Nexus Dashboard Day-2 Visibility and Protection

Okay, so let me start Nexus dashboard, right? 1st topic. So when it comes to Nexus dashboard.00:10This is really what's on the screen is really the the heart of the conversations, right? On this slide, you can see answer basically what is bothering us? What are the main day two operations questions, right?00:18Can I get visibility across data centers? What is the problem? What is the blast radiuse? How do I reduce NTTR? How do I prove that my fabric is healthy and what was the issue? Was it preventable? Was it something that there was anomaly in the network that I could see in advance and prevent this from happening? Right, so this is what we are going to.00:33Focus on, this is our day to day two operations tool for data center.00:53For the next dashboard. I'm gonna spend some time addressing the features that we are gonna go through, right? So this is probably not new to you and you might even seen this slide in previous session.00:58If it is new, I'm gonna just do the quick go through, right? So for we have different audience, so I have to address all of them. So as you see, we can put the current feature set into these three categories. Visibility and monitoring.01:14Well, as it sounds, you have the tools like topology capacity planning, connectivity analysis, which helps you to have a better overview of what's going on in your fabric. You have analytics and the correlations where it gets more interesting with anomalies. You can play a little bit more with the anomalies assurance.01:30Endpoints and traffic analytics delta pre change analysis as well, and in advisories and tools.01:50There we get the tools that focus on network, on sustainability, hardware software conformance so conformance etc. So I'm gonna spend 5 min just to go through them quickly as later on carried, we'll show them in the in the demo and I prefer.01:57Always to show it, you know, in a practice practice environment rather than just talk on talk on it from the slide perspective. The 1st one is topology. It's not just a picture of the topology alright? You can see that you have the.02:14You you will see that you have the updated statistics of your fabric, of your switches, of your interfaces, of the endpoints that you have in the network, and you have anomaly scores to each one of them. You have a health, you have a configuration synchronization status and historical comparison of what has been going on that specific.02:30Specific object.02:50Custom dashboards, yeah, as it's as it sounds. You can customize the dashboard any way you want it based on the, maybe all the way that you are using your fabric and you have your use cases or you have some ongoing changes, so you can just position and see what matters to you most to you or to your specific team.02:53What we have now is it's a private and a shared dashboards, so you can also share them.03:13Based on the, based on the access or based on the privilege of the, of the users. Anomalies and correlations, this helps you see what anomalies, what, what has changed, what, what happened in the network and what are the related objects.03:19Right, so you can focus on what's important, what has been affected instead of looking around for every symptom, and it can mislead you, you know, in sometimes. So thanks to these you get better understanding and you reduce, as it says, reduce the NO noise which equals to faster time.03:36To resolution. Okay, staying with troubleshooting. We have the connectivity analysis, this one is one of the most used and most powerful day two features.03:55And it's imple, you just enter the the source and destination's IP or MAC address. Optionally also layer four ports, and next to dashboard goes beyond the trace road. It will add you some forwarding checks, consistency checks, routing verification traffic analytics context, security context, so you can.04:10And also understand the traffic behavior itself, not only the what is the route, what the what route it goes from into, right? And traffic analytics even deeper. And this one can identify services through known layer four ports, right? So it can learn.04:30The connection across the switches and fabrics and go from fabric level down to individual client to, to, to service sessions. So with this one you get very, very, what's the word, granular visibility?04:50For for each connection and it helps you to identify what is the, what are the services in your network, right? If you want to map the services, then you're gonna use this tool. Now, I mentioned we have software and hardware life cycle.05:07Conformance check, is it just check the state of your software and hardware, it validates whether the fabric is within your scalability limits for the specific software version, which is important because sometimes the issue is not life fault, right? But environment is already operating in a way.05:26Which gets you closer to the limits and thanks to this conformance report you get to know that before it happens, you are not surprised the ones you're reaching scalability limits and then, you know, panicking why did it happen and when did it go the direction when the design change in the way?05:46That it's just, just utilizing the resources so much. Then we have a policy calm analyzer. This one helps you show how ACI contracts or NXOS security groups are consuming the, the of the switch.06:01You can see the filtered and historical views when you you will see it as well on the in the demo. In ACA environment, these tools matters a lot because policy scale issue can be easy to miss until they start affecting your.06:20Your normal, your proper behavior of the fabric, right? So policy can is also being very used data analysis exactly as it sounds. It compares two points in a time and it shows you changes in anomalies, resources, and changes in in the configuration. In ACI it gives you object level.06:35XML differences and for NXOS it can show you CLI.06:55Level differences, including for who did the changes and who did the modifications. So it's time, that's the overview of the of the features. It's time for 2nd question which is.07:00Which feature of nexus dashboard do you use the most often, right? So out of these, put us two or three of them from the from the answers so we can see statistically which one are the most used.07:16And with that, I'm sorry. I'll be I'll be moving to live protect. So now I wonder how many of you heard about life protect or expected that we will talk about it today as this is quite quite fresh and quite exciting feature. It came out.07:33Recently actually as a, as a tool which focus on and address the vulnerabilities.07:53And security advisories which might potentially hit your Nexus switches. But not only that, it also helps you to fix them without having any downtime and that's a huge benefit, right? Without any downtime. So as of today.07:59Let's say there is a vulnerability. Usually it's not only one switch which is being affected, right? If you have big fabric, you might have hundred or thousands and you need to set the multiple maintenance windows to do the upgrade, to to test it, to to plan the multiple maintenance windows that with all the stakeholders, with all the teams being involved.08:15And usually that's a lot of, lot of pain, right? We went through it already.08:35Probably all of us. So the way it works with life protect, if or at the moment when there is some some security advisory cisco detected, instead of patching it or doing the upgrade, it provides.08:40Something we call shield. Shield is understood it, understand it as a hard patch which will stop vulnerabilities without downtime, downtime or without reboot. There is NO need to change existing image and it can be applied on the running system.08:56Without any any interruption. And the main reason why are we doing this? Why this tool has been deployed, it's riff on this from this slide, right? Let's say that the customer address some threat, some attack, right? So then it might take few weeks, if not months.09:11To get a new patch version of the software, which mitigates this risk, and for attacker it takes few hours to exploit the network, right? Usually it's show the behavior of attackers that they will stay in the network. They will try to infiltrate more be before they get caught let's.09:29They try to access as much as they can before they do some damage, they create some files to some some directories etc. And that's where the life protect is coming to, to step up step up the in the game, right? So this is the reason why the life protect is now such a hot tool.09:49On the market. So we talk about why now let's talk about how does it work from the technical point of view, right? I will start kind of from, from bottom up from the from the left side of the picture if you if you focus on it. So what we did sometimes sometimes ago.10:05We invested in a company called Isovalent or Isovalent, isovalent, Isoland. So thanks to that, now we can use this and we use the EBPF extended backly packet filter policy, thanks to which we can access and do the changes on the kernel level, right? So, so what we have.10:24Is the tetragon agent, which gonna which we put as a part of our image and we ship it to the customers starting with the version ten.six. And then you have the which is sitting in the user space and it monitors all of the traffic which goes.10:44Towards the current one space. So all we have to do is just to create the policies on this agent and apply them as a field, right? So we do not change their image. Policy will go to to the agent.11:01And then any of those vulnerabilities, if it's control plane, routing plane, file I/O security, they can be mitigated. What else? Usually, yeah, you will get the logs to security management tools and you will get the notifications. So that's normal, and now.11:19Yeah, so you might ask, I talk about this like next to do I need Nexus dashboard? Is it really needed? That might be question running in your head. Answer is NO. Nexus dashboard is not a requirement. You can download the shield directly from Cisco and put it to the device.11:39But today we will show you how much easier it is to control, to apply and configure these policies on the next two dashboard, right? For specific switch and to see how easy it is to to control. She when you ask about the shields, they are released when there is new advisory, obviously.11:54If there is any new vulnerability, Cisco just upload them to the Cisco.com. If you have next to dashboard next to dashboard via inter site metadata will download the, the update. It will push it to the device, to the and the will update its policies, right? So, so this is how it works.12:13It's a huge innovation. We are 1st to the market. There is NO equivalent on, on the market yet, which would do such a level of protection without causing any, any downtime. Okay, what else to mention? Resources. When it comes to resources, it's very lightweight. There is only 0.1 % impact.12:31On the memory and CPU.12:51Because we knew at the end we only monitor what goes to kernel space, so it's pretty, pretty easy on resources. Yeah, and that's it. So in essence life protect is is really a game changer. It's a, it's a it's a great tool. It can reduce operational operational burden.12:54When we hit some vulnerability, right? It helps you a lot. I minimize downtime and you have this proactive real time security for your critical Nexus OS infrastructure. Okay, so that's how it works.13:12The last slide from my side will be what are the supported platforms so as you see, it runs on the cloud scale and silicon one models and from version ten.six.one, there are two modes which will talk about.13:27You have monitoring mode from 1061 and from ten six.two you have the protection and also called enforce mode. And when it comes to ACI support for ACI ACI is planned from really six.three or sixteen.three for the nexus. So now my question is.13:43Did I go the, did I do good sales pitch? Do you plan to use life protect? I mean is this something you would be interesting to use in your, in your day to operations, in your data centers, right? So we will apply the the next questions. You can answer meanwhile, will be doing the demo.13:59So thank you Patrick. Hello, everyone, thanks for joining us for today's session. I'm gonna walk you through our demo on Nexus dashboard. As explained by my patrick, by my colleague Patrick, we have, we hitsy.14:16The different features or different use cases on how we can use Nexus dashboard in day two operation.14:38And he ended that by the live protect, which is our new feature introduced with started from Nexus dashboard 4.2. So I'm gonna walk you through all those features briefly and I will end my demo with the next with a quick demo on live protect.14:43Which is the recent the new features introduced with Nexus dashboard 4.2. So as we can see here, I have two labs. The 1st lab here, ok, is running Nexus 4.2, which is the latest release of Nexus dashboard and ok the previous one, the other lab is running the previous release, which is 4.1.15:02As as we can see here the difference between 4.2 and 4.1 that now we have security advisories, ok, introduced in 4.2. I'm gonna explain more about security advisories, ok, in the life protect part, but now let me start my my ok, I will start, ok, I will start my 1st part in my.15:24Yeah, which is covering the day two operation features on dashboard.15:43So the 1st feature we have, ok, this is our galance, this is our landing page. We have anomaly ok two two windows, one for the anomaly level and one for the advisory level. So if you your entire network, your data center network, ok.15:47Even if it's contain multiple fabrics, ok, as we can see here, e.g., this is our lab, and we have here a several fabrics managed by the Nexus dashboard, which is as mentioned by my colleague Patrick it's a single band of glare of of of of glass, so we can manage our entire data center.16:04Network into and even if we have a multiple fabric using a single management platform which is nexus dashboard.16:24This ok and as we can see here, it give us ok an overview about our network. These are fabric here and as we can see here we have the anomaly level, so if we have a critical anonymous we can for for our center networks, the old fabrics, we can.16:33Critical and we can check, ok, what is the critical fault we have and we can track it. Same here for the advisories. The advisories here is security vulnerability.16:53The best practices into life certifications also it will be highlighted here under the advisory level and we can track and we can change any track any changes in our fabric. Here for the ok one of the added one of the great features we have is the dashboard.17:09Then you can customize your dashboard, especially if you have network operation center for you've for your 1st line engineers, you can or even in your operation center, you can customize your dashboard and put this dashboard on a really screen in your operation center and you can track and many track and monitor your ACI.17:29Fabrics or Nexus OS fabrics or your center network overall using the dashboard. The dashboard here as I mentioned, is customized.17:49And here we have one of the.17:58It can be customized and this is one of the customized dashboard.18:26Example as you can see here, you can hear, ok, monitor your top five fabrics if if you have multiple fabrics in your data center network and have a summary for every anonymous. Anonymous here basically is and I'm gonna explain more about the anonymous, but basically you can consider.18:30As anonymous here is like the fault in the ACI, it's the change in the standard behavior of any objects, e.g., the interface, if the interface is down, these, this is something then standard for the interface, which means that ok and and this trigger anonymous will fault in our nexus dashboard. So the anonymous here, any change.18:50In the standard behavior of the objects. The objects here is interface is a switch.19:10In points is whatever we have. And also here we can also track the conformance of the hardware and software. We can track our interface utilizations and this is key changing by the way every 10 s we can see here. So it's the the the table here, ok, is listing the five two.19:15Utilized interfaces and this can be changing and updated every 10 s, so we can move to the interfaces ok we can into the CRC errors on the interfaces, and as I mentioned, ok, this can be customized as we can see here, ok, if I go to here.19:35New dashboard. We can here select the the ok these some templates already existing rebuild templates, so we can use these pre built templates or we can create our template. E.g., ok, if we have this already template created.19:51We can add here, ok, we can still can customize this template which you already created we can change the design by doing edit layout, so we can change the size of the window, the location of the window as we can see here move it here.20:13We can move it here, change the location of the window, ok, we can add a widget, the widget, ok, every window here in the dashboard we are calling it widget and we can add a different widgets here. E.g., I can add a widgets to the.20:29Interfaces here we can go to the scope here can be the fabric, the switch by interface, we let us keep to the default, which is.20:49Fabric. Here our fab the fabric name and we can track the utilizations of the interfaces of this fabric. Okay, also we can track the CRC errors inside this fabric. We can track as we can see here, it's give us the list of interfaces with CRC errors. We can track the buffer.20:59Drops, we can track the receive drop, we can check the receive and transmit utilization, we can track the receive and transmit rate, also can the appearance here can be changed, ok, from table to line chart.21:19So as you can see here, we have, ok, we can add more widgets, more windows to be monitored inside our fabric and we can put that in our next in our network operation center. This is one of the added value or one of the great features we are using in the for the dashboard. Also, we can hear.21:41Most of the fabric and manage the fabric itself if we have a multiple fabric in our data center, so we can access the fabric from the fabric menu and here, ok, get inside the fabric. We will have this.22:02Okay it's same for every fabric and here we can manage the inventory of the fabric itself, ok, these are controls these every control we have these running version and these are the serial numbers these model number. Also we can manage the switches ok this fabric, and as we can see here, these are serial numbers, these out of band management interfaces for this.22:14Leaves, these models, these are rules for every switch.22:34Also here for the connectivity, we can check the connectivity, ok, we can check the check the interfaces in every switch we have status, ok, if it's operational or not, if it's admin up or not.22:40If it's healthy or not, and we can also hear and we can hear as as we can see here we can filter based on the operational status ok we we can check only the up or down interfaces. We can check we can filter based on the interface time type by double click on the interface byte, so these are the loopback, this is a list of the CVI interfaces, e.g.23:00Building is a list of the tunnel interfaces we have.23:20For the layer three neighborship as well, ok, it gives us all the layer three neighborship orders for the routing across our ACI fabric for the underlay and underlying network and overlay network and the status so we can have an overview about the status for every layer three neighborship, also we.23:24At least for us the endpoint, ok, the servers connected by fabric level and we can check ok the ok get informations where these endpoints connected to which leaf under which tenant under which VRF and the encapsulation be ran.23:43So can collect all those informations for the flow collections I'm gonna explain more about it later, ok, when I'm when I'm gonna cover the traffic analytics. Also, can you hear you check the anonymous and the advisories, ok, and I'm gonna explain more about the anonymous and the advisories, but we can check the anonymous and the advisories per fabric level.24:00Now I'm gonna move to the anomalous. As mentioned by by Patrick ok he ok we we had the dashboard which is one of the great features we have so we can customize our dashboard on our network operation system and as a.24:26Same time we have the anomalies. The anomalies here as I mentioned, ok, the anomas here, we can reach out to the anonymous for our entire data center network, not the fabric level through the analyze and under the analyze menu we have the anonymous menu. In the anonymous menu, it gives us the, ok, all the faults under our data center network, ok.24:46For all fabrics together.25:06And as you can see here, it's it's a group that together and give a category for every for every for every group. And we have as we can see here, let me go to this one ok we have a several categories as we can see here ok can be configurations. So if the fault was anomaly related to a configuration.25:07Issues. It will be highlight under it will be raised under the category configurations. If we have routing issues cause an outage.25:28Okay it will be raised under the connectivity category. If it's related to the telemetry configuration on the switches, it will be released under the telemetry and telemetry configurations. If it's related to hardware failure it will be raised under the hardware failure. Also, it's we have a C level, the critical heel is mean it's an outage. We haven't mean.25:35Get impact due to this anomaly this fault. Measure it's mean it's potentially can cause any impact at any time that's that's why we need to work on it and be proactive and fix it. Warning it means it's just few informations ok and it doesn't have any business impact and you can ignore.25:55And as I mentioned, ok, here as we can see here we have the the correlation column. The correlation column here, one of the added value we have from the access dashboard. E.g., ok, if we have an inter anomaly related to an interface down, this the interface will getting down, it.26:13Those might it might be causing outage in the routing and the the neighborship working on top of this interface will will will will will be down. In this case it it will be triggered another anomaly.26:33Okay, so the main trigger is same, which is we have interface getting is done, ok? And this interface goes two anonymous, ok, connectivity and at the same time neighbors should down. So it correlates between the two anonymous as we can see here in this column. E.g., we have interface on one of the spines, ok, interface ethernet one/thirty two is down.26:47And, ok, when there's a correlation here, ok, correlated anonymous here as we can see here, we have an OSPF neighborship is down due to this interface ok failure. So the interface failed, which triggered OSPF outage as well.27:07So when we are fixing the interface, the OSPF neighborship will be fixed automatically. And these ok and this one with the value, ok, we are getting from Nexus dashboard because it's categorized the faults or the anonymous we have and correlate between them if the the root cause is same as we can see here.27:24And here as we can see here, these are the root cause of of of the alumna which by solving this alumna will solve the correlated anomalies. The other, ok, added value we have from the advisor ok from the dashboard running Nexus dashboard in our data center network is the.27:43Advisories.28:03The advisories here, let me switch to the other lab because we have other advisories we have multiple advisories here. So as we can see here, ok, the advisories here is not, we are not sharing with you only ok the security vulnerability hitting your system. We are not ok but we also share with you the best of practices. We.28:04I'm sharing with you any software for hardware or software, any field notice, any bug hitting your your code. So basically, ok, if you are running the configurations, if you are running the code, ok, any security vulnerability, any bug, any.28:24It will be shared with you automatically, but in order to have the updated signature from the security vulnerability and the bug and the notifications, ok, we have two ways, ok? The 1st way here, ok, that we need to be connected to Cisco intersight. But if we are not connected to Cisco inter site Cisco cloud.28:44And we are getting the other option we have, ok, is that we can install we can we need ok we have a look a file called called a metadata file.29:04We can reach out to this file from the admin menu, system setting under the system setting on the right hand side here, we can see the metadata file. In the metadata file as you can see guys, ok, this file is keep updating by Cisco and we can download it from data center application center file. If you have cisco.29:13Account, you can look into Cisco account and you can request for the new metadata file and you can update your Nexus dashboard.29:33Okay your metadata file. So it's pretty straightforward and it's highly recommended to do that at least once a month to track the metadata file and update it if you are doing that manually at least once a month, the recommendation from Cisco.29:41And as you can as I mentioned guys, ok, the metadata file, ok, is the file we are keeping the signature of the security vulnerability of the bug, the notifi the end of the best practices information. Let me go back to the.29:58So as you can see here, ok, we have here different categories, ok, the security here is means a security vulnerability, best practices, it means that it's a recommendation it's a configuration recommended by Cisco to be activated in your system and you are not activating this configuration yet, which is ok that's why we have the warning, ok.30:15And as again, there is the practices and not something causing an outage but something improve.30:35Your system enhance the security of your system. Ok, and again and you can filter by category level so if e.g. you can filter based on the end of life notifications, you can, filter based on the list of practices category, you can filter filter based on the security vulnerability.30:40Let's.31:00Other ok the other features ok covered by my colleague Patrick as well is traffic analytics and connectivity and the delt. Let me start with the traffic analytics. Traffic analytics basically one of the great tools give us insights about.31:06The traffic running on on our data center. So if we have a traffic work going through our data centers, give us insights about the traffic those traffic about those flows, and it helped us to troubleshoot some some many applications performance issues especially if it's related to the leading.31:22See packet drops condition so we can track any service deviation, any application performance using a traffic analytics. What is the traffic analytics? Basically, the traffic analytics is the evolving of the flow telemetry.31:42Okay, what is the flow telemetry? The flow telemetry is the hardware version of the net flow. So basically in the old on the old network times we used to have the to track to track the talkers to track the flows across our networks but ok and we moved to the flow telemetry which is.31:57Send by the forwarding engine or the hardware of the switches, not the software, that's why it's give us a big scale, ok, up to 10000 flows per second. And there was the traffic analytics, the traffic analytic is the evolving of the flow flow telemetry because it gives us, it can cover up to 200000 flow.32:18Per second, which can cover a big scale network and give us insights about ok about more traffic running on top of our network.32:39The traffic analytics here, as we can see in my screen, ok, it's categorized ok categorize the traffic we have running ok the traffic we have in our network, based on the standard or the well known ports for TCB and UDB, source for the whole known applications.32:50Okay, like the web traffic like the well known ports, ok, applications is already it's already identified in the in the category in the next dashboard, so don't need ok it's automatically will match our traffic based on.33:09Those categories and categorize the traffic. If we need to customize ok a new type category of traffic, we can do that. You ok based on our business need and ok we can do that by going to manage the new fabrics.33:29In the fabric we have, ok, this is the fabric and ok we can access the fabric and go to action and from the action we can go edit fabric setting. In the edit fabric setting, ok, as we can see, we can go to telemetry and in the telemetry here, as we can see here, ok, the traffic analytics is supporting.33:49On ACI 6.1. So if you have Nexus dashboard, ok, it doesn't mean that it will be the will be supported through ACI fabric unless it's running 6.1.34:09And later releases. So for any ACI version before 6.1, the traffic analytics is so supported. However, we have a alternative which is the traffic analytics compatibility. The traffic analytics compatibility here, ok, is used for the versions before 6.1 and it give a.34:21They give us the traffic analytics with limited capabilities. E.g., the traffic analytics not ok give categorize our traffic.34:41Into civil applications and also it give us it measures the performance of our traffic based on the latency on the drops and condition but with compatibility options, it gives us information about, ok, it measure our traffic based on the condition only, not measure the traffic drops or the latency.34:50Also it doesn't support the flow telemetry if we are activating the traffic analytics compatibility. Now we can hear, ok, managed service categories as I mentioned, these ok, I will define categories based on the TCB port will known TCB and UDB ports if I need to add.35:11A new category I can go to actions, new category, here, ok, I define the TCB or evb poor and and define the new board which is used in our network and put a name for this new applications.35:29Now let me go to the traffic analytics. Is this the traffic analytics, so again as I mentioned, ok, it gives it classify the traffic, the performance of our traffic based on the latency congestion and ok give us categorize the traffic and so we can use we can.35:52E.g., I did five based on these charts that most of our traffic is a storage traffic.36:12Okay, around 45 % for our traffic is source traffic. And we have around 25 % of our traffic is database traffic and we have here in turble, ok, around 10 % of our traffic is gaming and so on.36:18Also, we can use the traffic analytics to troubleshoot the, application performance. How we can do that? E.g., if you have a service and this service running on one of your servers and ok it's misbehaving or you have a service degradation issue for this service. In our example I will.36:35Okay, we have a web server and this web server, ok, has a service degradation and we need to investigate why we have a service degradation for this web service. So basically you can go here.36:55Okay, under traffic analytics and filter based on the inputs, the inputs here is the server and these IP address of the server which is in our case 1702 to sixteen.027. As as we can see here, ok, we have here this ok the service running on this server is 8080.37:05Which is our service as we can see here. These are current informations, these are the leaf ok attached to the leaf two which is attached directly to this endpoints and the category is web service as we can see here. When we double click on the service ports so because now we need to identify which client.37:25Is speaking to this server on this service port because we have a service degradation as I mentioned. So double click on the service port here, at least for us, a list of the clients communicating, ok, to this server, ok, on this service.37:42We will use the 1st one, e.g., which is 1702 to sixteen.zero to three. Okay, give us informations about the client, ok? But we need to track the communications, the flow, the traffic flow between this client, ok, and this and the server.37:57On this service port. How we are doing that, we are going to the flow collections and here ok we have already a historical record we can track or we can ok as we can see here.38:15Oh, we can hear ok this is a client. If we go here ok go back here to the client and click on the three dotted here on the right hand side, we can't start to track a new flow collections.38:34Between the client and the server, but if ok if we don't have traffic currently traffic running between the client and the server, we can start to check the flow collection, ok, using the historical data, the historical record we have. So we'll go to the flow collections here.38:51And these are the the the the record as we can see here and ok we have here the list of the flows between the client historical records for between the client and the server of this service.39:11We can classify classify this flows based on the backend drops and latency. Okay, e.g., ok, it doesn't make any sense to check any flows, ok, without packet drops, so we will track the, the, the, the flows with a top.39:27Packet drops, ok? And these it's list for us here so we can rearrange the flow the flow records based on the backend drop indicator as we can see here. Now I'm gonna double click on the flow record to get details about ok why this flow record has a drops and as we can see here, ok, we can.39:42And basically, ok, we're using a very simple GUI interface have an end to end topology between the source and destination and identify which leaf misbehaving and identify ok by clicking on the leaf here, which is highlighted in in orange, which means that we have a measure fault here ok that as we can see here, this is a measure fault.40:01These hitting this leave. We have a buffer drop, ok, and this makes sense for us, we have a buffer drop drops the brackets between the source and destination and the racket drops here causing for us any ok a performance issue, a service degradation issue on the web service we have in our.40:21Network.40:42This is one of the use cases we can use the traffic analytics to identify the flows we have to track the service performance issues we have in our data center. If we have a connectivity issues, we can use the connectivity features as we can see here. The connectivity features here, it's it's not only three is the connectivity between the source and distribution.40:44It's also trace the traffic through the switches, through the hardware of the switches. So ok through the feature, it takes a snapshot from the hardware for the decision of the switches. So if, so if we have a link failure, if we have a failures, it will be on.41:06Identify if the racket reached out to the switch and the switch is drawing the traffic due to a forwarding issue, a forward hardware forwarding issue, it will be highlighted as well through the ELAM.41:25That's why, ok, the conductivity analysis is not doing a standard troubleshooting using the it's also it's combined that with the ELAM, which is the forwarding decision on the switches itself. So as we can see here, ok, this is one of the examples here, ok, between we have a source 01:32.41:3516 to two to six and the destination 1702 to six sixteen.two to seven, and as we can see here ok.41:54That the ok we have into we don't have any issues and again ok the Elam need a bucket to be received by the switch in order to be triggered. Okay, so as we can see here the ELAM is triggered and we can track the result here using the data blame.42:03Data plane, and as you can see here give us informations about the source and destination MAC address, source and destination IP address, and also give us if there's a contract, give us informations about the contract outputs, the index of the contract, and all such informations.42:24How we are created is pretty straightforward, we can go connectivity, new analysis, and he put the source IP address and destination IP address and run the and that's it.42:43This one for the connectivity, so we can troubleshoot the connectivity using the connectivity analysis tool troubleshooting the performance issue using the traffic analytics for the ok if we have an outage and we don't identify well ok and we need to track the changes in our fabric and we need to identify, ok, what.43:00That's the trigger or isolate the root causes which triggers the outages in our data center, we can use the data analysis. The data analysis is ok compare a two snapshot for for for our network.43:20Okay, one before the outage and one before after the outage and give and give us the changes, ok, between the two instances so we can be basically quickly identify what was it changed in our network and trigger the out the outage. So basically, ok, you can go to click data analysis.43:33And he put a name which is ok inside series and here check the fabrics and here, ok, take, ok, take snapshot and here the ok you can select a healthy.43:51Which is the healthy snapshot before the outage, ok, which will say ok this in the stance is healthy and ok take an the latest one which where we are experiencing outage right now and then next.44:08And then save, this will trigger the analysis. And here it will take some times ok to do the analysis. Is it ok we have some reason here as we can see here. Okay, e.g., ok, this output.44:26Okay we have two views, the Health data and just give you ok what ok the anonymous before and after the ok that the outage or the change. E.g., ok, what was it changed before and after ok that we have now new anonymous. As we can see here the.44:44Two two new anonymous is measured and we have a duplicate IB and those two duplicate IB cause an outage for us connectivity issues for us. So we can start from here, track ok that now ok what was what what the what what what is the new in our network that we have two duplicate IB eleven to eleven.eleven.one ten.ten.45:03And the two anomalous and those duplicate IB cause an outage for our network so we can track the issue from there and identify the root cause of the outage.45:24Okay, also if we want to track the configuration change, ok, if we are suspecting ok it's the outage related to a specific tenant in our, network, so basically you can go to hereports, ok, and here search by the object name, e.g., the tenant name which is test.45:36E.g., and it will give us, ok, highlighting for us in the viewer ok the the changes related to this objects. The changes related to this object is highlighted in red if we are if if we have a configuration delete related to this object. If we are modifying a parameters, ok, for this object, it will be.45:54Highlighted high highlighted in in orange. If we are introduce a new successful configuration related to this object, it will be highlighted in green.46:14Here let me ok also ok so we can track the changes from the middle. We can search based on.46:25To track any configuration change related to the objects from the, from the windows on the left for ok the one on the right is the audit log. So we can basically ok identify which which ok who who who done who has done the change and when done this change, so we can.46:44Identify what was he done what what what was he done? When he did that change?47:03And, ok, who the who did the change? And so we can track any configuration change trigger the outage. E.g., someone had a filter on the contract stop the communications between the two between the two ebgs, so we can identify who did the configurations and when did when he did the.47:09Configurations and what that's the configuration which filter he adds so we can e.g. fix that quickly and recover our network from the outage. So as we can see also the analysis can be used for other several functions. E.g., if you are doing a new configurations and you need to service before and after the.47:29Integration so you can basically start ok do a data analysis, ok, after then after after the change management windows. So we you can compare the changes between after and before the new configurations and make sure that you are not hitting any outages. You don't.47:49Type any changes in your fabric, you are not ok e.g. if you are adding a new new bridge domain, configure.48:09The subnets overlap with other bridge domains, this might be a causing outage so you can identify that using the data analysis, ok, by validating the new the new configurations after, ok, by taking a two snapshots one after the change and one before the change the change.48:18One, ok, one of the other features we are we have in the as mentioned by by Patrick is the olcan. We can track, as we can see, as you can see here guys, we can track our TCAM utilization, our policy can.48:40Utilizations ok using the. E.g., we have here ACI fabric.49:00Okay, and as we can see here, it can be classified based on the talent, provider talent or consumer talent or provider or consumer. And basically as we can see here, ok, most of the tables here, ok, we are utilizing 58 out of 88, which means that we are not utilizing more than 04:50 percent of our utilization.49:06Which mean that we are in a good shape, we are not exceeding overtizing our tcam. And ok so we can so if we are reaching to the limit.49:26Okay, this might cause an outage and impact for us so we can take our proactive actions ok if we are running towards the limit, but in our case now, as we can see here, we are not utilizing the 50 % of the which we are in a good shape in a good shape. Also, we can filter based on the note, ok for.49:37Example we have leaf one the leaf one TCAM is 188 and we have a 94 entries out of 188 which means that we are utilizing 50 % of our TCAM utilization in the list number one and leaf number two, which means that we are in good shape and we are not utilizing or oversubscribing.49:58Overauthorizing our our fabric.50:18Also at least for us, ok, here, the number of the, the, the policies and the the ok if if we have hit hitting our policies it will be counted here and the action related to every policy, so we can check from here our policy if this hit count here hitting our.50:22Traffic hitting our policy, it will be counted here as well.50:42Last not the least is the conformance. We can hear also ok have a view about our hardware and software conformance. So basically if ok the hardware and software conformance, ok, it just makes sure that you are not running all software or hardware in your eh data center network. So basically, ok.50:51We have end of life notifications, ok, it's very the end of life notifications against your hardware and software, and it's counting down, ok, the the life of your hardware against this end of life notifications so basically ok here we have a three warning devices as we can see here. If we check here, ok, it means that we have.51:10Okay, we are spent around 152 days after the end of life announcement. Okay, so e.g., ok, that's why it's warning. If we are spending, ok, if we are now consuming 300 days after the end of life's announcement, e.g., it will be the the status here will be changed for measure or critical.51:30So, ok, when we are moving toward towards the end of life the end of support date, ok, as a status here, the control status will be changed from warning to measure to critical.51:50But as we can see here, ok, these are our hardware conformance and these are software conformance. Our hard co harder hardware conformance as we can see here, ok, we have 80 devices healthy and three out of them are running and they are heading into five certifications, and as we can see.52:06Yeah, as I explained, ok, we already ok we already have hundred 52 days after the end of life certifications. For the software conformance, ok, we don't have any.52:24Servers or Eric server or switches ok and our all devices are healthy and and they are up to date in terms of the software.52:39Okay. So these basically, ok, I I show you ok a quick demo on all the features mentioned by my colleague Patrick and we can utilizing all those features and use case, ok, in our daily business routine in operating the.52:59ACI in our day two operation.53:19Now I'm gonna move to 2nd part of my demo, ok, which is which is life protect. And the life protect, ok, the life protect started started to be supported from 4.2, as I mentioned, and the difference here in ok the section here introduced in 4.2 is the security advisories.53:24Subwindow. So in double click double click of it, it will take us directly to the security advisories.53:43Okay, and as we can see here, we have a list of the new advisories hitting our fabric and as we can see here the means that ok this vulnerability already active in our fabric and the life protect shield here is not available. It's not available, it means that it doesn't have any fix.53:52That's why it doesn't have any fix ok and the shield here is this is a so and as mentioned ok and explained by Patrick, the live protect here, ok, is introduced with Nexus was starting from Nexus OS six point ten point 10.6 .2.54:12And with nexus dashboard 4.2. So the minimum Nexus OS release supporting the live protect is ten.six to two and starting from support and we can automate and run the live protect using nexus dashboard starting from 4.2.54:32Why is starting from two because two has a software module called agent. The help us to install the batch, ok, on the fly, on the spot without need to remove the switch, without causing any impact, without need.54:50To have a min test window, and this is the added value of the we don't need any more test window, we don't need, ok, a switch reboot in order to activate a fix for a security vulnerability, ok, with agent running on the agent on running.55:09I started from six to two. We can ok on the spot install the batch.55:30For the security vulnerability without need to have to do a reboot or investing anything of the switch and we can do that in in that in the normal business hours and ok and we can use nexus dashboard to activate the fix for this for the for the for the security.55:36Okay and enables the live protect. The live protect features we are ok on the switches or nexus OS switches, we are calling it NX secure. And it's need to be activated on the Nexus OS. How we are doing that, ok, we can use that using the devices.55:57Menu, we can switch to the devices menu on the nexus ok here in the device security and by the way, you can reach out to the device security menu directly from the device security. Manage device security. And this introduces I mentioned, is starting from 4.2.56:12Okay, here we have a list of the devices, ok, and as we can see here in the live protecting menu, ok, this is not enabled, which means that it's supporting the live protect because it's running as as you can see guys Ten to six.three, so it's supporting the live protect and we can activate the live protect on the switch, ok.56:27All activates any Nexus secures features on the switch using ok.56:47We have other switches here, ok? They are in ACI version and also it might be on versions older than 16 to six. They are not supporting the light protect features. It means that the running the current running code of those switches isn't It doesn't have at the it doesn't support.56:54Okay that's why it's it's not supported the life protected feature.57:18So it's not supported. It means that we need to upgrade the code on those switches in order to have the life protect supported. Now we have two switches now, ok, they have the live protect features, ok, supported. Okay, we're gonna enable the the life protect features on the switch by activating the feature and execute on the switch. Okay, how will.57:23We're doing that basically linking the switch and enable.57:42The live protect. Okay, as we can see here, it's enabled now. Also here, ok, we can track the vulnerability by switch level. Okay, if we have a multiple fabric by fabric level, if I have a multiple fabric, we can access the fabric as we can see.57:46Thank you Patrick. So as you can see here, ok, we can go to the advisories, ok, and as you can see here, ok, in the advisory we have the status of the ok of the the status here. Active, it's active in our fabric, protected means that we apply the small or the batch on the or the shield on the devices. If there's NO ok.58:04Yeah, ok, if the if there's NO small or shield available for this for this.58:24Advisory it will be not available. The devices here, ok, we can also check the list of the devices ok we as I mentioned, we can enable the devices from the devices menu and check which devices are supporting the live protect or not.58:30Okay, I already show you that, that's why I'm gonna skip this part also we can filter based on the devices, ok, not enabled, so can list all the note enabled features devices and enable all the that I protect on all the devices automatically.58:49Okay, together. So as so we can use filter by attributes team to filter based on non enabled and enabled them. And as you can see here we already enabled them, also can go with ok and do it fabric by fabric if we have a multiple fabric inside our network operation center.59:07So as we can see here, we are going, ok, we can select the fabric and it will list for us the devices which they have a live protect already shield ok available and also the list of the advisories hitting those devices. So we can, ok, switch between the advisories and to check which one, ok, of.59:24Okay, which devices already we have a shield available for it and we can activate the shield or the the batch. We have a three mode as we can see here guys. Okay, we have the note, we have the we have the disabled. Double check the note it means that go ahead, apply the policy.59:44Install the fix on the switch and protect the switch from the attack. More to note it's some customers they have concern about the the impact of the applying the smooth or the batch on their network. That's why they are preferred to 1st ok applying the policy without enforcing the policy. So.01:00:03So yeah and they will apply the fix without without enforcing the, the, the fix and prevents the traffic.01:00:23Okay with and this is what we are calling it a monitoring mode. So any head or ok for the for any head for this security vulnerability it will be recorded in the headcount. However, will not take any preventive action in the monitoring mode. The disabled here mode.01:00:31Will disable the security fix or the batch. Now we will go back to the security advisories. Okay, we have we will access the advisories which is double seven 80. Okay, and as we can see here, ok, we have two devices, as we can see here, we have the light protect is.01:00:49Features already activated on this on this switches and now ok we and we have available ok for this ok for this security vulnerability, ok, but go to deploy and deploy select protect mode, we will we will be activating the fix on the.01:01:09Switches on spot, ok? On fly without having an outage without without rebooting the switches and we can do that in the normal business hours. And this automated using without any manual manual intervention, without without the need to go to the switches and activating the small manually.01:01:29As we get ok without we are selecting the protected modes ok and now it's deploying the protected mode as we can see.01:01:48That will take the the batch.01:02:07And as you can see here, ok, sorry, it should be protected sorry.01:02:13Okay, sorry yeah we skipped this part ok the answer yeah ok and it will be ok the and the status will change it from available to protected. If we decided to go to the monitoring note.01:02:31The more here as well ok it will as I mentioned, it will be applied the policy without enforcing the policy, which means that ok we will ok our system will be exposed to any attack, However, we will track the attack without applying any preventive action.01:02:47We'll go to ok and if we apply the as I mentioned in the headcount any attack will be recorded again ok in the headcount and after applying the as we can see here.01:03:05Okay, it's deploying now. It will be the status here will be changed to partially protected. So if we apply, ok, if we if we apply the protected note, it will be protected. If we apply the monitoring note, it will be partially protected. Active it means that ok we have a shield available and the security vulnerability.01:03:26He is active in our systems without having a fix applied till now.01:03:46And as we can see here, ok, if we go to the availability itself, we can we can check, ok, we have two notes, one we apply the protected note and 2nd one we apply the monitoring the we apply the monitoring note we can go to.01:03:54Okay to do the same as we are doing from the security advisories menu, ok, we can.01:04:14We can go, ok, we can double click on the fabric itself and it will list for us the advisories hitting our fabric and the devices impacted by by every advisory, and we can from there apply the protected mode or apply the monitoring mode or disable ok ok or disable the.01:04:20Field if it's applied and we find ok and when when when actually we we disable the the shield if sometimes ok the customers feel that I have an impact since I applied this batch, so I decided as a proactive to disable this one, this, ok, so we will go.01:04:40Select the device ok inside the security vulnerability and deploy and this you will apply the disabled option as we will see now in my lab.01:04:58As again as we can see here, ok? Here it's it was partially deployed and these are disabled and here we can again, ok, we can basically do that. Okay by selecting the vulnerability and deploy and then disabled.01:05:18As we ok as we can see here, the now the vulnerability has been disabled on this switch. So it means that we are disabled the shield, disabled the batch on the switch. So basically, ok, you can using the life protect ok to track the security vulnerability hitting your system, ok, apply the fixed.01:05:40New spot without need to have a link test window to ok in doing the business normal hours without having impact on your network, your, your switches and ok and you have two options for that monitoring or protected note. Also, if after a while you experience impact.01:06:00And you are suspecting this in but due to the batch, you can disable the batch is right right away from using Nexus dashboard without the need to to access the switch and do that manually.01:06:20And with that being said, if you want everyone I'm gonna conclude my demo. Ok, I I brief you quickly about the several use cases for next dashboard and all these two operations and give you a quick demo on the live protect. Ok, I'm gonna give back the board to my colleague Patrick to reca.01:06:30Yep and thank you everyone for joining us once again. Alright.01:06:50I'm sorry we are a little bit late. Let me just close the session. So for all the sessions you already have seen, we went through what we went. I hope you took a lot from data operations and life protect. There will be summary of the sessions coming towards you. There will be also a questionnaire coming towards you with few more questions about the session.01:06:55And, interesting questions about what is the the usage of the Cisco solutions that you have. If you need one on one consultations reach out back. We can, we can always have it. There have been some questions in the Q and A very interesting, thank you so much for making this more interactive for us.01:07:12I think we managed to answer them. One more thing, there are three more sessions for, for May and June planned all of them super good sessions with dashboard micro segmentation. ACI with common policy and hyper fabric solutions. So this.01:07:28Let's say two months, very good sessions if you want to join them, I'm gonna be sharing the link in the, in the chat and Slido as well so you can take it with you. And that's it from our side. Thank you for joining today and see you soon for the next session.01:07:48