Secure Routing with Cisco SD-Routing: Enhancing WAN Security and Automation

Welcome to the today's session. Today we're gonna be talking about Cisco secure Vanage, which is formerly known as ST routing.00:10Before we kick off the session, I just wanna introduce myself. I'm amstress, a customer success specialist at Cisco specializing in SD WAN and its integrations. So in today's topic for SD routing, I wanna.00:20Clear a few prerequisites before we start off the session. The 1st prerequisite is many of you have heard a Cisco router can be operated in two modes. One is a controller mode, another one is an autonomous mode. So.00:38What does this controller mode or autonomous mode do for you? The controller mode is nothing but it's operating the router in an SD WAN mode. An autonomous mode is a classical iOS XE. On this while, so we had a management platform like a catalyst manager or formerly known as we manage.00:54Which is capable of managing.01:14The controller mode devices, but we did not have a management platform or we did have some kind of management platform in Catalyst Center or a 3rd party management platform which could manage your autonomous mode router. But with the starting of seventeen.twelve onwards, what we did was.01:18It's like we started introducing the same management platform which was used to manage the controller mode, which is our SD WAN routers can manage your autonomous mode routers as well. So.01:36Wow, like what are the, what are the things it can do? The couple of things it can do is configure simplifying monitoring and your security operations and your cloud integrations can be simplified using the same intelligent dashboard, which is your catalyst manager.01:49And you're formerly known as the V manage. That's the why we require this ST routing. So some of the challenges without the ST routing would be your separate management as we discussed earlier, a lack of security integrations. So your new secure routers or your regular.02:08IOS XE routers are capable of doing next gen firewall capabilities and also are capable of building tunnels towards one of the cisco's SSE solution where you would be able to pass all the DIA traffic towards the SSE solution and do a cloud.02:29Security inspection if needed. And also if you want to move your data towards the cloud, most of the SaaS application, and I need to have some integrations with the cloud as well, so AWS, Azure or GCP. So we did have lack of cloud integrations so that needs to be done manually or you need.02:47To some kind of a tool to orchestrate that, you know, deployment. So with all that challenges, we unified the management platform with a catalyst manager, which can solve all of those challenges like you could.03:06You could, you have a centralized configuration repository, you have a centralized monitoring capabilities. You have you have a capabilities where you would be able to monitor like manage your security policy structure, and also the multi cloud functionality. You would be able to build tunnels towards your AWS.03:25As Azure or GCP as well.03:45So, going, going further, so this is just the unification of like you can operate the controller mode or autonomous mode routers, which is the SD WAN fabric or the SD WAN SD routing devices using the same management platform.03:49So, what, what is this transformation looks like? So you would be able to use your traditional routers for a regular routing or DMVPN or a flex VPN or a get VPN or an MPLS VPN. So any.04:09Configuration can be imported into classical configuration groups and you would be able to push those configuration to the devices. One of the advantages we would have while pushing those configuration to those devices is configuration lock.04:28So when you have a configuration lock, which means that the devices are NO longer, you would not be able to modify any configuration while you log into the device via CLI. So those are the one of the advantages and you would be able to manage every centralizedly managed.04:44Those configurations are there. Apart from configuration, you would be able to, do a lot of monitoring aspects, so you would be able to monitor your your devices using your single plane of dashboard or a unified management dashboard.05:04And you would also have capabilities of enhancing your security as well. So you would be able you would be able to use the security feature functionality we have, which is policy group. You would be able to push the same security policy between your SD WAN routers on a non SD WAN router. In this case it's an SD routing device.05:23And, that unified platform can also be integrated with something called as a security cloud control, which is a unified security platform for all the Cisco portfolios and you will be able to manage all your security policies and everything from.05:43The security cloud control. So what.06:03All this functionality provides us as a simplicity and agility reduces the operational cost, and it it future it future proofs are one and it has a multi layered security. So you would be able to run all the next gen firewall capabilities on the router through the manager.06:07From a, from a controller architectural standpoint, if you have already an SD WAN fabric deployed in your environment, it remains the same. So you would have a validator manager and a controller, but an SD routing devices will establish communications on.06:29Lead to the validator and the manager. Your controller will not, the SD routing devices will not establish any communication towards the controllers. But if you are purely an SD routing deployment, you don't need that SD WAN controller formerly known as vsmarts.06:46What, what are the platforms we support as of today? So we can support catalyst eight K platforms, the ISR four K platforms, but ISR four K some of the ISR four four case, we would not be able to use the configuration because the last version on some of the ISR four K is 17.07:07Well, 1712, or 2012 version of the controllers will not be able to support the configuration on them. And similarly asrs as well. And we would be able to introduce our industrial routers, which is our IR routers, and the newest release is gonna be.07:27So yes, I, there is a question, can we run the same fabric? Yes, absolutely. You can pretty much run use the same fabric to run an ST routing as well. The catalyst secure routers as well. So that's our new platform depending on the version of the edge devices. Look at the.07:49Compatibility matrix, your controller version needs to be higher than your edge devices and there is n minus two compatibility between your edge version and your controller version.08:08So what about the journey looks like? Let's say e.g., I'm a customer C who is managing my traditional routers via CLI and i'm using my NMS services like SNMP APIs to get the information and I'm using some 3rd party tool or open source tools in order to manage my routers, I can migrate towards the SD router.08:20Which gives me a lot of flexibility in device life cycle management, which Edgar is gonna go through while doing a demo. Monitoring.08:40Configuration support, security, which is like on prem next gen security and the SIG integration as well, cloud connectivity, which is gonna be site to cloud connectivity as well and some of the other VPN technologies we have. From here, you can stay with SD routing.08:49Or you would be able to move towards the SD one which is gonna be capable of building much more granular things like auto tunnels between the two sites or you would be able to do identity based firewalling and you would be able to do TCP optimization, DRE optimization, service chaining, analytics.09:05A lot of things out there. So, some of the key capabilities we already discussed this is gonna be monitoring configuring assurance, full stack security, multi cloud and device life cycle management for this particular devices.09:25Benefits, same management platform for all the values cases and you will be able to use the same workflows which we used for SD WAN or SD routing as well, reduce operational expenditure, so.09:47You already have a single management platform which can do configuration like once you have built the configuration, you can variableize the configuration and you can use those same configuration across all the devices. You don't have to spend a lot of time you just have to upload a few variables out there, you have the configuration and you would be able to we we would go through the.10:04Slides over here, you'll be able to use zero touch provisioning to onboard the routers as well. Support for routing customer journey to multi cloud, so you would be able to build tunnels as I mentioned to AWS or Azure. Multi layered security, which is like you would have a next gen firewall capabilities like.10:24Zone based firewall ids, IPS AMP, all those functionality can be pushed from the V managed or through.10:44The security cloud control if you have an integration with security cloud control and the Cisco SSE integration as well, and it's not only Cisco secure access, but if you can have you can have a 3rd party SSE solution like zscaler, where you can integrate with them as well.10:52And once you have the routers in SD routing, it's easier to migrate to SD WAN. It's just changing the mode. And if you have used SD WAN before, one of the feature.11:10So we widely use this network wide, network wide path insights and that same feature can be used on SDA routing devices as well. And you can integrate with thousandeyes, you would be able to monitor some of the applications which Edward is gonna go through in this demo and catalyst analytics as well.11:25So, this is one of the tools which we built for onboarding a router into our portal. So this can be downloaded through CCO, so you would be able to download, it's a Docker based file and it can be, it can run on Linux windows or Mac, so you can.11:46Upload the all the repositories and everything and you will be able to add a device to it and the device can be upgraded to a certain version and it puts in all the necessary configurations in order to onboard the device towards the manager.12:06And these are the working details I don't wanna be going towards it. You can download that software from our CCO download location, and this is how, this is how it looks like. This is called secure auto swim and onboarding tool.12:23So what is the bare minimal configuration when you have a brownfield deployment. What is the bare minimal configuration is required to onboard a device towards the SD WAN or the manager where you can manage the device from there? So you just need to enable the netconf that's required netconf Yank.12:39And ST routing, you will provide your organization name, site ID, system IP, V bond, IP, port and one interface.12:59That's all. That's pretty much is what it is required in order to onboard. The system IP is a dummy VP IPV four address, but it needs to be unique across your entire environment. So make sure that you don't yeah sorry make sure.13:08Make sure that this particular IP is unique across your entire o over org organization. And it can be a dummy IP address. You don't have to be make this IP reachable as well.13:32One of the new feature we introduced in the later releases is you can use the van interfaces doesn't have to be in a certain global VRF we call it as, it can be any segment of VRF as well. So you, if you are in 1715 onwards, you can be in a management VRF or a custom.13:44VRF and you will be able to still establish the communications towards the controllers using that VRF.14:03And I I believe I do have a slide coming up later on that. So, going towards the automated automated zero touch provisioning.14:08See when a device is onboarded, the 1st thing the device goes through is, it checks whether it has a startup configuration present or not. If there is NO startup configuration present, the next step it's gonna go through is gonna be the bootstrap file. Let's say for an example, I don't have a.14:25Configuration, I don't have a bootstrap file. The next step it's gonna go through is a PNP process. What does this PNP process over here?14:45So the PNP processes like certain one interfaces will get a DHCP address. Once we have a DHCP address coming in, you would have a IP address on the interface, you would have a DNS, a resolution and everything.14:53And now a router will have a serial number and the board ID present. This information is sent towards the PNP. Because the PNP knows, ok, this particular serial number is present on a certain controller profile. We have we would have added that.15:09Before onboarding the device, we would know, ok, this is the controller's, this, this is a controller profile and I would be able to provide the org name and the V bond information back to the router.15:26Now that org name and the V bond information, since we have the V bond information, we will be able to reach out to the V bond. The V Bond is the one who's actually providing the IP address of the V manage over here towards the edge device. So once the V manage, once it establishes the communications to the V manage.15:40The V manage is gonna have the configuration already built, pre built, so you can push that particular configuration to edge devices and the edge device comes up online. So with zero touch, you would be able to onboard your devices. And this pretty much reduces your operational expenditure. You don't need a technician to go on site.15:59Link and plug the devices and configure everything. You just need some random person just make sure that you plug the right cables into the right lengths and it should come up.16:19By default. So, the, the concept, the tunnels remains the same. You would be still establishing the DTLS tunnels from your edge devices to the V bond. You would be still establishing either a DTLS or a TLS connection between your edge devices towards your manager of that. That.16:29Protocol from an SD WAN still remains the same, but if you need more details, please do visit as further sessions in EIS. So what can be done in device and life cycle management?16:49So you would be able to monitor device, you will be able to SSH into the device from the manager. You'll be able to ping race route, you can do a real time data and you can generate something called as a show tech or an admin tech, you'll be able to analyze your notification alarms, events, and you'll be able to do a swim process or just software management.17:05And the network part insights as well.17:25So this is basically what you would be able to achieve from a device life cycle management perspective yeah this is what I was talking about earlier, so you don't need to be a certain.17:30You don't need, you don't need the VAN interfaces to be in a global VRF, you can have a dedicated VRF in order to establish the connectivity towards the manager. And that was introduced in 1715 or 2015 release.17:50Going towards the configuration options. So, this is a new type of configuration we call it as UX two dotto. It's, that is that's the configuration group which is that's the type of configuration which is supported on SD routing. We don't support any classical templates or device template type of configuration on.18:03The configuration group can be.18:25Separated into two pieces. One is a parcel based, another one is a CLI based. A parcel based is nothing but a feature template where Edgard is gonna go through that in his demo, where it has all the features like the system profiles, transport and service profiles or where in system profiles you would have a AAA configuration, NTP configuration.18:27And so forth and SNMP configuration and all. Whereas the transport will have all the van interfaces.18:47Or you can even have some of the interfaces in global VRF or anything. A service profile is nothing but your a service profile is nothing but your dedicated VRF and everything and if you want to build a DMVPN tunnel, that's where you would be able to build as well. A CLI based, is.18:55Basically, you get the entire CLI configuration put onto the configuration group and.19:14You can variableize some of the fields like IP addresses, interfaces if needed, and you can push the same configuration to multiple devices out there. There's one thing you have to be a little cautious over here, from a CLI based perspective.19:21So CLI, this is a CLI based which we're talking about. A CLI can have two sets. One is a classic or one is a CLI config preview a CLI add on profile. There's something called as a classical CLI as well. So what is the difference between both of them?19:38So that is nothing but a modeled configuration on a non modeled configuration on a very high level, it's yangified model or a non yangified model. Some of the configuration are non yangified, so that needs to be pulled out of the classical CLI, but some of the configuration are yangified that needs to be put on there. So.19:56It's basically, why is that? So when you have a device configuration which is yangified, the device does a rollback. Let's say e.g. if something goes wrong, you're not able to establish a communication towards the controllers, we will do a rollback on the configuration. When you do a rollback, the yangified configuration can be done, can have a roll.20:16Rollback out there, but a non yangified non modeled configuration will not have a rollback. So that's the difference between a CLI and a classical CLI.20:36So that's, that's been that's been so that's that's highlighted over here as well. So, and you can see that the classical CLI over here and.20:47We can do a seamless upgrade to a workflow, so this is like if a device is running prior, the SD routing device requires minimum 1712 are now fully supported is 1715. So there is a workflow within the SD WAN manager. You can.21:02Upgrade your existing devices using SSH or an SCP and that workflow walks you through all the connections and fetching out the serial numbers and everything. So.21:22It it's kind of a workflow to onboard the SD WAN router if you do not want to use the onboarding tool. So you can use the workflow as well. So you would be able like onboarding a thousand eyes agent, so if you want to onboard a thousand eyes agent on a.21:33On the edge devices and we do have a.21:53Easy way of doing the workflows and everything. So you would be able to onboard a thousand platforms. And this is pretty similar to the SD WAN boxes as well so there is a question, sorry.21:57Okay, so and you would be able to monitor the crypto VPN monitoring as well. So the crypto VPN monitoring provides monitoring for DMVPN and flex VPN, and you would have a dashlet in the main dashboard and you would be able to select the dashlet to come up on the dashboard.22:15Another key thing we were talking about is the same manager can be used to manage your next gen firewall configuration and and Cisco SSE solution as well, cisco or party SSE solution. So we would walk you through in a.22:37During the demo, we'll walk you through the policy group and what can be done from a security standpoint on the Cisco catalyst.22:57SD routing devices. And this is the manager which talks to the AWS for the multi cloud from the cloud connectivity point, and you would be able to communicate to the workloads and this would build an IPsec tunnel from an enterprise site towards the AWS.23:07And the same thing applies for the Azure as well. So you would be able to build IPsec tunnels between them. So that's on my end. I would let Edgar run some demo and I would be back after the demo to do some policy groups.23:27From a security standpoint. Thank you. Yes. Thank you. Thank you. Hello everyone. Welcome to the session. I'm just gonna share my my screen just if you can confirm that you can see it, it's gonna be great. Can you confirm that you are getting my demo environment?23:47Yes, we can see that. Okay perfect. Okay, well, as you said, there's a lot of ways to to onboard devices, ok? So I'm gonna show you I'm gonna demo how to do it manually, ok? For that purpose, I have a router that is running in autonomous mode, as you can see, you do I do show person I can see that it's running autonomous, right? So.24:06What I'm gonna do in this router also I enabled the netconf junk because as you said, it's a prerequisite to be enabled, right? So once we enable the netconf junk, it's important to verify that the netconf junk is running, so I'm gonna do this comments of platform software.24:24Management process states. So in that way we can see if the process are running on the on the router about the the jank, ok? We can confirm that this is started and he's running the process that we see here most important is a couple of of the 1st two processes, ok? So only have this.24:42Up and running.25:01So we can then configure the as the routing section that you mentioned that we can do manually. Obviously you are using the onboarding tool. You don't need to do this because you can go directly using the onboarding tool or you can do PMP as you describe for new boxes or or green greenfield boxes, you know? So I'm gonna do is I'm gonna.25:02Then come get into the configuration mode, I'm gonna.25:22Do this and I'm gonna just put the comments of the routing just to onboard this device, ok? So I'm gonna paste the routing comments as practically I'm gonna specify the system IP, the IP address I need to have the resolution for that and the source interface for that, ok? So I'm gonna do that.25:25I'm gonna do a couple of of comments here on this box because obviously this is a visual environment, so I'm gonna need to do some registration but this is not in all the, in all the environments, ok? So I'm gonna do.25:44On this and let me do this other comment ok ok ok let's let me just wait. Okay, on, on the device is.26:00It's onboarded, how I can validate that it's onboarded, right? So how I can validate that it's up and running. So I can do, I can do a couple of comments, but the most common is gonna be showing the routing control, control connections.26:17Summary. So once we add that we can see that when we establish the connectivity with the SD one manager, ok? So I can see that now it's connected to the vmanage. In the initial phase it's gonna contact the validator.26:34And then on beyond the validator, we're gonna see that it's coming into the connection with the dtls connection, ok? In my case, it's a an interface just going to internet. I don't have any specific VRF, it's a very traditional router that is coming up, ok? So if, if I go to then to the the.26:48Manager SD one manager.27:08And I go here, I will start then talking about how I'm gonna deal with the configurations that I haven't, right? So you can see if you onboard the devices in the beginning you will will still have option to control configurations, right? Always just just start pushing configuration.27:10Or deploy configurations, your configuration console is gonna be locked I mean if I go to this router that is already on the routing mode and it's already provisioned, if I wanna do county, it's gonna it's gonna just warning, ok? It's, you are not able to do any changes on the configuration because you're using now there's the routing functionality, ok?27:31So you have, you are in this page so you can start building your configurations. As you mentioned.27:51We have two options. If you want to go, obviously you're gonna use configuration groups, you will go to the configuration configuration groups, go to the top part, and you will find the separation for the person that asks if you can have fabric of SD one traditionalize the right thing the answer is yes, and you need to go.27:56Configuration groups, ok? That's the 1st option. When you come here.28:17You have, as you said, a couple of options as could be using traditional CLI config based CLI configs or using partial based configurations. If I wanna go for parcel base, so I can go into these two options, I can use the catalog. I mean if your SD one manager is connected or I can.28:21Create the configuration using a guide workflow. So in my case I can go in this way, ok? So if I wanna go in this way, I'm gonna create e.g..28:41E.g., ok? So I can create what it's gonna do automatically also I put in the ok.29:01Oh, let me oh it seems like it's frozen. Okay ok 1 s, something is going on.29:12Okay. Oh, ok. Just give me a second something come up with the.29:36Okay, if I'm gonna go then to to use the workflow, I'm gonna go just create again something happens with my session. Okay, I'm gonna just configuration. I'm gonna configuration groups and I'm gonna use the guided workflow as you're gonna.30:09With the name oh sorry I need to go to the sorry forgot to change as the routing, then I'm gonna go to create configuration workflow, and I can see.30:27E.g.. Okay, so I get and create a configuration group. Automatically it's gonna create for me all the required parcel base or feature profiles that I needed on this, ok? So, so I go to the configuration groups.30:46I will see that it's new created here and if I go there here I will see that it's already created all the system profile, service profile, transport profile required to do that, right? If I go to the individual, you will find all of these profiles already created, so I know that you can start working on those, ok? It's gonna.31:00Just create the basic setup, the default settings so you can start from there, but you don't need to create everything from the scratch.31:20That is one of the advantages to use this workflow that we have here, ok? This is one option I mean that you can go and as you describe, if you go to the, to the system profile if you can, if you go there you will find that there is a parameter that you can specify like NTP, login, triple AAA, global parameter.31:26The banner et cetera, right? So if you go to the transport, you will find how to configure your interfaces, et cetera et cetera, right? So very typical as we, as we do on everyone.31:47The other option that you have, if you don't want to go in that in this way, you're gonna go using the traditional base CLI. So once you create it, you're gonna do heat again quick configuration group but in this time you're gonna select this option CLI configuration group, ok? So I'm gonna create in this case is the routing.31:57So you go to with this option, what is gonna happen is not gonna use parcel base and it's gonna exactly use just configuration lines, ok? So from here you can read configuration from your current.32:22Devices, ok? So e.g., I wanna create.32:36Based on my router number three, it's gonna read me the configuration, and as you mentioned also is gonna split, ok? Whatever it is supported and whatever is not supported I should be as a traditional CLI, ok? So it's gonna highlight that message. So.32:41Is it recommended specifically, e.g., if you are coming from a brownfield environment, right? So would you have your routers up and running and you maybe don't want to go and create the configuration group from the scratch using the partial features, maybe you are not familiar. I do want to be just streamlined and short to this.33:01So as you can see, you can notice here in the left section, I have everything that is supported in the jank, as jank comments in the jank model, so that means that I can directly as as also as mentioned, if there is a failure on this configuration push, it's gonna roll back automatically it's gonna do everything that he was mentioned. And in the right part.33:20You will find all the traditional CLI that you might need to adjust or you might need to do after the the section is pushed or deploy is gonna be the traditional CLI configuration, ok, that you have in this section. So something interesting here that you might be noticed or maybe thinking about is oh, ok, this is good but I need to read.33:40Use this, right? Because it's not gonna be just for a single router, so how I can reduce that. You can start using variables on this and it's very, it's gonna be very simple. E.g., if you want to change the system IP on the routing.34:00You just highlight the text and then you can go into the actions and then you, you can do create variable on this, ok? So automatically you provide the system IP variable, ok? So every time that you execute this or apply this configuration to your devices, it's automatically be prompting.34:12You to put the the variable value on this, right? So I think it's very powerful because again, you just can get configuration from as reference and you can build your configuration group very easy and very fast, ok? So you don't need to worry about that, ok? So.34:33Once you create it, obviously you create this, you can go and and then associate your devices with this configuration, with this configuration group that you created. So, automatically and then you can start using using that, that option, right? Like here I don't have any device attached.34:49So I can attach my devices. So in my environment I have already a device that is.35:09Actually using that so and it's in synchronized, but I can agree that I can make any changes and, and, and get that, right? So something cool to do. Now talking about how we manage or how we deal with the software management as we said. Okay, so one of the advantages like we can streamline or we can streamline the the soft.35:14Software in our devices. But what happens if I have a lot of devices that is running a code that is not supporting any routing, so I need to manually do that and then onboard it in on the tool? The answer is not. So you can start using, as we said a streamlined for that, for that purpose.35:34So we can use the upgrade as the routing to as the routing capability. So if we come into this page, you can have you can get the, add all the devices that are in not in the correct version. You need to have a remote a remote server for this. So you're gonna create that you can imp.35:52For all the boxes, you have the to provide the credentials here. So if you go and as an example, you need to provide the IP address, the username, the password, the enabled password, the remote server where you will have the version that is gonna be upgraded on those devices.36:12The image name and what is the image on the device? So you can trigger the upgrades using this this capability. And again, if you are using the onboarding tool that was mentioned in the beginning, it's gonna do this process for you and it's gonna onboard it for you automatically using the tool. But if you don't want to use that and you have new routers.36:26Or something that is coming up so you can use this workflow, ok? So I think it's a it's a nice capability. Also, we can have.36:46You can trigger swim or software upgrade workflows for every, every SD routing device that we have in our, our environment, ok? It's gonna be very simple and it's gonna be as the same methodology that we use as the one. So if you go to.36:54Maintenance, we go to the software upgrades so we can trigger upgrades from here directly. Obviously you can upload upload the the direction that you wanna achieve, e.g., in my case, so I have seventeen.fifteen that is running in my to sorry twelve.fifteen that is running in my environment.37:09And I have the version seventeen.fifteen for for my my hs, right? So I can directly trigger any, any man any upgrade directly from here and it's gonna be very simple, right? So you don't need to do manual work again and you can use as the as the one manager as an SD one router, right? That.37:27Is what we want to achieve here. So it's very simple, so you just again select the device, so where in my action you go to upgrade, it's gonna trigger, I mean which version you have available remote server or you have in loaded into the manager repository. You select the version and then you can activate and and.37:47The booth, ok? So it's very simple.38:07That you can use here, right? So it's something that also you can trigger and it's gonna be something really valuable. Also that also is important as Isray just mentioned, so we can have all full capacities of monitor all of this infrastructure, right? So you don't need to have an extra tools or.38:10Solutions to monitor on the devices are on a directing environment, right? So if I go directly to monitor, I will see.38:30If I go to the overview page, I can see the the health, I can see the, the, the, the health of of of my routers talking about CPU memory, right? So I can measure that directly, get alarms, alerts when something is going on. Also I can have application performance.38:38Something that I think is very important in this time. So I don't know you have in autonomous mode, you have a dedicated platform for that, but you can use it here for that. So you can start watching your application health and you can start.38:59What you know all the applications are running in your environment and what is the health. Remember that application performance monitor is gonna be in charge to estimate the performance in terms of latency packet loss and jitter, so for those applications that are running and are are flowing to your environment, pretty similar again what we do in SD one, but in this case going with sd.39:12Routing that is is the good news of this, right? You go into more details, we can see which sites are consuming the application and how what is the discourage? I mean the QoE scores that we are receiving for, for, for that application, right? So we can see that we can observe here. So.39:32So I think it's a it's a cool feature, but extra to that, I mean we have also the possibility to use the logs. I mean, you got you got you go to the logs, you will find all the entries of logs, what is going on in your environment, right? We have alarms, events, when something is going on in your logs specific.39:52Right, so logs for ACL, so you have all all the visibility, all the assurance information that you needed.40:12And using the same platform, ok? And it's pretty similar again with SD one and you have it now here for SD routing. Also you have tunnels, I mean as I just mentioned, we have we can have in having multi point VPN so where we can have tunnels, we can measure the healthy of those tunnels, right? So we can have the tunnels.40:19It's healthy in terms of latency, ok? And performance of those tunnels. In my environment, I don't have it because as I told you, this is just a simple DIA environment so I'm not using tunnels or VPN, but it's very simple to, to manage also and and monitor all of that statistics, right?40:39Extra to that extra all of this information that we have.40:59We can have more dedicated views of the devices. If we go to devices and we do click on any of my routing device, I can get all the graph, all the historical information, graphs of CPU, graphs of memory, right? Interface optimizations, I can even enable CIA if I.41:02Needed for some applications in order to start taking decisions to how to route some applications that I guess is gonna talk about the policy groups in later on and you can start doing all of this, right? If you enable next generation firewall on this, you can generate, you can enable from here from manager.41:23And you can monitor all the activity of the firewall, the intrusion prevention, the filtering, so everything is here again that and you can have it in the single console. So you can have also troubleshooting tools, as we know, we can do pin trade router speed test, so we can get real time data so we can retrieve.41:42All the information that we needed, right? So everything is here I think it's very important, but probably the most.42:02Value that it was mentioned is network wide path in science, something that is really cool. So if we go to, if we go to tools and we go to network wide path in science, what is this? Remember, so what we can do is gonna be packet packet inspection in all the flows and traffic that is going through, right? So I.42:10I can do flow analysis e.g. in the case of tunnels that I have, e.g., I can I can do analysis on those tunnels I can do for the IA traffic, what I can determine on that.42:29If I I can determine if he's getting the correct queue, if it's doing the properly quality of quality of experience, I can measure if the interface is getting congested. I can see if there is a policy that is incorrect. I can see if something is packet delay on the response of DNS. All of this information.42:42Is consolidated here, but let me show you a couple of examples that I have here, ok? So if I come to network wide buying science, again, I have the option for SD WAN or if I have a fabric already, but I have the SD routing section dedicated. So if I come here.43:02I can start doing new traces. I can do a new trace, schedule a new trace. I can enable the DNS domain discovery, that means it's gonna get the statistics of DNS traffic is gonna see how which resolution is doing and it's gonna you can generate more flow analysis of those, ok? So I can enable if I want it, you can.43:18Put the name, e.g., AS trace here.43:38Trace and you put the the maximum duration that is 60 min, so I'm gonna go for 10 min, just select the site that you wanna enable, you select the the VRF for VPN so you have it in my case it's just a global, a single VPN or global, and you can have some other criteria that you can add you can fill.43:44Service on application, you wanna see the performance or inspection of the traffic going to Google or YouTube or Amazon or Microsoft Teams? I mean you can do the search.44:03You have other options, right? E.g., give me a quality of server insights, if something is failing in the QoS, so I I need to be aware when the traffic is going out or the interface, if something is going on, it is getting the incorrect queue, it's getting dropped, what is going on, right?44:15So performance about the application is gonna start doing analysis on performance on this, and you can have application visibility, right? I mean, e.g., you can in case you have different sites, e.g., you have the dynamic multi point VPN, you have tunnels and you can get all the statistics of the traffic passing to all.44:31All your different ages, e.g., you can have this from a single capture, you can see all the statistics of the traffic flowing through the different edges, ok? When you have this, this option enabled. So in my case it's a single router going to internet, NO very complex but if we have any multi point VPNs or VPNs or interconnected sites.44:51And we wanna have from the single inspection all the data so we can, we can have it here, ok?45:11So we can also even generate synthetic traffic, so in case that you need to prove a specific traffic, you can do it from here, ok? So once you provide the the setup that you needed, just start running the, the, the capture and you can also go through to the bottom and see, e.g., you have captures previously.45:18You can have this one that is starting this moment is doing the deep back inspection or you can reference to the previous one. I'm gonna use the previous one, e.g. I'm gonna view the signs of a previous capture in order that you can see what I can see, e.g. e.g., in the DNS domains.45:37I can see all the resolutions that was made to the, to, to that specific, e.g., I can see I I'm using the the this DNS server and I can see, e.g., if I just monitor some of these discovering domains, if I do that, I can see I expand this and I can give me.45:54Insights about what was the number of DNS requests, number of DNS required, what was the response time for the DNS and the latency for the DNS and for the HTTP, so I can get all the statistics but also I can go to the applications and see all the applications that were expected on this and I can see e.g..46:14Completed workflows in order to analyze, e.g., I'm gonna analyze in this case YouTube that was the traffic that I was passing through, and I can see in the insigns, it's gonna give me all the information e.g. the upstream upstream feature is gonna give me what is the ingress interface in my case, if traffic is coming from the internet dose that is my.46:34One interface.46:54And I can see it it hit the CF forwarding. I can see how it was forwarding the traffic, you know, in that interface. Who who what happened in the interface? What, why was the protocol? I I was, I can see I I used the interface, what was the the address, the old address and the NAT address that I'm using, e.g., here, I can see e.g..46:55And the CFD, I can see the e.g. about the analysis of the traffic, how it was determined that was YouTube, the QoS very important again, which queue is getting, what is the qo ID, what is the limit of the queue? If if it's dropping packet, if it drops the packet or forward the traffic.47:15Okay, transmission report, ok, on which interface, right? So I can see the flow when in this in this direction, but I I can also see the the downstream flow also with all the details. What was the egress interface? What was the mbard, the QoS again?47:34In this case, how the traffic is is ingressed by the interface gigabit one, ok? What was the decision with the CF CF forwarding, all the stuff. Probably this looks very simple because it's just traffic going through internet or a router, but imagine again, you have a firewall in place, you have a tunnels, you have.47:51A lot of features going on, it's gonna be very complex to troubleshoot.48:11And this tool is the best class to do that inspection and details about how the traffic is flowing, what is the decision made, and if there is some parameters or configuration that is affecting your flows, right? So I think it's very powerful. Well, when this I'm gonna just head back to to Andreas for policy groups.48:16Demo and just closing the the session. Thank you.48:36I'm quickly gonna go to the policy group and there were a couple of questions which I want to discuss over here as well, once, once we're done with this. So if you go to the configuration and in the configuration, you would have a policy group. So if you navigate through policy group, I can just add a policy group saying that sDR_EIS.48:39So I would be able to click on the solution type, so this is where you would have SD WAN or SD routing, so you can go to the SD routing and click on create and you would be able to associate this particular configuration group to multiple devices, but you have next gen firewall and the secure service edge. Within the circuit service.49:00You would have secure internet gateway, which is just the.49:21Bypassing your internet bound traffic towards the cloud security firewall or you can have something like a private connectivity where you have some traffic, remote access traffic coming in from the cloud security firewall towards our edge devices as well. So if you go to the next gen firewall and if you can create a new one, so it's gonna walk you through a file.49:26Workflow.49:46So let's say, and firewall_EIS and click on next. So it's gonna create, you can create a sub policies like what is the source zone, and you can create the zone zone.49:47Over here, like let's say for an example zone interfaces or you can you can add associate an interface, let's say a loopback zero and save, so you can create a destination zone which is self or which is the same zone as well.50:07So if you want to create a new zone, you can create it over here. And once you have that, you will be able to match on rules section. You can do an inspect, you can pretty much do an application based recognition as well and source traffic.50:27Yeah, pretty much you would be able to save this rule, so you would be able to do an action drop or inspect and you can add multiple, let's say for an example edit, so you wanna like inspect what is the inspection you wanna do? So you want to do IP.50:44Yes IDS, so you wanna have a balanced signature set or what type of set you want to do that can also be done. If you want to create your own signatures that are that is also possible over here, you want to just do IDS or you want to do IPS, you can do a customer's custom signature set, and you can allow the.51:04This list as well.51:24So that's, that's on the IDS IPS and if you go back over here, click on edit. If you do an inspect, so if you click on create, it's just not IDS IPS, you would be able to do AMP URL filtering, you want to do TLS decrypt, you would be able to do that decryption as well. So this is.51:25Basically, a next gen firewall capabilities within the box itself, and it sits built over the UTD containers.51:45Out there. So moving back towards the SSE solution. So yep sorry going back to the SSE solution, so you would be able to, this is secure internet gateway, so if you look at the SD routing.51:54Let me so see create. So you'll be able to click click on the credentials, you would be able to create a credentials and once you create a credentials, you would be able to build auto tunnels like it's like building an auto tunnels towards your Cisco SSE solution. So how does it work? So once you've.52:14In all those details, Cisco we manage will communicate towards the SSC solution. It'll pull in all the informations required like a tunnel destination, the keys and everything and it provides those information and configures it on the SD WAN edge devices or sorry, the SD routing edge devices.52:34And the SD routing edge devices would be able to communicate towards the, the cloud provider. And you can do a context sharing which is the micro segmentation and micro segmentation as well. So yeah, the app is the secure internet gateway.52:53So there were a couple of questions.53:13Can I use 8000 V as of today? Yes, 8000 V is supported. If I go back to my slides, I'm not sure if I, give me 1 s.53:16So if you see the 8000 V is the 1st one and we do support zero touch provisioning monitoring configuration, swim, and troubleshooting on the 8000 V And it's supported from 1712 onwards. Just to just a caution, 1712.53:33Might not support the full functionality. So you might have to go towards the higher releases to have much more capabilities out there. The general recommendation is try starting it from 17 twenty.fifteen and seventeen.fifteen out there. And one thing we might have missed in this presentation is a little bit of more detail.53:50Else. So if you want to onboard the device onto the.54:10The SD WAN manager when you log like you need to have the serial number and the board ID in your plug and play portal. That particular devices needs to be associated to a controller profile similar to SD WAN devices, but also you need to make sure that devices are marked as an autonomous mode. So when you do a sync smart account or.54:13Upload the virtual upload the.viptela file towards the SD WAN manager. That particular router should show as SD routing device. So.54:33So make sure that that is not that our autonomous mode managed router. So you need to make sure that particular check mark is done on the PNP before you do a sync on the V manage. With that being said, I think we are about.54:45Three more minutes, the top of the hour. If you guys have any more questions, please let me know. I'll be happy to ask this, take the questions online. So Eric Edis or Tushar, is there any question you want to discuss over the.55:01Call, yes, sure. A question about I I responded but if you want to respond and came about that SDR like the internet age routers.55:21Do they support multi homing dual stack and full BGP table? Yes, and, so as long as the router is capable of supporting this one, yes, we would be able to support that.55:40Are these routers capable under consideration of SI and NWPI? I responded but if you want to respond sorry you can respond that to the question. Okay, is the STR capable to deal with especially with the consideration of.55:55Yes.56:15Yeah, and we do support like the packet inspection now and the network part by insights as well yes yeah and one more question from John just came in so I didn't respond, will there ever be supported for 100 X?56:17HX routers for the routing configurations you mean the asrs, right? Asr's yes. I don't think so. So there is only monitoring monitoring support for those ASR thousands. Yeah, I just.56:38Responded in the chat.56:57So is there any questions? I don't see any other questions so.57:08Perfect. So, yeah, I think I'm not sure if they can go off mute and ask questions if they have any questions, I'm happy to answer them as well. So yes, if anyone has any questions, they can raise raise their hand, we can.57:29Our conversation, if not, you can put that in the chat as well.57:47Yeah, yeah, it seems everyone is good.58:08Yeah, thank you everyone for joining the session and thank you everyone, thank Yous, thank you Edgar. Once you close the webinar, you will receive a survey. We will appreciate if you feel it.58:16So we know what to do better next time. Have a nice day, everyone.58:36