Micro-segmentation on ACI with Common-Policy Solution

Oh, or other domains. So what we are doing here is we create a context information closer to the domain where it resides.00:00So e.g., in the access layer for users and devices connected to the corporate network in the data center on leaves and in cloud for application workloads, ok? So we gather, create and gather all the information in ICE.00:20For all the endpoints which are connected to your net, to your network regardless where they reside, ok? We then normalize this context to a SGT, which is security group tag. In ACI world, we call it EPG or ESG, right? Micro segment. That SGT is understood across the domains.00:36Okay, we can call it micro segment, whatever you like, but ice in ice world we call it SGT, so this SGT is understood across the domains. E.g., I learn SGT or micro segment from my SDA network or corporate network and pass it.00:56Pass this information into ACI. ACI will learn it and it will treat it as external EPG, ok? We'll go into the details in future slides and in the demo as well, but just to give you idea, this is what we are achieving with common policy and ICE acting as a common context exchange hub.01:12Because it's exchanging the context, right? And.01:32Device for end user context, right? Who's connected? E.g., if someone is connected using a corporate laptop or is using personal laptop, those that that kind of information, ok? So what do we achieve with that? This helps us in creating consistent access and segmentation policy. We achieve sec end to end segmentation.01:36Irrespective of which domain they choose to enforce the policy.01:56Enforcing policy means like where do I deny or allow the traffic? It can be in data center, it can be in corporate network, it can be somewhere in SD WAN, it can be on your firewall. We'll look into the use cases, ok? So just to summarize.02:01Common policy introduces a unified framework for managing security policies across your diverse IT environment, ok? Number two, we have a centralized context sharing and policy enforcement. That's our eyes, right? That's our brain, that's our context exchange hub. And.02:173rd one, we get assurance that security protocols automatically adopt to the changes without requiring manual updates. So common policy, let's again go a bit more deeper into the technical details so.02:37Where it started, it's it's in in the market for quite quite a long time now, but it was known as multi domain and that version had number or I should call it phase one. It had number of limitations such as.02:58Only one single fabric of ACI was supported and within one fabric you could have only one tenant and those kind of limitations and the the biggest difference we had was we were just using REST API between controllers here and ICE controllers. So rest APIs we could get.03:17Get the limited information from ACI, but not the whole context. What's a special in this common policy, this phase, which has been introduced from version ACI version 611, ICE version three.four. My colleague sayed will go into a bit more details about this. And so what's special.03:36In this version, in this version we are using not just REST APIs, but PX grid.03:56That means we learn a lot more information and we exchange a lot more information. It's by two way communication between ACI and APEC, right? So what's the result? We get the support of multiple ACI fabrics. By the way NDO is not supported, which is next nexus dashboard Orchestrator as of today, but.04:00That will come as well, but you can have two independent fabrics, right? You get the support of multiple tenants, you get support of multiple vrfs, multiple L three outs, and the cool feature which I like and I prefer is filtering.04:20So you can have inbound filters, outbound filters, so you can say that I'm interested only in this particular tenant or these EPGs from apic. And I want to advertise outbound filtering would be like I want to advertise only these particular.04:36Sgts to Apex so you can define your policies between source and destination.04:55Okay. Right, so let's go into the use cases. As I mentioned earlier, 1st use case, that's not the topic of today, by the way, this, we can cover it in future sessions. So 1st use case is basically we build the connection between.05:02ICE and apic. Okay and we already have connection between ICE and SDA or let's say we build it now. And then what we do is we learn EPGs esgs from.05:22APEC, which we esgs we are interested in, and we enforce the policy on the SDA, right? Corporate network. So this is our policy enforcement point and we define a contract, you can see in the screen box that SGT one, it can be your corporate employees.05:38Can access the servers or devices and points or or whatever we call it any endpoint in ESG one, ok? So you wanna allow them access or you wanna block access to the guest users, you can define and enforce your policies on the SD itself. When I say enforce your policy, you are literally defining a SGACL.05:55Security group ACL, in other words, in ACL world, we call it a contract. You are defining that as the ACL on SDA, ok? So you block your traffic before it reaches the border.06:15Okay, so use block your traffic there. That's use case number one. Use case number two, that's our topic of today. So we have integration of ICE with SDA, we learn sgts from sgts again micro segments or EPGs in ACI world, we learn those sgts.06:25From SDA Catalyst Center DNA Center in ICE, we pass that information via PX Grid to Apic and Apic learned that information and enforce the policies on the border, ok? So what Apic will do, Apic learn those sgts, e.g., your employees, your guest users.06:46SGT and it will show as an external EPG within your.07:06For ACI, ok? And you can define a contract. For 3rd use case, you have a firewall in between that might be the case in most of the scenarios, we learn EPGs or esgs from ACI, we learn sgts from.07:10SDA, we have centralized information, we normalize that information in ICE, and then we pass that information onto firewall. You can use your define your policy, security policies on the firewall regardless which vendor, ok? So if I want to deny a traffic, any traffic coming from guest.07:26And trying to access my web server, database server, I can have a contract on the firewall, ok? I have segments, and contextual information which device my guest is using or which device my corporate employee is using, right? That kind of information. So I can divide and do.07:45Define and configure the policy and deny the policy or deny the traffic on firewall itself, right? The 4th use case, not the least one, we have SD WAN in between Cisco SD WAN solution where we integrate ICE with SD.08:05Used to be called vmanage and SD WAN controller. So we integrate ICE with those entities and we pass that normalized information onto SD WAN and we enforce the policy deny traffic using zone based firewall within SD WAN.08:26Okay, so number of use cases again today we'll be talking about ACI only and that will be the focus. Now, what do we achieve and what we are trying to achieve end to end and what we are building end to end in our lab so we can demonstrate it to you. We have sdxs, we have SD WAN.08:44We have APEC, we have Meraki, obviously we can't cover everything in 1 h. We'll be covering these sessions in future. Today we'll see we are just focusing on APEC. So.09:04What do you achieve? Do you achieve entry segmentation regardless where your workload resides regardless where your employees or guest users connect from, ok? So you have a centralized hub for all the information of users and workloads.09:18Okay. And with that, let me give you a quick overview of the demo, what our lab looks like today. So we have a SDA on the left hand side, ACI on the right hand side, we have very simple topology, we have.09:35Common policy tenant in ACI common policy VRF and one single EPG. Well, we have many EPGs, but what we'll use is a web EPG, ok? And endpoint, let's call it application server as IP of 172 1600 or two.09:51And on the left hand side, we have employees SGT SGT number two, and with the IP of 1000 01:30 will show you how we integrate ICE with Apic and how we learn this information into ICE and how ICE pushes the learn.10:07Sgts learned from SD access onto the border node. With that, I'll hand over to my colleague Henry who will take take you over through the demo of ICE and then my colleague Sayed will take you through the ACI part.10:27Just a quick reminder, if you have any questions, on the bottom right you have a Q and A panel. Just feel free to ask those questions and our panelists will be happy to answer those. Thank you. Oh.10:41Thank you, Ahmed. Okay, so good morning, good afternoon, everyone. So I'm just gonna pick up where Ahmed has left, so I'm gonna walk you through configuring ICE to be able to learn context from from ACI, from the data center.10:57As well as ICE sharing context that ICE has learned from other part of the networks so around SDA from the campus to share those contacts into into ACI. Okay, so.11:16To get started for those who's not familiar with ICE, there's a couple of things that we need to enable, 1st of all, to get ICE to talk to ACI. So if we go to administration and we look at our deployment, there's a couple of services that we have to enable on the.11:32On our notes, so, in this lab, we've only got one, one ICE node that's running all our personas, so if you're not familiar with ice, we've got four different personas, our administration persona, our monitoring persona, and our PSN. So.11:51So on the PSN, there's a service that we need to enable, which is SXP.12:10So SSP stands for security group tag Exchange protocol. And this is a application that allows network devices to learn and share SGT bindings across the network, ok? So we need to enable that service, and also we need to enable PX grid. So PX Grid is our platform.12:14Form exchange, service that we run that allows different platform to.12:34To publish as well of subscribed to different topics that ICE is gonna be publishing. Okay, so I've got these two service enabled. So to do the actual integration, we'll, go to administration, NO, work centers.12:41Under the trust sec header here we've got integration.13:01So on the landing page, we've got an overview of the different steps that we need to do for integration, we've got a nice little flow diagram that shows us the the different steps into the integration. But if we go into workload connections.13:06Now I did want to show you guys me building that connection using the wizard in, you know, in this demo, but I just didn't want to risk it so I've already done this ahead of this session, but I'll just walk you through the different steps using the wizard. So if you're starting from fresh.13:23You can click on add connection.13:41That kicks off the wizard, click next. So straight away you can see the different type of workload that we can connect to ICE, so we've got AWS, Azure vCenter GCP, but we are interested in ACI for today's session.13:44So we can select the ACI, click next, and then US is gonna start asking us a couple of questions to get this integration going. This way I'm gonna come out of the wizard and go into that integration that I have already done before. So if we edit this.14:02So 1st of all, we need to give that connection, that ACI connection a name that makes sense to us. We can give it the FQDN or the IP address, of the controller that we're interested in. Now if you've got a multiple controllers in your cluster, we only need to give.14:20To give one IP address of one controller, ICE will discover the rest of the controllers in the within the cluster. Give it a username and a password. And also if you want to, you want ICE to validate the.14:40The ACI certificate, we need to import that certificate from ACI into the ICE trusted certificate store, right? There's a lot of documentation around that. So in our lab we've got one apic, and ICE has learned this and we can see that it is in service.14:56Okay. Next thing we need to configure is our name conversion. So this allows us to, you know, modify the name as they come in. If we look at this little flow diagram here, as they come in as EPG or ESG.15:13We can, use our name convention to, you know, make sure that those those attributes, those contexts that we've learned from ACI is, you know, is visible to us within within ice. So we can configure the conversion that we can use ACI attribute values, so we can say the connection name, the tenant.15:29So if you notice here, every time I choose one of those attributes, it gets appended to the name, right?15:49Or we can append a prefix or suffix or e.g. if you want to, the EPG when they get converted to sgts to be just called aCI_you know, the name of the EPG ESG, you can change it here or you can.15:57Put something that makes sense to you in your environment. Okay, so for now we're just gonna stick with the, with the default one that I've already configured, so which is using the ACI value so using the connection name and I believe I had.16:13This connected like that, yeah, it's configured like that. So to use the connection name and the endpoint group type. So next thing we need to do is choose the EPGs and the esgs that we are interested in, right? So ICE has already reached out to ACI and learned all the apgs esgs.16:31So we don't want, we're not interested in all of them. We're only interested in.16:51Specific EPGs that we've named as common in this demo, so I'm gonna filter on common and these other EPGs I'm interested, right? Common policy app d DB, web, policy management PSR policy server, and you can see the name of the EPGs here and what it's been.16:56The name has been converted to as SGT based on our name conversion that we configured earlier.17:15Okay. We can also see the tenant where it came from, the VRF, the application name, and the type. So these are the one we're gonna be selecting, so these are the EPGs that we're gonna be subscribing to. So by subscribing these are the ones that we're gonna be learning the mappings.17:22Four. Next thing we need to tell ICE is a SGT numbering.17:42Now we can tell us to, you know, allocate those SGT numbers automatically or we can define a custom SGT range. So in this demo, I've created a range from 3000 to 4000 just so that they kind of kind of sticks out and it's easy for, for, for us to reference in.17:47Okay, so the wizard, like I mentioned, will walk you through that and hopefully you've got everything configured properly, you should end up with a connection, the platform ACI and the status connected. Now, if you get anything other than connected, couple of things that we.18:06You need to check is, you know, DNS resolution is very important. Every service that ice runs relies on DNS. So make sure that you've got forward and reverse DNS lookup configured for your ACI as well as ICE, right? So they can discover and learn about each other.18:25Okay, so straight away we can see that we have received four SGT bindings, so we can click on that and we can see that, from ACI here, the source we have received.18:43A number of SGT bindings, so for these for these EPGs that we subscribe to, now they've been converted to sgts using our naming convention and these are the four bindings that we have learned.19:01Okay, but we'll get back to that a bit. So, couple of things to check while we're here is let's go back to work centers and then actually NO we wanna go to take a look at PX grid summary because we're using PX Grid for that integration. We want to take a look at PX grid.19:16So as a client for clients, we can see, you know, our apic is here.19:36We can also check you know what topic we are learning or subscribing to. So if you go to diagnostics, we can under web sockets, we can see that ACI here, those two down here.19:42We haven't used a certificate to to to to verify ACI, so we see that we are subscribing to SXP binding as well as publishing ACI bindings, right? For some reason this is disconnected, so we've got some issues with the lab.19:57Ignore that for now. Okay, so a couple of things that next we need to do, we go over to SXP. So we've got our SXP devices, so SXP allows those devices to our network devices to learn about those SGT mappings.20:13We can talk a little bit about SXP domain. Now SGT domains is an important concept, right? So it allows us to control the spread of SX of you know contextual information that we're learning, right? Think of them as a logical.20:31Groupings.20:51That allows us to control where those SGT mappings are sent or where we learn it from, ok? So by default, ICE will create a default SGT domain, and we can see within that domain, we have some SXP devices that's been placed in those domains as well as some SGT binding.20:52That's right. This will become a little bit more important in a second.21:12Now, the next thing we wanna do is control the sgts that we are learning that that we are learning from from ACI as well as control the SGT that ICE is sending over to ACI, right? And we use, we do this using inbound and outbound.21:19Domain rules, right? So by default, as we have a default inbound rule.21:38That's configured. So if we take a look at that, we can see that this inbound rule is enabled by default, we can't get rid of it. And the destination is our default SGT domain, right? So everything that we're learning automatically goes into this default domain. But we can create our own if we wanted to, so you just.21:44So come here and click on add inbound rule. So give our rule a name, so.22:04Give it the name of inbound. Okay, so we can choose about where we're gonna send those mappings that we learned. So we're gonna choose one of those domains that we have configured, so say SDA corporate, that's a domain we're gonna send that to.22:10And then we've got some option to configure.22:30The sgts that we're gonna be sending to that domain. So, e.g., you can do things like say the source of the SGT, so value equals to say we're learning from ACI, that's our only SEC connection, a workload connection.22:34That we have in this lab. We can also choose, e.g., tenant as an example, is equal. So this is the only tenant that we learn from ACI. We can also add.22:51Additional conditions, e.g., EPGs, say e.g., we say contains and then we'll use the word common because that's why we've configured our EPGs for this lab. And we can click on preview and we can see which.23:07Which of the sgts that particular rule is gonna map? So straight away we can see that that rule is gonna map four SGT bindings and these are the sgts that we're gonna be mapping and sending to that particular SGT domains, ok?23:25Good, so we're gonna close out So for this demo I'm gonna stick to just using the default inbound rule, so we can see that there's four SGT binding within that default inbound rule.23:43So the next thing we want to configure is outbound, right? So this is gonna tell ICE, you know, which, which one of the sgts that ICE knows of, which one which one of those sgts are gonna be sharing out to ACI. So again, we can create an outbound rule, so we've got.23:59One already configured. So we've got an ACI, give it a name, which we've done here, make sure the status is enabled, and we've got a destination. So destination is where we're gonna be sending those SGT twos, right? So in a lab we've only got one workload connector configured and that's our ACI.24:17So we select that so destination is ACI and then here we can start configuring right which L three out we want to send our SGT to. So we can see that ICE has gone and retrieve all the L three out. So we've chosen this one here, which is what we'll be using in our.24:37Apps to common policy L three out V edge.24:57And then we've got some rule configuration. So the rule configuration allows us to match on the SGT, right? So down here we select the domain, so domain equals to our default domain, so you can choose multiple domains if you wanted to. So choose a default domain, and we're also choosing the SGT name. So.25:01Got a few other options that you can use. You can get very granular on your conditions here. So we're choosing other SGT names equal to, and then we've chosen.25:21A number of sgts that ICE knows of. So we've chosen contractors, developers, and employees, right? So these sgts that ICE may have learned by static bindings or ICE may have learned via SXP from other network devices.25:31So straight away we get, when we choose those SGT names, we get offered this contract configuration here. So we've got the SGT names here on the left, the connection tenant L three out, and then we can we can configure the contract that we're gonna be associated to those SGT twos. So.25:48These are the contract that's been configured on ACI on the ACI side and ICE has already retrieved those, so we can choose, e.g., this one here, common policy tenant can choose this contract here, allow all all come_policy. And then the provided contract, again, we can choose.26:08Use whichever contract we want to, we are interested in, ok? Now, this is where I'm gonna stop and hand it over to Syed who will continue this conversation from where we left off here.26:28Alright, thank you Henry. I'll just share my screen ok so I'll I'll cover the ACI part. So as you have already seen that ICE gets a lot of visibility once it starts learning objects from ACI.26:49Just learns about tenants, vrfs, EPGs. It's also learning about contracts. So the whole goal about this whole architecture was how ICE can influence policy on the L three out, how it can create sgts and map them to EPGs using the contracts that we build on ACI. So I'm just going.27:05To show you that there are three sgts that were forwarded to from ICE. So let's just go and see.27:25If we can see them, so we I'm in the common policy tenant and I have if I go into my L three out, so this is my L three out and I should be receiving these three sgts. So these are coming from the campus. These are the segments that was forwarded from ICE. If I click.27:32On one of them, let's say ICE employees. So this day will appear as external EPGs. As you know, that in ACI we don't use the word as GT, we use the word external EPGs, but technically it's the same thing, right? So if I go into my employees here.27:51So I can already see the campus SGT was four and ACI assigned a PC tag of 32775, right? So that's the external EPG that complements what the SGT in the campus environment.28:11I can also see that, what I'm learning from the campus side. So if I see SGT endpoints, so I see that one of the users employees on the campus side, it's a it's IP is 1000 01:30. Again, this is a binding that.28:26ICE provides, so ICE not only provides the SDT but also the IP address of the users over here. I can also go and see the contract, right? So I want this employee to be communicating to my application.28:45Which is over here, so I have my app EPG, already over here and if it should be able to access this server, just a slight delay.29:04Yeah, our ACI is slow today for some reason, it's really slow. Yeah, just give it a minute. Yeah. All right, so this is the server it's going to access 1702 to 16 or hundred or 20.29:20And we made sure that we already applied the contract, so the server is providing the contract and it's allowing all communication while the SGT will be the consumer of the contract, the external EPG. So if I go over here, you see the consumer is.29:39SGT. So let's just try to build some communication here. So on the user side, on the campus, if I just do IP address, so we have the user ten.00 01:30 that that's the user I showed you that was bind to that SGT.29:55And it's going to reach out to our server. So I'm just going to start a ping and it can reach to the server, 17216 hundred.twenty. So if I go to my server again over here, and so one hundred.twenty, right? So the contract is working.30:12What I can do is I I can always remove this contract but before that I'm just going to show you the mapping over here as well just to get some clarity on the topology. So I have my employee here if I click here, so the employee has a contract with.30:32Get the application over here.30:51Right, and that's how the traffic is working, but I can always go in and I can say like, ok, let's remove the contract now. I don't want the user to communicate, and you can see now the ping has stopped, right? So, the th the getaway from this whole exercise is that ICE.30:53Basically push these sgts.31:14And from ICE, we build the mapping from the employee to the app. So we use the contract on ACI to build the mapping consumer and provider from directly from the ice so security admin can pull that pull push that configuration, security configuration.31:17To build the communication between the user and the app. I'll just restore it quickly before we move forward. Okay, now if if the network admin wants to see some visibility of what's going, do we have the eyes connection working on?31:35What do we are learning from the campus site? So here we have that integration tab and we under that we have the eyes. So this is the software release 614, but this is also available in the previous releases, so you should be able to see under the integration and ice section. So we we have this eyes.31:53Over here, and if I go inside it, so you can see the recent activity, so if this connection went down with the eyes, so you would see those logs coming over here. So it was reconfigured like five days back as part of this exercise. I can also see the details over here.32:14So I can see that this is my ICE server and the connection seems to be working fine and I can see also the topics where the ACI is of the publisher and the ICE is the subscriber here.32:33If I want to see the endpoints that are user coming from the user in the campus, so these are all the user endpoints. Sorry, this is the EPG, all the application EPGs, and this is the user endpoints, right? So currently we are only receiving three routes.32:49From the campus side and we we have visibility with the SGT tags over here. In the production environment, you might see thousands of workloads in a normal organization, you might see thousand or 2000, maybe 10000 workloads. So that this here you can use the filters here, right? So you can all.33:08Always say like, ok, I want to filter out maybe you know SGT five.33:27Just to quickly, see what you're looking for, right? Because the data can be a lot to go around with. And then of course the the data centers EPGs which we are subscribed with the eyes. Then also if you want to look into the sgts specific.33:32Quickly so you can see the sdts that we are learning from the SDA environment.33:52And we can also search around over here as well as the data center EPGs, right? So those things are all available. You can also use these links to go in details of if there's any contract that has been provided, so you can quickly see it from here rather than going into the tenant side and and seeing it.33:57I can also see the bindings quickly. So what, what is the IP address that is bind to the EPG? So this is a quick quick way of navigating around if you are focused on the L three out.34:17That is integrated with ICE and in case if you have any events or audit logs changes so those those things are covered over here as well. Okay, so I'll just move, I have a couple of few slides. There are a few considerations that we need to make.34:28Make while, we build this architecture integration between ACI and ice. Just before that.34:48I'm just going to quickly ask you, I'll launched a new question over here and, be glad if you guys can answer this. So the question is like, what is the biggest hurdle your team faces when synchronizing security policies between campus and data centers, right? So it could be lack of.34:56Ability across domain because you might be having different teams that manage a campus environment and a different team manages a data center environment.35:16It could be the complexity of mappings between, you know, the SGT and the campus and EPGs and or it could be a operational overhead, right? So you, why do you want to make maintain dual policy sets? And then the last one option is inconsistent policy enforcement.35:26Where since you don't have a consolidated view for both these domains, so inconsistency can always appear, right? So, guys, just feel free to comment to put your poll, right? It should be seen on the bottom right of the screen, so you should be visible.35:45For you. Alright, so let's let's get into some considerations. What do we need to build this architect, make this architecture work? So I'll just cover a few hardware and software requirements 1st. So eyes would need 3.4 version or above.36:04And there's a hot patch that is available in the release notes, so you can have a look onto it. And from a hardware perspective, the recommendation would be to go with these certain models on PAN for your PAN and MNT nodes or something that is equivalent to them if you are running a VM.36:23For ICE. On the ACI side, we recommend anything any version that is above 612, right? So this is the latest train for ACI and this architecture, the features are coming in the latest train. So you can go with 615, which is a gold star release today and recommended release.36:42Also the hardware, Hardware is there's NO hard requirement in the hardware site, but we recommend you have at least FX FX three or any model that is above that, right? This is because we want the high due stack forwarding profile on the border leaf. I'm going to cover that in the next slide.37:03From the catalyst center, if you have anything above 2376, that supports the 64 character SGT names. So this this gives you a lot of flexibility when you are naming sgts, so it's recommended like if you have 237 or anything above, that that should work fine for you.37:20Alright, so if if you have been working on a, ACI before, so you would know that since one.three, we always used to have VRF in the ingress.37:41Enforcement mode. What does that mean is that all the policy that is applied would be applied on the non border leaves that is where we connect our applications. So you would see like anytime even the traffic is coming from the border leaf from the outside.37:55The data center, the policy always being applied on the non border leaf. The reason for that was that we can spread the policy across the T CAM that is available on the compute nodes and we don't want the border leafs to be overloaded with those TCAM and policies that we built or not source.38:11That was the reasoning behind the ingress mode enforcement on the VRF, which is by default. So even if you build a new VRF today in ACI, you would see that it's already configured in the ingress mode.38:31Now, for this architecture, what will happen is that once you start to configure sgts and push them from ICE on the border leaf, once the 1st SGD SGT appears on the L three out.38:45ACI from six.one.two will automatically move towards the egress direction behavior, right? So it will be moved towards the egress enforcement only for the north south traffic. So this will only apply to the north south traffic, not to your east west, west traffic.39:01And the reasoning be behind this is because since you already saw that we are learning/thirty two addresses from the campus and you might be scaling up to thousands of those addresses, so you would want to use the border leaf to store all those classifications on the border leaf.39:17Because the non border leaves and the compute leaves are dedicated and those tcams are dedicated only for your applications. So we don't want to overload your.39:37Compute leaves with the SGT information that is appearing. So we are recommending for the north south traffic once you enforce the 1st SGT, the ACI will automatically enforce the egress enforcement behavior and the policy will be applied on the border leaf.39:47Only for the north south traffic. Some of a few other considerations here, as I as I covered that we are receiving/thirty two prefixes, so you would want to know how many do we support. So with a high dual, a high endpoint scaling profile.40:03We are supporting 64000 bindings on the sgts, so just to know like once you start building policies, so how far you can go, so the TCAM today will support 64000 bindings. Other thing is like once the 1st, once you implement the SGT, so the 1st SGVT when it's programmed.40:21There might be a few packet losses while ACI is building some route maps and change making changes on the BGP behind the scenes. So you might experience a few seconds of packet loss. So it's recommended to always do this activity in a maintenance window when you are pushing the 1st SGT, right? Once it's pushed, then the.40:39The ones that are coming will not have any impact.40:59So some scaling, so we, we, we're going to you can always go on to the scaling guide for ACI and ICE to have to look into more details, but I just want to cover a couple of more, a few items over here where the number of.41:05We already covered the 64000 sgts on the ACI fabric. It's important to note that we are supporting today ten tenants, right? So once you are pushing these two policies to multiple tenants in a total of ten tenants are supported.41:21Today with the current release. Again, aci's vrfs is 50 vrfs, right? And then of course number of endpoints to one ACI fabric to one ice cluster is 20000. So you can go on always and check out more details on the supported scale.41:37To understand better how it can apply to your environment. Just remove this. Just a quick recap before we close. So the overall architectures we only covered today ACI and ICE integration, but the overall architecture consists of multiple domains, so we want.41:55Want to also include in this architecture the campus, if you have Meraki, we want to include your cloud sites or your firewalls if you are enforcing today policy on the firewalls, whether they are in the campus or data center, we want to enforce, this is a complete three 60 degree architecture where ICE will be.42:14Be the relay point for all your, you know, policies to push to different domains. So as we move forward, you would see more invites coming in where we will discuss the integration with other domains as well. So again, before we close, if you have, if you have a one to one consultation need.42:33You need to ask more questions or explore more on this architecture, just feel free to get reach out to us and we'll be happy to arrange a session with you.42:53The this is a part, this sessions are a part of series, right? So we already are through the 1st two sessions, this was the 3rd one and as part of the May June series, Nexus hyper fabric webinar will be available next Tuesday, next week Tuesday, so you can always scan this QR code and register.43:04To this session, and join if you want to learn hyper fabric. So just before we close, I'm just going to open a new poll, survey poll, really appreciate if you can respond to that survey poll.43:24We'll have a, we just need to understand what is your feedback, how we can improve these webinars. Also, we would want to also understand if you have ever used Cisco IQ.43:41Which initially mentioned during his presentation, and if you need any help, you know, onboarding Cisco IQ, it's a very straightforward process, but if you need any help, just feel free to reach out to us. Ahmed, is there any questions that we have like 3 min left? So any questions that you want.43:56To address live or we are good.44:16Oh, I think we are good for now. There was one question in relation to the access on ACI. So, today we looked at how to enforce the policy on ACI. That means we'll implement a contract or SGACL in SDA world on ACI border leaf, so we will need a rewrite access, but if you want.44:19Don't wanna enforce policy on ACI, then read access should be fine, but we highly recommend to give ICE read write access. Now 2nd question is, I'm not sure if we recorded this year. If we haven't, we can quickly record between three of us, myself, you and Henry and share the recording on the.44:39Being recorded so perfect. So can you be available?44:59On the community portal, so anybody who wants to go and check, they can go on the community portal. I believe it's good if we can share the link people have been asking so that'd be good. Okay, sure. Yeah. Apart from that.45:04Nothing else unless if you have any question, please feel free to ask now. Otherwise, hope it was useful information and we highly recommend to look into this how to integrate ICE with different architectures, including ACI.45:20Just to give you a heads up NDFC is coming up as well, into the picture and yeah stay tuned. There will be more sessions on, e.g., if you want to have a policy on SDA or you have a firewall in between, so we'll be covering all those topics.45:40So yeah, I hope it was useful to over to you Sayed.46:01Alright, thanks a lot for joining in guys and we look forward to see you in the next session. All right. Thank you, James. Say did you share the link or we will I'll just share it later. Okay ok that's fine, so perfect. Thank you. Thanks, everyone. Bye.46:06