Stay Secure: Ensuring Network Compliance with Catalyst Center

Oh Welcome everyone. Thank you for joining today and welcome to ensuring network compliance with Catalyst Center.00:00Expert inside webinar. Today we are focusing on how to maintain a secure compliant network posture using catalyst center. Whether you are a network engineer or a security stakeholder, ensuring your infrastructure aligns with your business intent is vital for.00:19Operational stability and.00:39Reduced business level risk. So let me introduce the presenters today. Myself, my name is Sridhar Elinda and joining along with me is Sherin Khan. We both are customer success specialists here at Cisco focused on.00:41Catalyst Center technology, and we are hoping to provide a good overview about network compliance using Catalyst Center. I also want to welcome our panelists, Sai and Anand, who are going to help us with all your questions in the Q and A session.01:00So the goal of our expert inside series is to share knowledge in a format where the information provide builds off of the previous session info information and continues to help drive your adoption. So this is 2nd session of the expert insight elevate series.01:20We kicked off things last week with end to end network management with catalyst center where we looked at how you can move from hop by hop configurations by managing your network using Catalyst Center, right? So which will help you on policy driven automation as well as proactive assurance.01:39Today we'll talk about complaints and you know feel free to register for the upcoming sessions as well if you haven't already done so. While we are going through our presentation and demos today, you might have some questions that come up, right? So we ask you, please use the Q and A set.01:59Phoned by clicking those three small dots in the bottom right hand corner and one of our wonderful panelists will respond. In the event that your question is not answered, we or information maybe recorded so that we can provide you with the appropriate answer at a later time.02:20And again, I just want to emphasize that please ask your questions in Q and A only so that all our panelists can respond. So with that, let's look at the agenda for today's session. 1st we will look at evaluating complaints within catalyst center and look.02:37Get the dashboard.02:57We will review different types of checks you could do and identify compliance violations. Next, we will take it through the remediation options on how you can act on compliance violations that catalyst center shares with you. We will be more specifically looking at the software image management workflow.02:58For software upgrade compliance. Finally, we will look at different considerations for compliance checks like CLI template compliance, and at the end, we will have a general question and answer session. Alright, let's kick off the session with our 1st topic.03:18Before we dive into deeper topics, we need to understand what is catalyst center compliance. So compliance helps in identifying any intent deviation or out of band changes in the network.03:40So e.g., a network administrator can conveniently identify devices in catalyst center that do not meet complaints requirements for different aspects of complaints such as software images, network profiles, you know, vulnerabilities and so on.03:55These complaints checks can be automated or run on demand. So just to summarize catalyst center can identify compliance issues within your network, identify and report them in the complaints dashboard so that you can take necessary actions to fix the devices for violations and.04:12And reinstate the original business intent.04:32So, basically there are like two different categories of compliance checks. There are the configuration checks as well as the software checks. For configuration checks, like there are different types. 1st is like startup versus running configuration.04:38So this basically checks or helps you in identifying whether the startup and running configurations of a device are in sync or not. Next we have network settings complaints violations, so this generally looks at your intent configuration settings using.04:55You know, network settings that you push the intent to the device. Similarly, we have network profile and service based configuration compliance checks as well. For a software checks, the 1st what we have is software image.05:14So this compliance check helps a network administrator to see if the tagged golden image in catalyst center is running on the device or not. Next we have security advisories. These are basically advisories that are existing within, you know, like within your devices for like any security vulnerability.05:29Case.05:49Right, so finally we have end of life or in short called EOX, which allows you to check the compliance status for the hardware, software, and modules of the devices. So that is just a brief overview of the different kinds of the compliance checks that are within comp.05:50Catalyst center. Now, before we, you know, go and look at those in detail, let's see what are the prerequisites right for complaints to work. 1st, we need to make sure that all the network devices that are in catalyst center are actually valid and supported.06:10Next, each device is onboarded, once it is onboarded, they have to be assigned to a site and are in the managed state in the inventory of catalyst center. One additional thing is that there are changes that are reported to the complaint service through events.06:29So telemetry needs to be configured. So with telemetry configured, you will be able to use catalyst center as an SNMP and syslog server to track the event changes. Finally, from a license perspective, you should have an advantage license.06:46For each device for complaints or violations to be available. So these are the prerequisites. Let's go ahead and, you know, before we go in depth, right? I just want to give a glimpse of where you can find the information of all the devices.07:04Being compliant or not, right? So as you can see on the top, top top top screenshot, like this is our inventory page. If for, if for some reason you are not able to see this inventory page with all these columns there is a focus up right here.07:23Which you can change and bring bring the focus to inventory that way you can check the compliance status of all your devices. I would like also to remind customers on what the definition of compliance is in relation to catalyst center, right? Like, e.g., some may think if you see a big red like in this.07:41Case, right? You may think there is something wrong with the communication with the catalyst center, right? But this is not the case. It's just a warning that that you have to take into consideration.08:01The deviations of what we have planned and what we expect it to have in our in your devices. There are other ways like for if you I mean there are other ways to filter on just looking at compliant devices. So on the left hand menu we have a filter.08:12Here you can click on, you can check the non compliant check box and you should be able to see or filter out just the non compliant devices. So if we click on one of those devices.08:28This is where it will be redirected to this dashboard. Basically this can also be accessed from the inventory page as well. So depending on the device that you select, there might be like more of these styles, like there might be.08:44More or there might be less, it just depends on the device that you select, and these are all the compliance styles, right? Showing the violations. Later on the session we will look at what individual individual tile is and what it means. So moving on, before we.09:01Start talking about configuration complaints, it is important to understand how this all works.09:21So in step one, catalyst center does an archive of all the device configuration so that it can realize the different changes that happen in the configuration at a later point of time. So 1st step it it just archives the current device configuration.09:28Step two, if there is a change in the archive on the catalyst center, you will be able to compare the configuration difference between, between those two times, timelines and using conflict direct option. As stated as a step three, like if.09:47As stated like before if the startup and running configuration device configuration do not match, complaints will either do an automatic or you can also do a manual check on the device as well. And in the step four, catalyst center will identify any violations against the defined intent and flag the.10:06Violation. So once you have the violations flagged, you also have the options to remediate them, right? So which is what is our final step where you can log into the catalyst center and you will be able to acknowledge and act on the violation.10:26That was reported. So now let's talk about this feature called config drift. To get to the config drift, you will need to simply, you know, click on the blue hyperlink of the device in our inventory page and you will be.10:44Brought to the screen. So as I conveyed before, conflict drift allows you to see the changes that were made to the device at a given date and time. At the top you can see here, you can see that like in the top you can see the various timelines.11:04Of when the configuration changes happen within the device. You will be indicated with like a red, if you have a red on the left hand side, you can see like before change and after change. We also have a change history of the running config as well, right? So, so what you can do is you can either input a start date.11:23And the end date to see here and to see what changes are happening. Next, you also have the option of, you know, adding a label, right? So you can add a label to a particular configuration and save it so that you compare, you can compare any future configuration with that labeled version.11:43Finally, you can see here the in this case it's an out of band change, but you also have an in band change as well. So what is in band and out band, right? So, e.g., in in band is a change that.12:02That has happened within Catalyst Center, so which could be like you provisioning a device or making a configuration change using Catalyst Center. Those are all in band changes. For out of band, like in this case, a user has decided to log into the device outside of Catalyst Center with console.12:17Or or an SSH, right? Or somewhere else and made the change there. So using catalyst center, you can verify all those changes as well. So that's the conflict drift for you and.12:37Moving on, like this is the 1st compliance violation like 1st type that we'll go through like it's called startup versus running configuration. So if you start with the compliance checks the 1st time, right? I mentioned there is a startup versus running configuration.12:54Which is what is shown is in this style. It may look similar to the conflict drift, but this is different because we are not comparing different running configurations, right? Instead we are just comparing the startup versus the current running config. So.13:11It is similar to config rate though because we are comparing different configurations, but here we are trying to compare with the startup ones. So on the timeline here, you will be able to see like what times the files were out of sync and when they got back in sync.13:26So you can check the red or green dots, right? To identify what changes happened during this time. Like e.g. in this case, right, there were a couple of lines that were removed which are in this shown in red color, there is a line which is in green that was added, right?13:41So you can do this kind of comparison. So the next tile is the next violation that we will review is network settings. So this compliance checks allows you to verify different network settings in catalyst center.13:58Such ASA, NTP, telemetry or certificates site and others that have been provisioned to the device. As far as, for a device being complaint or non complaint, complaint means that the intent configuration that was pushed is is in fact the one that is running on the device.14:16And for non compliant, the device is basically not running the intent configuration, right? So, so that's what that's that's the information or that's how the network settings is tile is displayed. Here we have an example of network setting that was pushed out to the.14:35Device below, like you can see there are about.14:55Four open violations and if we click on view details on any of the violations right you you can look, you can you know get additional details of the, of the violation. In this case, e.g., a policy name, IPDT policy or IP device tracking policy was.14:58Basically removed from the client, removed from this wider wide client. So this is an example of a network settings compliance violation. Next we have network profile. This is a similar example of network settings violation. Again, what you see here is there are two.15:17Violations with network profile things like like configurations like SSID settings right that are pushed from catalyst center to, e.g., a wireless controller or if you are provisioning a switch with a template, right? So.15:37So any violations that happened that time are flagged under network profile. Look like what we are currently looking is a 9800 wireless controller with two ssids were removed, right? Manually in a lab environment and catalyst center is showing those two violations for you.15:53So a quick note is that network profile compliance is applicable for routers, switches, and wireless controllers. So here is an example of a CLI template violation, so that I was talking as well in the.16:11The previous slide. So when we create a CLI template.16:31We will attach to the network profile, and in this case, we are currently having one open violation as you can see here. And when you click on that, it will take you to the CLI template screen, right? Where you, you can get additional details of what the templates is trying to push and why the comp by catalyst center.16:34Flag this as a complaints violation. So, yeah, here in this case we are trying to update the name of this VLAN. So next type what we have is application visibility.16:55So, nothing, I mean I'm not going to go into further details on this, but now just understand that application visibility compliance monitors devices to ensure that they are provisioned with the correct.17:12C bar or n bar configurations defined within the catalyst center. So e.g. for it to be compliant or for the device to be compliant, the intent configuration of N bar or C bar is present on the device. And for the non compliant, it means those.17:27Configurations are not present on the device. That's how this particular compliance is flagged. So that's all about configuration categories, right? We have looked at different various.17:45You know configuration category violations. Now let's move to the software related, right? So or software or software compliance checks. In this case like this is a compliance check.18:02Again, this is a software image complaints and this checks to see if the tagged golden image in catalyst center is running on the device or not, right? So in the swim workflow, which will be covered in the next session.18:18Catalyst Center allows you to choose a golden image for a device or a family or a device family, right? So if you have a device which is not running the intended golden image, then those devices are flagged as a software image violation.18:33So this is the exact thing that I was referring, so as I said, this compliance checks that the golden image and if it is running on the device or not. So in this case, the golden image version and the current running versions are different. That's why it is flagged as non co as being non complaint.18:53It is tagged as complaint which it is in this case right if the both the images are same version. Quick note, for Cisco switch tags. So switch for the Cisco switch tags catalyst center allows to check if the tagged golden image is running on.19:11The primary switch and the members of the switch tags as well.19:31So the next complaints is, is this critical security advisories. So this complaints is to check whether the network devices are running without critical security vulnerabilities, right? So there are different levels of violations.19:38But only the criticals are considered for this particular complaints violation. So e.g., in this case we have one violation and if you go click on the tile, you get additional details on exactly what advisory it is about and and if you, you know, you can drill down.19:54Further details of what exactly that vulnerability is and how to fix it. So again, quick note on the security advisories. As I said, they are flagged for a violation only if they are of critical status, right?20:11Any anything else which is not critical, we have like a high, we have a medium, right? We have these vulnerabilities as well. Those could also be viewed within center, right? So if you go to our, we go to, you know, device settings, you can click on security and you have an advisory.20:27Option there and you can look at all the advisories and if you want to drill down you can drill down to further as well as needed. Just just one prerequisite for for security advisors to work, like you need to go ahead and have the machine region.20:44The Machine reasoning engine settings, right? These have to be enabled for security advisories to work. So the last complaints check we are going to talk about today is the end of life, right? Or EOX check.21:01So this actually allows you to check the compliance status for hardware, software as well as module of the, of the devices. So I would like to I mean let you understand that this is this, this check is kind of a planning check, right?21:19Which can help you with like let's say device refresh or upgrades. As you can see in this particular example, the complaints check is for a software with the end of life support date of March 3120 28, right?21:35So you know ok so this device is gonna reach end of life at this date, it's that this date so that you can start planning for the upgrade or a refresh or whatever is required, right? So that again this complaints should be used as a planning purposes mostly.21:50So that you know when the devices are end of life support so that you can plan for either upgrade or a refresh, right? So one of the prerequisite to enable this compliance is to make sure that you authorize the CX cloud consent.22:08To connect agreement.22:28Through the catalyst center settings, so if you go under settings you will see there's an option. So this is a prerequisite for UX to work. And once you do this and you go to the inventory page, you should have a column which states, which is like UX status column, where you can refer or you can identify I mean, you can look at all the.22:30Alerts right, for every device. And once you click on that, you can get additional details as well. We also have like once you log into catalyst center in the homepage also we have a dashlet, I mean you have many dashlets and then EOX is one among them and you can look at see the scan status there as well.22:50Yeah, this, this is this is basically, you know, a quick example of UX compliance check is not enabled, right? So again in this case it is in grayed out because as I said, maybe the prerequisite is not met.23:14So you have to enable the content and then this, this will be enabled like in this example, right? So you have the UX life tile with the details here once the prerequisites are met. Okay, so.23:32Now we have talked about different in the previous section we have talked about different complaints or you know checks that happen within center, the categories and the different things that that are possible, right? Now let's go ahead and talk about how to identify those.23:51Violations, right? So, so yeah, I mean, again, you, we go to the inventory page and you can see all these details like all the devices which are complaint and not complaint.24:09Again this was as conveyed in the presentation like the complaints checks can be either automated or run on demand. So as an automated complaints check, e.g., if you take automated way, these are the times when the.24:25Complaints checks happen. So 1st one is as soon as you onboard a new device, catalyst center will run this complaints check for the 1st time, right? 2nd time it runs is if there is an auto band change, which is made to the device.24:40Catalyst Center will run this complaints compliance check again about about 5 h after the out of band change. And by default, the automated compliance check runs at every night 11:00 p.m.. So there is a complaints job that runs at this time and it triggers the compliance check for devices.24:57I mean it will only run on the devices where the compliance check didn't happen over the past seven days. So this is the automated way, the default way when the compliance check runs within catalyst center. There is option for manually running too.25:18Right? So this can be done in the inventory page. So once you go into the inventory page, you can look at all the devices, right? You can select either a single device or multiple device, go under actions column and go to complaints and click run complaints check.25:34So this is the way you can run a manual complaints or on demand, right? Or whenever you need it. And there is also ability to run complaints checks through our APIs, right? So we have a rich APIs within Catalyst Center.25:52For various functionalities and compliance check is one among them. So you can use our APIs as well to automate the compliments process. So for security advisors advisories tool, as I said is the machine reasoning.26:09Packet machine reasoning package, right? This has to be installed and enabled.26:29Once you have done that from the tools, security advisories, all you can do if you are doing for the 1st time, you can click on a run security scan network, right? So this will run the security advisories.26:33Now you can run it right away or you can schedule the security advisory plan as needed, right? So yes, so that will that will make I mean that will run the security advisor scan, right? And anytime if you want to check the status of the scan, you can always go into our activities.26:49And audit logs. So the in this audit logs you can you can find out when the scan happened last time and other details whether it is successful or any fail failure happened. So that you can look at or look at at the audit logs. Similarly for.27:09End of life complaints trigger. It happens once per week. You you can, you know, you can also like the security advisories audit logs, you can also look at the audit logs.27:28For the EOX compliance trigger and see when it was triggered whether it is successful or not and all those details ok so let's do some demos now. The 1st demo.27:45That I'm gonna show to you today is for an edge one device, which is basically a catalyst 9300 switch, and the lab version that we are gonna use today is two.three.seven.28:03What we will look at is, is, is, is basically there are a couple of violations for this device. One is the network settings that have been pushed out, right? So networks, network settings have been pushed out which are resulted in a complaints failure.28:20And we'll also look at the conflict drift to review the changes that happened. Similarly, we'll also look at the golden image of the device and the violation associated with that as well. So just to verify the version of the catalyst and.28:36Here what we are running is 2.3.7.5.28:56Right? So we just wanna verify it 1st like this is the version and currently we are on the inventories details page. We can see the list of devices here, right? With all the columns for, for these devices, right? There is one column for compliance as well.28:59So here you can identify whether the device is complaint, non compliant. As I said, we also have a filter on the left hand panel. You can click on the filter so that you can filter out the non compliant devices as well as you can also use our search where we have some advanced filters that you can apply, but complaints.29:18Is also one among them, right? So you have a filter for UX, you have a filter for complaints. This is just our additional filtering capabilities within catalyst center. So now let's go ahead and look at our edge one device. Again, you can click on the blue hyperlink, it will take you to the view device details screen.29:37And as the screen loads, we'll, we'll be looking at the summary of the edge one device, right? So this is a summary, if you can scroll down, we can look at the compliance summary, right? So that's located on the left hand panel on the bottom.29:56In this summary, we have, as you can see, there are these compliance styles. The 1st one is network settings which has two violations, and there are other compliance styles also showing green. That means they're all fine and we have software image complaints failure.30:12So so those are indicated with the red cross mark, right? So, so if you want to drill down to complaints, you just click on the tile. As you can see, we have two network settings complaints violations. The 1st one is trying to put.30:29Push an NTP IP address and 2nd violation is for an IPDT policy push. So these two configurations are pushed to the device which caused a violation and you can get additional details as well by clicking view details.30:45So these are two network settings violations, and if you want to look at the configuration, you can go to browse configurations menu, and this is the configuration. This is the current config of the device and you can go to config drift to compare.31:01You know, different versions of the configuration, right? So conflict drift drift is just to compare two different configs. As I said, there's out of band drift, right? There are a couple of lines that were added. If you scroll down, you can get to additional details of what lines were added, what were removed or what were changed.31:18Right? So in this case you have green, that means line is modified or added. Red means completely deleted like these are the lines that were changed and this one IP address push as well. Again, if you scroll up, you can see various the timeline of changes for the in band config also we have a while.31:38Or we have a change, right? And then orange is basically a labeled config. As I said, you can label the configs and if you wanna compare a labeled config, you can choose the labeled config and a current config, and that way, right, you can get to all the details of the actual changes, right?31:58So you as you can see here, like there are a bunch of configurations that were added. So yeah, so you can that I mean, again, this is the VLAN and so this is how you.32:16Can compare two different configurations using conflict drift. So if you let's move on, like if you go to network settings under design, right? You can basically actually scroll down under the network settings and.32:32You can verify here that the NTP server IP address that we are trying to push in the previous config. I mean you can verify that here in the details of what server originally it was. Similarly, it is also available in telemetry I mean the telemetry as well, right?32:49So if you scroll down, make sure the telemetry is enabled for this device also. We can also go to activities tasks and click on the provision device. Again, these are the tasks that are happening within center. Here in this case, we are trying to provision an edge one device. You can click on view work item details and find out.33:06Or search for the exact configuration that we are trying to push, right?33:26So those these details are available in the tasks, right? So you can look at what tasks are running within your catalyst center. In this case it's a provision device. All right, so that's about demo one. We have looked at network settings compliance failure as well as.33:30You know how to get into details, look config drift, right? Look at the config drift, identify the differences of the config files, right? Now let's look at the demo two. The demo two, we are gonna use a border device as well as a shared service device.33:50For border device we are gonna look at the conflict drift and software golden image difference. And for shared services, we'll be looking at our security advisories violation, right? Which is basically the vulnerabilities.34:08With the so with the software release. So yeah, I mean, so we are currently running this border device, which is again a catalyst 9300 switch. We are already in the complaint summary page. These are all the complaint styles.34:24So here the violations are startup versus running config, right? You can click on the details like I mentioned before, that will take you to the config drift. You can identify the difference and if you want to sync the current config with the running config, you just click on sync device config, right?34:41Once you do that, the, you know, startup config will be synced with the running config and this is the timeline that we saw in the previous demo as well. So that's about the startup versus running config violation and now we have a software image violation, right?34:59So we did talk about the golden image, so in this case the golden image version and the current running version are both different, right? As you can see, and I think the fix for this is basically use our workflow and update the device image, right?35:17Next, let's look at the shared services. This is also a cat 9300 switch and for this, the violation is critical security advisor. This is another type of violation. In this case, the software image is fine because both the golden image and the running version are fine.35:34So this is how you go into click to get the additional details about the vulnerabilities, right? As you can see here, we have one critical and then if you want to get additional vulnerabilities within the within the device, you can go into the security advisories column.35:51Or the menu option, right? So here in the security advantage page, you can look at all the vulnerabilities, but only the critical ones are considered for a complaints violation. Again, you can click on all this blue hyperlink here to get additional details about the.36:08About the actual security advisories and and any other details associated with how to fix it, right? So that's all about our second demo. We have, we have looked at.36:24You know, two types in the previous case, right? A software compliance, software image compliance as well as the security advice violation. And the, and the the final demo that I have from my side today is for.36:41The network profile violation, right? So again, we have aH2 device and then we are trying to push a template in this case in this demo, and that template is push has caused a violation in this case.36:56So let's go ahead and look at this demo. Again, we are on the edge two device, right? And we are on the complaints center summary page here in this case, it's a network profiles violation.37:10Right and and this this particular site. So if you wanna go click on the this will take, again, this is a CLI template that we are trying to push which caused the violation. You can get details of what the template is doing. Again, in this case, it's trying to update a VLAN name, right?37:25If you wanna understand what is the existing VLAN name on the device, you can click on run comments and then, you know, show VLAN and that way you can identify what is the existing VLAN name that this template is trying to update, right?37:42Which is what is causing the violation. So, that's how you, that's about, you know, again, if you want to go details, look at the conflict draft, identify, you know, compare the two different conflicts and you know get to the exact.37:59You know, configurations that are changing. Moving on, let's go to and look at the actual template itself, right? So if you go to tools template tab, right, actually something changed happened in two.three.seven, we moved this to the design section, right?38:16So now the CLI templates are under design, you can, you know, identify the exact template that we are trying to push, and then, you know, this is the test complaints and then you can go click again this is acting on the edge two device and if you want further details, you can go back and click on.38:33The blue hyperlink it will actually take you to the.38:53Template that we are trying to push, right? So in this case, trying to change the VLAN name. But that's an example of your network profile violation, right? So that's that's all in the demo three, right? So all these through all these three demos.38:57We are covered on how to identify various violations within the catalyst center and we looked at a few different types as well, right? So let me ask the ball Ton.39:16Who is my colleague in our customer success team and she's going to continue present on the rest of the topics in this presentation. Over to you Sharin. Thank you Sridhar. Let me start by sharing my screen. Welcome.39:33All again, my behalf. Sridhar, can you see my screen? Yes, I can see you. Thank you. So thank you Sridhar for explaining different compliance check in Catalyst Center so well. I want to highlight next Catalyst Center compliance reporting.39:48Is there too.40:08The purpose of the compliance report is to provide management visibility and audit readiness through historical trend historical trend analysis and real time posture assessment. And we have an example of network compliance reports shown here in the slide and you see it comes through different.40:09Compliance checks that we do. It's listing the non compliance across different devices. This report is flexible. It supports one time scheduled or recurring reports to automate tracking. How do we generate the report? We can hit menu.40:30The dropdown from the dropdown we can pick reports and reports will open this view, click on report templates and click on compliance and then go through the wizard. It's gonna ask you for, what file type do you want it delivered, what fields, and you can check all of them and you will get.40:49This compliance report.41:09So the output format supported our CSV, PDF, and JSON. PDF is ideal for executive summaries and audits. CSV and JSON is preferred for integration. Let's say with 3rd party or Cisco platforms, e.g. Splunk to create centralized operations or executive dashboards.41:11Scope of the report is to.41:32Enable, you know, a single run detection of compliant and non compliant devices across the entire organization or we can also go at specific site level or sites levels. In terms of efficiency, the report consolidates.41:35Multiple compliance categories into one report?41:55Making it user friendly and, tool for maintaining network integrity. This feature is highly recommended for any organization looking to streamline their compliance monitoring and historical data logging. Now that we have hammered out compliance check, let's take.41:58What remediation options does Catalyst Center offer us? Once Catalyst Center identifies compliance violation in different categories.42:18We don't just report it. We help you fix it. You can preview the fix and deploy it directly from the UI or acknowledge it if the change was intentional. Catalyst Center compliance violation remediation is automated.42:27Did for network profiles, CLI template, model configs, network settings, application visibility, individual flows for startup and running, software image, security advisory remediation is also present. This, all of these means that it eliminates the manual CLI work.42:47When a violation is flagged, you can use fix all compliance. Option to preview all pending configuration changes before, you know, push the fix and you can also do the conf view the configuration changes before they're applied.43:06You have full control to deploy the fixes either immediately?43:27Schedule them for a maintenance window or simply acknowledge the violation to suppress it if the deviation was intentional. This ensures your network remains aligned with your business intent exactly as you defined it.43:31Introduced in the release two.three.seven, the configuration preview is a safeguard before pushing any changes. Whether you're provisioning a device or deploying a CLI template, the system generates this side by side view comparison.43:53The left side displays the new configuration to be deployed while the right side displays the running configuration currently on the device. This allows you to verify the changes in real time. If everything looks good, then you can just hit you know.44:09You simply hit deploy and it will get deployed. If you need to make adjustments, then you can hit, you know, discard. You can also do exit and preview letter too that will also work for you.44:27Now let's look a little more. Not every deviation requires an immediate action or remediation. For insignificant changes in models or templates, you can acknowledge the violation to suppress future alerts on it. This moves item from open violation list.44:49To your acknowledge violation history.45:07Which is fully tracked for audit purposes. If your business requirements changes, simply you have to unlist the item to return to the open violation queue and resume active reporting on it. It's simple. Controlled way to manage your compliance dashboard and focus on what truly matters for you. Let's take a take a look at it with the screenshot.45:09What I have up here on the compliance summary profiles.45:29This is a CLI template, open violation I see as one, the template name where the violation appears, and it shows right here. These are the violations, and if you see that, you know, you will just want to suppress the alert for now, you can hit the acknowledge. When you hit that, open violations will be zero.45:34Zero and it will come under acknowledge violation before turning to one. We'll see it in the demo and once it turns into one.45:54Then you should be able to see it under acknowledge viol violation preferences. It will be listed and if you want to unlist, you have to click this to unlist it and it will again appear here. Simple.46:03When a device's start up and running configuration are out of sync, right? What do you do? Device by device details, you can do sync, you know, device detail page as.46:18Sridhar was showing you, you can do a sync device config from the device detail page as you preview it and you can, if you like what you see, you can just sync it up. That's a fix. You can also go to the inventory page and pick the device where you see the compliance issue coming to actions compliance.46:34And then.46:54Click check right running config to start up config and that will also do the job. So what I just explained is that devices start up and running configuration can be out of sync. Catalyst Center makes this remediation simple. You can trigger the right memory or copy running to start up comment directly from the device.46:55This details page.47:15Or from the inventory page by the device or you can also do it. You know, if you select multiple right here and apply it, then you can do it in bulk. By selecting right running conflict to start up under the compliance actions, you effectively accept the current running state and committed to the.47:17Startup configuration. Whether you're fixing a single device.47:37All all of them together, this process ensures your configurations are consistent and ready for a reboot. Starting in version two.three.seven, we have tightly integrated end of life status with the swim workflow, which I'm showing here.47:41When a device is flagged in the UX dashboard, we call it UX end of life dashboard for reaching its end of support. You see here on the software tab, we see announcement end of sale last ship end of vulnerability and security support. You can initiate the image upgrade directly.48:01From there, this is seamless transition turns a security alert into an actionable upgrade task in seconds. Ensuring your network remains secure, compliant, and fully supported. In this demo, we'll cover two key workflows. 1st.48:21We'll show you how to resolve all configuration compliance issues on a single device simultaneously streaming your remediation process. Second, we will demonstrate how to acknowledge specific violation, allowing you to suppress alerts for known.48:41Insignificant deviation while maintaining a full audit history of your decisions. Let's move forward. Now let's look at a short demo of the scenario one showing us how to fix all compliance issues at the device level. For that we need to go to edge one.48:59Device details page, which I have it open here. And what we can see here is.49:19There is two open violations on the network settings and we can fix all configuration compliance issues by clicking that. And here you see it will tell me the same thing. Two compliance issues are listed to be fixed, review.49:25If you, if I like it, review it, it's telling me to review it and schedule the fix. So it actually tells me what to do and it also shows routing remediation and all of these compliance issues will not be addressed in the fix, so you know what will not be addressed. So let's.49:42When we schedule the fix, once we.50:02You know, are ok with proceeding forward. We can schedule the fix. Let's see what happens then and two issues are identified and scheduling the fix right now would let me see now.50:05Now later are generated a configuration preview I wanna see.50:25So I will select configuration preview and apply and now it will try to generate the preview for me. It's gonna take couple of seconds as it tries to load it side by side and then I can check as Sridhar was sharing, there was NTP violations, right? And.50:29NTP DNS and IPDD changes that configuration wants to deploy, so scroll down.50:49And see if I'm ok with those and I find it NTP server, IPDD policy right there. Do I want to deploy it if I'm good? Then I can just say deploy now later, and I.50:55I can put a name and submit it. I could have, if I didn't like it, I could have discarded or exited the preview, but I'm choosing to deploy now.51:15Submit and success. So what's gonna happen is this page is gonna reload and once it reloads, I'll see the network settings open violation will go to zero. And here.51:26I start right there. H one device, network settings, so H one device, you I'm looking at it right now and on the network settings.51:43After the fix, it's green, the zero open violations. For 2nd scenario, we'll look at H two device next, which has a network profile violation, and I'll show you while I run the demo. If I find this deviation to be acceptable, then I can just, you know.51:59Either I can, if I don't find it acceptable I can fix it, but if I want to.52:19You know, if I think it's acceptable and I want to overlook it, ignore it, I can acknowledge rather than remediate, I'll show you both the scenarios and by selecting the violation, if I want to ignore I will acknowledge and then it will go to.52:25Two at one from open and suppress the notification while maintaining a history or record of my decision. If at any point of time my or your business requirements would change, I can simply unlist at any time to resume the active compliance reporting. Now let's look at this use case.52:42There will look at.53:02Next, it's two devices, and I'm on device detail page CLI template. On the compliance summary, it also appears and I can click to come into this view. And when I'm on this view, the CLI template, the problem is the CLI template, I have one open violation, the name of the temp.53:04That where I have the violation is test compliance. And if I click acknowledge.53:24Then this will go from one to acknowledge violation one and disappear from open violation would become zero. Here I can review what is the violation and it's just a name and it's insignificant and I can do that acknowledge. And once I do the acknowledge, it comes in here. I can view preferences.53:28Or acknowledge violence violations. So let's go forward. And here, you see I can also do a fix configuration compliance like last time if I don't want to ignore it. So it's the same. I will see the network profile.53:49Is listed with one issue and I can schedule the fix if I want to, and I can hit generate configuration preview, apply because I wanna view it. And it's gonna show me side by side what changes it's bringing in.54:07And I wanna discard or exit and preview later. I'm doing discard, accept, and then I can close it because I'm not gonna push anything right now. I can hit acknowledge because I wanna ignore it. It's just a name and I can hit confirm.54:27And success. It has moved to acknowledge violation. It, we see the change and we see the test compliance coming under acknowledge violation. We can see the preferences.54:46It's right here and we can unlist it if we want to. If you do that, then again, it's gonna come under open violations. It has that kind of flexibility. Software image management, swim.55:04We call it is our engine for consistent intent based upgrades by standardization on a golden image. You ensure every device in your network runs a verified and secured version. The workflow is linear, design, distribute, and activate three parts. Throughout the swim process, catalyst center.55:20Performs automated pre checks and post checks to verify device readiness and image integrity also guaranteeing that your upgrades are safe, trustworthy, and error free. And let's look at a little more.55:40On the swim workflow, it's a four step process. The swim workflow is designed for simplicity and reliability in these four steps. 1st, we need to do a import. So what we do is we import the image.55:58Pull it directly from the Cisco.com using our cco credentials for verified authenticity. You can also upload via local disk URL or from an existing device. That flexibility exists. The next step, we define the golden image, design image repository. We can tag.56:15The golden image.56:35So in definition, we, what we need to do is go to design imagery repository in catalyst center and tag the targeted version as the golden image, we'll see it in the demo. And next step is provision it from the inventory. So we know the inventory page, we go there and we need to provision it.56:36We select the device in the inventory target device to trigger an immediate upgrade or schedule it on a maintenance window. Next, once we trigger it, we need to monitor it. We monitor the upgrade progress till it succeeds. If there is a failure, we need to take care of that.56:57And there are prechecks, so you can run the prechecks and see the readiness report. We'll show it to you too. So the image repository is your organization's single source of truth. Here is how it works. We can see it here. I was talking about the golden image under the image status.57:15The advisories are here listed critical and high and we see one on the golden image we have one critical, three high. The image name appears for the device family we are looking at it and the version. These are the add ons we have.57:34The devices, however many devices we have, it will list it out, we can filter and we can see our Cisco.our credentials CCO credentials, if it's integrated will appear here. So this integrated.57:51Integration will give us the repository, automatically will display critical security advisories. This intelligence exists here for each image allowing us to standardized on verified and secured versions. And it.58:07Appears under the advisory column. The granularity of the control is, group images by site, device family rule or text to ensure the right software hits the right hardware. Grouping would appear under device rules and texts.58:22It's also extensible, easily managed add ons, including smus, Roman and AP packages, ensuring your devices remain fully patched and optimized, which we see here. So.58:39More visually, the CCO integration we can find here on the CCOID system settings Cisco.com. The advisory info information will appear for each images on by critical and high and it will be listed.58:58The golden image will be marked on one click and you can download the image directly from Cisco.com to Catalyst Center if you have this set up. And the add ons and SMU depending on the release store Roman and SMU, apsps and ADP pack APDP packages will also be listed under version.59:14You see different images listed under the image repository under the device family. You can come into here from menu, design, image repository and image family will get us here, and we'll see it also in the demo.59:35So the next one, we are all familiar with the inventory page. On the inventory, there is a software focus and you can find the focus right here and on the dropdown, you can just pick software focus. If you do that, then all your devices will be listed with name, IP address, device series.59:54You can also see the reachability, the manageability, but this is what I want to highlight here. You can see the software images and you'll see which one needs update, which one is the golden image, which one already has it? Which one needs an update will be listed here.01:00:14You can also see the image version, the sites, image needs an update. If it's outdated, it's gonna tell you, you'll see the advisories end of the life status also will appear here. You can also filter across global level. You can filter across sites.01:00:30You can also filter across your devices or you can see all of them together. So the software focus basically, I wanna highlight one more time, provides you upwards eye view of your entire network's software health. It's the fastest way to identify devices requiring updates by.01:00:48Surfacing image versions, security advisories side by side and end of life status in all in one place. By clearly flagging outdated versus up to date devices, this view allows you to quickly prioritize your remediation efforts and maintain a secure compliant infrastructure.01:01:08You can just go with another level of filtering just outdated and it will also show you at that level of granularity. Image update, devices, what we see here is when you're ready to perform the updates.01:01:28You know, now you're on the focus software images, image update is there. We'll show you at 2nd level. When you're ready to perform these updates, the software images focus view will provide the dedicated action for bulk operation, and you can filter the devices by golden image.01:01:46With status or outdated software quickly to build your target list. So here on the image update, we see that an actions and software image and you can just hit image update, to, you know, do the image updates. The system supports up to 1000 devices per job.01:02:06When you do that, you can filter by golden email status, outdated software quickly to build the target list and you can go for 1000 devices per job, processing batches of 100, and automatically validate the readiness checks before proceeding. Note that while major up.01:02:26Updates can be batched, add on updates.01:02:46Like SMEs are executed individually to ensure maximum stability. Image update readiness checks is available here. You see it tells us the device details. You can see the device name with IP address, you can see the running image, golden image.01:02:49If reboot is required, what kind of checks it's doing, and the status of the check, is it green, is it a warning? When was it done? And a brief description. You can execute it once, you can re execute it, you can export it out. All those options are present. So image update device readiness check.01:03:09We'll provide you all of these and before any upgrade regains, Canada Center runs a curated list of automated prechecks. This is what you see here to ensure success. We verify critical items like flash memory availability, service entitlements, startup configuration consistency conflict.01:03:28Register values, filter transfer checks. The system supports secure file transfer protocols, which is HTTPS, SCP, SFTP for wireless controllers ensuring that your image distribution is both reliable and secure. If any of these checks fail, the system alerts you immediately.01:03:48Preventing a potential disruptive upgrade. Image update pre and post checks, what I would like to highlight here is out of the box and custom pre and post checks, software distribution checks. We see three pre and post.01:04:07Checks we can enable and disable them.01:04:27It will tell us what kind of check it is, is system level, it will tell us too and we will see software activation checks also and we can also skip activation, the same thing disable enabled here, pre and post. It will do this check pre and post and the system level, it will tell you that if you hover here, it will tell you what does it do.01:04:30You can also add a custom check on both distribution as well as, on the activation. And on activation, you can also disable. It will distribute and not activate and you can activate it later down the road too. So the flexibility is key to your successful upgrade.01:04:50Center provides a robust set of out of the box pre and post checks that's in this slide, which can, you can easily reorder, enable and disable to feature your environment. You can even add your own custom tests for specific requirements with at a custom check.01:05:10If a pre, you can even add your own custom tests for this, by the add custom one for specific requirements and if a precondition fails, the system allows for a reevaluate reevaluation once the issue is addressed. Additionally, you have the option to skip activation due.01:05:30Very a change management window which in short we say CMW.01:05:50Giving you full control over the final deployment when the final deployment should occur, so you have that kind that level of flexibility. Image update can be done parallelly or sequential order. You can choose from parallel or sequential upgrades. You can move also.01:05:56So you can order the list. We'll see all of those as we go into.01:06:16The demo. Here you see the device activation order is showing us parallel and sequential. You can filter the devices if you want out. You can check one at a time to move to sequential order or you can keep all of those two parallel. You see that in this view you see the IP address site, device series rule, current image.01:06:22Update image. What this allows us allows you to do is full control over the upgrade process. You can choose between parallel upgrades for free or sequential upgrades for high availability environments. You can define the exact order of operations. If a topology change occurs we process.01:06:42You can dynamically move devices between parallel and sequential groups. Plus, you have built in tools to troubleshoot, act immediately on field upgrades, ensuring your maintenance window remains on track. So image update.01:07:02Distribute or activate. Let's look into it. What does, what do we have here? You can schedule the task and clean up. It looks at your software distribution distribution. You can do it now or later at your preferred date and the time zone is listed here.01:07:21Software activation after distribution, you can do that or you can disable it. If you activate it, it will ask you now or later and you can provide the time and the time zone. You can also initiate flash cleanup after activation.01:07:40So the flexibility, it's you who have the total flexibility in how you deploy updates. Distribution and activation can be performed ad hoc or scheduled for specific maintenance windows with now.01:07:56And, you know, if you click later, then you can schedule it. For organization with strict governance, we offer seamless integration with ITSM platforms, the ticketing platforms to support your change review process. This allows you to pre distribute images to devices.01:08:12Well in advance ensuring that when your change window opens up, you can activate the process and it's fast, efficient and ready to go. Image update workflow summary view.01:08:31What you will see in this view is you can review your scheduled task, device to update, device status series, and the sites. It will give you the task name with the device name, device series, site, current image, update image, and update order. You can do filtering here.01:08:45Or here, by device site, you know, it gives you that flexibility and here you get if you have more than 25, you can list till hundred and then it will appear on the next pages. Monitor progress is very important because you need to track.01:09:03Check if your update is successful or not, and I'm showing you how to track the successful updates.01:09:23Visibility is critical during an upgrade. Kelly Center provides granular real time status updates for every device in your job, as you see listed here, device name, device family date updated duration, image version, task name and status, and the date up here.01:09:29You see all, you can also see, you know, how many in progress, how many in waiting terminated success six, and you have one failure, it tells you right away and you can pay attention to the success or the failures. On the success, it can check that did it upgrade? Yes, 07:17 or nine was.01:09:45What it pushed on that device and this is the one that it pushed.01:10:05You can see the details here, the checks, so this is the granular level of checks real time updates is done on the job. Whether an update succeeds or encounters an issue, you get clear, actionable insights at every step. This allows you to monitor progress, verify successful.01:10:10Completion Completions.01:10:30And quickly troubleshoot failures, ensuring you always know the exact state of your network upgrades. Should an activation fail? Catalyst Center provides clear visibility into every step of the process. I'm repeating myself here. If activation doesn't complete within the 40 min.01:10:31Timer. The device initiates a 20 h about timer. If this timer elapses without a successful recovery, the device automatically rolls back to its previous stable image.01:10:52This safely, this safety mechanism is there to ensure your network remains operational even if an upgrade encounters unexpected issues, right? And this is the troubleshooting steps, showcasing the same here.01:11:04On activation, we see it failed and it gives you the details. And if it doesn't recover, we know within 20 20 h, then the device automatically will roll back. Monitor progress ensures the seamless upgrade.01:11:20To ensure seamless upgrade catalyst center performs comprehensive pre and post checks, validation checks at every stage. You can monitor this validation results in real time confirming that both image distribution and activation have occurred successfully. This proactive monitoring gives you full confidence that your network is not only updated by.01:11:40We're also operating at peak performance immediately following the maintenance window.01:12:00So here I'll start my demo. In this demo, I would like to walk you through the full swim life cycle. We'll start in the design, golden image, go to inventory software upgrade focus view.01:12:07Where we'll see vulnerable software example and the swim workflow will see prechecks, post checks, update image and checks upgrade order can be also reversed or adjusted. We will see the highlight of two.three.seven.01:12:21Enhancements such as flexible upgrade ordering parallel processing, which makes learn and faster, safer, and more predictable. And we'll start right here. If you go to catalyst center menu design image repository and summary, it gives you a global.01:12:38Full view of all your device families listed here, six to six devices.01:12:58None without golden image, total images four, two imported, two golden, and we have advisories on top, the summary view, critical, one critical and six high on running images. We can also filter by device level. Here I'm on the all view. We can go routers, which is our wireless control.01:13:04Dollars.01:13:24I can see that the CCO login ID was integrated. I can update device import images and I can see the tasks. Here I have the image families which I can filter with. There is another filtering option that will allow me to filter at this level. I see that Cisco catalyst 9300.01:13:24Which has five devices with three images and with one advisory critical and three advisories that is high. And one image of them is marked golden.01:13:44So let's look at the live demo. Here we are going to the menu, design image repository, design image repository, the summary view at the global level. You can also have it at the site level, device families.01:13:56Now all have golden images. I'm just re exp reiterating the same thing here with Cisco.com ID, which I see present so I can download the image and these are the family of devices listed here. If I click on it, I will go into catalyst 9300 view.01:14:14So Cisco Catalyst 9300 switches are here. All the different images are listed, the versions, the devices and the status, and I find my golden image, which is 17 nine oh four marked under the image status with two advisories, one critical and one high.01:14:32And I see the role was assigned, I would like to pause here. If I click here, what I see is the family name, the version, the advisories, and I can go into detailed advisory from this view. But what is important is what is the image?01:14:51And how was it imported? I see it. What is the size of it? Was the image verified? And I see the MD five checksum is a checksum also listed here. So this is when I say it's verified images when we download from with CCOID, we also verify the.01:15:11So there is your validation.01:15:31I'll click close and these are all the rules I assigned to it. Under device rules and tags, I can hit edit. Rule all would cover core distribution, border router, unknown, and access. I can also go at you know at the family core or distribution level, I can also go. I can actually.01:15:35Go to the inventory page directly from here and I can mark it as my favorite.01:15:55So next I'll close this and here I'm showing you that this is at the global level.01:16:00These are the images that's present on this page. And as I marked it as my favorite, I can go directly to the inventory page from here. You see the star on top is how you mark the favorites.01:16:16And I'm just showing that I can jump magically from here with a click. It seems that it's taking me a long time and I'm magically there.01:16:31On the inventory page and then see I marked this as my favorite, so inventory software images. I just changed the focus, image update and image update status is there. Now this needs an update. It tells me on the software image co column I can see all the devices. I see border and two H ones and edge.01:16:48I can click the details, the running and the golden images are different. Okay, so it's valid. The golden image is 1719, I'm on 1712 and these are the readiness checks. Startup configuration checks.01:17:09Is a green register verified successfully is a green flash check. It also does the HTTPS and SCP reachable check, which is also green. The license, there is a warning, you can still proceed colden image is applicable to the device and it was done on 2024. Obviously, if I wanna do it now, I would re.01:17:25Execute the check and image update or I can do it from image update status. So image update will open this workflow. I can come to this workflow from the menu and workflow also and also from the inventory page. I will name it upgrade.01:17:45Generally if I name it with upgrade n, you know, the device family_I can also upgrade with the version that I'm upgrading to. That is a good practice, and next we go to the select devices view. We see all our devices and these are the three that came in.01:18:02That had the needs an upgrade.01:18:22So I can select all of them. If I select here, three selected, all the devices I want to take to the next view. These are the ones that I'm, I want to upgrade. So this is my software distribution check. We can do pre and post checks. This is all I'm gonna highlight here. And I, this is.01:18:24On enabled right now, I can disable also if I want to, I can add a custom check here.01:18:44And here I'm, it's not a fabric, so I just disabled one, software activation check. I can also add a custom check. I can skip the activation right now. This one is skipping it and all of these checks, if it's activated, it will perform all of these checks.01:18:49And if I hover on the eye, it should give me details, a description of what that check does. I'll click next. Device activation order comes into this page and I can filter or sort of devices, activation in parallel or sequential, I can do that.01:19:09After the devices are sorted, I can request you know, I can reorder them sequentially, which I'm doing right now. I pick the border and take it to the sequential order, and on the parallel, the two other remains edge devices.01:19:27And I see only border here. If I edit the order, what it allows me and I will pause here, each one device will be updated, then two devices will be updated together. Why? Because on the sequential I have sequential will go 1st and then the two parallels will go.01:19:42If I wanna change the reordering I can do that.01:20:02I just dragged and dropped it and if I save it, it will maintain a different order, but see here I will put it in sequential and then parallel mode. I'm hitting cancel, so it's still at sequential and parallel mode. On the parallel I have two H devices.01:20:09Move to sequential. Right now I'll have two devices, a border and an edge. If I want to reorder the list, I can finish. Reorder, right? I can drag and drop or I can do it from the top. That's all I'm showing here.01:20:30And once I'm happy with it, I can progress and this is another thing terminate on update failure is disabled here. You can keep the option like that, and this is cool, update readiness report. It has already done a check. If you open it, you will see all those.01:20:46For both the devices and next, I can schedule tasks and clean up. Also, same page, software distribution I can go now or later software activation, I can do after distribution now or later.01:21:05And the time zone I can pick from here and I can also do it after distribution, software activation, same time, I can initiate a flash cleanup after I do the activity.01:21:22I have to just check it. If I do that here I'm gonna exit because I don't want to do it now. So you see I still need an update because I didn't do it. I'm gonna show you the image update status page.01:21:43Where once I start the updates, it's gonna come up here on this page. You will see across all devices and families, the device name, device family. You want to see the devices that you try to upgrade should have a green check or you can retry or failures will also appear here. The task name will also.01:22:00Here you can filter with the progress waiting terminated, and see.01:22:21If you, if I click in progress it will show me zero in progress waiting zero terminated zero, but on success. I'm on success view and all view you know will probably show me pretty much the same on update status I have eight, so four on success and four on failures.01:22:25And here I have the dropdown which will show me 2500 and I can, if it's more than I can go beyond that. I clicked the success to see what happened and I can see the distribution happened, how long it took, what was the task that.01:22:43It ran through what are the checks right now when it's not running, so there is NO check. Distribution and activation took nine and 18 min.01:23:03I saw that. I'm happy with it. There is NO terminated ones that I have to pay attention to. There is NO waiting ones that got stuck. There is failures obviously and you know we need to troubleshoot that. So here coming into.01:23:10Consideration for compliance checks. What do we need to consider? Well catalyst center automates the compliance process you saw, it's important to understand the operation nuances that exist. To ensure accurate reporting, we must account for device specific behaviors such as comment syntax, case sensitivity.01:23:28Template logic. We will now review this key consideration to help you fine tune your compliance checks and avoid false positives. I start with CLA compliance.01:23:48To ensure compliance reports are accurate and free or false positive, follow the best practices listed here for the CLI templates. Prioritize indication for nested comments, be mindful of case sensitivity and use logic based templates instead of interface range comments. The simple adjustments makes your templates.01:23:58In Catalyst Center more robust and ensure Catalyst Center correctly interprets your device configuration.01:24:18Missed indentation here I have an example of it and missing comment, these both will be flat. So if you fix proper indentation at the section level, there won't be any compliance issues at the template level. To move beyond the limitation of interface range comments, we leverage.01:24:25Either velocity or ginger template in catalyst center.01:24:44By using this logic based templates, we can iterate through list, like the example that I have right here. What we are doing is we are looking at the CLI template, that's the name of the template. For each loop, this is a velocity template, it looks at access port between over the list and it goes over the interface and.01:24:48Adds this access port to each and with the description.01:25:08That's it. And there is a simulation part that I can check when I run this template. How is it gonna appear, and I see it will start at 1314 and 15. That's my 1st access port and go through 15, and that's all it's gonna do. Quick time check. We have five more minutes left.01:25:11All right, and thank you for that. So here I have demoed that to you and this is if you have overriding, right? It's not gonna, it's gonna fail, so you need to add start ignore compliance and then ignore compliance to overlook that.01:25:31You can also see, do the same for your username and password, put it in, put it in, start ignore compliance when it will ignore it. You can also hit acknowledge for the same. And the modification that we see here is for the CLI templates.01:25:51If we see it.01:26:11On the templates. We can see on the provision status the templates that are provisioned are committed green. If it's not provisioned, it will show you out of sync. All you need to do is provision it to make it sync it up. This is very important. Machine reasoning engine is a powerful tool that uses knowledge packs to identify.01:26:12Issues, combined with the integrity verification that I showed you, the check sums.01:26:32You can be confident that your device images haven't been tampered with. MRA is your proactive network intelligence tool located under system settings. MRA uses updated knowledge packs including the letters PCR data to identify potential vulnerabilities.01:26:38For maximum protection ensure you enable both auto update and security advisories. On the swim settings, your device images haven't been tampered with. You can, you know, know it from the integrity verification feature under external services. This relies on.01:26:54Cisco's assigned QTB values, known good values file in JSON format. You can keep this file currently by either pulling it directly from Cisco or uploading it manually. Finally ensure your EULA acceptance and cisco.credentials and you're good there.01:27:14I want to highlight that security is dynamic and our advisory scanning reflects that while we default to software image based scanning, you can switch to custom criteria for deeper configuration aware analysis simply at your specific match patterns and trigger a rescan. Your subsequent reports will clearly detail these matches.01:27:32Providing you precise visibility needed to address evolving security threats. And we see the same. Advisories, all of them listed under advisory ID ID, click it and it will give you detail and there you have the remediation.01:27:52And this, there is another compliance event coming on two.three.seven, it's called network devices config collect appears on platform developer toolkit. And you will see that these are the network devices and that's the name. It's support.01:28:08Rest email Webex and peter duty, and here we have an example of email notification.01:28:28When you subscribe to it, it will go up, and under device settings you can configure your archive, you, that way you ensure you have a reliable backup.01:28:33Both automatic and even triggered archival based on syslog changes and manual and scheduled backups. You can store up to 50 versions. For added security, you can configure an external repository to export these backups to withdraw and sanitize. Providing a robust safety net for your network configuration.01:28:52And this is your end of X you can manage hardware life cycle easier than ever with switch refresh workflow that you see on top. Your cat three case can be automated path two cat nine case handling configuration, image upgrades and licensing in one flow. You can onboard replace.01:29:12Switches, PNP and discovery for both fabric and non fabric environments.01:29:32We also have AP refresh workflow, which now supports non provisioned wireless controllers, ensuring your network hardware stays more modern and fully supported. And to wrap up, remember that effective network compliance is a strategic business advantage for you, not just a technical one. But.01:29:37The leveraging Catalyst Center.01:29:57You transition from manual reactive firefighting to a proactive automated posture. This consistency directly reduces downtime, minimizes security risk, and simplifies your audit preparation. Ultimately, you are transforming compliance from an operational burden into a reliable asset that keeps you.01:29:59Network secure, resilient and ready for the future serving your business outcomes.01:30:19For next events and recording, the expert insights series are all listed here and you can view it. Let me put the link in the chat so you can grab it from there. And I will also show you.01:30:25And let's see the chat actually I'm hiding the chat. Is it possible for someone or you know we'll just I will share.01:30:44Where you can see it. Let me open it and bring it over here. This is where you can.01:31:02Go and find all the expert insight series. You can, it will tell you details and register now and all our prerequ the ones that we have earlier is also here. You will find this one also appearing here. Thanks Matt for sharing it.01:31:18And, yeah, Sharon if you if you don't mind me jumping in here cause I know we're a little over time, so there's, there's the registration link for for those of you who'd like to view it and any recordings, they, they'll take some time to be vetted and posted, but they'll all be available for.01:31:34Are you on that link for the the elevate with Catalyst Center series?01:31:54And if you want further one on one engagement with us, you can talk to your accounts team for customer success consultation. You can also do that. And thank you everyone take for for taking time out of your busy schedule to attend our session today.01:32:00I'll stop sharing. Alright, thank you and thank you everyone for joining. We would greatly appreciate your feedback regarding today's session. I have sent a Slido link in the chat as well or you can use the Slido within Webex. We would appreciate if you can, you know.01:32:18Provide your feedback regarding this session. So this concludes our presentation. We thank you for your participation and hope you found this session informative. We wish you a productive reminder of your day. Thank you so much.01:32:37