it to track for a Mac address or an LLDP system description.55:07So if you select, e.g. MAC address, then you need to put in that specific device's Mac address. So if it is LLDP description, you need to mention that criteria here, right? Now to just show you what exactly is available, 1 s, I'll just go back to automations.55:27And so for this particular automation name, it is going from Meraki MR to VLAN five. So what it does is it is automating access points to wireless information whenever it is coming and Meraki MR is coming in, it is assigned.55:43And what is the trigger that trigger is an LLDP system description and then what it does is if it's a Meraki MR device, it.56:04Moves it or it applies that smart port profile on top of it, right? Now if you want to assign these smart port profiles and automations that you've created to say, a device or a switch, right? So for that, what you can do is you can simply come under switching.56:11Right, you will come under switch ports. Now this as I mentioned, right, this is something supported only with the cloud managed devices. So, we'll just find a few devices out of this. Let me just see if I have any cloud managed ones.56:32This is the other way wherein you can go into the specifics of creating a profile and the automation charts.57:07But if you want to go under that particular switch port, you need to go under switches 1st and find out which, which switches that cloud managed switch or cloud config device mode switch and only on those switches you can apply this. So let me check if this is the configuration source for this one or cloud, so I can go.57:14Going to any of these switches and a specific port on the switch and then configure the the particular setting into this. So e.g., I can configure the status of that port, assign if I have any.57:34Port profile, so e.g. if I have that assigned here, then that smart port profile can be assigned directly from you, ok? And you can just simply click on apply or update and it applies it to that and you can do this for multiple.57:53Ports as well. So if you want, you can directly come under the switch ports and select a range of switch switch ports directly from here and apply the smart port automations directly to that switchboard. Now if it just loads, I'll quickly show you one of it.58:10Let's say yeah and select this one. This is number two hopefully it runs it.58:27And from here, you can simply assign it a particular smart port configuration if you have anything currently it's not loading up, yeah. So with that, let me quickly jump to the next section of our session which is adaptive policy and.58:43Quickly take you guys through this spin.59:03Hopefully my screen is, I mean the presentation screen is visible. So I'll quickly start off with this topic which is adaptive policy. So, this slide here introduces adaptive policy, which is another Cisco's approach to identity based segmentation and security enforcement.59:06Traditionally, network segmentation relied heavily on VLANs and ACLs.59:26While effective, those approaches become difficult to manage those environments scale and become more dynamic, right? Now adaptive policy changes the model by focusing on identity instead of just IP addresses or physical topology. The key concept here is security group tags or sgts, so which can.59:30The identity information directly with the traffic flow. This allows security policies to follow users and devices consistently across the network regardless of whether they connect through wired or wireless access.59:50One of the biggest advantages is that the policies become topology agnostic, so administrators NO longer need to redesign policies every time the network changes, ok? Now this aligns very closely with zero trust architectures where organizations want granular and identity based control over access. Operational.01:00:06The adaptive policy simplifies segmentation, improves visibility and creates more scalable security management across the enterprise.01:00:26Now how does or or what exactly are sgts, right? So the secure, the security group tags or it's it's an it's it's essentially an identity label assigned to a user device or a traffic flow itself, right? So instead.01:00:35Of relying only on IP addresses of the network identifies what the device or user actually represents, right?01:00:54Now, e.g., traffic maybe tagged as employee traffic, IoT traffic, contractor traffic or server traffic or guest traffic, right? Now, in this example that is shown here, the packet carries an SGT value identifying it as employee traffic.01:01:04Now the major advantage is that security policies can now be enforced can now be enforced consistently based on identity. So this becomes extremely useful in modern.01:01:21Enterprise environments where users move between locations and devices connect dynamically. Now rather than building large number of complex ACLs, administrators can define simple policies between these groups. E.g., employee devices maybe allowed to access business applications via.01:01:35IoT devices may only communicate with specific servers, right? So this approach.01:01:56Improves that scalability, it simplifies that policy management and strongly supports zero trust security principles throughout the environment. Now, how security group tags are assigned within, so there are two primary approaches that are that you can see here.01:02:011st being the static assignment and 2nd being dynamic assignment. Now static assignment involves manually associating your sgts with switchboards, VLANs, ssids or subnets. This works well in environment.01:02:21Where devices or the device roles remain relatively fixed. So that is where your static static assignments comes in. Then we have dynamic assignment which is much more flexible and scalable.01:02:42Okay, in this model sgts are assigned automatically using radius authentication and identity information. So the network can make decision based on user credentials, active directory groups posture information, location or even the device type.01:02:58Now this is extremely valuable in enterprise environments where users and devices frequently changed locations or roles. Here it also highlights support across platforms including your MX MS switches, MR wireless devices, and.01:03:16Appliances as well as in the security firewall appliances.01:03:37Now the overall objective is building a strong foundation for zero trust security. So instead of trusting devices simply because they are connected to the network, the infrastructure continuously validates identity and dynamically applies the appropriate security policy on top of it.01:03:40Now this year is, is the final slide on this, but this brings everything together by showing how adaptive policy delivers consistent security enforcement across the network. So the key idea is that policies are.01:04:02Centrally configured in the dashboard and automatically distributed to adaptive policy enabled devices. So this means the same security intent then can be applied consistently across wired wireless and multiple network locations as well. So e.g., employed.01:04:20Devices maybe allowed to access business applications while IoT devices may only communicate with designated IoT servers. So because the policy is based on identity rather than physical topology.01:04:38Enforcement remains consistent, even if the users or the devices move between locations. So this significantly simplifies and improves their security operations as well. So administrators NO longer need to maintain large number of VLANs, specific ACLs across different devices instead.01:04:53They define policies once and the infrastructure handles enforcement automatically. Now this as as I mentioned earlier also improves the visibility because you as administrators can clearly understand how different groups interact across the environment.01:05:12Overall, cisco's vision of combining the cloud managed simplicity with the enterprise grade segmentation and the zero trust security is what this slide kind of highlights. Now with that we are at the end of the session, but if you guys want to engage with us on.01:05:31On these topics further in a one to one session or something, you can definitely drop in a mail to us and we'll try to set up a meeting accordingly for the same.01:05:52Now with that, let me quickly jump to the key points that one should remember from today's session, starting off with 1st of all unified management, so you can manage, manage your catalyst, which is the currently supported ones via the Meraki da.01:06:01While maintaining the power of natives XE features.01:06:22Then you have flexible operating modes. You can choose between cloud configuration mode or device configuration mode to suit the operational needs. On top of it, we also have the incentive program, so active DNA license orders are eligible for a three year cloud management entitlement for.01:06:26Eligible devices.01:06:45For eligible catalyst 9000 switches and Wi-Fi 60 access points, just one thing to remember here is that it is valid to Feb 12029 or 2029. Then we have the policy driven automation, so transition from manual port by port configuration to smart port automation.01:06:49To eliminate human error and ensure.01:07:07Network consistency tool. And finally zero trust foundation. So use elaptive policy and implement consistent intent based security across your wireless and your wired networks. So with that, let me quickly call upon last year.01:07:10Because through the end of the session. Over to you. Thank you ok thank you everyone for joining today's session. Team, I know we are way ahead of the time, but if you have any questions, I think most of the questions that are there on chat have been answered. But if you have any questions.01:07:31Please use the chat button, we'll be there for five more minutes.01:07:51And you can also reach us through this community.cisco.com and we also have shared two more emails. So if you have any questions or any doubts, you can either reach us through customer success at_APJC address cisco.com or cloud monitoring at the rate cisco.com and we will.01:07:59Will respond to you through mail and we can have one on one sessions as mentioned by Akshay.01:08:19Yeah, so sorry I was just pasting that customer success emailer in the chat section for reference. Thank you. Moving to the next slide, yeah. Thank you. So for the next steps team, please look out for an.01:08:30Feedback from our team. It will be from Cisco customer experience. It will take 2 min or less than that and it will really help us help us to improve our future offerings. And thank you so much for joining and we'll be there for five more minutes team. If you have any questions, please put your questions on the chat. Thank you and have a good day.01:08:50