Making Sense of Device Controllability: A Foundation for Automation

Alright, hello, everybody. Thank you for joining us today for making sense of device controllability, foundation for automation. It's a pretty exciting session that we.00:10Brought together myself, Matthew Abel. I've been a customer success specialist here at Cisco for about four years. I've primarily worked on the catalyst center technology and then we also have Urban Mandioa who's a.00:20Colleague CSS of mine. So let's just take a quick snapshot of where, where we're at in the elevate series, right? So to, so today what we'll be looking at is making sense of device controllability, foundation of automation. Hopefully you've been able to join us on some of the previous sessions.00:35But next week we have powerful troubleshooting with assurance and Cisco thousand eyes, and then the following week after that we have AI enhanced workflows with Cisco Catalyst Center. For any questions that that you may have, please go ahead and use the Q and A panel in the bottom right, the way you can get into it is you can click.00:53The three.icon, and there should be a Q and A panel there, our Panelistsuharan and Anshu should be able to help you with any questions that you might have. So today we have a pretty packed agenda, we'll be going through just an overview of the device controllability feature.01:13It's important in catalyst center and how we can better understand it going into Catalyst Center deployment. We will step through recommended settings and prerequisites for utilizing device controllability. We'll break down the configurations and what kind of impact device controllability is gonna have.01:32We will go through just some brownfield considerations and then we'll, we'll follow up with the Q and A Okay so let's go ahead and jump into understanding device controllability. So Catalyst Center is a platform that manages your catalyst devices, so.01:50When you bring your catalyst devices in, you, you want Catalyst Center to be the controller, right? So, these automation assurance use cases, they require at least some level of configuration to be put on the device before you can fully utilize.02:10All the features that are within Catalyst Center and more specifically what I mean by that is things like telemetry, right? So our syslog and our SNMP, our streaming telemetry, those need to be configured on our devices in order for them to talk up to Catalyst Center to provide you that insurance information.02:26So let's just take a look at the device controllability setting. We can find this in the system settings and under device settings. Here we can see device controllability and we have a nice lengthy write up.02:47That's you could take a look at to sort of step through what this feature entails. But effectively what it's saying is that there are three different operations that we can do within catalyst center, one being device discovery, so when we initially discovered that device.03:01What's gonna happen when we do a site assignment, so when we assign a device, what's gonna happen? And then when we do a provision of a device, what's going to happen? So that's what we're really talking about when, when we're looking at device controllability.03:19But we're gonna have to jump into some of these more specifics in just a bit. So there is also the auto correct telemetry configuration, which is a subsequent piece of device controllability. So if device controllability is enabled.03:36What this will allow you to do as part of that, those telemetry configurations is it will be able to renew a certificate for you or automatically correct some of these configurations on the device.03:54At in later day if if anything changes with those configurations. So let's step through some recommended settings and prerequisites. So 1st, before you start utilizing device controllability, you wanna have a robust design in the network hierarchy?04:11So you want to have created your site structure, so that's your buildings, your areas, and all of the floors, and those floors should contain their floor maps. We can do.04:29A import from prime if we're coming from prime over to catalyst center or we can import those project files into our floors so that way we can get our APs automatically positioned. Here in the network settings, so we have the server settings where we.04:45You can define some of the.05:05Intent that catalyst center is gonna want to push, we'll we'll talk about that in a little bit more detail. So if we configure say triple A server settings part of device controllability, when we do a provision action, it's going to provision that onto the device. The DNS servers.05:08Those are another one that it will provision onto the device. And then the NTP server as well. So those are all wrapped up in device controllability, but we'll take a deeper dive and look at that in a little bit. The device credentials, these are prereq for device discovery. It's for.05:26Required that you have a privileged 15 CLI credential in the network settings under device credentials as well as either a SNMP V2C read is the absolute minimum that you can do, but you also have the right option and you can do V three credentials here as well.05:46And then last is the telemetry settings. So, these configurations allow us to specify that we want catalyst center to be the collector, right? So we have the SNMP trap server setting.06:06The syslog server settings and really what these are doing is setting it up so that the host that it the traffic is sent to is gonna be the catalyst center itself. Another call out here is gonna be wired endpoint data collection.06:25When I say that throughout the session, I'm generally referring to IPDT. Those are sort of one in the same when we're, when we have wired endpoint data collection enabled. Another thing to sort of talk about when.06:42We're going through these prerequisites is to familiarize yourself with the UI.07:02Of the configuration preview. So when we step through a provision of the device or we step through updating the telemetry settings on a device, what it will give is the intent that wants to deploy onto that device.07:07So we'll get a list out of all of the configurations in the side by side view where we can see the configurations that catalyst center wants to deploy or the configuration to be deployed, as well as the running configuration currently on the device.07:24So this way we can go and we can validate that configuration before we push it out. Another, really great call out is the, we can drill in and we can see the configuration speed.07:40Deployed on the configuration preview, so we can see specifically the CLI commands as well as if we have netconf enabled on those devices, any, any netconf that the catalyst center wants to push. Okay, so I'm gonna go ahead and pass it over to Irvin, he's gonna give.07:56Give us just a a quick demo on some of these recommended settings.08:16Right, thank you Matthew, that's a great start. So let me share my screen and well, let's get started with the initial recommended settings that we have for this session. As you can see here on the 1st main page of the center.08:20We're gonna check that we enabled the the device controllability. We can find that device controllability here under the system. Then let's go to the settings and here the settings we can find device controllability under the device settings.08:38Device controllability or we can just scroll down and we can find here, the option of the device controllability. Once we open, we are gonna find more information about the setting and also what you can configure when you have enabled this option and and easy and as easy as that.08:56We can just enable and disable with this check mark.09:15Also we can enable the auto correct and telemetry configuration. This will identify the automatically the whole configuration of your devices and it will help you to do the stream process with the certificate issue, some iOS wireless controller and certificates and well some other network devices certificate.09:19Dates.09:39By default, these options are enabled, so you don't have to enable manually. Just keep in mind that if you disabled for some reason, we may lose some capabilities of the ones that we are gonna explain here on this session. So just remember here under the system settings you can find here under device settings.09:41Device controllability and you can find this option.10:01So let's get started with the best practices of this of the setup of for this device controllability. 1st, we recommend you to start working with the, with the hierarchy. You can find the hierarchy under the design.10:04Network hierarchy and the option of the hierarchy, we are gonna find the whole maps that we already have been working. Also remember that here you can have sites and also you can create areas over areas.10:21And another area you can build one building. You cannot bring or you cannot create buildings over buildings, just remember that you need areas. Here in this case, we can just go to the area of North America, then California.10:36And here we can have by cities like San Jose. Here we are gonna find our building for the San Jose one and here we can see that where is the location of this building and also you need to to to find it with the coordinates. You just need to add the address and this will.10:52Find automatically the coordinates. In case that you, you need to adjust these coordinates, you can modify them. Here on the edit building.11:12As you can see here, it's the address and well, this will fail automatically the latitude and the longitude that we need to to add the building floor. For the floors, we can add the floors over the building and here we can be more specific and we're gonna see I'm.11:22Have a map of the of the building. Which level do you require do you require at least to have the devices to be assigned? Well, I recommend you to have by CD at least and then by campus. With that one, you can be.11:41More easy to manage the whole devices and also to troubleshoot them. So, it could be that's that could that depends on you and how you wanna be as granular as you can, but you can just leave it until the building and here just assign the devices on the on this building.11:56Well, once we already have the network hierarchy, we can start working on the discovery process. For the discovery process, remember that we have four different ways that we can add these, processes. But we are gonna talk about more detail in the next.12:15Part of the of the session. Also, do you remember here you just need to to work on the, on the device controllability, then the the heat maps and well if you wanna keep the floor, that's ok or or you just can leave it until the building design.12:31Also, it's it's good to check the device settings. Once we already create the the network hierarchy, we can go to the network settings, and here under the network settings, we can review by area or by building.12:51Which setting we wanna use? If you see here we have the triple A selection. So it's good to that if you integrate the eyes or you have a 3rd party AAA server, you can you can manage how you are gonna use that server against your hierarchy.13:06Here you can select like by protocol that you are using in case that you have radius or you can add here. This depends on on you and also you are gonna add here the whole information. Also, it's good to add the DHCP server. This DHCP server keep in mind that it's just for to be assign.13:23Find IP addresses. It's not to provision the DHCP.13:43As it sounds. It's just to use the IP addresses pools that we have available for this server. Also, you can select which IP address pool you wanna use per building or per floor or also for by area. So it depends on how do you wanna manage your IP pools. Also, we can.13:47At the DNS servers and also this will help us to manage by area.14:06In the case that you wanna manage your image in another server, here you can add another external external server and let to store that images. Remember that the DNA, sorry, center, I changed the name. It's mainly used as a storage server of your image.14:12So once you download the image from Cisco.com official page, that will image will be automatically added here in the, in the server as a repository.14:32Also we can have the NTP, and this is one of the most important setups that we need to take attention. The NTP server will help us to synchronize the whole devices. In a specific when we are gonna try to to provision the device or we are gonna schedule a maintenance window, well, it's good to have the same time.14:44Right, sounds sounds easy but sometimes happens. So I recommend you to to add the NTP server and in this way you we can manage more easy the synchronization between the devices, the call center and the processes that we wanna schedule.15:03Also, that's a new theory that we have that the still watch, we can be act as a storage of your destination information. So here you can select in the case that you have a steel watch on cloud or in a server or as an external flow destination, you can add here how you wanna store that.15:21And well, the last options, time zones. We wanna have the same time across the different time zones. Well, you can manage here which time do you wanna get under your scale processes. And well the message for the day, this is nice because we don't need.15:42We don't need to go to the CLI anymore. We can make here our custom message of the day and we can select here how we are gonna manage that message. Also, we can prompt the whole message for the whole devices. It depends on on which area you wanna select and well that's easy as that.15:59Well, once we already finished the MOTD and the and the whole settings from the from the initial servers, we can check the device credentials. Here we can add the global credentials to be used against the devices. Also, you can use.16:20Use credentials for the, for one process. But in the case that you want to reuse these credentials, you can just add here and well remember that for the devices we need at least CLI credentials and SNMP version two or version three credentials. So, here my recommendation is to start adding your credentials.16:39It's in the case that you want to reuse? Well, you don't have to rewrite.16:59Once we already have the IP addresses pools, here we are gonna see the available IP addresses pool and management of that one. Also here you can see that this for this IP before you can measure what's the percentage of usage of that IP addresses pool by area.17:03The last the next option that we're gonna review is the telemetry and the telemetry is to select how do you wanna manage your SNMP drops. If you want to store here, well, you can manage from from this side if you wanna store that telemetry in another place, well, you can select another external server or both options.17:22Also, you can store the syslog message in our server or you can store it here. And well.17:41This is nice because for the ABC or application visibility, we can manage how we wanna store that information. If we wanna make the guys center act as a network control collector, well, we can select here or also we can use the Cisco telemetry broker.17:49We can manage also for the wire devices and point data collection if we wanna manage that to be stored here on the center or if you wanna add in into another site. You can enable or disable that collection information of the information of your endpoints.18:07And for the wireless controller and the wireless devices, we can select if we want to stream the the information to the center. In case that you do you want to have more privacy of that information, well you can just select unselect this one.18:24And that will disable the option of streaming that information to the center. So, that's pretty much for the 1st demo. Just remember you can find these network settings here on the menu, design and network settings. So I'm passing the role again to the, to Matthew.18:40So thank you Matthew on mute, great, so just something that I want to take a look at really quickly is just going through that configuration preview just so that we can.19:00Take a look at that together. So here I have a switch, and just an action that I'm gonna go ahead and perform. We'll go ahead and update telemetry settings on this device. Here we'll just go ahead and click force configuration push just so that we can we can see all of the telemetry configuration.19:19And we'll go ahead and click next, and here it'll give me the option to preview, and this, this will allow me to see the the configuration that Catalyst Center wants to deploy to the device before it actually goes and provisions it onto the device.19:36So we'll go ahead and step through here, we'll click next and we are going into the configuration preview here.19:54Yeah, just be patient and sometimes it's loading the the configuration, but that's part of the real demo, right? So yeah we cannot.20:15Make it. Yes, so once we've loaded in here, what we'll see on the left is if we were performing this operation on a ton of devices, we could click through each individual device and just validate that configuration here. But so we can see some of the telemetry configuration that's coming out of device controllability.20:28Here together and if I hover over this, we can see all or telemetry and other settings I think that pretty much just encapsulates all of these settings here. And we can see the side by side view. So if I want to go and check to see if a specific configuration is already present on the device, so I can do that.20:48And then we also have this option in the top right, and this is a good option to check because here we can see the, if this device was discovered with netconf enabled, then we can see the netconf that it wants to push to the device as well. So we can see.21:07You know, the system or the device certificates be provisioned through netconf here. And from there you can decide to go and deploy this, so I can click deploy and click now and then submit. And so that, that was just something that I wanted to to demonstrate quickly just so that we all are familiar with.21:27Okay, so let's step through just a you know breakdown of sort of device controllability, the different operations that we can do within catalyst center and their impact on the device. So here we have that matrix that, that we built out.21:49So for discovery, for switches, we, so if those SNMP V2C credentials are specified within the network settings, they will, if, if they are not already on the device, they will be provisioned onto the device. So.22:07There's a couple of different ways you can do discovery. If you have the device configured, pre configured with the SNMP credentials, Catalyst Center is not gonna want to deploy them. But if they're not present on the device catalyst center will deploy them. So the technical only requirement for.22:27Discovery is a privilege level 15 credential that's in the network settings, and then from there we can provision on the SNMP credentials via the discovery itself. The netconf port for switches is optional.22:44But it is recommended that it's on port 08:30. There's a whole ton of other ports that we could use, but we, we tend to recommend 08:30 and there's a couple of ports that you definitely want to avoid like 22.23:0080 and so on. And then for WLC we require that netconf is enabled as, there's a whole ton of features that we use through net netconf on those controllers, and then for routers we just require.23:15On the SNMP credentials. And during site assignment, if we have a triple AAA server that is mapped at the global level, we'll provision on CTS credentials, those will be unique to the device. They'll use the, the serial number of the device.23:30We will also provision on the telemetry, everything that we need to get telemetry up and running so that the server certificate, the device certificate enrollment, the syslog SNMP.23:49And streaming telemetry onto the devices. And then during provisioning, we will do AAA configuration, the DNS servers that are mapped in the network settings, the NTP server.24:04The domain name and then any additional templates that we have configured, and then for wlcs we'll pull in all of the wireless network profiles and so on on top of that. And then routers it's pretty similar to the switch.24:21For app telemetry, we'll configure the flow destination, and flow monitors for our switches as well as those netflow records. The WLC will use some of the pre built or pre configured records, but it'll con.24:38Figure load destination and flow mon or yeah flow mon. And then for routers we use for the application telemetry and just to sum that up, so discovery is gonna cover any settings under.24:58Design network settings, device credentials, assigned to site, that's gonna be designed network settings telemetry, so the SNMP server, the syslog server, wired endpoint analytics, those settings, and then provisioning is gonna be.25:16A combination of your network settings and your network profiles, anything that we're bringing together to create that network intent for the device. So let's just look at discovery in a little bit more detail.25:32So device discovery can be performed through two different methods. There's the discovery tool or utility that's built into catalyst center. But we can also do a bulk import through inventory using a CSV file.25:48So the discovery tool allows for IP range discovery, but here we just have a couple of examples so we can appe append some different VLANs if we want. We can also do a network scan with a seed device.26:05For some of these neighbor discovery protocols like CDP LLDP or, a CIDR with a specific prefix length. And then for the management IP address, so this is the IP address.26:20That will be stored in Catalyst Center inventory under the device. And this is the the IP address that Catalyst Center is gonna use to manage the device. So for devices with loopback, we can use the used loopback if applicable setting.26:35And if there's a, a applicable loopback on the device, then we'll prioritize that one. Otherwise we'll just use the IP address that we discovered the device on. Okay, so here's just an example.26:53Of what a device discovery would look like. So the mandatory credentials for discovery are gonna be CLI credentials and SNMP credentials. During a discovery we can specify the protocol order that we want to use. So for discovery we use SSH and telnet.27:08We can disable Telnet if we want to during discovery. And then there's also support for enabling that netconf port in the either the credentials or the credentials during the discovery job itself. Okay, so here's just an example of that, right? So.27:26Center is gonna go and check if the device is configured with those SNMP credentials or the netconf credentials. And if you discover the device with those credentials configured on the DNAC side and they're not on the device, they'll be configured.27:49Just some additional information you know regarding this just so that it's very clear, just since we have V2C and V three in the picture. So we have the, you know, manual config on the device. We have our.28:07Community, RW, we have the RO community on the catalyst center. There's gonna be NO config to the NO config change to the manual configuration. Excuse me.28:26If we have our RO, then call center is configured with both RO and RW. There's gonna be NO configuration change. And if we configure it with SNMP B2C.28:45And Catalyst Center is configured with SNMPV three credentials, then the SNMPV three credentials are going to be added to the config and those are gonna be the credentials that Catalyst Center will use to manage the device. Okay, so let's pass the ball back over to Irvin. He's gonna take us through.29:00Great, that was a nice explanation and for the discovery process that it's one of the most important parts. So let's get started to 2nd demo that we have for today.29:22As you can see here, we are gonna manage to see the main menu, and we have four different ways to add the the devices into the center. The 1st one and the most easy way to add it's go to the tools.29:36Select discovery. And here under the discovery we're gonna find a dashboard of the discovery processes. We just need to add a discovery process in the top of the right and here you can select to add a discovery job name. Here you can add like a test.29:51Maybe it could be like a test one, and then we're gonna be prompt to select discovery type. We can use the CDP if you have enabled Cisco discovery protocol, we can manage to add that. And here we will it will ask for us an IP address, the range.30:08Or the subnet filter and the CDP level that you have already configuring your devices. Also, the most easy and the most common way that I have seen with my customer is to use the IP address range. Here with the IP address range, we can manage to have the range that we wanna use for the devices and.30:24In that way it will be more easy to, to add that ones or that usage of the devices.30:44Also for the 3rd party devices, you can add by link lawyer discovery protocol or LLDP and also CIDR for the 3rd party devices. Once we are ready to manage the IP address range or we want to add that devices, we can just add here the IP address. Let's say like we have.30:50The 1010 and ten.31:10Let's have a/twenty four and here we can add just the range and five to five five and this will be in a/twenty four. Also, sorry. If you have configured a look back IP address, you can select here which kind of.31:13Management IP address you have. Just don't forget that. And then we're gonna provide the credentials. Here the on the credentials we're gonna see that.31:33The global credentials are the ones that I show you in the previous demo in where we create the credentials and into the settings or the network settings and that credentials will be added here. So if in case that you already add that credentials, well, you can add here that ones. Also, you don't have to return.31:45To the network settings and add that specific things. Well, we can add from here.32:04Also you can add just for this specific job, you can add the credentials for those so you don't redo everything. For the global credentials, if you select to add the global credentials, it will also store that credentials here into the center. So it depends on you how you wanna use. If you wanna just.32:10And use it one time and you don't need to store it, well just use the job specific credentials. If we need to use and store that credentials, well, you can add here the global credentials and that will be enough. The nice part from here is that we can mix that credentials. In case that we have different credentials and with different sites, well we can.32:30And use here and that will be stored. So why we need that credentials and also how we are gonna use them? Well, in the case that you already store, you can just come here and add that credentials here and when we are gonna try to find the devices, we are gonna go to the next ones.32:50Once we are ready, we're gonna schedule the job or if you wanna run it now, well, that will be enough to run it. So just select here scale job and if you want to run it right now, just select the now and that will be now. Maybe you have already programmed to add new devices during the weekend, well we can schedule.33:09For the weekend. And in this way it will auto run the the process of of the discovery.33:28And maybe you have some daily or some weekly devices, new devices and your team don't don't want to add it manually, well you can scale here and you can also select how much time do you want to run this process? Maybe we have problem to add new devices in our facilities in the next two weeks. Well, we can run this process.33:36And to auto add that devices here. And also we can select when we wanna end that process and we can add here the end of date of that one. So also the end date or the end after we can add here how many records. Maybe we just wanna have three occurrences in the next.33:56Two weeks, well, that will be done here. So once we already are done with that, we can review the process.34:16And review the credentials and the ones that we are gonna use or we can scale for the, for right now to to run the process. Let's go to the next. We are gonna see the summary of what we have been selected, then to start the discovery process and well.34:24That process will start right now and that that process will make to, to ping every IP address of the range. If the IP address replies, well, this will try to add the credentials with the CLI and SNMP credentials. If for some reason the CLI and SNMP is not working, well, they want.34:42Be added into the inventory and you will know which device is not em.35:02Or it's failing to add. Here you can see that that's the, the current processes that we have been running and the the status of that credentials. Also another way that we can add devices to the inventory of the center, it's go to the menu. Sorry, I were too fast.35:07Menu, provision and inventory. Here in the provision and inventory, we're gonna find some some views and the 1st view of the inventory is that we can add some device. If we select other device, we're gonna find here the discovery process that we already have been working.35:27If you just want to add one device and you don't need to to run the whole process of the of the adding the the IP address range, well we can just select here a single app device. Here you can just add the IP address or the DNS name.35:46Are the credentials, if you wanna use the global credentials, we're gonna see the ones that we already have configured and also the ones that we have, the credentials that we wanna use. At least we need SNMP with the read credentials.36:02But to be able to work with the device controllability, we need to have the read and write communities or for the version two or for the version three we need to have the read and right communities usernames and password.36:22In the case that we're gonna add a wireless controller, here it will be required to add the the port of the network. You can add the default port may most of all the customers have the default port that is the hundred 30, and you will use here.36:36And also we can select how we wanna contact the device if you want to use SSH version two or if you if you're still working with telnet, well, we can select here. As you can see the telnet is not working with netconf. So the port is disabled by default.36:54Once we are ready, we can just go to add and select the device and, and, and find another device. Also the 3rd option that we can add the device is to import inventory. And here we can download a template of the CSV file in where we can see.37:11What we need to fill the to add in that template and in that way we can select how we wanna add that list of devices. Let me show you quickly. So here you will have some instructions, what do we need, the IP address.37:30The SNMP version, the communities for that versions, for the read and write and also the CLI credentials. You can just list that devices here, then reimport that in that that specific IP address or sorry, that specific CSV file.37:46And then you can just wait until it pings the devices. And well, we have another the last four option it will be via the smart account. That's more for the plug and play. In the case that we wanna, add new devices and we already buy the devices, but they haven't arrived in our facilities. Well, we can.38:05You're find that serial numbers that been that have been assigned into our account and you're gonna find that serial numbers into the plug and play dashboard.38:25So that's why we have four different ways that we can add the devices. And once we already see the device here, we are gonna find the the device with the manageability and manageability as a managed and the reachability as a reachable. These both states means that they are.38:35Working well and you don't need to do more to add the device.38:55I think that that's pretty much for the discovery processes and I'm gonna return the ball to my partner eh Matthew to continue with the next next part of the session.39:01Great, let's go into some site discovery or site site assignment. So we'll, we'll talk through just an example of what that'll look like, the configuration across, which is wlcs and routers. This one is pretty uniform across all of them.39:16But we'll we'll just take a look together. So, there's a couple of different ways that we can add or assign devices to sites. So one way we can do it is in the inventory here, we can select any unassigned devices and we can go to actions, provision and then assign devices to site.39:34And we also have on the left the device work items where we can select specifically any unassigned devices in your inventory. And assigning a device to a site is really, really central to working with catalyst center because effectively all of our settings, you know, the information that's gonna get.39:53Provision when we when we go through the provisioning process, everything, any templates that you're assigning to a network profile, everything's gonna revolve around the site, right? So a site is really, really important. So it's important that we have a good design when we create our hierarchy.40:14But here is the assigned site step, so you can either assign through the provision, assigned device to site or we can go through the unassigned to select those devices. And during site assignment, this is when we're doing.40:33All of our SNMP traps, your syslog hosts, the certificates, the system certificate for Catalyst Center, as well as the SAP enrollment process for the device certificate, your NetFlow destination, but not the actual netflow configurations.40:50We'll we'll look at applications telemetry later on. The IPDT, if it is specifically an access switch, and we'll, we'll look at that together as well. And then streaming telemetry and.41:09CTS credentials, CTS credentials applicable. So let's take a look just at some examples here. So here's a switch, here we can see the syslog and the netflow configuration. So we can see logging hosts, we can see the SNP server host.41:25And we can see the SNP server enabled traps. We can see the IPDT configuration on the switch. So this is only if it's an access switch in Catalyst Center. So in Catalyst Center we assign devices device roles.41:44And so IBDT or that wired endpoint data collection is only gonna apply to those devices that are listed as an access device in the catalyst center inventory. So let's look more at that configuration, right? So.42:01We can see that IPDT the way it gets configured is with this global device tracking configuration and then on a per interface level, if those.42:20Our switch ports that are our access switch ports. So we'll go ahead and step through. So here's just, you know, another example. So if we have an existing brownfield configuration.42:34Of IPDT that's manually configured on the device. The result here and the this is part of you know why we're we're having this session just to go through so that you're aware of these kind of things as you go through the onboarding process.42:50Catalyst Center is going to overwrite the existing IPDTC configuration on that device. So if you have wired endpoint data collection enabled for that site, then.43:06It will overwrite that configuration, but there is a couple of different solutions that we have for for that such as appending an additional template or we can disable the functionality entirely. So here we can look at.43:21Brownfield configuration, so for SNMP credentials, so if we have manually configured SNMP credentials on the device, here we can see an SNMP V2C community that's configured with an ACL on it. If we discover this device and assign it to a site.43:39During that process, catalyst center will remove that ACL. So if we want to maintain the ACL, we'll have to reprovision the device with a template that includes the command and it will leave it alone after that.44:00Okay, so let me quickly step through how we can modify the device roles, so this is tying back to the IPDT configuration. So what you can do is you can select the device in the inventory, you can go up to the edit device.44:17Option at the top, and here you'll be able to see device role, so for those devices to get IPDT configured properly on those devices, you need to have them configured as access devices. So let's let's take a look at the certificates.44:33So during the the process for a switch, we have the catalyst center system certificate pushed to the devices, so that way the device itself can trust catalyst center, and what we also do is something called Sep enrollment. So.44:52On behalf of the device catalyst center can operate as a certificate authority and so we we provided the enrollment URL to point to the catalyst center, and it's able to enroll itself and generate this, what we call the device certificate.45:08Under the SDN network infraid trust point and we have the auto enroll AD regenerate command on here. So at 80 % of that certificate's lifetime, which by default it is a year, it will.45:27Reach back out to the catalyst center and regenerate that, that device certificate. If you ever have any issues with certificates like this, and that's also where the auto correct telemetry configuration setting comes in, you can use the update telemetry settings.45:43From the inventory and a lot of the time that's gonna fix the issue. Of course, if you have any additional issues, you can go to tech. So here we have just you know the some additional SNMP config, start traps.45:59We can also see some streaming telemetry. So this is if you have netconf enabled, this is a bit of an older screenshot. These days we've been slumming back the scope of how, how much.46:16Data we're, we're collecting via streaming telemetry for our switches. It's still very important and crucial for the controllers, but today we're really just looking at the, the PoE analytics piece, so if you want to utilize PoE analytics from Catalyst Center, you're gonna need to have netconf enabled.46:33And it will configure the streaming telemetry on there for you. Okay, let's quickly step through the controller. Very similar settings, right? So we can assign a device through this process. We can see that it's gonna push the syslog SNMP netflow configurations.46:51The certificates, device certificates, and then primarily assurance through, for controllers is gonna be done through the streaming telemetry.47:11For routers, again, very similar, we'll configure that SNMP syslog, so on. We'll configure the certificates, the SNMP traps, and then here we'll go into our 3rd demo, so if you're ready, let's.47:30That's the. All right, thank you Matthew for that next. So let me share my screen and let's continue with the demo part. That this demo part it's I think.47:48It's the most rich with the, within the.48:07Device controllability, and here we can see 1st how we're gonna assign the device to the sites. Also, we are gonna talk about some device details and the assurance dashboard. So let's get started. 1st, to assign the device to the site, we just need to go to the.48:12Device, let's go to the provision menu. Here under the under the inventory, we're gonna find.48:31That the list of devices and when we wanna provision or assign the device to the site, we just need to select the list of devices, maybe you wanna add two or three. Here let's go to the actions and we can select how we're gonna assign the device.48:38As easy as that is just to go to the menu, actions, provision and assign device to the site. This will help us to, to, to know where we wanna assign from the part of the hierarchy. Also, you can manage to select two different locations. It could be maybe to another area or another building and you don't need to, to do it.48:56Everything in the same one or if you want to skip and you already know which device belongs to, you can select from here.49:17And as easy as that, it will be enough to do it. Then just go to the next. And well, if you already have added the device to the to the site, you are gonna have this kind of message, but also you can unassign them and you can select which site you wanna have.49:24Here we can move on that, that site, as you can see, it just let me do it by building. So that's why we were talking about the hierarchy part in the 1st section. As you can see, it's asked me to do it into the building part and well.49:44That will make it more easy for you to assign the devices. You can have the option to do it one by one as I do it 1st or you can do it the whole with assign all the devices. As you, you, you continue, you can see the menu of these assigned devices and also let's see what will be the server.50:00That we select in, in the network settings, also we have some trust sec or CTS credentials, for the SNMP trap receiver, if you want to store it here in the center or this is log level message that we wanna store.50:20Also you can manage to have the control certificates and to see it by device. So here it's nice that you you can manage by device and well you can just go to the next and then it will be prompt YouTube video in where you can see.50:33And just a quick tutorial that we are talking about. Here you're gonna have to see the previo preview and deploy of the configurations that we are gonna have and well, it will be easy to do that and here we are gonna see the operations that we were working on.50:49And if you wanna some you have some issues and you wanna recheck and if you already fix that, you can rerun this this option. Then you can just go to next and that will be enough to, to select the assigned to device. Also you can match between the configuration to be deployed and the running configuration. So.51:05So here.51:25It's easier that to check that information and let's look for the eh information that we are gonna deploy to the device. If we are already sure that we are gonna deploy this information and the configuration to be deployed, well here we can see once the the current configuration that we are gonna deploy.51:26Sure and well you can select to do it later or today. Also you can scale the one options and well, that's pretty much that we have for for this assigning device to the site. And as you see that, so just remember select the checkbox of the device.51:46Action provision and assign device to a site. Once we already have assigned the device to the site, we are gonna check the device details. With the with the device controllability, we're gonna be able to manage the ports, the configurations that we have per per device, and also we can have more.52:05Clients information for that devices. Here on the 1st view of the details of the device.52:25We can select the port and also we can run some actions, like to shut down that port or to clear the Mac address of that specific port. Also, we can tag that port or to create the tag for the ports. Just remember that the just the the ports that it contains the one interfaces.52:31It have to be targeted with the one interface or the one port, sorry. If you create a one port, it will be targeted with the tag here. Also, you can manage the the sum of configuration of the ports. Like if this is an access VLAN port.52:51Or if it will run a VLAN over a VLAN with a voice VLAN that it's the only one that it can be run over a VLAN, well you can do do here also the Mac address and the kind of information if it's a full duplex org.53:10And the power of internet if you have enabled or disabled here. Also we can match more information like the kind of speed, the MTU and the admin status of that port. The nice part from here is that you can see the whole ports and if some for some reason you wanna just.53:26Shut down, you can do it from here.53:46Or you can do the NO shutdown comment like in the CLI, well you can just run it from here and that will be enough to turn. It's a nice part that you can manage these ports or also you can manage the virtual ports. In the case that we have some port channels, we can manage here the port channels port and also to see more information.53:48Of that eh ports.54:08Also, we can see more information for the system. This is, this will be like a nice show show version of the, of the devices where we can see the host name, the MAC address, the serial number of the devices, the current image that we are running and the version that we have here.54:10And well, the provision status if we already provisioned with the assigned to the site and well that's pretty much that we have for the hardware and software. The nice part from here is that also we can manage the configuration drift. We can see or manage the the history of configuration that we have been running across different.54:28We can see here the the change of the configurations and where was the changed. Here, our running configuration under 8 November.54:49Used to have this configuration, the platform and then under November nine they clean up that configuration. Also you can manage to change the for the different version that we already store. And well, the nice part from here is that you can create a label.55:00For that configuration. So you can add like this is the the good one, 1.0. So here you can you will know that that configuration is the good one to store here sorry my sometimes my lap gets me out.55:17So this is pretty much to, to, to see the configuration of your devices. And remember, if you wanna just see just one configuration or you wanna make a rollback, you can do it from from that configurations menu.55:36To see the options remember it's just open the name, view device details, and here we are gonna be prompt to the view of the details. For the browse configuration, we can see go go to the config drift and well that will be enough to see the configuration changes.55:53Well, now let's see the summary tabs. Here on the summary compliance, we're gonna see the whole dashboard of of compliance. We can see by the end of life, if we have some model that is maybe needs some, some update, we can manage from here. Also for the software.56:12We can see the version that we have running into the device.56:32It's compliant or the hardware, maybe we need to update the hardware or some manual we can see it from here. Sorry. If we, this, we have some issues here. Sorry for that.56:35But well here under the issues we are gonna manage to see the, the, the information of the devices. Sorry.56:53And well, we can see also the network settings that we have in compliance. If we have forget to do the copy runnings to start config, we can see if we have run it or if we have the right memory, Well the case that we miss it, we can fix from here.57:13And well, for the case of the SDA, we can manage to have here this information, also the ABC and the software image. For the critical security advisories, we can manage to see the advisories in the case that we have some risk, we can add from here or the SDA access more information.57:31Also, we can find this compliance check from here if you already fixed some of that issues, you can rerun manually or it will run whenever the device is synchronizing with the currently center. If you wanna take attention of all the issues, you can just go here and select the fix all configuration compliance issue.57:52And you will be prompt to do the whole configurations of the compliance.58:11Also, if you want to know more about the violations that we have for that specific device, we can see the the list of violations that we are running on and we can fix from here. So this is a nice dashboard that we have an idea what's going on with our device and how we can fix that issues that we maybe in experience.58:17And well, this is one of the nice parts that I like from from the center that it's the assurance dashboard. Once we already add the device and synchronize and select the network settings, what we can do with that information. Well, it's under the assurance dashboard, and here under the health.58:37We're gonna take a look about what's going on with our with our network. I think that that is one of the fancy fancy dashboard that we have for this center where we can have a good idea of our network devices, what's the what's the current.58:57State of all our devices if for the wired clients and the wireless clients, also we can check the network services like the AAA services, the DNS server or the DHCP server, and also how they been working with our endpoints devices.59:18We can see more information like the site analytics. This we can we can use the AI analytics where we can know more like how many times an attempts been working with the site, also the important duration that the customer have been working with our network.59:36For the connections. Also we can more have more idea about the roaming attempts that we have been running across different sites and well the duration of the roaming and the coverage of that for specific issues. Also the nice part from here is that we can know.59:53Which kind of issues we have been working on that specific site and also by priorities. This is linked to the to the databases and we match the kind of issues that you maybe experienced, give them the priorities like P1P2 or P three. And in this way you can know if that means.01:00:09That you need to take attention right now? Well, it's aP1. Maybe you can wait for the end of the day. Well, you can use the P two and the P three it's more informational, maybe some fee free time that you wanna solve these issues, you can come here and and see the kind of issues that we have been working on.01:00:29Also, we can filter by area of the hierarchy. So if we go to the top of the left below overall, we're gonna see the global legend. And here we are gonna see the list of hierarchy that we can filter on. So that's why we started with the, with the buildings and the floors of the hierarchy. So.01:00:47You can see here we can just manage by just that San Jose building.01:01:07Or the global areas, it will be whole areas. Also, you can use some time range, like the 3 h range, 24 h or seven days. So here you can manage just to see which kind of areas and floors that you wanna use here.01:01:12Well, we have more here and we are gonna find out that we use the applications. Under the applications, we're gonna find out the kind of application that we have been working with ABCU or application visibility and control, and we can manage to do it by some specific sites or for some specific areas.01:01:31We can find the kind of traffic that has been working on, the users or the endpoints that have been connected through the devices, and also the kind of application that we've been working on. Also, you can see by the application maybe this Microsoft Teams, what kind of.01:01:51Issues they have been or the help that we have been working on.01:02:11Also, we can customize these these measures. So maybe if you are ok with that this health, it's ok and you can go here and see why it's having these kind of issues. Here we can see more detail about the usage of that application.01:02:14Like the usage, the throughput, the kind of packet loss that it had been experienced, the year or the network latency that we went and been experienced on that specific application. Well, that's pretty much and well the users that is being connected to that.01:02:32Application to be any more specific.01:02:52Also, we can see the more details about the servers that we've been working on, like the triple A servers, give a second. Let me select the global area. And here we can see by the dashboard of the network services, like for the aaa.01:02:55What's the top side by highest latency, the top side by transaction failures?01:03:15And the triple A server latency. If we scroll down more and we're gonna know more, we just need to come here, view details, that will let us know more detail of that information. But here you can manage to see which kind of user having been connected through that and also the AAA top sites by transaction failures.01:03:21Oh, also we can see here the DHCP services. Remember that these DHCP services are the ones that we linked for the, from the network settings and also the DNS server that we've been working on.01:03:41Well, remember that all of this it's managed and used by the device controllability. So that's why it's important to keep enabled and to start working on these actions of the device controllability. For the next part we're gonna see more about the power of internet and devices.01:04:03Here under the menu, sorry I were too fast, menu, yeah it's loading. Here under menu we are gonna find the assurance.01:04:23And we can go to the PoE and here on the power of our internet, we are gonna see the insights of that information. Like how much we have been using for the usage of the power, how much we have been saving with the devices, like the more distribution of to save that information.01:04:38The power allocation, the power of ethernet, and the power usage of that ones. So all of this, it's coming from the information of the of the devices that it's working with the power over ethernet or PoE, and this will help us to know more information of that ones. This is a nice dashboard because we can know the.01:04:58Savings that we have been working on. So we know that we have right now 594 W and they target to be 743. So we are saving that kind of watts here. Also, you can look out by area and hierarchy.01:05:18And also the list of devices that they've been working on that what's and how many of them have been consuming the whats of that information. Then in the last part we are gonna talk about the Wi Fi six and the Wi-Fi six we can find it here again in the menu.01:05:37Assurance and Wi Fi six. Here on the Wi Fi six we can see the difference between how many clients bring up Wi Fi six and how many of them have been working with eleven AC protocol.01:05:58Also, you can manage to to see the network readiness and Wi Fi six E applications for the access points. For the distribution protocols we can manage to see that give me a second. And well, we can see the wireless air time efficiency.01:06:10Also to know more the wireless airtime efficiency. If we want to know more of that, we are gonna manage to see the kind of information like six E And if we wanna know more detail of that, we are gonna see that we we can manage. Just select the the devices details.01:06:30And also you can see the devices that are connected through that Wi Fi six E or or that ones. And well, this is pretty much for this demo part. I hope that you liked this usage of the assurance dashboards, the device details.01:06:49And the assign of the devices into the hierarchy parts. So I'm returning the ball to Matthew and let's continue to the last part. Thanks. Alright, so I'll go through this relatively quickly just for the sake of time, what we'll go through.01:07:08Is just provisioning. We'll just go through the example of a switch. So for a switch, right, when we do the provision operation, it will pull in those.01:07:25Network settings for the site specific, whatever site that device is assigned to. So the triple AAA server, if you have that configured, the DNS, the NTP configurations, these are all part of those site specific network settings.01:07:40And these are the configurations that will be enforced during the provision process. So if you have those enabled in the network settings during the provision process, it will, e.g., the domain name, it will.01:07:55Change the domain name to the domain name that you have in the network settings, the NTP as well and then the DNS servers themselves and triple AAA configuration. The only thing to call out here is that the triple AAA configuration, if there's existing triple aaa config.01:08:11On the device, it's not going to overwrite that. What that'll do is it'll just result in a provisioning failure. And in that case, you may want to remove the AAA server from the network settings and just use your existing brownfield configuration or you can come up with some solution to.01:08:31You utilize the intents otherwise. Also during the provisioning process, what we'll do is we'll bring in those day end templates, so any templates that you have configured and that are associated with a switching network profile that's assigned to the same site.01:08:48That this device is on, it'll also pull in those day end configurations as well. So we'll just look here. So, you'll see the, the source address here for radius. So if, if the IP address is assigned to.01:09:08A loopback if there is one, otherwise it's gonna assign it to the VLAN. Here's just some additional configurations so AAA config, and we can see some additional aaa config here.01:09:29But now we'll just go into application telemetry. I'll talk through the different device types. So historically if you've been working with catalyst center for a while, you'll know that the way that we used to to do this is.01:09:47We would require that you go onto the devices and you tag those interfaces descriptions with the land keyword in order for catalyst center to pick which interfaces they utilize for application telemetry.01:10:03So what we've what we've done is we've created the ability for to automatically select those via an algorithm, and so you pick the devices and from the inventory, if you go to.01:10:19Actions and then you go to telemetry, you can enable application telemetry on that device. So application telemetry is an additional step after site assignment, right? So site assignment, you get all the basic configuration for telemetry, so your streaming telemetry, syslog SNMP etcetera.01:10:35Application telemetry is an additional step that you go through the process of enabling through through the inventory. And so this has a specific algorithm that it will follow. So the 1st one is being four routers.01:10:57If, based on the previous tagging methods that they still work if you want to utilize them. If it's a physical interface has an IP that's not the management IP, ETA is not enabled on that.01:11:12Interface and the description has the land keyword inside of it, then it will go ahead and apply the application telemetry if it has an IP for the automatic algorithm, if it has an IP, ETA is not enabled on it.01:11:31And it's not one of the following, so if it's not your WAN interface, and it's not your management interface here, then it will configure it on those interfaces. For switches, very similar situation. Just look out for the LAN keyword.01:11:50And it will try to only find the access ports here and you know similar situation for the automatic algorithm. It's looking for those specific physical interfaces that are accessed.01:12:06The WLC is going to look for any WLAN profile on that controller that has the land keyword inside of it. But now what we do with the automatic algorithm is if it's not a guest guest SSID.01:12:25Meaning that the SSID name does not contain guests, then it will configure the application telemetry on there. Okay, so let's look at that, what that might look like. So.01:12:43Here we'll take a look at the FNF config. We can see on the right what it looks like to actually enable this. So we go on the inventory, we go to the dropdown, we go to telemetry and enable application telemetry. This will configure the FNF flow records on there.01:12:57The flow exporter and flow monitor commands, and it will it will put those monitors on the correct correct interfaces based on the algorithm. And the information that we get from switches is what we call quantitative metrics, so that's things like usage.01:13:14In throughput. So we can just take a look at some of the config here, so we can see the flow records get applied. We can see that the exporter gets created, and then we can see that on the individual interfaces that are selected via the algorithm or have the land keyword, we can see that those monitors are applied to those.01:13:32Interfaces. For the controller, you know, it'll, it'll configure the flow exporter and the flow monitor commands. Those flow records are pre configured on the controllers. So we don't really need to to worry about it. We can see the ABC flow monitor gets created here.01:13:52The wireless profile is there and we can see that the flow monitors are applied to it. For the router, this is what's gonna provide us those quantitative metrics, but it also supports qualitative.01:14:12And, for the routers what we're applying is not FNF config directly, but we're we're configuring what's called perf mom. So here we can see just that rules, APM profile versus the new.01:14:30APM profile, and we can see that configured on the interfaces as well. So let's dive into just some brownfield considerations regarding device controllability. So what we can see.01:14:48We've already discussed this, but for SNMP, any SNMP V2C with an ACL, it's gonna go ahead and overwrite that. So the best course of action is to append an ACL via A Center template.01:15:04And apply that to the devices, make sure that Catalyst Center is not blocked by that ACL, so that way the SNMP telemetry can get to the catalyst center. We have the IPDT configuration, so if we do have a brownfield IPDT configuration.01:15:20Catalyst Center is gonna overwrite that configuration, so either what we can do is remove the wired endpoint data collection setting or disable it for that site, or what we can do is append it via a template, we can append those additional.01:15:38Device tracking commands. We also have CTS credentials, so CTS credentials only get applied if the site is, if the global site is configured with the AAA server.01:15:56And so if in the case that, you know, if, if the the mapped site where, you know, the devices are assigned, catalyst center is gonna overwrite any CTS credentials pre configured on the device in this, in this case.01:16:11So the best approach is to either use the, the CTS credentials of the the or modify them with a template or you can remove the AAA server from the global credentials.01:16:31Or from the global network settings. And then for triple aaa configuration, we have triple aaa defined on the device in our brownfield configuration and we have a triple A server, then catalyst center is not gonna do any pushing and it will result in a provision.01:16:46Failure on Catalyst Center.01:17:06This is so we don't end up locking you out of your device. So we can either remove the AAA server from the network settings or we can utilize some templates. Okay, so here we're just looking at that example of the STP credentials. We can see the.01:17:08The ACL configured on the device and we can see that after we do a site assignment here, we can see that the community ACLs are moved. So we can, the way that we can address this is by creating a template.01:17:28As I mentioned, we want to make sure that when we do create that template, that the ACL that gets configured on that SNMP credential is in the allowed list of ACLs. So let's just take a second to talk about CCS.01:17:48So it's only gonna be configured when triple AAA is is defined at the global, server settings on the network level and so so yeah so that that's, that's effectively the the most important.01:18:04The piece, when we're talking about CDS credentials, just know that if we're at the global level, it's gonna create them and what it'll do is it will create them based on the device ID, so it'll use the serial number to make sure that it's unique, and then it'll also use that for the password.01:18:24So we can see, you know, here's the manual configuration and then after site assignment, we can see that it was overwritten, right? So if the AAA server is at the global credentials, it's gonna overwrite the CTS.01:18:42Okay, so we can see the SNMP credentials here. When the device has NO SNMP credentials configured on it, catalyst center, when it does discovery it's gonna provide it on them, in a brownfield scenario.01:19:06Similar situation with with the ACL, so if there's an ACL on there, we need to make sure that we use an additional template. It's gonna enable all telemetry traps when we do that that operation.01:19:26And we can see here the s the PV two credentials as well as STPV three credentials. So if we, e.g., if we had SWP two credentials on the device and in catalyst center we we.01:19:41Configure SNPV three credentials, what actually ends up getting provisioned is gonna be those SNMP credentials, SNMPB three credentials. Okay I'm gonna briefly take us through ICE configuration, so we can integrate ice.01:19:57Here we can define that in the server settings, we can, we can specify the triple A for both radius and tacas, and we can see the global triple AAA configuration that gets applied.01:20:16The CTS authorization commands, radius server groups, et cetera, all part of that provisioning workflow. Again, we can see just those settings get applied, and so what happens when ICE and catalyst center integrated like this? So.01:20:33As we onboard new devices, if the IP address of the device is added to a site and they already exist on the ICE, then center is not gonna make any changes.01:20:53Otherwise it'll actually create those network device entries on the ICE for you or the nats. So here I just want to take a look sort of at the brownfield situation, right? So.01:21:08If we do have triple AAA config manually on the device in our brownfield environment and we configure via catalyst center, catalyst center expects the device to not have any triple AAA config, and this results in provisioning failure. And then last what I'd like to talk about.01:21:24Is just to bring together the whole process of device controllability, so we've gone through discovery, site assignment, provisioning, now the last piece is the deletion of the device. So when we go to delete a device.01:21:44We have the option to select for cleanup configuration and during this cleanup it will clean up the domain name from the intents, the name servers, triple aa commands, the system certificate, the device certificate, syslog.01:22:01SNMP hosts, streaming telemetry and IPDT configuration. SNMP trap message configurations are gonna stay present on the device. So that's just something to be aware of. And so that pretty much concludes the session today, so.01:22:18Thank you so much for attending today. I really appreciate it. And you can find us for future sessions next week what we'll be going through is powerful troubleshooting with Assurance and Cisco thousandeyes. So thank you so much.01:22:36