SD-Routing and UX 2.0 migration: Driving operational simplicity and enhanced user experience

Good morning, everyone. Welcome to the export insights series.00:10Today we have SD routing and UX two dottom migration, so the session will be focused more on driving the operational simplicity and enhanced user experience. I'm Akshay Savan, your host for the day.00:15Next, please. Thank you. Just a quick introduction about our presenters today. So we have Satish Ami. Satish has an overall eleven years of experience in networking industry. He's worked in routing and switching and wireless technologies and now engages with customers on Cisco Catalyst Center.00:31Cisco SD WAN adoption. He also holds ccie enterprise certification.00:50But now with the is a customer success specialist at Cisco with eleven years of experience in networking, specializing in wireless and SD WAN technologies. She is dedicated to delivering seamless solutions and empowering us to achieve their goals.00:56Before I hand over the presentation over to, Padma, let me cover a few quick logistical items. During today's session, you will have the opportunity to ask any questions you might have about Cisco SD WAN.01:14Just type your questions into the Q and A panel which you can find on the right, the three.menu on the right side of your screen. You can also use the hand icon to raise your hand and one of our panelists will respond. Please lower your hand once your question has been answered.01:29For any unanswered questions, there will be a Q and A with our experts following today's presentation. If you're having any audio issues, please use the chat panel and one of our panelists will assist you. And with that over to you Padma. Thank you.01:46Hello everyone. Good morning. So we're here to discuss on the UX two.O migration and followed by which we'll be covering SD routing. The agenda for today is like we'll completely take a look at the configuration management and what is the change that we see from UX one.O to two.o. And we'll see the.02:03Such as the config groups or the feature, their feature profiles, the policy group and the network hierarchy and all of that.02:24And we'll go through the flow of, we'll have a deep look into each of the feature profiles identifying what they carry and how they've been merged. And followed by which we'll have Satish to cover the routing, the overview of it, the configuration part along with the licensing overview.02:31With that, I'll quickly start off with the configuration management evolution. How we have started this deck in specific or this picture, what it mentioned is that it is showing us the difference as to what it was and how it looked in the UX one.two and what we see and what's the changes in made.02:48Primarily in the UX one.O, it was mostly like the CLI template based and we did not have the flexibility to have one configuration done and used everywhere. It was more of device feature templates and policies and so on.03:08But wherein in we've simplified that and we call it just configuration groups and policy groups. And, and these configuration groups are made of number of feature profiles and these feature profiles, the advantage, the primary advantage of UX two.O is these feature profiles can be used in multiple config groups.03:24So that's what the evolution shows. The UX one.two has CLI templates, device feature device the feature templates under the policy groups, wherein ins configuration and the policy groups only.03:43How it has been simplified, how it saves a lot of time we just put up or we'll explain or we'll go through each step. The process is simplified in such a way that all your day zero and day in operations are streamlined the entire life cycle or the initial onboarding process.04:00Classified just to day N and day zero through which all that you'll have to do is go through the day zero process, whether it is the workflow or the configurations that you do, and there are like preset of there are a set of configurations that are predefined. You can use it or you can have the configurations done on your own. Now, you have the flexibility to test the con.04:21Configurations in in a controlled way.04:41Or for a lower risk environment before you deploy. And we have aligned the look and feel of the Cisco product which means the look and feel of UX two.O has been made similar to other Cisco products that we've been using so that we carry a uni uniform or a seamless experience across the portfolio.04:43Now for the best practices, we've embedded a smart default or the user actions to help you work more efficiently and to give you more suggestions or to, you know, provide you a lot of best practices. What is it and how it is achieved? We'll take a look in the following slides.05:03So starting off with the configuration group, configuration groups are here are like a local grouping of devices that can share a common purpose. Say e.g., we have one device and the van device is present across multiple sites and maybe as you can see in the picture, you have a config group where.05:20Now, previously with respect to UX one or two, if you do a set of configuration or or it would be specific to a device or you'll have to do a separate set of configuration when you do it for a different site. And again for the same device which soonest serves the same purpose in a different.05:41A site maybe you'll have to do the configuration all over again. But wherein when it comes to UX two.O, you can use, you can attach a device to a config group and each of that feature person you can use it in both the sites as for your requirements say e.g..05:58As you can see in this picture, using the basic profile, the VAN profile and the land profile. Each of this can be assigned to both the groups. So there's NO restriction any longer that if you create one profile, it has to be used only to one group. That is being changed as you can see here.06:15Similarly, the feature profiles as I said, they are flexible, we call them a flexible buckets, which means I can, for the same config group, for a similar set of configuration, if I'd like to change any set of one specific set of configuration, maybe the system profile which I wanted to change, I have the option to change.06:32Specifically the system profile alone in this specific group and I can still use the same set of configuration.06:52For a different device that's been made possible. So this is quickly the workflow as to how the approach into UX to has been changed. In terms of defined in terms of network that you see, you define the network hierarchy in the system construct as to.06:59This the configurations that are specific to the timezone maybe the NTP server or the AAA server, all of this can be done here. The configuration group again, it creates the configuration workflow and it creates a configuration group. Also we have two different approaches within this alone.07:16And the applications, you can define customize your application as per requirement policies, again, you can define, you can create the policies and you can map it. Topology. Here you have the flexibility to define the topology and onboard the device and add the tag to it and you'll be good to go and deploy. Deploying is easily done again in the same configuration group.07:33As well as the policy group. You have the option directly to attach the device to it and then you can proceed deploying it. We'll take a look all of that in the demo. This is a pictorial representation of what has changed from UX one.O to two.O.07:53That previously it was the templates or the device of the feature groups or you have localized policies and centralized policies, wherein here in the we call them configuration groups and policy groups and topologies yeah again this is how the configuration groups are being.08:12Marked.08:32For in within a config group, we have system profile, transport management profile and service profile, all of this would go into one single config group, and that config group with all these configuration can have a device attached to it. Similarly, you can use the same set of system profile transport and can form another config group too.08:33That's what the diagram indicates here. Yep, the network hierarchy, as you can as you can see from this picture, this network hierarchy, this feature allows you to build and customize the hierarchy that.08:53You know, mirror exactly your local or geographical location. However, you have your, your environment which is built up, however you have your devices mounted exactly the same way you have the ability to build the structure within the UI now. That's primary difference we can call in the UX two.O.09:10So which means you can easily organize the hierarchy in which the region or the area or a specific site. You have the flexibility to put them in the same order how you have you created in your local network diagram maybe. And this makes the process of handling it and automation easier.09:27And also not just that as you can see from picture, you have a lot of system IP pools. So to manage this, we have few of these parameters which can be assigned to it, which is the system IP, the site IDs, the region IDs. So all of this makes the process of identifying them, mapping individual conflict to it easier.09:42So this is about the workflow, so when we have a separate set of configuration maybe, we understand that every team maybe there are scenarios where you have your configurations that's already done.10:06There are scenarios that you want to do it completely manually. There are scenarios where you want to export and import your configuration. All of this would be made possible. So the 1st one is the workflow. Using the workflow, you'll have the flexibility just by clicking on the next, next, next, you will be able to go ahead and create all of these profiles and you'll be good to go with the configurations.10:21And in respect to catalog, you'll have predefined configurations or component which you can click on, find the relevant one and use as where requirement. Manual, that's the normal configuration that we always go with. We do the configuration from scratch based on the requirements. We create each of the profiles, the config groups, your policy.10:40Groups everything individually and manually.11:00Again in the same tab, you'll have an option for export and import when you have a separate set of configuration or you have a configuration in UX one.o, you wanted to import the configuration and change it to the way we see it in the UX two.o, which is the configuration policy or the con or the.11:02Configuration group or the policy group that again can be done. Yeah, so this is how to start off with the 1st approach, the workflow. This is how the workflow would look like. You will, you will see the workflow right under the analytics. Once you click on the workflow, this is going to give you.11:21A set of option to start off with whether you want to create a config group or if you wanted to define any kind of a specific service, all of this you can simply start the workflow and keep going just by clicking next icon. This is going to take you to each of the next step until you get the process completed.11:39So for that, so moving on to from the configuration to an overview dashboard, under the overview dashboard, again, you have the possibility to see all of this this is how the primary difference is to UX two.O dashboard looks.11:56There are few features that you can see from here and once you go to overview, you have the option to go to topology which we'll cover in depth in the demo. Once you click on the topology from here on, you have the option to, you know, go to an individual site and start the capture from there.12:13To quick to give you a quick demo on that part, I'll 1st start off with the demo only for the workflow. The manual approach we'll cover in the later slides This is the workflow demo of having.12:29In a config group created.12:49As you create each of these group or site, the relevant profiles such as creating a config group or the system profile would automatically created, you will be able to see it at the end. Yeah.12:58Now it will automatically move it to the next step to associate it to a device so we have come to the stage now from here on, once you click next, you'll be able to.13:15Attached directly to the device. So this demos primarily show how the work, how easy the workflow is made to create any kind of a profile. So, quickly from here moving on to the next slide.13:33Sorry. So this is how this is the catalog. 1st we saw is the workflow. Now here what we see here is the catalog. In this catalog, it's mostly it's Cisco hosted and managed that provides you a ready to use configuration templates for various deployment scenarios.14:01If you have any kind of a cloud service which is enabled, your SD WAN manager can directly access this catalog, import the configuration from here and you'll be good to go from there. There are certain real value experience or variables that you might have to configure as per your requirements for each site.14:17Yeah, so here it is. You see a create config group, you can create a tag rule, you will be adding a new route to it, excuse me, and in in the feature, you you'll add more tags and you can add more policies to it. As you can see, there's a highlight that is done.14:37You can click on each of this, you have the option to add a tag and from here you can create a new tag also. So this is the SD WAN conversion tool. As I said, we'll have the option.14:56To import the configuration like previously if you're using UX one.O and if you wanted to move to two.o, the conversion is made possible using the SD WAN conversion tool. So I'll quickly play a demo for the SD WAN conversion tool here.15:12This would start by pulling up your existing config template policies and directly from your manager by importing them from a file. And it will come, the tool would then automatically transform to the legacy device templates and feature templates and would upload.15:32And validating it to the similar configuration that you would be having or you would see in your UX two.O.15:47It's collecting each of the templates.16:21Now we're.16:42And then the state of transform, this would convert each of the device feature templates and policy into the modern equivalent, which means equivalent to the configuration group and the policy group that we have in the UX two.group.16:43Now this will show you the summary so that you can validate it before you.17:05Upload it.17:09Sweet that was about so this is about export and importing the configuration. We covered the workflow, we covered the export import. Now, with this, I'll stop here and I'll move on to the demo of how we do the manual approach process.17:59I'll quickly pause screen sharing for a moment.18:14When I quickly switch to the demo part.18:43So just move one. So we are into the this is the UI of UX two.o. What we see here is the.18:45Configuration, what we'll be covering today is the configuration groups, the policy groups to start off with the configuration group. So what we see here is the primary configuration group and all of this is the feature profile that would come under the configuration group. We'll quickly open one of the configuration group and find out or explore.19:03What are the mandatory profiles that we can see from here? Yep. So as you can see on the screen, each config group would have a system profile, transport and management profile, service profile and the CLI add ons out of which the system profile and the transport management profile are the mandatory profile.19:22Each of these profile gets individually created and we, we get to map them under the configuration group. What we'll do is we create a configuration group of reference I'm showing I'm creating one as test and it will give you an option to choose whether it's a single router or a unit router.19:41I'm choosing a single router and, I'm hitting create. Okay, once I expand it, yeah, as you can see, it's asking me to select the system profile.19:57And the management profile. Once I I'm done creating the system profile and the management profile individually, I can come back here and map it. And once this is done, once my configuration group is complete, you see the option that says add, I can add the device here to which I want this config group to be associated, and I once I hit deploy.20:13I'll be good to go ahead and deploy the device in this specific configuration group. I'll pick up one of this group where you can see. As you can see, associate has four number of device that's associated, associated to it. And if any changes that I make here and if I want that to be.20:33Applied Simply if I hit deploy, the changes to any single profile that I made here would take effect on that specific configuration group which are part of or to which the devices are being associated. From there on, I'll quickly move on to the system profile.20:52To show you what is exactly present in the system profile. I'll open one of the existing system profile which is shared by three groups already. I'll hit edit to show you what's present in the system profile. The system profile has, as I said, has basically.21:07The configuration that is related for having your NTP server, your AAA server, your basic. So once you you have the option to go ahead and edit and make any changes as per you need, as you can see? Yes. So this is going to give you the system, the device.21:23Group. As you click on it, it is going to give you each of more in depth as to your tracking settings. Once you go to advance from here, you will get to see the port popping and all of this based on your requirement in case you wanted to have any kind of a CLI ideal timeout period as to what time you want the CLI to be timed out and all of this get basically.21:40All of your system settings can be.21:59Made into the system profile. And if you wanted to add any of new feature to this existing system profile itself, by doing add new feature, you have the option to add any of this as we already have all of this added, you can, this is being grayed out if in case anything is missed.22:01You can, you can click on that and you can move it to it so that you will be seeing this under the system profile. So the transport and management profile, basically the transport and management profile, what they carry here is.22:20Mostly that is relevant to your van and your management interface configuration is what you would see under the transport and management. And anything that's related to your LAN you would see under the service profile. I quickly open one of the transport and management profile. Yeah.22:36So this is mostly relevant to the relevant to the van and the management interface as I said. So it's asking you the van interface which you wanted to choose and any changes that you wanted to make. If you wanted to have a tracker that's set, here it is, and the part that you wanted to choose is primary.22:56Secondaries here and for the management, you have the option to choose your management interface and if you wanted to add anything to it, you have the option to add from here again. So these two would be the mandatory config for the system profile.23:14For the configuration group. Apart from this, we have the service profile which is more relevant to land any any land related configuration.23:34You can do it from your service profile as you can see not just the land related, your VPN or your routing protocol such as your BGP and all of that you can do from here, your multicast, your DHCP, your BFD, all of this configuration as you can.23:41Scroll down.24:02Will have the option to add additional settings that you wanted to do like adding a route policy and all of that can be done from here. The CLI add on here, moving on to the next feature profile. Yeah, the CLI add on that you see here.24:02It allows you to add any kind of custom CLI command that you would need. E.g., if I click on add new, or don't let me click on the existing one that I have already had as you can see.24:22If you wanted to add any kind of a CLI command and add on CLI command, you can add it from here. You click on create new variable, it gets added and so that you'll be able to see it reflecting on the device where you have the device or to which the group the device is attached.24:41So this is about the configuration group and all of this profile once created individually they get mapped into the configuration group. You create a new group and you get to add them here and click on edit to once again show you all of that.24:59Sorry, you get to choose the system profile, the transport profile and add additional profile would tell you or would give you an option whether you wanted to add any kind of a.25:15Service profile add on add on CLI if you have created, you can click service profile and that will get added to here and you can choose whatever profile that you've locally created and that will be mapped in here. Similar to this is what we will see under the policy group also.25:31Yeah, so we have the policy group here and again under the policy group, we have the application priority. I'll explain one of the policy group that we see here. So this is the policy group.25:48One of the existing policy group that we have. So this is going to show you exactly as how we saw on the configuration group. The policy profile also has feature profiles like choosing the application priority in case you have any kind of a next in firewall that's created.26:04Or anything that you wanted to do for the secure gateway, and all of this, the DNS security config settings, you can create them individually in each of these feature profile and you can add them here. Similar to the configuration group, you have the option to add the device and deploy it right from here.26:19This is how you add a policy group. Add policy group would give you an option to add a new policy group, you would give test and when adding the policy group, this would ask you if you wanted to do it for SD WAN or SD routing. I'll choose SD WAN here.26:36The test is added here as you can see. It's giving an option. The name here is taken as test that we described. Any additional description that you need is option that you can give application priority. You have the option to choose any kind of an existing one that is already there or if you wanted to create a new one.26:59That can again be done. We see a QoS, which we I'm choosing QoS here. What is there in the QoS I'll show you again once we move to the application priority. Once this is added, the necessary configurations are added. Again, it gives you an option to associate a device to it.27:17And once the device is associated, you can go ahead and deploy the policy to the specific device. From there on, I'll quickly move to the application priority, what we see under the policy group. Clicking on the application priority and SLA policy would give you an option to create a new.27:32Application profile, I'll create a test again. Reference. Okay, so there is one that's already present. I'll take the two as one which we just checked in the policy group. I'll expand it for the reference.27:50So, we are in the advanced layout. What we're seeing here is the advanced layout of the application and policy edit policy. So what you see here is a policy name. You can mention the VPNs. You can choose the direction from how you want this to be applied, whether it is nor the direction or only.28:07From service tunnel or from a specific tunnel you want, you have the option to choose that. And if you move on to Q from there if you go to the SLA class, there is NO SLA class added, but if you want to add, you go to add traffic policies from here.28:27And it is again going to give you the same option. It lets you choose name, the VPNs and where you want this to be applied, the direction in one in which you want the, again, this traffic policy to be applied and whether you want the default action to be accepted drop, all of this is mentioned here.28:45Now this is the advanced layout that you're seeing here. You want to go back and see the basic layout where you choose the devices. I'm choosing the test which was created for reference. What you see here is a simple look or the basic look.29:02What it defines here, it lets you choose the preferred path, and it gives you three categories, which is gold, silver, and bronze. Gold is primarily for most of the applications that's related to the business, maybe your Webex or your MX teams.29:19For any of this. It lets you choose the preferred path which you wanted to be primary for that application to be chosen choosing this internet here, and if in case the SLA that you define when the SLA is not met, what do you want to do, whether you want it to fall back to the best part.29:35Or whether you wanted to drop off or if you wanted to fall back to the backup path. When you choose a backup path as an option, it again gives you option to choose the backup path where you want this traffic to be followed over to. I'm just choosing this for reference.29:52And once you scroll down, it's going to give you an option to choose the policy that you wanted to apply or the application it's showing the list of application. If it is from the SIA or the part that you choose, which application do you want?30:09For each of this tunnel it gives you the option as to which application you want to choose and how do you want it, whether you want it to fall back to the in case if this is not met, you have the option or the sliding button so that it can fall back to the actual routing.30:27And the target policy, so this is the place where you apply the policy that you have created. Like you get to choose from which direction you want from the service tunnel, if it is from SIA or from the above our list, you get to choose from if it is from the service VPN.30:44You you get to mention each of these data here and mention the traffic VPN which you have created the one that is already created I'm choosing. Once you hit and save, this would be completed. And what we see here is a simple view. If you wanted to go to the advanced view, which we just saw.31:02Before the simple view, you go to the sliding button and from here this is where you get to define your SLA classes, your QoS classes and all of that. Add a QoS policy. Yeah, so you get to define the QS policy here, you get to mention the value, the forwarding class, the what type of traffic you want it to be, the bandwidth.31:17If you want it to be dropped, all of this can be chosen here or chosen from here. So this is about the application and the priority application priority and SLA. Not just that, it also gives you an option to.31:37Choose your your firewall settings, you have your zone based firewall which is already configured here and it is being referenced in one of the policy groups also. I'll quickly expand this. Yeah.31:53So this is how it looks. It lets you choose the rule that you have already created and the action that you want. It has created block ICMP to specific port from any source and it has mentioned the destination.32:09And likewise, if you wanted to add more to this, you will have the option to add more and this will get automatic and once this is added here and this can be called into the actual policy group as you can see from here. Yeah, I click on add policy group.32:26Or i'll pick one that's already there So this is where you can call all the configuration.32:47The next gen firewall that you created, the application priority that you created, all this can be called in here. And once the settings is saved, so this is the type that we chose, we want this to go for the SD WAN devices. You choose SD WAN.33:04And you can associate to the device, you will get an option to choose which device you want it to be associated with. And from there on, once you hit deploy, you'll be good to go with the deployment process. So this is how exactly how we do for the configuration group and the policy group. We have a lot of feature profile that will go into single profile.33:19From there on, we'll click the add to associate the device and deploy. The process is made similar or more easier comparing to the UX one or two. Now with this, I'll quickly take you to the top one more view which is an add on or an additional feature to.33:38Can you move on to the overview screen. Now being on the overview screen, what you can see from here is I'm clicking under the topology and clicking on the topology view. I'm choosing any one of the site.33:56If I wanted to see any one of the specific sites health, I click on the specific site and I'm choosing on any one of the advanced that specific region. Now from here on, this is going to give me the overall view of how good in this site, on this region, how good this specific device is performing.34:14What is the device health status? Oh, how good is the CPU load? What is the device model and all of this? It just doesn't stop with that. Right from here, if you wanted to run any kind of a packet capture or anyone to do any kind of a troubleshooting, it gives you an option to do a trace route.34:32Run a packet capture from here directly. And again, NWPI is again one of a very good feature to run a hop by hop capture. Now, you can create a trace or a new NWPI from here.34:49This is individually covered as a separate topic. We'll by the end of this session we'll also continue to paste the session link here for your reference and create a trace from here would take you directly to the NW page and whatever trace that you wanted to run for a specific site, you can choose a specific VPN. You can choose the site name.35:05And you can do a lot of advanced how long you want the capture to be run, you can schedule the capture from here so that even in when there's somebody not present in the site, you'll have the option to have the traffic captured for your future reference. Once you hit all of these and do a start capture, this would either start the capture directly or if you do a scheduling from here.35:24Using all these options under the NWPI, the captures would also would be scheduled. So this is about the basic or the overview of how the primary difference from the UX two.O to one.O with this I'll stop and if you do have any questions.35:44Please continue to post your question in the chat.36:04For SD routing, I'll hand over to Satish from here. Over to you Satish. Thank you, thank you for the presentation. Let me share my screen. Okay hope everyone can see the screen. So the next topic that we are going to see is the SD routing topic.36:08So if if you are if you're new to SD routing technology, it has been introduced on twenty.twelve seventeen.twelve version. It is a capability to simplify and overcome the challenges of your traditional routing deployment. And this also enables you to manage your non.36:25SD WAN routing devices in autonomous mode and at the same time at the same we manage you can also manage your SD WAN devices in the controller mode. So this unified management platform offers lots of features like device life cycle management. You can do your configuration management, software.36:45Management or even you can do a direct internet access or a cloud on ramp for multi cloud for your non SD WAN devices also.37:05So we will just try to click on go to each and every use cases and we'll see how to enable it for your non SD WAN network. So, we, we, so every customer's part to a modern cloud managed solution is unique. So we recognize each and every one of you in a different stages of.37:16Maturity and our architecture is designed to meet them exactly where they are and whether they are going with the full SD WAN solution or an SD routing solution. So with that, we actually classified our customer into three categories. One is a customer A So if you are a customer who has already.37:36Already deployed an SD WAN network and you are part of already an SD WAN journey. So you can also optimize your existing non SD WAN devices on your same we manage with the help of SD routing. On or or else if you are a customer B, if you are in a transition phase, let's say if you have a non SD WAN network today and.37:56If you wanted to move it move to completely SD WAN fabric, you can also if you're, if you're actively evaluating the SD WAN migration, you can use SD routing as a foundational step or a 1st step to bridge your legacy environment toward the fully managed software defined future. Or if you are a customer C.38:16E.g., you, you are a customer who are satisfied with your traditional core networking performance, but if you, if you, if you like to evolve, then evolve, you can also evolve with the modern management, cloud integration or advanced security without replacing your.38:37Entire routing stack to our SD WAN immediately.38:56So the beauty of this model is flexibility. So if you are a customer starting with SD routing to gain visibility and management or if you are moving to an SD WAN, we provide a consistent and secure path forward. So this strategy also help us to build the right conversation with you in order to modernize your environment.38:59And if you are a customer C, we can help you on the migration acceleration or else if you are in a customer A, we can help you on, like for the the modernization.39:20So with that, I wanted to talk about the key use cases of SD routing once you onboard your autonomous devices on the V manage. So the 1st use case is the life cycle management in terms of monitoring and the software management part. So once you onboarded your existing autonomous.39:36Devices on the V manage, you can monitor the devices or you can take the SSH terminal of the devices from the V manage itself. You can do some ping trace route, you can get some real time data, even the application data from the autonomous devices. You can you can use the V manage in order to.39:57To collect the admin tech logs or you can monitor the notification alarms, events that are generated on your autonomous devices. Also, you can do a software management from the V manage also, so any, any software upgrades that you want to perform for your autonomous devices, we can do that on from the V manage through the soft.40:16Single pane of glass. Also, if you would like to troubleshoot the issue with some packet capture or do a speed test, you can do it from the V manage itself for your autonomous routers.40:37So this is the 1st use case. Moving on to the next use case. We can also do secure DIA with embedded security on your autonomous devices. So more modern branch offices require today with direct high speed access to your SaaS application like office 3605.40:49Or, a Salesforce, right? So traditional backhauling of your traffic to the data center is inefficient.41:10So the secure DAA model allows your branches to connect directly to the internet while maintaining the enterprise grade security on your router. So we help you to enable the thick branch model by embedding security security directly into your SD routing devices. Instead of managing SF.41:18Separate security appliances like firewall. We help you to integrate a comprehensive security stack locally on your branch router itself. You can enable the zone based firewalling firewall, the perimeter defense from your SD WAN router, like sorry SD routing router or you can enable the URL fill.41:38For controlling the web access, you can enable the IPS for interest and prevention or you can enable the appread gate for advanced malware protection and sandboxing on your SD routing devices. We do have a streamlined security workflow in order to enable, all these features.41:58You can enable, as said, you can also enable the config groups for your routing in order to manage all your configuration. Apart from that, you can also create a policy group in order to push the embedded security policy on your router with all the security functionality that I have listed out.42:18Once you have done that, you have to associate and deploy the config groups and policy groups to your respective ST routing devices. So the architecture also provides you immediate feedback through a centralized dashboard. E.g., you can monitor your firewall rule hits and identify the.42:37Top threats in a real time in your environment, allowing for proactive adjustment rather than a reactive troubleshooting methods.42:57So this use case helps you to like how to how how to turn your complex security requirement into a single automated workflow. It also empowers you to secure your branch offices without sacrificing the performance or benefits of.43:06Direct internet access.43:26So the next use case I wanted to talk about is SD routing cloud on ramp for multi cloud. So our as organizations scale their cloud footprint today with different multi cloud environments like AWS, Azure or Google Cloud.43:30We introduce you to introduce you to the cloud on ramp for multi cloud feature which simplifies by automating the connectivity between your branch location and cloud based workloads. This is this is effectively done by extending your SD routing device.43:47To the cloud. Now we have this capability of for your traditional router also with the help of SD routing cloud on ramp multi cloud workflow. So there are some workflow that you need to follow in order to enable it. 1st is creation of config groups and applying it to your SD routing devices so that your SD.44:06Routing device will be like up and running on your V manage and then you can do the cloud integration. So you can go to the cloud on ramp for multi cloud workflow. It can create your transit gateway. I I take a example of AWS. You can take a transit gate, you can create a transit gateway and you can.44:26Define your connectivity intent. So connectivity intent is.44:46Just an intent to intend to update that we manage what are the vpcs that needs to be leaked to your SD SD routing VRF. So that intent you can define it from the we manage itself. So finally, attaching the site to the cloud gateway.44:50It creates a secure IPsec tunnel between your on prem routers for an example to the cloud infrastructure. On top of that, the BGP neighborship will be created where all your VPC routes will be learned and with the help of intent, as I mentioned, you can leak your VPC into your existing VRF.45:10In your SD routing domain.45:30So, a key takeaway by moving away from your manual configuration to intent based model, you can reduce the human error and speed up your deployment time and you can also define the same policy or intent with the different cloud regions or different cloud providers as well.45:32And, and, whatever I have mentioned is for an example, it is an AWS support and we are also supporting Azure webcub also from seventeen.thirteen version onwards. So before going into the demo, I just wanted to touch base on the licensing.45:51The information as well.46:11So licensing for SD routing is designed to be very modular, providing you a clear path of both on premises and cloud delivered controllers model. So we categorize the licenses into two functional pillars. One is the configuration licenses, which is for full management and the monitoring licenses that is for.46:13For only visibility zero touch provisioning and troubleshooting. And.46:33And for your CAT8 K series, we, we, you can also utilize DNA licenses, which is on prem or you can use DNA CDCSS licenses for the cloud ties, which can provide you a full configuration and monitoring capabilities for your CAT8 thousand series in the SD routing mode.46:39If you have a ISR one K, we offers flexible option. Either you can choose full DNA licenses for configuration and monitoring through vmanage or if you want to just monitor your ISR one K from the vmanage, you can also use a dedicated monitoring licenses, only if you know.46:59In order to get the visibility from the we manage for your cat ISR one K devices. You can do zero touch provisioning or you can do a software image management, get some assurance dashboard for your devices, but you'll not be able to manage the configuration like creation of config group or policy group. We also support this.47:19For your ISR four K and ASR one K as well, but we support only the monitoring capability. You can only use zero touch provisioning swim or troubleshooting functionality for the ISR four K and ASR one K devices. For that you need monitoring licenses.47:39So so the key takeaway is whether you are using a CAT8 thousand hardware or if you are integrating legacy ISR four K or ASR 1K routers, our licensing model is designed to scale with your operational needs. Starting with visibility, you can also.47:59Also grow into a full base full intent based automation on your network.48:19So with that I wanted to go into a demo where I wanted to show you how to onboard autonomous devices on the V manage in SD routing mode. So before going into the demo, I wanted to talk like take 2 min to talk about the different onboarding methods.48:27It depends upon whether you have a physical device or like a virtual device, the onboarding methodology is different and also the onboarding methodology differs from your existing autonomous devices, whereas new autonomous devices, a greenfield or a brownfield environment. If you have a greenfield environment, if you wanted to onboard a device.48:47Is for the 1st time and get it onboarded on the vmanage for SD routing. We also support plug and play and quick connect in order to support zero touch provisioning or else you can also use bootstrap configuration if you cannot get an IP address through DHCP for your routers. If it is a software.49:06Based you can go with only the device based bootstrap configuration because the device might not have the chassis ID in order to get authenticated. If you have an existing devices and if you want to preserve the configuration before onboarding into the SD routing mode, if it a hardware, you can also use the bootstrap.49:27Configuration, even from the configuration more without reloading the devices, you can add the bootstrap configuration that is needed to onboard it on the V manage. So that is also available or else you can also go with the manual onboarding process. There are some set of configuration which I'll show you in the demo. You just need to paste the.49:47Configuration on your existing brownfield devices, so the device will come up on the we manage in ST routing mode. If it is a software devices, you additionally need to add the chassis ID and the token that you need to get it from the V manage I'll try to cover that in the upcoming demo.50:07Yeah, so I'll just show you autonomous devices, which I'm going to onboard in we manage in history routing mode. Let me log into the devices.50:28So in terms of onboarding methods, and the cloud on prem multi cloud workflow, we will send you a link on the chat window which you can refer.50:48So in order to onboard this, this devices, so I do have already V manage with me. So the site level is not available on the V manage. So let me quickly go to the V manage and show you what are the devices available on the V manage. So there are site twelve, site 13, and site 14, which is available on this.50:57Routing mode if you see the device model, it says in bracket it says the routing. If it is not, then it is in SD WAN mode. So I'm trying to onboard a new device site level, which is a brownfield environment for my network. I don't want I want to preserve the existing configuration also. So before onboarding, as I said.51:17You need to maintain the software version in order to onboard on the.51:37We manage in ST routing mode. So let me check the version that is running on this device. Yeah, if you see the device is running with seventeen.fifteen, and since it's a cat ak, you will be able to get.51:43Both the configuration management and also the assurance functionality of software management from the SD routing mode in the V manage or SD WAN manager. And, and these devices already have the DNA advantage licenses, which I said it's one of the requirement for the device to be.51:58Onboarded. And if you can see the device operating mode is autonomous.52:18And, the device model is 8000 V so with that, I wanted to show you how to onboard the device on the ST routing mode. So before that, if you wanted to check the status of the control connection, if you do show ST routing.52:23Control connection summary so here I don't see any control connection today because I don't have any configuration to onboard these devices on the SD WAN manager. So I'm going with the man.52:43Manual method, so basically you need to do some sort of configuration in order to onboard these devices. You can either do it in the bootstrap method or you can manually copy paste this method on the existing devices or to get this configuration. So basically you need to enable the netconf yang and in SD routing mode, you need to define what.53:01What is the system IP address, site ID, which is an organization name that that is configured on the V manage and you need to specify the V bond IP address. It gets authenticated with the V bond, gets the V manage IP address.53:21And it the communication is done on the gig one interfaces. So, for the organization ID, if you're already in SD WAN customer, you must be already aware of it. If you go to configuration and settings, you can get, you can just fetch sorry administration and settings. You can fetch the organization ID. So I have already.53:36We fetch the organization ID.53:56Yeah, so it's I'm going to use this organization ID for my network for the devices to be onboarded. Sorry, not this device. I think this is the we manage. Yeah, if you go to administration.54:02Settings page yeah you can see TME-routing-mode is my organization. So I have specified this as an organization over here.54:22So I'm going to paste this configuration on this device going into the config mode. Yeah, so I have paste the configuration. Now if I check the.54:37Control connection summary.54:57So it will take like 2 min in order to form the control connection to the V manage. So in the meantime, I will also I'll also try to show, Yeah I I think there isn't one more steps in order to do it. So this is software device. It does not have the chassis ID in order to authenticate with the vmanage. So for that, you need to do one more steps especially for your software devices. You might.55:02You're doing the same thing for onboarding your software devices on the fabric also. So you just need to go to configuration, certificate and managers.55:22So here I do have all my KB chassis ID and the token key that I can use for my devices. So I just need to embed this chassis ID on my devices. So I'm just copy copying this chassis ID.55:32So I'm going into the device again. So in order to embed this chassis ID and token number, so the command is request platform software. In SD WAN you might be using in a term called SD WAN. Here you have to use SD routing.55:53And the chassis ID I'm going to paste over here and then you need to paste the token key for the authentication also. So this is the token key. I'm going to copy and.56:11Use it for this device. So now this device should form the control connection with vmanage. This device has, should be reaching the V bond IP address that we specified. It should authenticate with this chassis ID and token.56:31Key and now if I execute, show ST routing.56:51Control connection summary. Yeah, you can see now the device formed the control connection with vmanage. In order to validate it, if you go to the vmanage or the steven manager.57:01And monitor and devices, you should see the site level that is onboarded. So from here I should be able to get leverage all the use cases that I have mentioned. If you want to monitor this device, just click this device, it will go to the system status under this device, you can monitor the CPU memory.57:16Utilization, you can monitor the interface statistics of this device under interface.57:36And you can get all the events of this devices, like any event that is generated on this device. And if you wanted to do some troubleshooting, like you can do ping trace routes, speed test, can validate the control connection.57:43And you can also execute the show commands over here and you can get the output for those devices. So this is the assurance functionality. So you can also do the software upgrade. So if you go to maintenance, software upgrades.58:01So you can, you will see that this device site level, so you just need to click this device and software manage image action. You can upgrade the device or you can schedule the upgrade also. So you can set the upgrade, so you you have to specify the remote server or you can have the V manager said remote.58:19Server and you can select whatever the image that you want to upgrade, and if you select activate and reboot and upgrade, your devices will upgrade it to the newer version, so basically the upgrade can be done over here. So even before onboarding the device to the SD WAN manager, if you wanted to upgrade your autonomous devices to 1712 or 1715 version.58:39To onboard then you can use the, there is a tool also upgrading for your SD routing capability also. So if the device is in 1719, you can upgrade through SD WAN manager and then you can onboard into the SD WAN manager in SD routing mode in order to do all the other functionality. Similarly, you can also do configuration.58:59Groups.59:19So if you, if you click configuration configuration group, you have a dropdown of SD routing and SD WAN, so you can select SD routing, so you can create an configuration group for SD routing. So let me create one for 8000 V So if you select it will be a CLI configuration.59:20Group or if you want to feature parcel, you can use this feature parcel group. And this configuration group, I just specified the name as 8000 V but as said you can use this configuration group for a different model also. So that's the difference between UX one.zero to UX two.zero. UX two.zero config group is.59:40Model agnostics, you can use it for a different models. And within this config group, you can attach your system profile or, system profile can be created from here or you can create your transport and management profile, basically the global VRF you can create over here. So you can create from here and you can create your policy.01:00:00See profile and all the profile that is required for your ST routing mode. So if you click add profile, you will get to know what are the profiles that you can create and you can map it over here as mentioned in our previous session. Similarly, you can also do policy group for your 8000 V device that you onboarded.01:00:20So you can create a add policy group and you can specify it is for security and you can select the SD routing mode. Here you can create all your NGFW policy in your policy group. So when I say NGF.01:00:40W policy, you can create any policy, a security policy related to let me just create it one. Zone based firewalling, URL filtering, AMP, all those things can be created over here. So if you go to sub policy, you will get the option. If you click add sub policy.01:01:00You can create a s a sole zone and destination zone for the traffic and over here you can create whether the traffic needs to be passed or dropped. Here you can select what all the application needs to be in do that.01:01:20So in the additional settings, you have an option of creation of advanced inspection profile. So this is only for the creation of IPS or AMP or URL filtering configuration for your routing devices. So this is 2nd use case for.01:01:36So the 3rd use case is the cloud on ramp for multi cloud, so you can go to the cloud on ramp for multi cloud and you can associate your different clouds.01:01:57Let me show it in a different we manage. So you can associate your AWS Azure or Google Cloud environment and you can create your cloud gateway for AWS it's a transit gateway and you can attach the transit gateway to your SD routing device. So it will form an IPsec tunnel in BGP in order to.01:02:08To learn the VPC routes. So VPC can be discovered from this tab for your associated AWS accounts and under the intent, yeah, under the cloud connection, you can go to the VPC connectivity and you can see, you can write a rule what all the VPC needs to be leaked to your.01:02:28SD WAN or SD routing VRF, so these are the SD routing VRF, so the intent can be done over here so that any device that connects behind the SD routing or SD WAN devices, SD routing devices in this case, it can have an access to the AWS VPC through the IPsec tunnel.01:02:48That is created to from the SD routing devices to the AWS transit gateway. And through the BGP it can learn the VPC routes and it will be leaked into your VRF.01:03:08So this is all I wanted to do a demo for this session. So quickly I'll hand over it to Akshay for the next steps. We will pause for maybe a couple of minutes here, guys, just to see if we have any questions.01:03:18For NO questions, just a moment please. Okay, so thank you all for being patient and and being on the session throughout. For your next steps, please keep an eye out for a survey from us. It will be from Cisco.01:03:43Customer experience. It's a quick, it's it's quick easy and we would really appreciate it if you can take a couple of minutes to help provide feedback to improve our future offerings. With that, thank you all for joining us today. Have a good day. Bye.01:04:03