SDA Design Best Practices - Terminology and Concepts

I welcome you to the EMEA Cisco Catalyst Center Expert Insight series for SDA design best practices terminology and concepts.00:00Presenters for today Mina Sam and Miguel Valera. What you will hear and see will be guidance based on Cisco's recommended best practices. It's your decision to employ this guidance, to use it, to design to change your design or.00:20Your business needs. We are here to support you and you can always contact us@cisco.com, you will see those emails and links at the end of the presentation. Today's session is 2nd in the September October schedule.00:40But also the 1st for.01:00The SDA series. The next next Wednesday we will have architectural alignment sizing and scaling for SDA networks and we finished this series on SDA with advanced segmentation and multi site deployments on.01:0321 October in into Wednesdays.01:23Couple of things on logistics you are muted on entry and you can ask your questions in Slido. The Q and A panel is removed from Webex, so now we have the Slido application top sorry bottom right corner.01:29You will see the button for applications, so you click that button Slido opens and you have the questions and the answers. If you have any technical difficulties you can use chat and we will try to assist you as soon as that is possible.01:47Few more details on on Slido, you once you open the panel, you have this field where you can ask the question. Over here, you click send and we see your question and we respond. Now, you may.02:06Wants to use this button recent in order to see the questions in a sequential order. The default is popular and this is a bit confusing. Any eh questions that will be left unanswered well.02:26During the session will be answered afterwards. We will send you email with your answer so we have NO questions left and answered at the end. And with that, I'll welcome Miguel and I'll pass the ball to Miguel for.02:43The agenda and his part. Hello? Good morning. Good morning. Thank you Alex. Let me share my screen real quick. But yeah, as Alex mentioned, I will be covering SD access fundamentals today and terminology and concepts. So.03:04We'll be covering what 1st we're gonna start with why Cisco SD access. This is to allow us to understand why we need SD access, what is the problem that it solves, what are the benefits of SD access, then we're gonna jump right into the roles and terminology so you understand what are the basics of SD access. So when you are configuring your fabric, you understand what are the roles.03:24What are the functions that we'll be doing in the fabric and the terminology? Then we're gonna be describing the fabric internal mechanisms to understand a little bit better how is the access works.03:44Then we're gonna see once we have covered the SD access basics, like the fabric basics, we're gonna explore how to connect the fabric to the outside world to your external networks. And then after that, my colleague Mina will be jumping into wireless in SD access, device onboarding, SDA extension, how to extend.03:56There is the access fabric and then we'll be, we'll be covering SD access new features, so new features that will be available on recent releases of catalyst center.04:16So without further ado, let's jump into why Cisco is the access, why should I bother about Cisco SD access and why should we implement it? In order to understand the benefits of SD access, we 1st need to understand what are the challenges that we have with networks to do.04:27Okay, so traditional network offers.04:47Some challenges in terms of deployments, in terms of security, wireless and wire challenge, e.g., in the traditional network, when you are declaring a policy or an access policy, you have to consider the wireless policy and then the wired policies because it will be different. And then we also have network operationship.04:52Challenges like monitoring, troubleshooting and understanding what is happening in real time in our network.05:12So that is solved or those specific challenges are solved in Cisco SD access. So Cisco SD access is an intent based networking solution on which you will be declaring your intention on Cisco Catalyst Center will be the that will be the main orchestration.05:18Platform and there you will be declaring your intention and then that intention will be translated into your configuration to your network devices and that configuration will be automated for you. So you won't have to go and and and deploy that configuration on your network device. So that will be offering you one automation.05:38The network fabric and that fabric will be a single fabric for your wired and wireless.05:58And that is important because again, when you are defining a policy on Cisco as the access, it doesn't matter if the user is connecting into the wireless of the or or to the wired network. You also have the identity based policy and segmentation, which is completely decoupled from IP addresses, and we're gonna explore.06:05Little bit more on that.06:25And you will have AI driven insights and telemetry with Cisco as the access. So once you declare a policy, let's say you define a policy restricting or or allowing traffic between different segments on your network or different groups. In a traditional network, you know that we have a lot of show and debug commands that we can.06:27And introduce box by box in our network devices, but then you have to interpret those commands, you need to.06:47Identify the things that you want to identify and that can take some time. But Cisco has the access and catalyst center that is way easier because you have AI driven insights and telemetry right away. So just to see.06:55To show you a small comparison between a traditional network and a SD access network, and let's let's compare, e.g., let's imagine we are deploying a new network today, a few switches, a few routers, and we just want to provide access to our network devices, to our users. So in a.07:10Traditional network management part, they can we need to go box by box configure them via CLI, SNMP or basic management tools. With Cisco as the access we have that centralized orchestration via Cisco catalyst center. The network architecture of a traditional network will be monolithic, so you, your topology.07:29It will be dictating the subnet, the routing, and the access control. In as the access, we have two layers, so that that physical topology is decoupled from the the logical topology. So you'll have an underlay and an overlay.07:49And in terms of segmentation, the traditional network, as you, as you guys know, you will need to declare and plan your VLANs, after your VLANs you need to declare your subnets or your IPs, and then once you have that, you will need to define which ports will belong to what VLANs and then you will need to define.08:06Your access list and what interfaces will be affected by those access lists. So all of that is manual process that take a lot of time. In SD access you have identity based using a scalable group tags and independent of IP and that allows the policy to follow the user regardless of the ports where it's connected.08:27And regardless if it is connected via wired or wireless.08:46So, and also the SD access is based on LISP protocol instead of mainly on our routing protocols for the control plane, and we're gonna be exploring that a little bit later. So another small example before we continue, let's imagine that you are deploying your.08:51For a traditional network.09:11And again, this, the example of our switches, you need to go and configure your interfaces, define your trunk, you need to take into consideration the dynamic trunking protocol, how the trunks will be negotiated, then spanning tree, then if you want to define layer three access, you need to.09:14Coordinate the root bridge with the your 1st redundancy protocol.09:34All of that, all of those details you need to take into consideration and plan it really well or you maybe having issues like routing issues or loop issues with spanning tree. With SD access those problems disappear completely because the data plane is based on VXLAN and you have embedded HTTP metadata across your router layer.09:39IP underlay so you don't have spanning tree loops and the policy enforcement is way easier, so you don't have to be creating and and and managing big access list. So you just have micro segmentation, so you have a policy matrix managed centrally managed by ICE and catalyst center. So all of them.10:00That's the management, the troubleshooting, the monitoring is way easier with Cisco SD access.10:19And also the policy enforcement. So now that we understand how SD access solves the main issues of managing a network in a traditional way, let's jump into the roles and terminology. And in order to start understanding the SD access, we need to understand what is the fabric because you will see.10:25When we're talking about SD access, we use the term fabric very often.10:45So a fabric is an overlay network that treats an entire group of interconnected devices as a single unified intelligence system. So that logic or over logic topology or overlay network is managed by by center in the case of SD access. So instead of managing.10:51In each network device independently, as I mentioned before, with separate configuration like subnets, VLANs, the fabric decouples the physical infrastructure which is considered or known as the underlay.11:11And the logical topology on top of that physical topology is known as the overlay. So what is an overlay? And again, the overlay is a concept describing a logical topology or or a logical network.11:24But this is not a new concept. An overlay network, as I said, is a logical topology to connect or to connect like to virtually connect devices. And you have been, you have been using that with technologies like GRE, MPLS, IPsec VPN.11:42So on on SD access we use VXLAN when we have been using VXLAN before for other applications. We have BGP EVPN, SD WAN, ACI.12:04And overlay to visualization. So all these technologies exist already and are used to logically connect devices under an existing network infrastructure and create a logical topology, that is what is considered an overlay. So you will see that you have your existing.12:13Physical network and on top of that network, which is the underlay, you will be creating your logical network, which is the overlay.12:33So, on the overlay, on the fabric, you will see the the control plane and other components of the fabric that we'll be discussing in a few moments. So the benefits of doing this is like the overlay is very simple and manageable. Maximizes network.12:42Reliability.13:02The services are delivered using the overlay. It improves the user mobility because now as I mentioned, and you will see in the details that we will be covering, a user can connect to a, to a switch today, move to the wireless or to another switch in another site and the policy will be followed.13:04Doing that user without you having to configure interfaces, trunks or access lists.13:24So the underlay is the physical layer three foundation that provides basic IP connectivity and hope by hope transport across all fabric switches and routers. So the underlay is your physical existing network. In SD access, the underlay, when you especially when you deploy with LAN automation, the underlay is a routed and it is going.13:33If you're doing manually also it is recommended to configure as a layer three router access.13:53So with that, you will be getting rid of spanning tree and all the headaches that it provides. Typically runs an IGP protocol such as ISIS or OSPF and because you're not using a spanning tree and you are running a layer three protocol like ISIS or OSPF, you will be also leveraging the equal cost multi path.13:58Technology for load balancing which will be making a more efficient use of your links instead of blocking redundant links as a spanning tree does.14:19And as you can see, the primary job of the underlay is to carry encapsulated VXLAN list traffic between fabric nodes. And we'll be describing that in a little bit more detail later on. So, for the concepts.14:28For SD access, now we understand the overlay and underlay. Let's jump into the concepts. So when we are creating or planning to create our SD access network, we need to understand there are some mandatory components. We need to have Cisco Catalyst Center, which will be there as I mean, as I mentioned before, it is the orchestration platform that I will.14:47Allow us to manage our whole infrastructure, and it provides a graphical user interface and APIs for the automation of wired and wireless devices. Then you have the fabric border nodes, and we'll be describing that later on, the edge nodes and the control plane node.15:07So what are those? We'll be describing it in a few minutes. Optional components, it is Cisco ICE services engine, Cisco ICE identity services engine. Even though it appears as optional, it is highly recommended and I will say, I will say.15:26The almost mandatory because one of the main benefits of SD access is the policy enforcement and the policy plan as we will be describing it, and you cannot enforce any policy without Cisco eyes in integrated with catalyst center. So another optional component will be the fabric wireless controller so you can have fabric access points and.15:45Requires LAN controllers.16:06To have SD access wireless. Then you can also have extended node, which is which will be a switch operating at layer two that extends the fabric connectivity and optionally enforces micro segmentation policy on your network. Then you have the intermediate nodes, which are the the nodes.16:08Typically main of your underlay that moves data between fabric nodes and can be one or many hops.16:28So for the definitions, as we saw, one of the main and mandatory components for a fabric is a control plane. The control plane node acts as pretty much the brain. It it keeps it is based on LISP.16:35Map server and map resolver. So it keeps a host tracking database to keep track of where the endpoints in your network are located. So this host database supports multiple types of endpoints ID lookup type like IP four, IPV six or IPv six or Mac.16:52And that control plane node, this highlighted in green, e.g., receives endpoints ID map registration from the edge node border node and fabric wireless LAN controllers. So what happens is when we have an edge device, which is the equivalent of an access switch on the fabric.17:11When have an when we have an endpoint connecting to this switch, this switch will register that connection or register that endpoint to the control plane node and say, hey, I have this device connected to me. And then that control plane node will be keeping track of that. So when another device, when I know when another's endpoint, like e.g..17:31This one here wants to connect.17:51To the initial endpoint, that switch, this switch will go to the control plane node and say, hey, how can I find the host with the IP address 1.2.3.4? And then the control plane node will say, ok, this endpoint is connected behind this switch, and then this switch will have the information necessary to.17:53Start switching the the traffic to that destination, and we'll, we'll see the details of that a little bit later.18:13The edge node, as I mentioned, it is the equivalent of the access node on a traditional hierarchy, Cisco hierarchical model and the edge node is responsible for authenticating and authorizing wired endpoints. Example, e.g. two.1X authentication MAC address.18:22Base authentication or static authentication in concert with ice. Again, we can say here in order to authenticate those users and to enforce policy.18:42We need ice. The edge point the edge node register the endpoint's IDs with the control plane node as I mentioned before, and also provides an anycast gateway, which is second that I will be describ describing later on, but it's be pretty much anycast gateway is an IP address a layer.18:52The three IP an IP address.19:12That will be providing access to the endpoints to the access whole to the endpoint devices and that will allow connectivity and mobility to that endpoint in the network. So that's one of the main things that allows that a user can move to anywhere in the SD access fabric.19:14Because this edge edge devices or edge nodes are providing this anycast gateway, and we will be describing that in more details in detail a little bit later. Also the edge node provides VXLAN encapsulation, so once the edge node knows how to reach a destination host, it will be creating a VX.19:34Plantonel.19:54To the switch to which that destination is connected to. And we're again we're gonna see the details of that later on. So the border node is the fabric site entry and exit from the network for network traffic. The border node, you can think of it like like as your gateway to.19:55Go out to network outside your fabric.20:15So again, the border nodes subscribe to the control plane node, IPv four and IPv six tables, and you will have four types of border node. We have the external border node, internal border node, external plus external border node, and a layer two border node. And we're gonna see the.20:19Details of that.20:39But the main idea here is the border node is that the exit or entry point of your fabric to external and from external networks. So the external border node, which is the most common configuration will be exporting all the traffic subnets.20:41To outside the fabric as an EBGP summary routes. It will be acting as a gateway of last resort because it will not be registering or importing external networks to your fabric. Instead, it will be acting as a default gateway, so you will be like having like a default route pointing to the external.21:00World.21:21Through that external border node. The internal border node, so you will see you will have enabling layer three handoff in catalyst center and this selecting the default to all virtual network checkbox. This internal border node will be exporting all traffic subnet.21:22So outside the fabric side as EVGP summary just like the external order node.21:41And it will be importing and registering EBGP learn IPv four and IPv six prefixes from from outside the fabric side into the fabric control plane. And it will not acting as a gateway of last resort for unknown network.21:47But it will be acting as an exit point for the network that is injecting into the fabric. And it is important to understand here because we'll be covering another picture of SD access later on that this border node will be.22:03Injecting those prefixes or importing those prefixes from outside the fabric, to the control plane using BGP or IBGP.22:20And we'll, we also have the internal plus external border node. So the external plus external border node, again, we'll be exporting all fabric subnets outside the fabric site as EBGP summary, and it will be importing and registering the EBGP learn prefixes from outside the fabric side into the fabric control, so it will be injecting.22:35Specific subnets from outside the fabric into the fabric, and it will also acting as a gateway of class resort or the fabric. So you just select default to our virtual network and leaving the the node import external route unchecked, and that will be configuring that node as an external plus into.22:55Internal close to external border node in your fabric.23:15Then this internal external border nodes are just basically a layer three border nodes, but we also have the layer two border node. The border layer two border node will be acting as a layer two handoff or pure layer two overlays or layer two plus layer three overlays, and that.23:19Will be allowing VLANs translation between SD access network segments and non fabric vlan IDs, so when you have, when you need a layer two connectivity between your fabric and outside your fabric, you will be using a layer two handoff.23:39Which is done in a layer two border node. When you are planning to do dual homing, like having multiple devices, doing the layer two handoff or multiple interfaces, you need to have link aggregation because s spanning tree is not tunneled within the SD access fabric.23:55So it should be also even though you can configure a layer two border node and a layer three border node on the same device, ideally it should be separate separated. The the roles should be separated, so you have, it is recommended that you have a dedicated device for layer two border node and a separate device for layer three handoff.24:14Then as part of the fabric components, we also have the fabric enabled wireless. My colleague Mina will be covering that in more detail, but pretty much basically is a fabric enabled wireless for unified management and policy data planes. So you can have the same policy.24:39Policy for your wired and wireless network.24:59So you have the fabric wireless line controllers accessible through a fabric border node that is on you know on the on on the underlay and can be several hops away. Fabric enabled access points are in a dedicated IP range and communicate with the fabric wireless LAN controller using the cap web tunnel or controlled traffic.25:02And this is something that I, I would like to highlight and something that I really like about is the access wireless. The fabric access points.25:22Switch endpoint traffic to the adjacent node or e.g., if you want to, if you have a wireless endpoints wanting to connect to another wireless endpoint, normally in a traditional network, you will see that that traffic will go through the tunnel to the access.25:31To the wireless LAN controller and then to the access point and then to the.25:51And the last destination endpoint. In SD access, that traffic is sent to the edge node from the access point to the edge node, and from there is switched using VXLAN as as wired as normal wired traffic. So the traffic is not going to the.25:56Wireless line controller and because of that you don't have any bottlenecks.26:16So that allows also traffic to up to 9.6 gb/s or with Wi-Fi seven up to 46 gb/s. So that's yet another advantage of using SD access versus traditional network management.26:19So when we are talking about the border node, we can also co locate the roles, the the different type of roles in a single device. So you can have, e.g., a border node co located with a control plane node in one single device. You can also co locate the border node.26:40The control plane and edge node in a single device. You can also have the border node.27:00Control plane node and embedded wireless LAN controller in a single device, of course, be sure to consult the design best practice the design guide because of course that will be depending on the type of the the amount of endpoints that you will be servicing, the amount of.27:06Virtual networks, e.g.. So in order for you to be able to co locate those roles in a single device, so there are some design considerations that we need, you need to have into into account. But you can also co locate the border node control plane and edge node.27:26So when you have all those roles co located in a single box, that is what is known as a fabric in a box in in SD access, so you can have a remote site with a single device acting as all the roles and that is considered a fabric in a box.27:42Good, so after we saw all these SD access roles and components, another construct that we need to understand or another concept, it is the fabric site, and that is also something that we will see very frequently, especially when we have multiple locations that we have to onboard into the SD access fabric.28:01The SD access fabric is or an SD access fabric site is a logical construct on catalyst center that contains a fabric node, a fabric edge.28:21Border control plane, border node, control plane node, ICE node, and you can also have wireless LAN controller access points and so on. But mainly like the fabric side is composed for a control plane node or an edge node, and you can also have a border node for connect connectivity to external network there.28:31Typically interconnected by a transit network, so you can have an IP transit or an SD access transit and you will see a little bit more of that later on.28:51And it can also be defined by endpoint scale, failure domain scope, scoping, round trip time, and underlay connectivity attributes, but and normally the sizing of the sites is important for from a design perspective. So again, what.29:03Checking the the design guide for that part.29:23Good, so now that we understand the roles and the components of SD access, we're gonna jump into the internal mechanism. So we're gonna start with the control plane of SD access. Again, the control plane is like the brain of SD access and it is based on LISP.29:28Locator ID separation protocol, and that's what allows the main benefits of decoupling the location and the identification of the of the hosts in the SD access fabric.29:50So LISP is is lightweight, efficient, scalable, and extensible, and for the host tracking, it kind of works like a DNS service on which the control plane node will be keeping track of the location of the host.30:05On the SD access fabric, and then when an edge node or when a host needs to connect to another host, the edge node will be consulting that table on the control plane node in order to be able to get the the information that it needs to form the tunnel to the destination edge node. And we're gonna be seeing those details later.30:24Later on.30:44But speaking of the control plane, there are two types of, let's say control plane, there are two versions. There's, there is one called list BGP, which will be using BGP from the border node to, so you will see on this BGP.30:46It will be using internal BGP sessions, IBGP between the border nodes and the control plane nodes and external BGP EBGP session between border nodes and let's say as the access peer devices or fusion devices as we will see later on.31:05But in the case of, list pops up, it will be using only lists natively to propagate prefixes between control plane node, which is which are the publishers and the edge border node or subscriber. So.31:22That will be removing the BGP dependencies inside the fabric. So just to summarize it with list BGP, the border nodes will be using IBGP to when the when it is injecting external networks into the fabric.31:39That is done with IBGP sessions between the control plane and the border node, but with Lisp pops up, that is made a little bit more efficient because you will not need BGP, you will not have any BGP dependencies, and that will be done with Lisp itself.31:54And a little bit of clarification before you ask, the fact that we have list BGP and now we have list pops up, that doesn't mean that we have any plans to end the support for list BGP at least any time soon, soon. List pops up is recommended though for new deployments.32:17So new fabric sites can be configured as list BGP or list pops up.32:36And of course you need to verify the minimum iOS XE versions requirements and there is a 1st phase. So if you have today if you have list BGP and you would like to migrate to list pops up, there is a migration workflow under development now as a as a 1st phase, and there's a.32:40Second phase migration workflow under planning. So you will be able to migrate from list BGP.33:01To lisp pops up to to have a fully a full list environment in your control plane in your fabric control plane. So now to cover the data plane, we know that the control plane, that's we, that's where we keep the host tracking database database.33:09We keep record of where our hosts are located in the fabric and and all of that. So the data plane, how the traffic is actually forwarded, the data plane in Cisco as the access is provided and supported by VXLAN.33:29Yes VXLAN is an encapsulation technique for data packets. So when the encapsulation is added to data packets, a tunnel network is created. So that tunneling encapsulates data packets from one protocol inside a different protocol because normally you will have, you can have like either traffic or even IP traffic from one host to another host.33:45And that will be encapsulated in a in a VXLAN tunnel. So that's why you see that in the fabric each overlay network is called like a VXLAN segment and it's identified using a 24 bit VXLAN network identifier, which can support up to 16 million VXLAN segments.34:04So what happens is when you are communicating between hosts, you can have the, the inner packets here, the inner header, and you can have the Mac header, outer IP header, and then you will have the VXLAN header.34:23Which will have the segment ID, the VNID, and any flags that are useful for for that header specifically, and then you have the original Mac header, the inner original IP header for the that traffic sent on the overlay. So let me.34:43See, let me show you so you this is how a frame looks like. We have your ethernet, header, IP, UDP, then the VXLAN header, and here in the VXLAN header, if we, if I go back also, you will see that that VXLAN header also contains the.35:03SGT or policy enforcement as well.35:23So and we will see a little bit of that of that later on. So how the policy is enforced on on the fabric. So here, e.g., let's imagine that we have these host one and host two wanting to communicate. So when host one connects to edge one.35:26As I mentioned before, edge one will send a register message telling the control plane, hey, control plane node. I have this host one connected to me and the host node, the control plane node will be registering that host.35:45To the the router locator of this edge one. And the same will happen with this edge node, edge node two. When host node connects, it will be registered with the control plane node. So now when host one wants to connect with host two, this edge node will be asking the control plane node, hey.36:04Do you know where host two is located? The control plane node will be replying, hey, this host two is behind the edge two routing locator.36:25So with that information now the edge, now H one can create the VXLAN tunnel directly with H two under over the the underlay network, so then they are now creating an overlay tunnel, an overlay network over the underlay.36:35And they are using the remote locator. Again, the remote locator is part of the underlay that will be routed through the underlay with the traffic of the fabric being the like the inner information on that on that on that traffic, on that tunnel. So.36:50H node creates a tunnel directly to H two, then H two receives the traffic and when it receives the traffic it decapsulates that information, find that the destination is host two, and forward that traffic to the corresponding port.37:10And of course a little bit more than that happens from the policy perspective, but we're gonna see that a little bit later. But that's for the data plane. For the policy plane, on 1st in order to start talking about policy, we need to understand a little bit of how segmentation works in SD access.37:26So we have like two layers of segmentation in SD access. One is a virtual network which is considered as or known as macro segmentation. So with macro segmentation, basically you are creating another construct in the SD access fabric that is known as a virtual network, and that virtual network is a.37:46The equivalent.38:06In the, in the in the the in the in the underlay is equivalent to a VRF and in the list is equivalent to a instance ID, so they are pretty much the same. It's just like a segmentation mechanism. So the virtual network is a constructing catalyst center, but in the network, the way it is enforced is a VRF.38:08Then you have micro segmentation because once you create your virtual network, all the devices that are part of the same virtual network, they will be able to communicate with each other. But what happens if you now you have different groups inside a VRF or inside a virtual network and you want to rest.38:28Trick and control the communication between those different groups. That is how, that is where micro segmentation comes into play. So micro segmentation is.38:48Enforce or created using security group tags, which will be again is just like a label, a second level segmentation that allows group based access control between groups within a virtual network. So now you have the ability to segment per endpoint on missing minimum necessary.38:57So you can have your devices on the virtual network and within that virtual network you can have different groups and then you can control the traffic between those groups using micro segmentation or security group tags.39:18So when we are talking about virtual networks, there are also several types of virtual networks. You have the layer three virtual networks, which uses uses vrfs and Lisp instance ID as I mentioned before, to maintain separate routing topologies. So again, that is important to understand the virtual network trans.39:32Slate to a VRF in the network and that will be completely independent.39:52A routing table and routing topologies. So that's for layer three virtual networks. For layer two virtual networks, you will be using a LISP instance ID and to maintain separate switching topologies. So the endpoints IDs like Mac addresses will be switched within a layer.40:00There are two virtual network. So edge node border nodes and fabric access points are being our virtual network ID to the instance ID for the fabric encapsulation or sorry, it's not virtual network ID, I think it's big network ID.40:20So, then for micro segmentation, you will see that edge node assign that unique security group tag that is essentially a label.40:39To which endpoint in concert with ICE, so we need to understand that we need ICE integration with catalyst center in order to be able to create your micro segmentation and your policy enforcement. So it is very important. So edge node and fabric node access point add an SGT to the fabric encapsulation, and we're gonna see a little bit of that.40:56Process a little bit later and used to implement IP address, independent traffic policies. So that is exactly, as I mentioned as one of the benefits of SD access, instead of having to create an access list and then write your access list sentence in saying this traffic is not.41:17Allowed between these.41:36Destination and and this source. Instead of doing that, you will be creating these sgts with micro segmentation and then you will be creating your policy based on that. Sgts can also be extended to numerous other networking technologies like secure firewall, Cisco SD WAN, and some 3rd 3rd party platform of course if.41:38They are the support sgts. But again, for the policy enforcement and the micro segmentation, it is essential.41:58To integrate Cisco ICE to catalyst center because Cisco ICE is the key element for the policy plane. So with Cisco ICE is where you will be able to authenticate and enforce the, the micro segmentation and end policies.42:07So this is how, how the process works. So you have, if you have a one endpoint wanting to connect to another endpoint, let's say this device with the IP 10.1.10.220 wants you to connect to these two devices here.42:26When the endpoint is authenticated and classified as a camera, e.g., the help of ICE, an agent label will be added to that, to that endpoint. So when you see traffic here coming from that endpoint to the destination and that one dot 152.42:42That, traffic will be labeled again and let's say with an AGT number five, and you can have a you can have that other device, the IP, the device with the, with the IP address ten.one that 152 with the AGT number 20.43:02And you may have a, a policy, an SGT policy or a micro segmentation policy saying I will be allowing the traffic between the SGT 20, the AGGT five and the HGT 20, but blocking the traffic between five and 30. That is where this device is. So when that's.43:22If it comes into the edge node, again, the same process happens, the edge node will be querying the control plane node to know where these endpoint is located. The control plane node will be giving it the remote or route locator of the destination endpoint.43:42Or the destination edge node, it will create a VXLAN tunnel, and then it will send the traffic encapsulated to that edge node. Then this edge node will be decapsulating the traffic. It will find that the destination EDGT is the EDGT 20.43:58And then it will download the SGT policy from ICE. And what happens is this edge node will be downloading the policies for any, any policy that includes one of the devices connected to it as a destination, not all the, not every, not all the policy, not the whole policy, just the policy.44:18For the devices that are connected to it. So you will find that there is a S as the access list restricting the traffic to.44:39AGT 30 but allowing the traffic to AGT 20. Since the traffic is allowed, then the traffic will be sent to the final destination and of course blocked if it is denied on the SG access list in the policy. So that's how it works. So pretty much and and you see none of these.44:49Or none of these you have to go box by box configuring anything. You will have a policy matrix on catalyst center that is very intuitive and is graphic and you will be restricting the traffic between different sgts. And then all of that is enforced and configuring your network devices by Catalyst Center and ICE. So again, you are declaring your int.45:08And then catalyst center takes takes care of the deployment of the configuration in your network devices.45:28So for fabric constructs in SD access, there is a concept considered known as a host pools, and this is a really cool concept. Hostpool is a group of endpoints which can be users, phones or IoT devices that are assigned to a specific subnets.45:37And VLAN within the fabric domain.45:57And then for for each hostpool, you will see that the edge node will instantiate an access VLAN and a switch virtual interface with user defined IPv four and IPv six addresses per host pool. So you will be able to configure those pools in Catalyst Center.46:00And host pools are assigned to endpoints dynamically by triple AAA or statically by port again in in catalyst center, so you don't need to go switch by switch configuring ports and edge nodes and fabric wireless and controller register endpoints/thirty two or slash 128.46:17If you are using IPv six with the control plane enabling IP mobility. So you have an anycast or any IP address anywhere. So the concept of any cast comes into play here and that's what allows the mobility of your endpoints, so if you can, you can have a user.46:36Are Connected to an access point in this edge node here.46:54And then it can moves at any time to the wired network, connect to a port into a switch, and the policy that the the endpoint will can keep its IP addressing and it will also be followed by the policy that you have defined for, for that endpoint.46:58And again, all of that automated with you, with you have without you having to go and entering any commands on the network devices. So again that anycast gateway provides provides a default gateway for AP capable endpoints. It is similar in principle to the 1st hub redundancy protocols like HSRP.47:16Your VRRP that we already know.47:36Which has like a virtual IP and a MAC address, a virtual MAC address. So the host acting as the primary will be responding to that IP, but in the case of SD access, the same virtual interface SVI with the IP address and virtual Mac is assigned to all.47:40The edge node and then the wire or wireless endpoint can connect to any switch or access point in the fabric and communicate with the same anycast gateway. So again, that's what allows mobility to the endpoints in the SD access fabric. Good, so.47:59We have seen the concepts of the roles of the devices in the fabric, what is micro micro and macro segmentation, and then we have also seen how how the traffic flows from one device to another and the different fabric construct like virtual network.48:19And Layer three virtual network and layer two. And now that we have our once we have our Cisco SD access fabric built and virtual networks are deployed, these virtual networks.48:39Normally requires connectivity to external networks. So as the access provides a mechanism that is called virtual network handoff to connect fabric virtual networks to external networks. So these handoffs.48:50Can be either layer two handoffs or layer three handoffs depending on the type of virtual networks and of course depending on your requirements. So for the layer three handoff, the layer three handoffs is pretty much like the physical or logical because you have the border node that will be acting as we saw as the exit.49:05Point in your on your fabrics. So the layer three handoff will be deployed in your border node.49:25And the layer three handoff is just like the physical or logical interface on a fabric router that connects an internal isolated virtual network to an external network. So in order to also allow communication to external networks, you will need a peer device that it is also known.49:31And as a fusion device and that device will be acting like as a bridge, between your, your fabric and external networks. So border node and the peer device will be establishing an EBGP session to ex to exchange routes.49:50And so e.g., the border node will be advertising internal fabric subnets outward and learning external destination from that peer device. And then to maintain macro segmentation outside the fabric.50:09Each fabric, a VRF or virtual network is extended over this connection using dedicated.1Q interfaces sub interfaces. So you will need a separate EBGP session for paired VRF.50:27So you will need a an SVI, an EBGP peering and and a sub interface for, for these different vrfs in order to keep the macro segmentation outside the fabric.50:44So if for any reason you're allowing communication between a VRF and another one, what happens is the traffic goes outside the fabric, gets into the fusion device, you configure route leaking on the fusion device, and then the the that traffic comes back into the fabric. So.50:59So it is recommended of course that you plan your, your deployments, so you don't need to be configuring route leaking for communication between different virtual networks. So if you see that you need a lot of communication between devices in the same virtual network, probably the best, the better idea is to have them in the same virtual network.51:19Instead of making routes too frequently. Then we have a layer two handoff in Cisco software defined access, which is used to extend the layer two virtual networks. So if you have a layer two virtual network from inside the fabric, you can extend it to the outside of the fabric in in this layer two. So.51:39This can be, so if you have a a layer two.51:59Network on which you have you some from to which you need connectivity from the fabric in layer two, you can have a layer two handoff or a layer two border node. And even though you can define, you can have these co located.52:04You can have the layer two border node and a layer two border node and a single device. You can the recommendation is to have dedicated devices for that. Also, if you are having like, as you will see as if you're having dual homing, you need to have a port channel.52:21Because spanning tree is not allowed here inside the fabric, so very important to, to, to know this. So let's go back to review the traditional route leaking that I was mentioning.52:38So a peer device, as I was mentioning, will be, you will be like having this EBGP session with a peer device with different svis and vrfs. So in order to maintain segmentation, and again, if you need communication between one VN and another.52:55Right, on these peer devices where route leaking occurs.53:15And this route leaking is also like you need this peer device also in order for the border node to learn about external network. So you see the peer devices outside the fabric can be any platform router layer three switch firewall et cetera, with the appropriate.53:20Create capabilities. But the main idea here that I want you to to understand is.53:38For route leaking and communication outside the fabric, we need the border node and this peer device from which you will be learning external external routes and having communication to external networks.53:47And this is something that has been improved with the concept of Lisp Extranet on Cisco as the access. So with LISP extranet policy, you can allow communication between one provider virtual network and one and more subscriber virtual network. So with this, you are basically what you are doing, you are removing.54:02In the need of of having an external peer device.54:22To allow connectivity to external networks. So if e.g. you have a VRF on which you will be having your chair services, which are, which is the network on which you will be may maybe having your DHCP DNS servers and other servers that you need to communicate with your internal fabric sites.54:26Instead of having that peer device and doing their route leaking on the fusion device, now you can get rid of that and just declare that VRF as your provider VRF.54:46And then your internal VRF has your subscriber vrfs and all of all of that will be managed with LISP directly. LISP pops up control plane directly instead of having to do this peer device or phishing device. So that will be, this is just an enhancement of SD access and improvements, but that requires to have.54:58Have a list pops up control plane, so if you have list BGP, you will still need to go with the peer device. But yeah, that is another reason as as well if you are planning your SD access deployment, you have list pops up in instead of list BGP.55:18Good, so that that's all from my side. So if we don't have any questions I will be going to my colleague, I mean thank you so much Miguel for for presenting that part. It was I know, a little bit heavy.55:34Thank you so much. Let me share my screen, guys.55:531st of all, would like like to mention what we have like in summary, what we have discussed in this in these topics for SDA because it's like SDA capsule like showing a story about everything related to the SDA, so we discussed why SDA roles terminology and internal mechanism and how to exit.56:12SD, and this part about the the wireless is one of the very also important topic in in software defined access because simply it's.56:32Every campus have a wireless, whatever Cisco or non Cisco, but here if we have Cisco, let us discuss what, what we have here. So actually, the 1st mode that we have here in in in the wireless, but before speaking about the the modes for the fabric wireless or whatever, the benefit that we can get.56:43If we go in the in a fabric in a fabric wireless. It doesn't like for the design it it maybe different from from from the site to another site, but we have many benefits we need to focus for that if we go in the fabric fabric wireless or make the wireless part of the fabric.57:03Site. So this mean that you have the full automation with Cisco Catalyst control, Cisco Catalyst Center hierarchical segmentation VRF and SGT, and also the policy that you applied for wired, it will be the same for wireless.57:23And also it will be part of the communication, let's say that the policy you apply in between like in the point and wired need to communicate another endpoint and wireless, you can apply a policy for them also they share the wired and wireless share the same subnets as well. So to be honest me.57:38Many many benefits for something like that. And one of the very good benefits actually the roaming that's happening between access points, so whatever you connect with this access point or another access point you will take the same IP address whenever you are in the same single fabric fabric site. But we have some little bit changed.57:58Change if we compare it with regular wireless, because the access point as well, so the prerequisites here that the wireless LAN controller should be activated to be in a, in a fabric, and you can see when we activate something like that, we can see that the fabric wireless controllers start to communicate with the controller.58:18Control blame note, they will communicate each other actually and they will update each other with some information, ok? And 2nd point here that the fabric fabric access point this is one of the requirements here. It should be in the same like in the same size.58:39It was the wireless LAN controller because the the like the RTT should be like less than 20 milliseconds, because it's communicating with wireless land controller a lot specifically for cap web controls blame.58:58But when we speak about data plane, and this is what, what is different here, data plane, the access point will build the VXLAN tunnel. So imagine all the data will go through the VXLAN tunnel and that is, that is will help us for whatever the traffic is layer two or layer three.59:15To carry all of these through through the fabric. And all the benefits that we have spoken about, maybe we don't have enough time to like to discuss how the access point join, how the client is joined. We can discuss it later about that. But, inside is the fabric in the wireless.59:35Everything is working like is mostly specifically when we speak about the roaming, when we speak about the policy, so it will work like that and.59:55Also another option is already supported wireless over the top. And we have seen this use case already exists with some of the customers because they start in the SDA access for the wired firstly, and they they don't they don't like to start both of them wired and wireless. They want to.01:00:06To see.01:00:25Like the wired 1st and then at the same times they can do the wireless maybe later. And 2nd use case sometimes the the wireless LAN controller is centralized and managed many many sites. So in this case, they want to keep everything like like like that.01:00:26Over the top and they don't like to change it to SDA. And for this reason the traffic the tunnel here it will be for control plane and data plane will communicate to the wireless LAN controller, but this was mentioned, it will not be fabric.01:00:47And for this reason, we will lose the capability for the SDA, let's say the policy that we have spoken about and also, second part of that also the the same subnet that you can allow for wired and wireless also you lose something like that. So there is.01:01:06Also pros and cons for each of the design you need to go, for. And also we have mixed mode between between fabric and non fabric. In this case the controller will be fabric as well. Access point will be fabric, but the SSID here it will be it will be, it depends on.01:01:24About what you need to do. So let's say that the campus SSID, it will be fabric, but maybe customer have another, another SSID, let's say guest the customer doesn't like to make it like like fabric because maybe guests it will be centralized between many sites. So again, this also.01:01:44Supported something else already I didn't mention here, it's also supported. When you make the the the access point in flex mode, this also already supported as well.01:02:04And here, I have shown you these slides because it's showing you that the wireless LAN controller can be shared between different sites but the the only condition here that this wireless LAN controller should be dedicated for one fabric site, but other sites it will be.01:02:16Be like non fabric. Till now we don't support shared wireless LAN controller between many fabric side, just any each wireless LAN controller will be dedicated for each fabric site. This feature, it will come maybe sooner.01:02:36So this is quickly about, about how wireless is in SDA. For sure there is too much detail we can mention, but already we have some series has been done before, talking about wireless in catalyst center, how everything is going, how to configure and discuss discuss all the use cases.01:02:54And right now we need to focus for, the topic number six, which is device onboarding because this is one of the main, let's say challenge when we speak about device onboarding with customer.01:03:15The customer actually do a lot of efforts to prepare the the the like the template and you can apply that in, in your devices, and sometimes there is some mistakes happened. So actually many challenges maybe happen during the onboarding and the manual ways.01:03:31Little bit, to be honest, it's little bit tricky and hard and have a lot of human mistakes here but offer another way it's it's called LAN automation and this is to automate the underlay. But again, again here when we speak about device onboarding, we speak about.01:03:50Any device inside SDA fabric, ok? Except maybe the the border node because border node we can already discover it by, by blood and blay feature, but not with LAN automation, not with LAN automation feature because LAN automation is focused.01:04:09To, to configure and apply all the underlay configuration for the downstream devices that exist that exist under the the the the border node. So this is the reason why you are using LAN automation. We have a lot of benefits for using.01:04:29Plan automation.01:04:49And the the automation simply simplify the network operation. It's it's, it's saving a lot of time consumed from pushing the underlay and make sure that everything is fine and make sure that device already onboarded very well in Catalyst Center. So what you need to do or or what you need to worry right now.01:04:51So just to put and feel the inputs or feel the intent in catalyst center. Let's say the network said we will speak about these prerequisites in the upcoming slides. So this is actually how everything is working and it's actually in during this pro process you can see that it's little bit error free from under.01:05:11Delay network problem sometimes problem it happened but in this case you you can see the notification about what's happening and you can check. But let's say.01:05:31It's working very well and save a lot of time from you. 2nd point here for the, from the benefits for the automation, it's zero touch provisioning. So simply when you put the the device, let's say intermediate switch or each switch, when you put this device, it's already factory default.01:05:44Just to connect and then started the process so device will be discovered from catalyst center, device will be receive all the underlay configuration. Everything will be.01:06:04Received and also during the process also the the the if you already select a golden image, so in this case, if your device doesn't have the the or the latest version according or the golden image according to catalyst center, so in this case catalyst center will upgrade.01:06:16There's something like that.01:06:36And here in the, in the process we have like prerequisites for LAN automation and these prerequisites actually exist in catalyst center and also the communication between Catalyst Center to the border. And in this case our border device, it's called like seed device, ok? And.01:06:38Did some prerequisites, not too much actually exist in the, downstream device, maybe it's it's intermediate or edge device. And this is called BMB agent, ok? And the prerequisites that exists in catalyst center, let's say that you need to.01:06:58Figure the network setting, you need to configure the design hierarchy and the site for SDA.01:07:18You need to configure the LAN LAN automation subnets and you need to use it in this in this site. So you need to finish some of these parameters before starting the process. 2nd one is the communication and connectivity between catalyst center and the seed device.01:07:23Device here in the in if we speak about new new greenfield site it it can be a border, but in case that already you started this process before and you connect a new edge device, you can, the seed device maybe can be another edge or maybe intermediate. But let us.01:07:43Assume that we started the site from the from the scratch. So 1st of all, we need to discover the seed device. We can discover it by using the BMB plug and play option and and the push specific like template to make catalyst center manage.01:08:03Manage this device or.01:08:23Or 2nd we can push the configuration like manually and make the catalyst center manage the CDC device. And 2nd point here when I speak about new implementation, that you need to configure like attempt connection between fusion.01:08:27And border device, because, because in the beginning nothing already configured and after LAN automation process finished after when you finish everything, you then can start in the layer three handoff configuration as Miguel mentioned and.01:08:45Listen in this case will push some configuration lead to BGB and so on, ok? And point connection between border node and fusion. But in case, as I mentioned that is.01:09:05Site from scratch, you need to like configure attemple connection in the beginning just to make a reach the border node. And the last prerequisite that exists in the device, the device should be in the default or factory default. Even if you are using brownfield, remember that this device should be in.01:09:18Factory default 1st before starting the process. And actually the connection between in the beginning, between let's say between the border and intermediate or edge, this connection should be like layer two. So once we start the the process already we select fabric sites selected the LAN automation subnet and then.01:09:38Start the process. You can just wait and actually will go and discover the devices. I don't need to go in more details, but this is.01:09:58High level overview about what's happening exactly and as we mentioned here, the seed device this is another good option here. Seed device can discover the direct connected device or maybe if the device have like two depths and we have right now the option for the device like.01:10:10Up to five dips, ok? And that is available. By default it's two, but you the catalyst center can be discovered up to five, up to five. This mean that like in this case, 1234, and five.01:10:30Okay? And that is very good option if you have a large, if you have a large network. LAN automation, it can be like, it can be done like multi step. It can be done in a single step like that. So you have many options actually in LAN automation process and once you stop the process.01:10:44The then the the point to point configuration it will be done between device each other.01:11:04This is actually quick, quick review or high level about what's happening in the LAN, the LAN automation. Another topic here it's it's very important. It's about SDA if you need to extend, but what I need exactly to extend in this case, I need, because when.01:11:11When we remember together what's happening inside is the fabric, is the fabric that we have, we we already covered before that we have macro segmentation macro and micro segmentation. So when we speak about micro segmentation here, we have like let's say virtual network and inside this virtual network, we have many.01:11:31Like whatever VLANs and we have SGT exist here. So when these devices need to communicate to each other, they will communicate through, each other and you have VXLAN happening between because this is inside the fabric. So inside the fabric in data plane, we have the VXLAN and VXLAN.01:11:52See this SGT. So the propagation here it's done through VXLAN. But if we need to go outside the fabric.01:12:11So outside the border node, so this technology or this protocol will not be exist beyond the, the fabric in the normal situation, ok? So the propagation here will not be available. So in this case the AGT will be lost. So the policy that you already.01:12:20Configured in the policy metrics in catalyst center, it it will not work in this case if if we have two fabric sites and there is two in the point need to communicate each other but you apply a policy. How to extend this mechanism something like that. And basically what we need to extend here is SGT.01:12:41Security group tag. This is actually what we need to extend. And we have many solutions for that. The 1st one, it's it's called SXB solution security group tag exchangeable protocol. This is because outside fabric, we don't have the option to carry the SGT or in line tagging.01:13:02In line tagging, this is Cisco like option and in case that you have different vendor, so this option will not be available. But in SXP, it's it's coming to to carry the SGT inside this inside this tunnel, and it's carrying doing the mapping between SGT to IB to IB.01:13:21Finding and.01:13:41Try to send this through the the other fabric sites already. There is already my colleague timer will cover too much detail about that, but this is briefly what's happening because we have many like updates related versions and so on. We don't need to go on this detail, but just I show you that this is.01:13:43Is one of the solution that we can use in case we don't have any support for propagate the SGT outside. 2nd design here or second solution here using SDA transit. We agreed before that we have IB transit, IB transit. It's normal IB. Just to configure VRF light to fusion and some.01:14:03VRF that's it. And everything like IB.01:14:23But in case that we need to extend the the the fabric site here, 2nd solution we have is SD transit and is the transit we extending our mechanism, extending the extending VXLAN. So we propagate the the the prefixes to other fabric sites and.01:14:27To win the edge let's say this edge.01:14:46Required to communicate or we have an endpoint here and the point A need to communicate with endpoint B and other sites. So both of them, according to propagation here, they will aware about each prefixes, so if they need to communicate each other, they will build a VXLAN tunnel between.01:14:51Both of them. So remember again, VXLAN tunnel is a propagation mechanism here. So once I have VXLAN again, this mean I can propagate SGT so I can do the policy that I did in the policy, in the policy matrix in the 3rd solution that we have here is using SD.01:15:10Or Cisco is the specifically. And inside the fabric we are using VXLAN to propagate the SGT, but outside the fabric, we will activate here in line tagging. And simply in line tagging, it's activate, it makes A 80 two.1Q.01:15:30Encapsulate the SGT value here. So once it is valued it will be kept between a border node and between CH, this value it will be propagated through the V through the SD WAN mechanism inside IPsec header, so it will go from site to another site and then when.01:15:48You have the policy that you built in policy matrix when you, e.g., allow something or deny something, it will be applied exactly.01:16:08So this is the three solutions that we have here in in this case. Already we like have other like situation like between SDA, ACI, this is something else and this is required a different sessions so again we quickly talk about many topics here.01:16:18Here what is SDA terminology and roles, internal mechanism and how to exit the SDA site, how to, what, how what is working in SDA and device onboarding and the last topic was was the extension for that. The last topic that we have it right now is the new field.01:16:37And I have seen one of the questions actually talking about firewall and the answer the answer actually existing here for one of the use case. For sure we can use the firewall as a fusion, but here we have a specific use case is very important and I have seen for one of my customers. So here.01:16:58See the 1st thing here that catalyst or the smartest which catalyst 9350 is already supported in this version. It can be fabric in a box, and also in the border node, you can see it can be supported in control plane, also supported and in edge node as well.01:17:17And we you can go and check in this day access compatibility matrix in three to three and you can see you can see which device already supported in this version and which in which role exactly. 2nd use case here that in LAN automation, it was before support IBV four only but right.01:17:35Now it support IBV six in LAN automation process with ISIS. 2nd feature that is very important and a lot of customer requires something like that, they need OSPF in the LAN automation. They need to, the, to, to.01:17:54To push the OSPF between the fabric and the underlay. And this option already exists starting from these option 3323. Just a moment guys.01:18:10And the, 2nd use case that is also very important here is SSI security service insertion, and this is what I have referred in my answer. And simply what's happening.01:18:25Our customers actually and this use case talking about, if we would like to specify what use case that we are talking about, this use case, if we have, if we have a communication inside virtual network between two different VLANs, so this is layer three inside virtual network.01:18:40Okay, so the main use case here, if we have such of this traffic between both of them, actually what's happening that the VXLAN tunnel will be built between both of them, that type of traffic it will be layer three VNI.01:19:00Because it's two different subnets. So in this case they will communicate each other directly through the VXLAN, so our customers here require that the firewall should be in between. And to do something like that in SDA, in the previous situation, you should like let's say you.01:19:14Using a solution it's called layer two or.01:19:34Gateway out of the gateway out of the fabric and this is required layer two handoffs so you need to go outside the fabric, and if you go outside the fabric, this means that you will lose the SGT. And we don't need to lose this option because of the policy that we already built. So in this case, this is one of the very good solution here. We can see that the.01:19:39Back it going to the border and the border to outside to the to the firewall and then come back is still the SGT already will will be exist and then come back to go to another, endpoint. So in this case.01:19:59The traffic is going to the firewall between, two different between two different endpoint in the same remember that in the same virtual network, and two different subnets, layer three traffic. So it will go to the firewall and, another point also is very good. The firewall's.01:20:14It can be Cisco, it can be, another, another firewall. So in this case it will go and and and inspect and then come back. So you will achieve the, the two important or benefit for that. Your traffic will be inspected by firewall and also 2nd point that the policy, it will remain the same.01:20:34Another also use case, it's one of the very required use case here about silent host. I, I don't know if all the audience have one of these use case or not, but simply what's happening here, silent host, we have some silent host devices. These devices is in.01:20:53Be active in the network. So let's say this is a brenter. If you have a active traffic it will work. Maybe after sometimes NO traffic, this device it will be like, like silent, so the MAC address will be disappeared. So if you would like to reach this device again, it will be unreachable. So in this case you activate the the.01:21:12The previous solution or work around, you need to activate the layer two flooding inside the fabric to reach out this device. So what's happening here, it's like probing or sending the, the, the, the, the ARB request everywhere inside the the fabric until reach the.01:21:32This in the point. But the main issue here that we have some, like limitation or or some like recommendation here that you you like the recommended subnet maximum to be/twenty four, not more. Let's say like/twenty three/twenty two. It's not recommended in this way.01:21:52To avoid like CPU and memory consumption and a lot of traffic.01:22:12So for this reason we have this option, it's a feature called is the silent host detection. Simply what's happening here that, that when you activate this option silent host detection in a specific subnet, so everyone in the fabric, it will be aware that this subnet have.01:22:18This subnet have a silent host. So in this case when they sending information about that, the control plane will send like a probing or message to everyone guys this subnet have a silent host, so they will be aware about their silent host, so in this case, we will not active.01:22:39And at the same time we can stretch and we can make the the subnet for, for the silent host subnet it will be bigger.01:22:59There is some like prerequisites here, three to three already supported that and iOS XE 17 to twelve. Remember that and also starting from 26 to one to two. And this is actually the configuration here you need to come and activate the silent host discovery in a specific subnet.01:23:09And then activate the candidate pre authentication VLAN because also the configuration that will be pushed for this interface, it can be for VLAN one as well.01:23:29And this is actually like a quick animation about how it's going like going like that, the traffic going from source client to Lisp going to LISP server and then LISP server sending already aware about this subnet. So sending probing for everyone and then to until this comes.01:23:40For the silent host target and then the traffic will come back and it will work normally. This actually it's very important use case in the in the like factory field or industrial fields, ok? I will not cover everything related to the new.01:23:59New, new features in SDA because just to avoid the time consuming. So right now this is another good new feature. It's overlapping IB pool in SDA.01:24:19So this means that you can use the same pool in fabric site and you can use in another fabric site, but make sure that these sites will not communicate each other because it will be duplicate in the address. So if you don't have this use case, you can use this option. 2nd, another option also that you can use the.01:24:32You can use secondary IB address and that is very good option already. A lot of customer requires something like that to have secondary IB for, for the anycast gateway, ok? So right now we have finished our session and.01:24:54Again, our topics describe like the capsule about SDA what is what is and why SDA is important in your network, roles and terminology, how the internal mechanism is working and how to exit the SDA site and and how to.01:25:13To use the wireless in SDA device onboarding extension how to do extension, and the last topic it was about the new feature. I hope in this session we answer your question. We cover as much as we can from from the topics and important topics for SDA.01:25:32And we encourage you to attend the upcoming sessions. It will go deeply for the design according to what my colleague mentioned Alex in the beginning.01:25:52Thank you, thank you Mina and thank you Miguel, of course, for this excellent presentation or presentations and thank you all that you attended this session. You can find expert inside series sessions.01:26:04On all technologies in the 1st link CS.co/EMEA-EIS that's that's Okta.01:26:2326. If you want to see previous recordings or upcoming sessions for catalyst center, specifically for catalyst center, you can use 2nd link and if you want to contact us for further support for further engagement, you can send us an email at nx.CSS-EMEA.01:26:34At Cisco.com.01:26:54Oh, one last ask from you, once we close the session you will get this post webinar survey in a browser. Please spend a minute to fill it in. It is helpful for us to understand how you found the session to provide feedback.01:26:57So we get better and of course to to read your suggestions if you have and.01:27:16With that, let's quickly check if we have any question you don't mind just in 5 min answer some questions right now if you don't mind, ok? So we have a question about layer two flooding is not recommended to be enabled on/twenty three.01:27:23Yes it's not recommended like.01:27:43Slash 24 it's it's it's it's recommended here because you can imagine that if your network is big, so this means that when you activate that, the traffic will go everywhere, and actually in in catalyst sorry in SDA, we by default actually we didn't activate the anything related to the broken.01:27:45It's not actually broadcast, it's multicasting underlay but also when you activate the layer to flooding, it's a spread everything for all the fabric and we need to avoid something like that. So if you activate layer two flooding it's ok but keep in your mind as a best practice in the design like/twenty.01:28:054th. It will work for short last/twenty three but we don't, we, we need to avoid any problem or or situation. Second question, what would be the best way to change it from legacy to SDA? If you will change if you will change.01:28:25From, like catalyst nine K from legacy to, to, to SDA, to be honest it's it's a little bit tricky. The design here it will be tricky, you need to go step by step to avoid because you have you have already production area, so you need to move like one.01:28:41Like, like e.g., if you have to border, you can move one only and keep the other one as a cool switch. It's already require a lot of things. You can reach out to us and we can discuss more for something like that. The last question about silent host is very important topic. Yes, I know it's very very important topic in the industrial and.01:29:01Manufacturer fields and if we have if you're already interested for that, let us communicate and we can discuss more and more for something like that. Otherwise if we have many audience require a specific session for that, so we can, we can prepare something like that in later.01:29:21Or later or upcomings. Thank you Alex.01:29:41Thank you, Mina just to comment on the question on migration, on existing network. There are a lot of prerequisites, there are a lot of things that you need to take care, so if you are thinking, please consult consult us to consul.01:29:46At Cisco for planning for design and for migration solutions to make sure that everything goes smoothly and you start the journey in SD access the best possible way.01:30:05So, we, we will leave the session open for 05:10 minutes after we drop, after we close but if you want to send any other questions, you can, you can do and we will contact you. But, that's it for today.01:30:20It was the session on SD access design best practices terminology errors and terminolo.01:30:41Terminology and concepts, Mina Sabah and Miguel Valera, thank you so much for the presentations. From Mina, from Miguel and myself Alex. Thank you all. Have a great rest of the day. Bye bye.01:30:51