SDA Design Best Practices - Advanced Segmentation and multi-site Deployments

Oh, Hello, good morning, good afternoon. It's Wednesday, 21 October and we are here for another expert insights.00:00Is in EMEA region.00:20Cisco catalyst center expert design series although this time we will focus on SDA design best practices and more specifically in advanced segmentation and the multi site deployments. I presented Tamra Ahmed will cover many topics.00:22Any advanced topics?00:41Tammer is a solutions architect in customer success and he's one of our experts in SDA design, so SDA design so he will talk about advanced segmentation and multi site deployments. If you have questions.00:44You may find that we provide NO answer, NO answers in the session. This is because of the level of the expertise needed for the questions. In such case, we will respond to you in a, in an email in the next.01:03Days.01:23Before we start, quick note, this is what what you will see is basically guidance based on cisco's recommended practices. It's up to you to decide whether it applies to your networks. It's offenders to you, it's it adds business value and all.01:25That stuff. Happy to help you happy to discuss with you further if you want, you can request a one on one in the post webinar survey and we will contact you and we will have that session to advise you further. There are a couple of requests from the previous session, but.01:45Since this is a continuation, we will send those we will cover those requests once this session ends.02:05This is the last session of the series. The other ones you can find the recordings in CS.coxlash EMEA-CIS-cat C This is our community page. I know that recordings should be there but are not.02:16Yet there, where we we are working on that, but if you make a note of that community page you will find the recordings.02:35Fairly soon. You are muted, you cannot speak, but you can write and you can write your questions in the Slido which we will launch in a couple of minutes. Any technical difficulties you can send a direct message.02:44To the host and we will try to.03:04Sort them out as soon as this is possible. Regarding Slido, you will see, you will find the slide on the right hand side. You click on the field for your question and then you type your question you sent and you can see your questions and.03:10The answers you can filter by reason so you have them in a specific hierarchy.03:30One last thing you will see that we have a pilot at the end of the session. If you want a one on one, we will provide you with a link so you can select your session, your slot on the spot. So.03:38If you want to hear more from us, stay tuned.03:57And we will give you more info at the end of the session. And with that, I will pass the ball Tommer to start with the interesting part. Hello? Hello, good morning, good morning, everyone, good afternoon. Thanks Alex for this introduction, allow me to share my screen from this.04:02And here we go. So as continued continuity for what we discussed in the last session, this is a series of two sessions for SDN architects. So in the 1st two sessions we covered foundation and architect.04:22Time in scale sizing. Today we are focusing more into segmentation strategy including enforcement points and multi site topology as well.04:42This is our base that we are extending the session today to cover it. So, we, we have covered so far the two topics. So we covered in our discussion phase one and we covered also phase two when we have been talking about knowing what exactly in the customer environment today.04:54For the current method of operation to have some common SDA deployments and we discussed about some best practices for considering some deployment, including fabric in a box, embedded wireless and controller.05:14We went into the phase two for the last session into center sizing and what factors shall we consider and the delay requirements, number of endpoints, number of managed devices, and then we started to move down to the site, the specific design.05:27When we classified site categories, small, medium large or any other categories that we mentioned, it could be decoupled. Then we covered the external connectivity. Why do we have a fusion layer? And we deep dived into why do we have, let's say in path or out of path fusion layer?05:43And then we introduced a concept called hardware basket, which is, a validated hardware for any standard deployment. This is and this is where like a feature metrics compared to the model that you are using. And we ended up the discussion for ICE integration which is half of phase three that we are going to continue.06:03Today that and we spoke about how the cater center is integrated with ICE and what are the main use cases for ICE integration here and this is a core of SDA deployment and the foundation of segmentation. And that's why this one should give us.06:23Or prepare us for the next phase about the segmentation strategy, which is the scope of today, half of phase three, and then we are talking about the interconnection between fabric sites and what can we do for larger campus as a special use case here?06:40And migration approaches and how can we tackle this from strategic point of view? Segmentation strategy. Now, we are looking for major parameters to consider here.06:581st one, this is very critical this phase with the customer that you need to in detail get requirements from the customer. 1st of all, is it an IT or OT environment? Is it shared or higher or dedicated infrastructure for OT? Is the OT part of the scope or not?07:16What is the definition of virtual network? Why customer may need a virtual network? What is the role definition whenever possible, and this is different when it comes to IT versus IT? E.g., is the customer having a role definition based on.07:35Cameras, printers or corporate disease or location specific role. What if the customer has a specific definition or criteria to place endpoints in different VLAN based on what? What is the criteria to identify from, let's say external identity store or active directory or ServiceNow.07:51That the customer has and eventually profile this endpoint or segment it into certain VLAN.08:11Very important point serving the segmentation. What is the nature of the application communication here? Don't assume anything, analyze as much as you can so you can get it. If the customer can provide you at from the beginning it will be amazing. If not, which is the majority of the cases, you are going to use other monitoring tool.08:18To recognize if the majority of the traffic is east west or south to north.08:37Defining enforcement points, and this is very important. Not everything should be covered by micro segmentation, but at the same time you need to understand how many enforcement points the customer is using firewalls, is its higher level inspection?08:43Does it have sassy solution or not? Or he is looking for campus only. And this is where you are going to have, including even multi vendor or other vendors. This is very critical point to understand what traffic and inspection is enforced or controlled by which tool do you have.09:00Options of enforcement points. Are we using traditional access list today? Are we going to keep them? Are we considering dacle? Or we are considering agsls or others? And what types of enforcement points do we have? Where to enforce, NO matter it's traditional ACL or Dacle or.09:17Is it on a switch or a firewall?09:37Please don't rush in this phase. This is SD as a journey and don't expect that you will get all questions on top in one session. Macro segmentation, the most critical part here in the micro segmentation.09:45To define enforcement point, but let's go for very basic question and this flow chart adjusted to brainstorming together here. Why do we need a VN? Some customers may deploy VN everywhere and then have cross communication between all vns unconditionally, which is which is.10:00Exactly breaking the concept of a VM. So let's think of from high level perspective.10:20Security requirements. What is the intention? Do we have intention not to have a cross communication between the organization units or business units or if the most of the traffic is to be denied or isolated? If yes.10:26Then yes, go ahead for a virtual network, a separate virtual network. If NO NO, I would like to make most of the communication allowed or full traffic merge, then it's the same virtual network. With this virtual network A or virtual network B, how do you couple them on your WAN connectivity?10:42Which is another topic. Is it going to be same virtual or VPN ID on the SD WAN or any other one technology or it will be collapsed like my consolidated, which has also some other considerations when it comes to micro segmentation later stage.11:01And the same on the right side, if it's a VRFA VRFB part or virtual network A or virtual network B, but with different aggts here. Let's say analyze common traffic flows.11:17And this is to give us a holistic view from where shall we come understand our possible communication. So we have intra intra VN, this is within the virtual network, inter site within the same site or this is option one or traffic flow one. Traffic flow two, if we have inter virtual network.11:34Look at the same site.11:54Option three if we have the same virtual network communication within the same virtual network but across multiple sites. Option four inter VN and inter site and option five which is subdivided into further items for to non fabric, which it could be fabric to customer manage data center, to customer data.11:55Like hybrid data center on cloud or even non migrated fabric sites etc.12:15This is administrative model, just not to be followed, and we have a lot of varieties here. I picked up one model here when we have SD transit. When it comes to IB transit, e.g., which we discussed that we have maybe IB transit versus SD transit, you may have different enforcement points.12:21But I have to select one model at a time.12:40Let's focus on the 1st traffic flow where the policy enforcement point. So in this case, you have, you have the traffic flow here between one endpoint connected to the same switch or on different switch, but within the same site. That's why it's intra site within the same virtual network.12:42Enforcement point on the egress direction.13:02When it comes to, second case, the same virtual network, but across multiple sites since we have VXLAN encapsulation based on the color color legend here, so the red is a VXLAN encapsulation and this is native IP packet if.13:06Dotted black. So the VXLAN is.13:26When I have one session from VXLAN here and with the help of the ISA transit, ok? We have another conducting or this control border is going to have another VXLAN tunnel to the other border nodes and the 3rd VXLAN, and for these three VXLAN tunnels with different VTAP.13:29This virtual, tip, the the is transported.13:49A 3rd option, if we have inter VN, INTERVN within the same site. Here I selected one option. Some customers prefer to for the enter VN to do local fusion on the same site. Some other customers prefer to get the full troute, e.g., from one hub location or the.13:56Central firewall and the reverse back to the.14:16Same location. It has pros and cons of course but some some traffic flow can be for central management it's preferred, other could be for delay requirements, it could be another challenge, but in this case we are selected one one option at a time and it has been managed on the on prem data center, which is managed.14:19The by central, let's say security team.14:39Excuse me for just a second.14:47Okay, ok, sorry for interrupt. Now 2nd traffic flow.15:04Which is for inter VN and inter site, in this case as well, let's say one of the samples, the customer has decided to have the inter virtual network between two sites fabric A and fabric B or site A side B to be through a firewall. And here when you selected the policy enforcement point.15:22Sorry, here, and it has been configured on the firewall. Now, I'm talking in general, I'm talking about where the enforcement point. I'm not talking about if it's going to be using a traditional ACL, which could be an option or maybe through BX grid, if the customer would like to migrate the firewall rules, if it's FTD, e.g., for.15:43From ACL or some groups configuration into sgts, sorry, from objects to be sgts. This is another topic but here I'm defining.16:03The from security requirements, where do I want to control the traffic flow? Fabric to non fabric, and we are talking here about possible scenarios and that's why I said option option five is going to be subdivided into following. 5.1, let's say this is for a migrated site to SDE and the.16:12Not migrated yet. That's why I have two possible traffic flows or enforcement point. Either I do it on my border node here before I leave the fabric or let's say on my C edge or when device.16:32Or if I have another fusion layer here in the, in the transit path. If I would like to make it on policy enforcement point number two, e.g., I may need to have SXP, of course if it is an FTD or another fusion layer here in the middle I need BX grid.16:46But mainly for with the FMC. Fabric to non fabric, which could be to the customer data center itself. So if the customer himself has some on prem applications, e.g., some SAP applications, some Citrix or could be also clouds hosted in AWS or.17:05Etc. And this is where the enforcement point has been also decided in this selective example to be on a firewall. And this is where the enforcement point. Also, when it comes to internet reachability, the same enforcement point can be selected over a firewall.17:25And again, as we mentioned here, for AGSL on a firewall, a BX grid is required. Of course, if you are going to span your, let's say workloads outside, which is not presented in the slide, but worth it to mention, if you are going to have let's say dynamic workloads spanned across your multiple data centers or even whether it's.17:45On prem or even on cloud, this is where dynamic connectors are coming from Cisco, when you can integrate with ICE can integrate with through this dynamic connector and to the ice when you can get your dynamic mapping of your workloads with dynamic IP assignment.18:05Or any other attribute into an AGT, so you are avoiding heavy static binding of any of IB to HG binding that you may not know in advance what will be the assigned IP address into your SGT. And that is topic is outside the scope of this call, but I would like to share the light that it's worth it to consider.18:20For dynamic connectors, which provides dynamic as it is been based on some dynamic attributes that ICE can retrieve from from clouds.18:40Most important part before you move out from this enforcement point selection, you need to create a holistic view about all possible virtual network, source virtual network, destination virtual network, whether it is within the same site.18:52Or to another site. Am I talking to a non fabric site? Am I talking to another fabric site or I'm talking to another, another, data center hosted here?19:10Now, OT segmentation, this is where we moved out from, let's say generic enforcement points coming to OT. OT has generic requirements or common requirements from most of the customer here.19:26Allow me to close one window here. Yeah, so we are talking about five, let's say five foundational requirements, either for resiliency or host ports or visibility about endpoints or segmentation requirements or some supported topologies.19:43For the resiliency redundancy, this is where we are talking about certain applications or flows that can be must be critical. There is NO even tolerance for even milliseconds. It could be lower than milliseconds. E.g., PRP.20:00PRP excuse me or which is provided by parallel redundancy protocol, which is e.g. like profit or we are talking about host ports here for OT. This is most the complex part when.20:18When you are, let's say designing or asking the customer, what is the typical port configuration or port authentication for OT endpoints? Most of the time it will be open ports or statically configured. And this gives the customer even lack of visibility if you have dynamic authentication, e.g., by ICE, it will give him enhanced visibility.20:35Which comes to the next point. But the customer is expecting from you at this stage.20:56To find enhanced security onboarding for the OT ports. Not only for connecting some OT or IoT in the points like PLCs or some activators or some centers, but it's kind of, an an infrastructures that other, let's say unmanaged devices like 3rd party switches can be connected.21:00Connected without control.21:20Visibility. According if you don't have dynamic authentication or ICE integration in this part of the infrastructure, typically most of the customers may not know exactly what type of assets do we have inside our infrastructure. And this requires another tool or monitoring tool here and we are going to talk about cyber.21:22Segmentation requirement which is the main concept we are looking for, how can I segment my infrastructure or OT cells according to the burging model the customer is following into different segments? How can I communicate, control the communication between different cells into one certain production line? Again, do we have ring topology versus.21:42Start topology. Five aspects to consider here for zone based segmentation, this is like why, why IT segmentation is different from OT, one step at a time, zone business segmentation, and the zone business segmentation within the cell.22:02And this is a process typically micro segmentation is not needed. It means that within one cell at a time, let's say I have a cell representing certain process PLC with some HMI, this is typically allow, allow cell.22:19Another point, I triple E or the 20 X So many OT endpoints maybe headless endpoints like not capable of the 20 X process centric privilege, which is like typically for micro segmentation, ok? It does not come from the device role. E.g..22:35We are not going to have it in similar to IT infrastructure when you have printers, the cameras and they are going, you are going to create some contract or some access list or whatever that applied for all locations. Typically, this comes from location specific or process orientation. So that's why we are decoupling the segmentation for OT different from IT.22:53OT endpoints and typically don't expect that at this stage that the endpoints are DHCP and then you are going to go for greenfield, everything is green. No, typically this type of endpoints will be a static IP assigned even with some maybe challenges related they are being a silent host, which.23:15Which was covered by my CSS colleagues two weeks ago, 7th of October, some features or enhancement coming to catalyst center 3.2 for silent hosts, which is important point to consider.23:34And transit in OT environment, which is what is the last enforcement point you are going to apply your trust sec or enforcement? Is it down to the Cisco industrial switches, e.g. or is it going to be a 3rd party switch?23:47Now, from very high level perspective, what is the model? This is a common model which is here. It's very simplified, but it shows that we have at least two environments here, IT versus OT and at least separated by IDMZ of a firewall, which is people call it like.24:06From level perspective level four five and this is level one to three, including the different cells and this is 3.5.24:25Which is a DMZ or IDMZ, industrial DMZ. This is a typically detailed model of the birding model when you when you call it like enterprise cell enterprise zone for zone four and five or the industrial which is zone three versus the cell area which is zone one and two and the industrial.24:33DMZ which is zone 3.5. Typically, you have a firewall segmenting IT from OT, and as well as we are going to see in the next slides, even within the cell area, you may have multiple firewalls.24:54The IEC standards, 62443. This is where the most important. So we from the birding model we identified which group of endpoints residing in one one zone, e.g.. But how do describe the communication flows or the conduits between one zone to another?25:09This is let's say, is it isolated zone does not need to communicate with another zone or just only communicating with some, industrial data center located here or communicating with some cloud computing on northbound. This is something that the IEC 624443 is identifying the.25:28Communication pattern here or the conducts.25:48Now coming to one important point since we are talking now into IT OT, sorry, OT specific use case, the asset classification. Let's say the main component that you are going to be your eagle eye to look into your asset is Cisco cyber vision.25:52And Cisco cyber vision can.26:11Create let's say traffic monitoring here for locally using our span, but only exporting part of Cisco metadata into the Cisco cyber vision center. So the cyber vision here is mainly com main component to classify your assets to find the communication between the the sales.26:14To to enhance eyes visibility as well.26:34As we see from the following. In this case, I'm, the asset inventory comes from the from the cyber vision, which if you go to the ICE dashboard, you can find some specific attributes under assets.26:37Information. This comes from the BX grid integration between the ICE to the cyber vision. Or you can I also identify the communication patterns here, who's communicating? And this is e.g. one process, like e.g. drilling machine. You can see all the components and it's predicting for you, this is what I.26:55Could see in one cell.27:15Based on the communication flow. At the same time, it can tell you, and this is also one critical value for it for vulnerabilities here to identify based on the specific hardware model and then it can identify so you can install some patch in advance for some potential CV.27:16Is impacting your assets. And the assets and that's why from cyber vision it has just two components that cyber vision itself is the center, the dashboard, and cyber vision, the sensor, which is network based on most of the cases unless you don't, you have a switch does not support it, then you can have external sensor. I see 3000.27:36But it's all about have deep packet inspection to understand what the communication flow is going within the cell.27:57But it does not export the whole R span to the that is a cyber vision center. It only reflects the metadata, so the heavy lift contained within the sensor of the cyber vision itself. Now, we mentioned from the model that we may have a firewall, at least segmenting the IT.28:03From the OT.28:23But that is not the case, or this is not limited only. We have multiple rules of the firewalls within the OT environment as well. So in this case, e.g., if I have on prem, let's say some edge computing or on prem data center within the same factory or the same manufacturer or within the same production network.28:24This is one potential firewall location here. Another you could have between cells, and this is something that important to understand. Many customers may come to you asking or may may ask us, we have, let's say, 300 cells. Each cell has a package. Let's say 3rd party switch.28:44And a firewall located with it. You don't need to really need three hundreds or 200 firewalls one representing each cell. You could have one unified firewall control the communication between cell one to cell two, even up to cell 100 or 200 here.29:04Alternatively, what if the customer today has a distribution switch or like where this like the most of the svis are configured here. So the enter VLAN routing or router is tick. So in this case you can insert a firewall if there is NO chance to replace the switch with a firewall, you can insert a firewall as.29:24Transparent mode, which you can enforce or inspect the traffic between different cells without changing the svis configured on the on the solution switch. Now coming to network as enforce.29:44We mentioned that we have multiple options here, whether it comes from VLANs, assignment which is a traditional way, I have on my switch, ok, printers in X based on whatever dynamic criteria that I'm selecting on ice, based on profiling, based on some integration with some external active directory.30:01Group or SQL or some ServiceNow integration as we are going to see some couple of examples, but this is the foundational segmentation method that we are doing VLAN based segmentation.30:21Another approach could be access list, whether it is downloadable ACLs or named ACLs or eventually another one which could be about sgts. There is NO black and white. You must convert everything to bhgts. That is not going to be the case and it will never be the case for everything.30:35But you need to position every tool you have in the right place.30:55Plus, you must identify very clearly what is the enforcement point and which technique you are using, which type of tool you have. Let's see one traffic flow here. So I have two cells e.g. here and in step one, the classification for most of the endpoint.31:00Based on static binding from VLAN to SGT. Don't expect.31:20Frequently in OT environment that you are going to have dynamic endpoint selection. This is not the case. This is going to be the exceptional case as we are going to see in the next slide. Majority will be be will be I have one cell, I have one production line, I have one process, whatever the customer.31:26Is calling it. This will be static binding. And then for some exceptional, if I have, e.g., I want to have exclusively PLCs, so just to take it an example, the communication between sale one to cell two is blocked, but except the BLC here.31:43I would like to have interlock between blcs.32:03Between one and two. This is where you can dynamically with also cyber vision in asset inventory or asset visibility can enhance the visibility on the cat on on the eyes to get better visibility and then you can assign a dynamic. And from the order of operation dynamic classifica.32:06Comes or supersedes the static classification.32:26Then the source agts is propagated over the VXLAN here or even if it's a traditional network or Cisco metadata. And then the destination AGT needs to be propagated to enforce at the egress point, which is in this, in this.32:31Yes the edge node here and policies are enforced at the egress direction, which is a fabric fabric edge. Now, let's take a real example for what we described before and how it looks like. In this case, we have let's say one cell.32:49With one static VLAN assignment or bound to one SGT, let's call it 1010 60 mapped to SGTA. On the other side, the other VLAN 1069 which is like typical up one process here, another process or shop A or shop B.33:09And this is where you have the static binding on top, but you wanted to make sure that the blcs, which is an exceptional here, which has a dynamic SGT assignment is not going to be blocked from static binding. So in this case.33:28You must have dynamic VLAN assignment and if the enforcement point on this egress direction on this switch here, and this switch does not know because this switch does not have the PLC e.g. physically associated or attached to it, then the IB two HD binding is not going to be learned to the.33:45Which.34:05The last binding or the, the IB binding on this egress switch or edge node will be the static binding of 20. So in this case, if the switch or the egress switch does not learn the dynamic binding for BLC, which is not physically attached to any port with dynamic authentication on this.34:05The Edge switch, the action will be blocked, which is not the intention here. So in this case.34:25As an exceptional, either we have an SXP session from, from ICE to the edge node to educate the edge node about what is IB to HG binding or to have SXP from switch to switch, which is another approach.34:31But this is to to teach this edge node that be careful I have one AGT assignment for 30 for the PLC coming to this edge node. Of course, that relies on this switch will be.34:50Cisco or a 3rd party, but this is one of the topics that we are may have a separate discussion or extended discussion about it. This is assemble how the may look like eventually. So this is my, let's say level four and five.35:07And this is where we have the 3.5 here, and then we come down to the model to the, production, and you can see that I have whatever permit e.g. cell one communicate with cell one as we said, but for other cells it can be blocked.35:26One thing to to consider before we move out, the most challenge in this part is how can I make sure that I don't have a scalability or what is the best practice to consider here?35:48If you found the communication or that the similarities here for individual cells, they may are doing the same you can give them and they have let's say isolated cells. You can you can assign safely one AGT with two of them and.36:02Or this is one thing or if you wanted to make sure that the communication based on the cell location is blocked, you can create site specific agt, which is typically the case and you move out the policy management as we mentioned from the last call, some situations are considering moving out.36:18The policy management from the catalyst center to the ICE. This is one of the examples if you would like to get more granular like thousands of agts into the policy metrics from ICE. Another option we are going to evaluate in later discussion is about also trust sec domain.36:37If I have, e.g., some endpoints communicating or some communication between some cells here, site is specific and I don't need to be aware at all with other locations, then you may start to create eyes separate trusted domains.36:53Again, we have, let's say some challenges here for three topics, whether the customer has dedicated deployment for IT versus OT. It depends what does the customer requirements. So if I have, let's say isolation from IT changes, I have a software upgrade.37:10Plan I had whatever let's say a life cycle of my software, some features for IT area, but I don't want I don't want to be coupled to the software in the IT. This maybe pushing you to have a dedicated infrastructure for OT. Custom segmentation, the policy metrics that I just mentioned in the previous slide that it's not applicable in IT, so I.37:30We wanted to have separate policy metrics in IT different from another policy metrics for OT. Or different to quality of service as we mentioned. And the Cisco even validated a new CVG for OT for especially for profit.37:50I would like to have dedicated traffic flow for quality of service, and this is like separate from IT and from OT. Now, and this is the other case for shared infrastructure. Of course I have.38:04Advantage of cost efficient efficient infrastructure, so I don't need to pay twice in switches. Of course, it has a simplified administration and converged IT and OT infrastructure and then we can segregate them logically using virtual networks.38:19We have three approaches here, whether we have, which is some customers prefer to have IT in the scope of, e.g., SDA, but not to consider OT. This is the most common one, 2nd one here.38:37Where you have, let's say partial SDA distribution layer, e.g., which is a hybrid hybrid approach. And in this case, you have cells. This is not part of the SDA, but upstream from the industrial to the enterprise zone.38:53Is is the A 3rd one which has been validated recently for certain customers and this is where we have dual fabric strategy and this is where we are using PRP. 1st approach if you have, let's say according to the birding model again.39:12This is the enterprise zone down to the cell area or sell zone. This is where you have here the demarcation point for your SD and anything else downwards is non SD. This is where you can have your traditional network.39:30With all DMZ IDMZ can put your the is you can put the cyber vision etc. But nothing here is fabric oriented. So again, this is the.39:48Pros and cons for such deployment. It's of course, this is preserve existing design, NO change, and this is something that many customers prefer to start with. Okay, let's start from.40:02SDA for IT sites, we find it stabilized, we can manage it, we know how to troubleshoot it, and then let's touch OT incrementally, but not to start both of them. On the other side, this is lack of SDA fabric benefits where you cannot have segmentation down to or macro segmentation down to the OT parts.40:17But again it is pros and cons here. Of course, this is faster deployment because I'm not touching the OT at all. And we said it's best for industrial environment especially the brownfields that the customer may not prefer to start for SDA in both sides.40:37For the other one which is the most common deployments, we have partial SDA like let's say partially shared infrastructure, but the SDA is in this area or to this part of the DMZ here, or the industrial, but starting from the last nodes, edge nodes, you may start.40:58Connecting to your industrial switches, whether it is Cisco or 3rd party.41:17This gives start point of giving you more visibility and of about automation, which is what was like lack of SDA or center management of visibility, automation assurance as in the previous proposal. This will provide some flexibility and administration.41:23This is where you can have up to macro segmentation and the micro segmentation if you are going to do a static binding as well. At the end, you have shared infrastructure here, which may require very close collaboration between the IT department to the OT.41:41Okay, now coming to the next, some concepts we need to be aware of. Now, what type of switches will be connected to my last edge node, which it could be part of my fabric?42:02We have a concept called intelligent versus non intelligent and the definition here is not about how the switch is thinking, like a smart switch or not smart switch. The classification here is about I could have a dummy switch, ok? You cannot even configure it or does not even support VLANs.42:23Or even does not send bbdus or generate and this is critical, very critical part, does not consume epop or EAP overland or versus consume OVERLAN. What does it mean? If I have, let's say a switch, Cisco switch and I have a 3rd party switch here.42:41And I have my eventual endpoint here. Now, if I'm sending, this is EAP OVERLAN or even wireless LAN, this is multicast in nature, and then this nads, which is the 1st switch registered with ICE.43:00It's converting the EAP message into radius packet. Sometimes people can think that I don't see any EAP authentication coming from my endpoint. Why? Because this switch in the middle is consuming it, is dropping it. This for the for this switch.43:18Is processing it and this will require this switch to be integrated with the ICE. In this case, it's not mandatory. But this point about consuming or not consuming people, this is very critical part. Now accordingly with NO VLANs, this will be an access port according to the support.43:35Out of multiple vlans, it can support the trunk.43:55Let's see what will be for us if we have intelligent or non intelligent. Now, if I'm talking about non intelligent, according to the color codes on top here, this is a color of the cell if it's micro segment or micro segment or some AAA configuration pushed by cater center to the switches.43:59Or AAA communication for authentication authorization come from ICE to the nets or just the generic information that the infrastructure is sending telemetry back to the catalyst center. What we care about more is macro.44:17And the micro and the aaa. Now, in this case, for that unintelligent switch, there is NO triple A here configuration, but you have to be aware that there is NO VLAN assignment. It's just one single VLAN. It means that NO matter about the one cell, e.g., all of them.44:32It will be one microcell, but it will be dynamically some question on option B.44:52If I have intelligent switch, this is where you can have a trunk. So the last switch here represented in this layer or this layer will have a trunk. In this case, the ICE must be integrated with the switch itself, and this uplink is a trunk port.45:10But in this case, this switch here uplink is an access port. So pros and cons again, and this is model by model, it's not about all vendors. Let's say all the models coming from vendor X This is all of them are intelligent or intelligent. It's a.45:28Some work that you need to consider in the back end, that which models are consuming EAP messages or which is not. And you know what is the end based on the VLAN assignment dynamic VLAN assignment with AGT or static binding here. The last model here before we move out.45:49This is where we have, let's say multi fabric or dual fabric approach with parallel redundant protocol. This was mainly developed for certain, customers requesting for virtual PLCs and for some application protocols like Proofinet, of course, certain protocols or traffic flows will.46:07Then profinet, not everything in Profinet, but for very extremely low tolerance delay, that's why we are supporting now the dual dual fabric here.46:27And we are considering for parallel redundant protocol, like you are sending the packet twice to the fabric and then so you have two typical infrastructure identical here and then you are, you are getting, you are dropping one of them.46:38But that is a special setup here. Now moving to micro segmentation into IT wallet. This is this is approach.46:55Is in a phase manner manner. So phase one, we are talking about discovery of assets, which is maybe similar to what we discovered through cyber vision, but it may, we may have another, tool here.47:14Phase number two, which we are talking about, then the traffic flow behavior, which is very important. So in phase one, by the way, it's not phase one is the most difficult one actually. Phase two is to monitor traffic flows. You are not at this stage, you are enforcing anything. You are just like, ok.47:29X is communicating with y, and let me see what is the communication pattern. Step three, start creating. You may have started to apply as it is but NO con contract at all and NO enforcement. In this case, you may start to create the policies and.47:47Maybe in the phase four, when you started to select what is the enforcement model you are going to go like allow model or deny model, what is the enforcement point as we discussed, is it the firewall? Is it on egress switch, is it on a central firewall et cetera? And if it's AGSL, do we have something like trustsec monitor mode or not? And.48:06Finally, to close the cycle of micro segmentation here, you must have some active monitoring, whether it is by sign or your secure network analytics, which is similar to cyber vision but in IT wallet. Please consider it.48:26There is a common misunderstanding in the market Coming from that we must do everything at one time. It's not going to work. It's not going to work. You need to consider segmentation for use case by use case. Of course, if you have, let's say.48:44Like in the perfect wallet, everything is the traffic flows are well known, the assets they have full visibility, you know exactly the communication patterns go for it. But this is typically not the case in the market and the real SDA deployments. It comes from one topic at a time. Okay I'm taking part of my assets. How can I do micro segmentation?49:01For them.49:21I digested them et cetera, and you are repeating the life cycle. But here, the effort is decreasing because the 1st one may take longer time. You are putting the architect, the strategic thinking, the process to identify assets. Next, which is expecting that the level of effort with time will decrease more and more.49:22Because it became automatic process. Tools used in micro segmentation here. Again, we are using about we can talking about catalyst center, ICE, SNA or cyber vision if we are having OT.49:42And for understanding the behavior, for understanding the behavior for SNA or catalyst center from policy analytics or building the policy from ICE integration with stealthwatch.50:00We are going to to check one by one. Now, segmentation targets. This is subjective, very, very subjective with from one customer to another customer.50:17Some customers from the market believe that, ok, if I have sday I must have micro segment and this is Yeah is something that we cannot say that, ok, you know what? For all printers, for all cameras, they must be in separate cells or they must be in separate sgts. There is nothing.50:35Thing like that. That's why it's a very critical phase when Cisco typically works hand in hand with the customer to understand what is the business intention.50:54Let's take some examples here. I would like to do segmentation per virtual network and I'm happy. I don't want to go go beyond this. Or I would like to go for micro segmentation down to per subnet like static binding, which we had similar to the OT cells.51:03Or I which is also some subjective topics, some customers maybe confused about what is the OT exactly do you mean here? Maybe my cameras are are part of IT. Some other customers may consider cameras are part of IoT, or it is per device type.51:20You know what? Or all, all cameras will be or all printers from Zerox will be certain micro segment or based on functionality, like all printers, NO matter about the hardware manufacturer or based on the business unit membership, which is a very interesting topic.51:39Some customers may have, let's say, some concept logical concept, very well known. It's called like carve in carve out.51:59Today I'm having my infrastructure shared between multiple business units. So I would like to classify my assets. So if tomorrow I'm carving out this business unit, let's say I'm customer aBC-one.52:06And-two is another business unit, another business unit three. So all assets from business unit three classified here, let me carve them out into their own cell or could be a cell or even a dedicated virtual network. But these samples that we are mentioning on the left side here are to give you ideas.52:21What granular level or based on which criteria do we wanted to reach the micro segment level here? The Step one, which is in my opinion, the most difficult one. Typically as in the OT infrastructure, the same in IT.52:42Very few if you can find the customer has a full knowledge about what assets types he has inside infrastructure. Many customers are struggling or thriving to has to have a single point of truth for all asset inventory management.53:02Usually I'm not updated to the latest usually it requires some a manual effort to keep updating some may have some expectations that you may have some dynamic profiling, but this iterative method.53:17One example, e.g., I found with one customer that he has ServiceNow integration and he was doing, really, adding even for the asset. He is one device, he can add any attributes, but in this asset I'm not talking only about network assets like network device, but one printer.53:34One camera, one BC is adding a certain SGT here.53:52Accordingly, when I'm having ICE integration to ServiceNow, I may have an a policy at the end to get the AGT as an attribute from the ServiceNow or CMGB, into the ICE, and then you can assign the AGT.53:57As you are reading it directly from the CMDB.54:16Another approach you may have even from the description in the active directory, you can have an agentity which is another description. And then you can retrieve these attributes in your eyes external identity store here and they can retrieve a description.54:21For certain endpoints and then you're in authorization profile, you can recall this AV pair here for this description name. But this is something like assemble. I wouldn't I don't want to, let's say interpret it. This is the only possible ways.54:37Because we're going to have another dynamic way.54:57What if, I don't have active Directory integration and having this attribute? Active directory, let's say most commonly around the OU organization distribution with some other attributes of department or other other attributes, but maybe not the sity or.55:00It does not give you information about what is the asset type itself.55:20Or the ServiceNow, whether it is or CMDB is integrated specifically CMDB is integrated or not integrated or maybe these missing fields. Some customers may ask to come back to, ok, can you help me with some profiling? Historically, the ice, and this is until today, the ICE has a profile.55:24Internal engine. But with the introduction of endpoint analytics, it has been dramatically dramatically enhanced. And from the catalyst center, you can retrieve all endpoints that has been discovered from the production.55:44But does it mean that everything is perfect? No. E.g., and this is something that's interesting. You can look at it into different verticals. Why don't I have a hardware manufacturer here listed? And you can see I have endpoint type, I could have all of.56:01Operating system name or based on hardware model.56:21Or or or. So what if I selected, let's say based on the asset type or is on the hardware manufacturer, I may would like to go for micro segmentation as we saw previous slides. Or what if I have let's say generic hardware manufacturer here. So what.56:24Whatever it is missing or it has something and you wanted to override it.56:44Now, this is a real example. Of course I randomized all information here, but this is real example that I have Mac addresses and this is very important to start with because there is a very, very beautiful.56:51Regular expression for the catalyst center that you can based on certain Mac addresses, you can create a new hardware manufacturer here. So in my case, I randomized based on the Mac addresses.57:08I created with the regular expression that I matched, I ended up certain hardware manufacturer. In my case, I call this manufacturer called the missing. You can call it rock rockwell. You can call it Cisco. You can call it printer, whatever.57:23And eventually, eventually. This is really a sample of how the endpoint analytics can give you information from exporting the CSV file into an Excel sheet or CSV format and you can evaluate. And let's let's go through.57:39Through it to understand what does it mean. I have a Mac address.57:59I have an IP address, I have endpoint type, I have also information from the columns hardware model or the manufacturer, which virtual network it is assigned, where is the location, what is the VLAN, what is the VLAN name et cetera. And then some.58:04Proposed, this is not automatically created. This is something that you amend to the CSV or the Excel file by yourself. If we come back to the 1st slide we mentioned that it could be based on hardware manufacturer, it could be based on the location, it could be based on the business unit, it could be on whatever.58:22Here it can give you a glimpse or an idea that you can start proposing some edities, but you cannot say, hey, I would like to segment everything. This a co joint effort, I repeat.58:41Co joint effort with the customer. The customer himself does not have a clear security requirement to which granular level that you should create some micro cells or what is the cell definition or what is the AGT definition?58:56From all this raw data gathered in amazing format, which is exactly the main value of this stage, a full visibility about endpoints, including the missing pieces that we found some regular expressions to create from from Catalyst Center.59:11But this is where you are going to go for phase two. And this is the reality. If you are not able to reach out with other like for a clear vision, what granular level or the scope of one cell or one one SGT?59:28This is typically where the micro segmentation stops or halt. This is very critical to understand. Step two, behavior. We are not creating any AGGT now or even if we create it, it does not matter, there is NO contract. Historically, it was called from center.59:42Good called the group based the policy analytics. Now it's called the policy analytics. Now, this is something that from real lab, and this is where I got let's say let's say different aggities from, from, from the left, which is catalyst center three point X.01:00:02And to the right some other agts. Now, in this flow, you can see, OK I have, let's say from finance AGT to HR agt. And when you click on this, let's say bipe, you can understand and this is sample ports, please don't consider it for, let's say the typically finance department.01:00:20Is communicating to HR over DNS or HTB. This is just for demonstrative perspective. But the most important here, this is in a reverse engineering approach. You are understanding who is communicating with what.01:00:40And what is needed and I keep you honest, this is another project or another deep dive into, you need to validate, maybe you can find some violating communication or why finance is communicating to HR over, let's say HTTP. Why not HTBS? This requires some.01:00:53Even cleaning up the communication before into, before building the contracts at the end.01:01:14I love, I truly love secure network analytics, former stealth watch. This is also something that the customers may ask, ok, we have two netflow collectors.01:01:21One of them, the catalyst center, one of them, the secure network analytics, which is former still stealthwatch. Secure network analytics as analogy similar to cyber vision. It's working differently, but it is oriented to IT environment. When you don't have specific protocols in the in the OT cells, that's why you.01:01:37Your lovely tool here will be secure analytics. It depends. Catalyst Center has netflow embedded within the whole other functionalities. If you are talking about small medium deployment, which is a bit fluffy to say what is a small, what is a medium, what is a large, it can be totally fine.01:01:58With the policy analytics from the catalyst center as we.01:02:18The presented in the previous slides. If you have heavy amount of net flows and the dedicated product joining not only flow collections, but on top of it also analysis or even anomalous behavior detection integrated with XADR or even sign.01:02:22This is your going to be your primary choice. But the most important takeaway from this slide that you are observing on another tool, which could be an optional component here is secure network analytics. Who is communicating with who? In this case, apology if it's a bit small tool to see it, but for.01:02:41Example this is one, another cell here and you can see if it's permitted or denied or there is NO even flow or there is a special flow and you can see we are going to go to it in phase five when we can see specific flow, what exactly is communicating here and what is the final flow after.01:03:01Applying EASYT.01:03:21AGSL. Design and model policy. I hope you can understand from the sequence here, please don't rush to build AGSL very quickly. It's really approached phase. Once you understand it, it's very.01:03:22Easy to apply, it's not complicated. It is totally easy but very structured approach. And in this step, and this is my love step, where I would like to map everything that I saw, I have the my assets classified, good to certain level, you are not going to have a perfect wallet. And second phase, you have.01:03:42Observability, whatever the tool policy analytics on the catalyst center or even on a secure network analytics. And now we let's build an Excel sheet for all communication metrics, and this is where you can map everything. What who communicates either permit, deny or any specific.01:04:02Contracts or protocol allow list. If you reach this and it's visible for you, who wants to communicate with what? And this is targeted, not by chance, not someone doing port mapping or port sniffing and then he scans around 1000 port and then ok this is let's convert that 1000.01:04:21Access list entries to be matching it in the the contract between. No.01:04:41It requires from you to fine tune and filter any unknown or ambiguous or anomalous behavior before you build the contracts. Now enforcing the policy. Let's take it from what we discussed before. This is one sample.01:04:46I would like to enforce a policy. I'm not repeating again what we discussed, but I I took one sample flow, ok, I have intra VN the same virtual network across sites under my enforcement here. So this is my enforcement point. But what type?01:05:03Of enforcement technique shall I start with? Shall I hard code the enforcement or shall I keep it in shadow mode? Now, we have two models here. B.01:05:19Be Careful. Be careful about your choice. The analogy here, ok, in the traditional ACL, we would like to start off from everything is denied unless I have explicit like any traditional ACL under SVI.01:05:35Under SVI for any, any distribution switch or a firewall etc. Everything allowed explicitly and the implicit entry is denied. Don't trush into make this setting deny.01:05:52Because your whole matrix will be black. It will be a nice color or red. But this is the choice of this setting affects the whole entire matrix. What happens if you are not identifying? What is the policy associated between any two entities, so.01:06:07You can see here, e.g., in the random cell, not specified, let it permit. Please let it permit if most of the deployments and as we mentioned, the micro segmentation is a strategy, is a journey, it's not going to be ok, we know everything.01:06:25Keep some space for unknowns, for unforeseen communication flows that you are not aware, that you are not able to digest, you are not able to block.01:06:45See 1st. And that's why this is where you can recommendation to start with for most of the deployment with default permit. And this is not to confuse with default to deny within a policy. If a policy started to speak about allowed TCP portal communication 443.01:06:54AT or DNS et cetera.01:07:14Implicitly at the end of one particular policy is implicit deny. This is not a conflict or too confused. This is a model called in general default allow, and the next model is default to deny, which you have to be careful with unless you fully understand the consequence of it.01:07:17This is mimicking that everything is blocked.01:07:36Unless you explicitly permit and you have to be fully aware about every single communication pattern inside your network, about any possible entities, printers, but I thought only printers only communicating with some printer servers over the cloud, but someone doing probing or some control management from another.01:07:42Exported from another data center or etc. And unintentionally you plug this communication for this cell. So in this e.g. this cell, like if NO communication is allowed explicitly, then this cell will be implicitly denied.01:08:01In case, in case you are going to go for this option, and this is from very heavy security requirements, make sure that you disable enforcement all, all your uplinks.01:08:20On fabric devices, otherwise, the fabric communication itself, the infrastructure here, anything managed by center to your eyes will be dropped. And then that's why you have to be extremely careful if you are starting with this or you're ending up with this. My.01:08:32Recommendation please go step by step, start off from allow list.01:08:53In the previous slide default to allow, and then move slowly into the default to deny. Now, within this phase, as an optional component but still recommended, not to enforce, NO matter about the enforcement point on switch or on a firewall etcetera.01:08:57Go for monitor mode because there was there will be always and this is not something that academic that's ok you're going to configure everything will fine.01:09:17Be patient in this phase and don't trush and I'm repeating this through the session. Be patient and don't trush in applying configuration and you don't block yourself. Give yourself some chance to monitor what's going on here. And that's why this is where you can find it here from monitor mode or some it's logically called the shadow.01:09:27Eventually, eventually, you are going to find it on the center here, but what will be configured at the end on the switch, you are going to find this is hardware or software based on the traffic pointed to the CPU or transit.01:09:46To the switch, but you will find the monitor mode here. And this is where it's very important and this log at the bottom comes from a switch that has logging keyboard logging option, like let's see this one. So this is reflected in the local console of the TTY or of the switch here.01:10:04This is just like repeating what what do we expect here? This is also all of them are just monitor modes. So what does it mean? It will be allowing the communication, but you are going to be notified or you are going to get log. And that's why this is.01:10:26Where you are going to understand if something by chance blocked, I mean not blocked, need to reevaluate shall we block it or shall we keep it as a steady state condition?01:10:45Active monitoring. Now coming back to my lovely product, I know that we are talking about catalyst center and we are talking about eyes, but also really secure network analytics is really, really your eyes or Googles.01:10:57Inside IT world, if you are wanting to do beyond NetFlow collector or and you go deep dive into monitoring what's going on or some anomalous behavior deviating from the standard or let's say not normalized according to your traffic flow. But again, another full discussion as for cyber vision.01:11:14The same for secure network can happen. This is phase five active monitoring. So in this case I have my let's say aggts and I hope the screen or the resolution here is better. So here I could create a report for all AGT communication.01:11:34And now this is something important to see at the end. Then in if, e.g., if there is any deny here, maybe it's not displayed in this, but one said e.g. X is not able to communicate with Y AGGT or whatever. This is where I click on the security.01:11:52And they can give you all the flows and whatever whatever it is permitted or denied. In my case, e.g., I have for one guest virtual network or guest, sorry SGT.01:12:12But this is the AGT name, and it could be also agt ID, so it's not mandatory to be name or ID like number. It could be both. Here for simplicity I used AGT name. And the communicating with any network device or any other service.01:12:21This is where I have, can can the security network analytics can show you exactly who is communicating with what, which protocols, what is the IP address and from the managed column here, you can filter the information. You can get the user information, you can get exactly the destination trust.01:12:37Like ID, not only the name etc.01:12:57But this is exactly when you wanted to make sure if everything is in control or violating actions because it's another life cycle again. Real SXP deployments, and this is from one customer had a real deployment for, we mentioned SXP in case you are looking.01:12:59Looking for.01:13:19Enforcing your traffic. E.g., when you are leaving your fabric, but this egress point e.g. we called it like fusion switch or it could be a router or it could be any other components or any as we saw even in in OT when we had traffic flow on egress or edge node, which.01:13:21Is not physically attached to the BLC.01:13:41That's why we need SXP. Why? Because we need any enforcement to happen for any SGSL to to be downloaded to the switch. You must be aware from the source IP to HG binding to the destination IP to SG binding. There are some info tools they can learn this, either source and line tagging.01:13:43Like Cisco metadata or we are doing it in the fabric using VXLAN or using SD WAN technology, we are doing it with VX SD WAN tunnels which kind of modifies IPsec tunnels.01:14:03But this is the methods that you are learning source you are learning. But what if the destination or the enforcement point here is not aware about destination, something you create located on data center or another non fabric site?01:14:17Or another or cloud, and this is there is NO IP binding over here. This is where ICE needs from certain personas, which is like the SXP they are designating or nominating some psns to act as SXP speaker.01:14:34And this is where we had eventual some deployment. I cannot go deep dive into detailed discussion for SXP, for a scalability, not only because of the scope of the, of the call we are trying to do from segmentation perspective, but also for the sake of the time. So I really apologize if I'm trying to give glimpse about some.01:14:52Two important topics to cover the whole journey, but I know that every single topic is a whole separate discussion.01:15:12The last section I would like to end with or let's say the ultimate one. There are another one, but it's very small. This one, what are the typical connectivity between the fabric sites? Whether we have, and this was demonstrated from our colleagues in the road.01:15:22And the terminology from session of 7th of October by my colleagues.01:15:43But worth it to revisit it again quickly. So either we are connecting the fabric or the exit point from a fabric using IB transit or is it transit. In this case, we are talking about we have options either I'm going external connectivity through a switch, through a router as we saw the traffic flows from enforcement point or a firewall as.01:15:48Optionally like physically in path or logically in in path. In this case from some old version now we can configure your peer IPs and this is not a challenge anymore as it was for a while that you can especially when when you have a fusion.01:16:08Firewall and this is a cluster, not only/thirty one or randomly selected IP, but you can make it you can designate what is the IP in advance for your peer and for your local IP address and what is the mask.01:16:28Now, other option we can consider for the VXLAN, which is I cannot call it the primary or the best option. Again, it depends on what is the WAN technology here and some other considerations. And we are going to go for some real discussion with the customer.01:16:43To see how we ended up. The VXLAN, something to make sure that fully aware of the VXLAN into you should consider at least 60 bytes headers.01:17:01Including the IP headers, just to make sure that you can carry AGT as well. So the minimum MT you are looking for for your WAN connectivity 1560 plus. Now, why is the transit?01:17:16Everyone talking about it, you must have it. You don't need to have it, but it's preferred if you can have it because it provides different options that without it, it maybe a challenge to achieve it without. In this case, e.g., this is a normal traffic flow between two fabric sites.01:17:34And you can see from this small animation that this is another approach, which is if I have shared internet from one location, so in this location, this is internet provider. So like this is shared shared site. Okay, this site does not have local handoff.01:17:51And it goes from VXLAN for the default route. Of course, this is not proxy HR as before. As we described it from previous session, there is NO proxy HR or hard coded proxy HR from Lisp pops up. This is historically from Lisp PGB.01:18:11Or you can go for if I have, let's say each quarter or a headquarter, this site which maybe connected to local shared services here, shared service. This can be providing specific routes, and we mentioned this is one of the very few examples of.01:18:28Sure anywhere border nodes. Back to the session of 14th of October, you can find the details discussion about how can you select your border node, but this is one of the specific questions, solutions for any border.01:18:47Another solution relying on a VXLAN into which is MSRP, which is in a nutshell, is how can I get unified IP pool across all fabric sites, one site here, another site here, another site here, and all of them are tunneling their traffic.01:19:00Back to my anchor controller.01:19:19For anchor control node. So it has one centralized internet. So it's not this is centralized internet, so I don't want to have local breakout, e.g. or different subnetting here. It will be let's say/sixteen. So many customers may start I have for the whole guest 172.01:19:22To sixteen.zero to zero.01:19:42Slash 16. I don't want to go for individual fabric sites to have.third doctor.one, another site 3rd doctor.three, etc. I would like to go for one unified unified pool across all sites and I wanted to control all traffic.01:19:45Internet breakout from one location, e.g., here. This is where the firewall exiting the to the internet. This is typical solution relying on multi site remote border when you are defining the anchor versus anchoring sites. Similar concept as we have from today the wireless LAN controllers.01:20:04When you have ethernet over IP tunnels, some overlay protocol here, in our case, we are relying on which is kind of another use case from the other four use cases for transit, but this is where you, you would like to have VXLAN also in the end.01:20:22On the cost of MQ. Just a word to mention here and this is something that you may have a concept, let's say or a challenge that it must be 9000. No, the minimum requirement here 60 bytes only.01:20:39Specifically 56, but let's say 65. This is where you you need only for this topic. Just to take away here before we leave it, this is where a border control node or transit control node cannot be a different role. It must be a unique role.01:20:58So it cannot be. It's acting as, a route reflector when it's just like I have one border here, one border here, so this is site one border node or control node, and this is site two CB two. Of course I was assuming.01:21:16Border under control. The traffic flows for the does not go like this. This is nothing more than as analogy to BGB as a route reflector that just like sharing the information from Lisp for register the summary subnets to each local control node, what is the destination VTEP that you should establish your eventual tunnel?01:21:33That's why the the forwarding traffic is not passing over the transit control node ever. Make sure that you have always, always/thirty two routes for the loopbacks between all nodes. Don't aggregate, don't aggregate.01:21:53Real discussion. So, we had, let's say option E and option B So option A we had let's say over one customer with one SD WAN transit network here. So we had.01:22:12This advantage of using SDA transit. So advantage of SDA segmentation as the sgts are is transported. No dependency on my SD one and this is simplifying the enforcement point on the egress fabric edge. On the other side, the VXLAN.01:22:29Headers 50 bytes, more, let's talk at 01:56 just to be inside, but this may create some challenges for some traffic inspection. Ideally speaking, you should manage it by TCBMSS, which was introduced in cater center a while ago.01:22:47But unfortunately until today, some customers may not be confident enough to evaluate. Maybe this is TCP is going to work fine, even on the wireless and controller can go for your access point configuration on 9800. You can find access point to TCP MSS is by default adjusted to 1250.01:23:06But the ambiguity here comes from what if I have UGB applications that I'm not, I'm not aware of what is the payload here and why should I go for segmentation? And I don't know if, if the some application is sending don't to fragment a bit or not.01:23:25Still there is some uncertainty although majority of UDB applications are small payload size, but it's still a concern to be considered. Another aspect here, e.g., as an example, but other considering another, this is application that we're routing. If I hide the original payload.01:23:41From my border nodes. And I mentioned this is e.g., I have my border node here, I have my CH here.01:24:01And then I have SD WAN and I have another SD one here and I have my border node here and the transit control node somewhere here. This is TCP transit control node. Eventually I have VXLAN over here. So I'm hiding the original payload.01:24:08To the LAN interface of my WAN connectivity. No matter what I wanted to do with it, maybe in this particular case, I had application routing, so I wanted to see this is Microsoft Microsoft 3650 or another team meeting or or.01:24:23That I need to route it specifically based on certain SLA. Now I have the encapsulation, and this will hide this processing from the SD WAN unless some deepaket inspection is enabled. It's another story. On other side, it could be for also some net flow. What if today I have what.01:24:39Netflow destination here, but I am relying on netflow. My payload now is encapsulated inside VXLAN, so I'm also hiding this information.01:24:59That's kind of sample of pros sample of cons here or disadvantages. Advantage here, of course, end to end segmentation, good news that it is over IPsec or is the one tunnels to be very accurate. And this is NO additional effort to evaluate the which which traffic.01:25:08Is taking small payloads or et cetera, and this advantage is that I'm relying on V edges or C edges or any hardware refresh here or dependence on my one provider.01:25:27The discussion was to go for SD WAN as SD WAN transit as a primary option and then we can consider SD transit in later stage. For awareness, although the session will end up in 2 min, ideally, but according to the topics and I know it's a little bit heavy, but we may expect.01:25:39Send for another maximum of 15 min. I hope the audience can have find the time to stay longer. If not, it will be a recorded session of course.01:25:58Large fabric design. Let's start from a typically challenge which is a special use case from SDA. If I have a customer with a larger site, a larger site, e.g., and.01:26:08Has multiple distribution block. This is one distribution block sharing one common distribution switch with common IB schema, another one, another one etc. And he's looking for, I have one particular virtual network called corporate VN.01:26:22I wanted to make sure that it is a spanned across multiple distribution blocks. By the way, multiple distribution blocks could be one building, one floor or even group of buildings sharing the same distribution network, like same common SVI. But the common thing here I wanted to keep my VLAN.01:26:39At the end mapped to the same virtual network unique across multiple distribution blocks, but the IP mapping is different. So in this case you can see from this small animation that I have same VLAN here.01:26:59Name called VLAN corp mapped to different VLAN ID five oh one five oh five etc. It does not matter. And the different IP, IB one, IB two, IBC until IB six.01:27:12This is a challenge. What is the default? Default behavior from catalyst center is going to provision the whole fabric with the same VLAN and it will be pushed on all fabric edges. So if this is let's say one building, I don't want a laptop. If I'm going to connect to my laptop in this network.01:27:30Work to find any IP availability from this subnet ten.ten.ten.0/ 204I don't want to find. I wanted to get only allowed IPs from 20 2020 zero.01:27:50So by default Cater Center will span the anycast gateway over the whole fabric edges. And let's talk about the solutions here. We have three proposed solutions, either it is fabric zones.01:28:02Or VLAN group or multi fabric design using one single fabric zone. This let's discuss this is summary, NO need to go for the whole text. Let's go for directly the slides with the fabric zones, which is typically the recommended solution. This came too.01:28:18To address two, two use cases. One of them that we mentioned already, the customer has same VLAN name across multiple locations and I or multiple distribution blocks and I don't want to get some subnet with certain IP schema in different block. Another challenge here fabric zone addresses.01:28:34Is provisioning certain vns in certain locations. What if, e.g., if you have 9200 switches and this is you cannot use more than four vns. If you can correlate this to excuse me.01:28:54To the hardware basket we created in the previous session. Okay, but can I use 9200 in a switch in the fabric? Yes, you can use. But given that you are not going to provision more than four vns. You may consider this switch in certain location when you want to, this specific VN to show up only.01:29:09In this case, you have normal VXLAN communication.01:29:29Between edge nodes and in this case here is the same. VLAN, I have mapping it to fabric zone one to one.zero in fabric zone 220 and in the default zone, which is the default zone by default unless you're carving out from it and you're creating explicitly your individual fabric zone.01:29:33A gentle reminder I know I'm talking from high level perspective, this is not configuration session or not attended, and I know that every certain topic requires deep dive. So just to remind that I'm talking about what aspects shall we consider in the design, not how we are going to configure this.01:29:53And in the some advantages here of course will be that we have simplified design, NO need for hardware segmentation is into different zones, and this is can be for larger sites. But of course, it requires some additional layer of configuration here. At the end of the day, you are limited to 1000 pools.01:30:16For the whole fabric?01:30:35And you are going to share one infrastructure for IT and OT back to the discussion. This could be for some decoupled SLAs, NO, I don't want to have the availability for IT infrastructure, same as OT. So this is one thing. And another point to be considered here, be aware that the wireless.01:30:37Controller, the three components that are not considered part of fabric zone or aware of fabric zone, control wireless and controller, border node and control nodes. What does it mean? If a con wireless LAN controller.01:30:57Will have a decoupled wired and wireless subnets. That's who is going to work. If you have the same wired subnets coupled between wired and wireless, you need to consider this in a separate discussion with Cisco.01:31:10VLAN group, this is another approach here. We are doing it from traditional iOS, even it was introduced before iOS XE, when you can map individual VLAN, the same VLAN name and distribution block one to one IG, let's say ten, another block to map it to this VLAN list like 20 etc.01:31:28So this is kind of a workaround that you are using the same VLAN name.01:31:47That ICE is pushing, so and this is a simplifi the simplification we are looking for. How can we get one unique VLAN name pushed by ICE? And then I'm going to recolorate to different VLAN ID, which is mapped to ten.ten.ten or 2020 or 30 to 30.01:31:52There's another option. A 3rd option which is typically used, but on the cost of hardware, if you are going to have a multi fabric within the same campus. So practically speaking, this is a whole one single campus network.01:32:12Logically separated into block one with one complete fabric because the fabric does not equal SDA campus or campus site. Fabric is logical perimeter. You can exclude exclusively take one building and you make it make it one fabric or you can make the.01:32:31All canvas as one fabric. In this case you are you are going to have all individual components, border node with redundancy.01:32:50Embedded wireless line controller, layer two border nodes if needed, et cetera for everyone, which is big difference with the previous model since you are going to add additional hardware for control node, for border node, but it will give you amazing, a chance to decouple.01:32:58The dependency from let's say if failure for the whole control node, the whole fabric is not going to fall down. At the same time you are going to have not have a challenge of wired and wireless LAN mapping if that because you are going to have multiple wireless LAN controllers.01:33:14Now, last topic to finish or wrap up with, what should we consider if I'm going to migrate large campus based on what we discussed? Okay, now I know how can from.01:33:36View can I put my ICE policy to have one unified VLAN name, whether it is with VLAN group or it is with fabric zones or even different fabric sites within the whole campus? Thank you. How can I migrate it? What should I be? What should I consider in my migration?01:33:52You should consider the following. This is when you are migrating from current method of operation to the FMO. What is the IB schema? Are we going to change it or it will be sticky?01:34:09Is it per virtual network or generic? Is it easy to change the IPs or not? Majority of cases NO especially with the OT as we mentioned. Level of effort for changing, let's say, ok, some like clarification why it's not easy to change the static IPs because there maybe some static files.01:34:25Firewall rules that somewhere else in the same campus in a data center or whatever that does not allow you to change the IPs, otherwise the associated rules on a firewall or netting policies or or or can be impacted.01:34:44Or at least it must be updated. And then are we talking about what is the scope of each distribution block that you can partially migrate? And this is what we are going to come to the challenge more visualized so it will be more illustrative.01:34:59Here I have, let's say, a migrated part, migrated, let's say a portion of the network and non migrated. In this case I have two subnets. One, I must stretch and that's why in, in blue color, this is the same subnet ten.ten to ten.0/ 24 and.01:35:17On the non migrated side in the non migrated part not yet. So in this case I have to stretch.01:35:36A layer two handoff here. Oh, another subnet is new. Okay, I have whatever number I have with a subnet and it was before something else. Which approaches do we have? Approach A, approach B, approach A.01:35:43Which is like partial migration. Also from the discussion or the sessions that presented by CSS or expert inside series from October, there was a talk about layer two border. It has been intensively discussed in our, this last discussion.01:35:5914th of October, where we have some dedicated node called layer two border nodes, which you can stretch the VLAN between one distribution block to one one fabric to another fabric. Here is the thing.01:36:19Here because here I wanted to stretch. I have one subnet stretched. This is partially migrated I cannot make it in one maintenance window. Everything moving into the fabric. I have, let's say 70 switches, I cannot migrate all of them. I have many access points etc. So I must split it.01:36:35The challenge here even is more if I have FMO network operated by provider B, versus provider A This is where it is a challenge that you are going to allow eventually the future method of operation FMO.01:36:54Managed by one provider while the current method of operation can be managed by another. But this is a special case, it could be also the same customer here. But in this whatever we have the same provider, same customer or different management, we must stretch layer two between the border nodes.01:37:14Now, if a customer does not want, and this is the corner case that I mentioned, if there is different operational team and we wanted to have ownership, total ownership for one entity managing it because in the other solution.01:37:33You are going to have the current solution here, if you are going to stretch it here, excuse me, this is where you are going to have a gateway outside the fabric.01:37:50Now, if my current information, my current network, today have the gateway here, let's say SVI is configured here, and these endpoints have been migrated to fabric. They have the SVI as any casting gateway here. Now, you cannot, the border nodes by default creates SVI here as well. Where.01:38:06You can put this as we I.01:38:26Either on the, this new layer two border and it will act as a gateway for these endpoints or you can remove it and make it only on this one as it traditionally today. Most of the customer prefer this. The option, keep everything intact on my layer two my distribution switch. But again, you must understand or must make sure the scope here.01:38:28Will I have conflicts or inconsistent operational that the gateway imagine imagine that you you push the gateway here and now someone from this endpoints are complaining. Where is my gateway? My gateway is here, so, but my infrastructure is here.01:38:48But unfortunately your gateway is here. This back and forth in communication here is can can create some confusion and the only takeaway I would like you to focus is to make sure what is the scope of when the solution block and to align from level of effort from the maintenance window 6 h 10 h, only whole weekend.01:39:05And et cetera, what will be the scope of one batch of migrations? Is it going to be the whole distribution block or partial distribution block with layer two handoff if needed? With this, I would like to stop here and I give it back to my colleague Alex.01:39:25Apologies if I extended, but I hope the session was informative for you. It was I think it was very informative to be honest with you, I wanted to do some other things but I had to watch it till the end because it was very detailed and time informative. We have.01:39:44Two questions that you probably can answer quickly. The 1st one is is it planned that catalyst center can help with firewall routing?01:40:04Center can help with firewall routing? Routing. Yeah. No catalyst center cannot automate the configuration on the firewall, but the catalyst center Cater Center here is only doing the automation up to the border nodes, but if the firewall is considered for fusion layer.01:40:17The fusion layer, NO matter if it is a switching platform or firewall, this is not automated by the center. Yeah, that's that's what I know as well and one more quick question a customer asks any additional actions to deal with low MTU.01:40:32In one for SDA transit greater than 1560 and less than 9100. No, you are in the safe site. If you are passing the 19 1560, you are in the safe site, you shouldn't be worried about this. That's why I was careful when.01:40:52I mentioned it yes the headers even from i <CAP>EE standards are mentioned. 9100 was presented to to from LAN automation, but this is not hard requirement.01:41:12If you can go without it, that's the minimum is 515 60. Perfect. Thank you, thank you tomorrow and thank you all who stayed until the end. As I always, if you want to contact us, you can use our email at the bottom and nick's.01:41:25Does CSS does EMEA@Cisco.com. The recording so far this plus previous.01:41:45Sessions and upcoming sessions can be found in CS.CO/backslash EMEA that's EIS that's this one and if you want to see sessions from other technologies as well, if you want to see this paged this community.01:41:53You go to this link assist.co backslash emea. That's EIS that's booked 26.01:42:14One last thing, we have the post webinar survey. We can, we need your feedback, you can provide your feedback, and you can also request a one on one if you want to contact us for further information on any of the topics of this or the other sessions. I have also pasted.01:42:27In chat a new way to contact us. You can schedule a meeting right now so if you click that link, you can choose your slots and we will contact you to see what information you need further and how we can we can engage. With that.01:42:46We thank you for your attendance from Mina Sabah and myself Alex. Thank you. Have a great rest of the day.01:43:07