Streamlining SD-WAN: From Templates to Policy Groups

I have been with Cisco for the last five years in the enterprise networking domain. I got my CCIE when it was.00:00Still the routing switching track and.00:20And so today I'm going to be helping with the demo, so stay tuned we will get back later on after the 1st section of presentation of 1st. Thank you. Thank you Mohammed.00:22Okay, so today's agenda will be overview of the configuration groups, what are a couple of ways how to do the configuration groups? We have workflow manual configuration export import. This is very cool and I like that feature and we have some.00:40Catalog prebuilt, we will see them and probably you will ask ok what are I'm going to do with the existing device templates. We have another amazing tool called conversation tool. Mohammed will.01:00Walk us through how to do that. We have some best practices and what to keep in mind and the demos, how to create and the migration from template to configuration group. Okay so I will start with my presentation and will be like a mix between a presentation and a demo. So.01:17You don't want, you are not going to see only the the slides and in the end the demo is like a mix or stay tuned.01:36So a little bit about the overview, main questions is why we as Cisco decide to kind of improve our UX. Now we call that the UX 2.0. This is mainly because we are listening customer voice and we were receiving.01:46In different feedback and the main ones.02:06And we wanted to kind of with this upgrade or with this new introduction of UX 2.0, we wanted to have couple of things that will improve the user experience. With that in mind we now have an onboarding, a very.02:09Like a simple way and a flexible way of doing the day zero or the day in on operation ability to cook deployment, we have couple of workflows or other features that will help everybody to deploy and assign a device.02:28Through that configuration groups or other operation day to day we wanted to because we don't have only SD WAN, we have catalyst center, we have Meraki and some other very good domains, and we wanted to have a user experience kind of across the board.02:45When you see this new UI, now you will see very similarly with other domains as well like center. And, last but not least, we have integrated kind of the best practices and recommendation.03:05By implementing the workflows, the workflows are not there only to make the, your experience easy but kind of to show you what are the best practices that you can do your day to day work.03:24And, specifically for this what we are going today configuration group, we wanted to simplify reuse reusable options and kind of better structure with the simplify again we have the workflows configuration that will guide the users step by step.03:41What what to do and what are some best practices. Reusable meaning that you create a profile and you can use the same profile across the board.04:02And the same thing with the structure, so what is the main difference that I really like? It's we have been working as the WAN for, five years or so now or more and we know how kind of challenges when you build a device template, you need to keep in mind.04:17Okay, I'm building this device template, but what is the the router will will support like the model of the router and we need to know for each model of the router that we may have.04:37On our network, we need to build a device template and this is kind of now gone with the configuration group. It's much more simple. I will explain in more detail later.04:50So on on according to the reusable right what I was explaining, you build AAA, e.g., feature templates or partial, right? And you can use the same one across the board.05:07Only if let's say you have a domain like hub routers or data center routers that you need a different username and password. But if that is not the case, you can use the same profile everywhere. You don't need to think again, what is my router here and.05:23The probably the triple AAA is the most easy example, but there are some other configuration that they maybe supported in one router and they're not supported on the other router. With the configuration group, that challenge is not there anymore.05:41So you may have router A B and C The same profile will be used on router X Y, Z A little bit kind of to show the difference between the template or UX 1.0. So we know that on the device template, we need.05:561st very important. We need to know what is the device specific like a model A or model B Is this a CSR? Is this ISR four K and so on?06:16And with that we can have different feature templates whether we'll do a specific configuration. We can have a mix of feature templates and the CLI add ons templates when that feature template is not available, we use the CLI add ons. And the last option.06:27If we want, it's not recommended but if we want we have a CLI template when we have under the CLI way of doing the configuration through the device template. On the configuration groups.06:44And feature profiles on UX 2.0 kind of things are different. We just need to create the configuration groups based on our logically like I need this routers to be part of my West region or I need this routers to be part of my.07:01Big sites, big retail stores, and I need these other routers that will have only, let's say one internet connection or one to log.07:21And that that should be kind of the the new logic building the configuration group. So now I'm not thinking anymore about the device model. So I just need to think what is the use case for these specific routers, right?07:30And with that in mind, I have very few profiles. I have a basic profile, I have a WAN profile and I have a land profile, so on the basic profile, basically I'm building all my global configuration like like login, banner, aaa, and so on. On the one profile.07:45I'm building my transports and management if I want to have and inside those profiles I have those interfaces like when I build MPLS and the internet.08:05And whatever will be the situation. And on the long profile, I basically I'm building all my service profile VPN VPNs or vrfs. I have some other optional profiles.08:17Let's say if you want to have a CLI add ons, you have to implement thousand eyes agent and some other use cases. A little bit terminology because we are changing some ways before we were saying device template.08:32When we were meaning everything, all the configurations are mapped in one place. Now we have that called configuration groups. Again, this is the logical group of the devices and customers user can group based on their business needs. Again, some example will be like.08:52Like a east region versus west, America, if it's like continental.09:12Environment versus APEC, Europe, retail store data center and so on. With the feature profiles, these are like flexible buckets of configuration that will be shared across the configuration group, right? So these profiles when you build, again, you can share between different.09:19Configuration groups.09:38And, again, these are like basic profile for global configuration, one profile for your transport and management and profile, it's when you build your service site of of configuration, and the feature person.09:40Those are the the main real configuration that will be attached on these devices, right? And those parcels are again they're specific to whatever configuration you want to do like AAA, if you want to do an interface routing protocol and so on and so on.10:00And, some questions right may may come to your mind and we have received this question even before like, ok, I have my production environment, I have X amount of routers, they are all part of the device templates. So now.10:23If I start moving them to the configuration group, I can do that everything in one, right? And we are not expecting you to do all the migration in one goal, right? So this is the reason why you have.10:41And this new system, new UX 2.0 is offering you to have devices mixed between some devices can be still on the device template on the classic way and some can start migrating easy to the configuration group.10:59And there are some kind of main difference. E.g., templates, device templates, now we have the configuration group. For the local policy and centralized policy, we have policy groups and topology. Basically the topology is the portion when you do the.11:16Control policies, hub and spoke or custom control policies. And the network hierarchy is kind of something new when you can build your network hierarchy.11:34Similar to what we have on catalyst center. Also, it's very useful if you are using a multi region fabric, but the main goal is that you can have.11:49Devices that are part of the legacy configuration and devices that are part of configuration group. Everything will, will work without an issue. Here I want to kind of explain a little bit what what are some main difference and the steps.12:06Let's say if I want to create a branch with one.12:25Very minimum configuration one transport, two service VPN and full mesh. If I want to do this on the existing device templates, approximately I will need like 25 steps even more if I have more configuration on it, but.12:29The main steps are like 1st I need to find and start building the configuration or feature templates, right? And to make all the configuration that I need, probably I will have between.12:48Two to 19 steps different feature templates that will satisfy this type of configuration and after I I have all these feature templates I need to start mapping those feature templates to the device template and again the challenge.13:04Which is ok so I have all my ASR routers. I need to put all my ASR routers on this device template and if I have another set of routers like catalyst 8300 or same family, I need to have another device template.13:22And after I have sorted this device template, the model device model and all the feature templates, then I need to start assigning the devices or attaching the device to these device templates and.13:41After I do the attach I need to go through the template variables for each router, and by the time that I'm ready to do the the push of the configuration, I have easy reached like 25 steps.13:59The same exercise but for the configuration groups, now it's much more easy and it's approximately seven steps and of course this is Cisco recommended way moving forward. But what we need to do, let's say if we decide to do via workflow.14:14We just open the workflow, we we set up our site configuration and we will see some example later, but basically is this like a single site or dual site? Once we we finish that type of configuration, we are ready to associate a device.14:33For this configuration group and after that we are ready to deploy and during the deploy, we still need to have those variables filled and the the difference is when we click deploy, it's much faster, right? So the same exercise, the same configuration, two different ways.14:53To do it. You can see the the difference, right? And this is why we are highly recommended moving forward to kind of start building and using these configuration groups.15:13And here there's a couple of like mapping system profile transport profile. You can see now the the feature personal name, right? It's triple AAA before was cisco triple AAA BFD, Cisco BFD, and so on. And I'm not going to read all of them.15:24Is here just for your kind of.15:45Looking and understanding a little bit better. We can see here that now we have a device access policy that will represent the old or the legacy site of the local policy, right?15:48And the same, it's with the the structures, right? It's going, the list going below and what is more important here, right? That I wanted to show is that app flow visibility it's been available on twenty.fifteen.16:04And the reason why we want to kind of point this out because the C flow D before was part of the, when you build the centralized policy now has been moved out that centralized policy and the new place to do the configuration is under the hierarchy collector and C flow Ds.16:23Okay, so now we will see a couple of ways how to do the configuration groups, right? We have four ways right now despite the numbers that I put it here, you can pick any one of that will work just fine, right? We have the workflows, we have the.16:48Manually creation and what I'm excited about is this export import because right now if let's say you have a lab, we manage and you build a template and you want to have the same configuration.17:07To the production, then it's not an easy way to take that specific device template on from your lab to the production, right? You need to, I don't know, do by opening the configuration group, open a tag case or running some la.17:27Like script when you copy the specific configuration and move into that production.17:46Now with the export import, you build that configuration group, you export that configuration group and from your production we manage you just import like from the GUI, you don't need to run any type of script or anything else.17:54And last but not least, we have some catalogs. These are pre built. They exist on the cloud. Cisco is taking care of those. There are pre built configuration groups. On those we have some policy groups as well, some topologies kind of mix it together. And if you don't know where.18:11Have to start, you can download that one of those catalogs as well and as a start so you can.18:32Learn more about these configuration groups. So we will go through a couple of ways. The 1st one is the workflow, but this kind of the logic is not only for the workflow the this is true for configuration like manually way and the export.18:40Import and the catalogs as well. So basically what we will do, we will create a configuration group associated with a system profile, WAN profile, land profile. After we create that configuration group, we can associate a device.19:00A router basically. And once we associate the device, we review the summary, we are basically ready to deploy and during the deploy process.19:17Well, is when we kind of fill the variables, we can review the CLI preview and deploy configuration group basically the the configuration for those specific routers, right?19:32So you do the workflows, it's from the main menu configuration workflows library under a window like this will open. You need to put the name. Again, the names can be based on your.19:49Network logic, right? Some example are east coast branches or data center branches and and so on, right? So after you put the name or description, here is when you have a couple of options.20:07You can leave everything as it is by default, right? You don't need to do big changes here. We can do changes later as well. But couple of points it's you can select between a single router or a dual router and this navigator here will help you to.20:23Of visual though those what we are building, right? I am a visual guy, so I learn.20:42Or understand better when I see something, not only when I read. So this will be helpful for a lot of people I'm very sure. Under the site settings side by default there are some things like admin password should be admin admin and you can change that and if you want.20:49You can leave again as I mentioned like by default and you can do changes later if needed.21:09Under the one interface, here is kind of something that I want to point out. If you select full mesh, meaning each router will connect with those ISP providers from the interface, if you do a transport extension, even these will will change and you will use the transport extension.21:15In as well.21:35You can change the the name right away by clicking this little pencil or you can leave again and do the things later and again the the same thing with transport name color and so on. So if we look a little bit deeper on those configuration, right, if you click show.21:36Advanced, you will have the option to do the interface name by using variables. Our recommendation is to use variables side, but if it's a situation when you know this specific configuration group will be only for this specific router.21:56You can do static, but most of the time variable is the way to go. And again, you can change between DSCP and static. If you want to do some advanced routing, you click on the sorry not advanced but just routing, you click on the add routing.22:13And here you can do like a static or if you have a BGP you can start doing the configuration on the BGP before you create creating the configuration group. And the same thing for the LAN or service side, right? By default now we have four prebuilt.22:29We have put it some names and again you can change the names if this doesn't make sense for your network, and there are some numbers like 1213 99 and ten. Again, you can change these values, but if you need more we have an option, add multiple VPNs at once. This will allow you to add.22:50Another eight VPNs on top of four, so totally twelve in one go and all of them will be without the name and all of them will be marked as VPN one so you need to change if this is the case, you need to change the numbers before you move to the next step.23:09After we're done with the site configuration, we can do the additional features. If you just in case if you have like a remote access like server or server, you can click the enable and you can put the values here.23:30Again, everything that I'm showing here can be done later as well. And the same situation if you have high availability for the routing, you can enable that one and you can pick for each for each VRF, what will be your primary device and what will be your secondary or backup.23:45It could be the same router or could be a mix, let's say for VPN twelve you need router one and for 13 you need router two. Depend on that.24:05What what will be your network design at that point, right? And this is supporting both Ethernet interface by default, but if you have a port channel interface, you can select the port channels as well. That's the last step will be the summary once you are satisfied with.24:16What you have.24:36You can just click create and you will see like a window like this telling you that the configuration group is created and you have two options, I will do later and that is probably the the recommended because you don't need to associate the device right away, we can review or add some more things as well.24:38But if you are convinced that you have everything in place, you can click associate the device and you will be ready to attach or associate the device to this configuration group that we just created. The same way with the manual way like basically from scratch, you go to the.24:58Configuration configuration group.25:18I'm highlighting this because by default will be SD WAN, but these configuration groups are here and you can use them even for other use cases like SD routing. If you are using SD routing, you can pick from the list as the routing and you can create a configuration group for the SD routing.25:21We are focusing on SD WAN portion, but things are very similar to SD routing as well. So after we select the the mode, let's say you click on this blue big button, create a configuration group. This window will come up, you will put a name, you have two.25:42Option like a workflow before, right? You click a single router or dual router depend on the situation. Right after you do this selection, this window will be created.26:01And you will see what is the name of the configuration group that you just did it, the system profiles like transport profiles, policy profiles, these are some optional all of them that are optional you will see optional.26:12And it's very quick access and deployed right so to to attach this app associate is basically attaching a device, right? So you click add and you are ready to associate the device another big difference is under configuration sorry on the device template.26:29When you go through this process, right, when you attach a device.26:49You are not able to stop there. You will go through the process of doing the variables and till you push the configuration here, there are two different steps, right? You just associate, you can continue doing other things related with these configuration groups or not and.26:53Only when you are ready, you can click the deploy.27:13That that is allowing you some kind of flexibility not going through the process at one shot. And in the same way, right, after we did the configuration groups, we can build our profiles, the, the.27:16We click on the system profile, right? Will be the same concept. If we have couple of them, we will have an option to edit them, but if we want to create from scratch, you click add new, you will see the same thing, a name and description, nothing changed here. You click create.27:35And this window will pop up right away after you create and you have some global profiles ready to go. And if you had if you need more, you have an option here, add new features. And if you see a couple of them are like kind of grayed out because they are already.27:54Already exists but you have option to add the banner or like a port flexible port speed if you have that type of router.28:14That you are working on. And let's say if you want to create an triple aaa, you click on the the dropdown little icon here and you click create new, this is my lab, nothing exists. If you have other profiles, you will see the list here and you can select an existing triple A profile.28:24So when you click new this new window will open, again you will put a name description, and here are where you can do different configuration with regard to the triple A.28:44Like a local user or the user or radius or whatever will be your situation that you want to create with this profile, and that is true for all of them. And after that you click save and basically you just created the 1st system profile.28:55The same thing, it's with the transport profile, you click on the transport here, add new nothing different from what we did with the system, right? A little bit, the visual will be a little bit different. You will see that the transport profile created and you have you are ready to add them.29:14VPN, right? And if you want to add more, you have some other features, right? So the transport VPN is representing the, the transport side, but if you want to create a management VPN, you click this one and you will see another row here.29:34And here are a couple of things when you create a VPN, right? You click new and this will open and here is when you create the VPN itself. In, in this situation will be the VPN zero or global global VRF, right? The representing that.29:50And in that in the same window you can create or configure the DNS host mapping. This is when you have V bond that is not reachable from the router to the internet so you can map those IPs to the router.30:07And you can do the the route like a static route or services whatever will be the situation. And once you create that, you will have an option to click this little plus here and you can add more configuration with this VPN, so meaning now that I have the VPN.30:26And global VPN or any other VPNs, right? I can add interfaces or IPsec tunnels or BGP routing and so on and so on.30:46And the same exact same thing on service side. Again, we click on the service side, put the name and description. Here, a little bit difference is if you see by default, you don't have anything here. It's saying add a new feature to begin building your profile.30:57So the 1st step will be all the new features and here you can select service VPN, and once you select service VPN, you will see the service VPN, you can create a new one and here is when we build the VRF.31:15Like that we need like in my case VPN one, I'm doing the number and if I have a DNS mapping and the more information and after I create the VPN one, now I can add more.31:33Configuration to that VPN one like interface or any other things that I need to do part of the configuration. And all of these that I'm building despite the configuration group, system profile policy.31:49Group et cetera. We have some three dots and we can edit. We can copy copy means the deep copy or cloning.32:08Just in case if we want to build another configuration group that will be very similar to what we have, but let's say an example will be this, a new configuration group needs to have different AAA.32:18Profile. The the local user needs to be a little bit different or whatever would be the the situation, right? The option is there for you to use. And the same this is true for features or even for the policy, right? We had another express serious.32:34Early that we talked in depth about the policy groups.32:54But here I just wanted to mention that the copy option, the the this deep or the cloning is there for all the features and policies, variables, right?32:59We still have variables. They are life saving for me, but I wanted to point out a new feature or something new that we have inside the variables. It's called default values. Let's say we work day to day with SD WAN, we know most of our routers.33:15When we deploy, they are using gig interface one, e.g., right? But some routers because of the position or they are using a different type of routers, some location, they may use gig internet two.33:34So we have an option now to keep the main or the most used variable like internet one, and we go when we go through the deployment, we will see that here that that default values here, but on the specific situation when you don't use gig interbit one, but you need two, you can change.33:50On the fly, right? This can be used for other situations as well. I'm just explaining one kind of an example. And we have some JSON files if you like to do some type of automation. This is how that JSON file will look like.34:10And the API kind of keep a note to, to keep in mind, API still is just looking the name and the value. It's it's not relying much on the description. Description is more for the GUI purpose.34:30And the last but not least is the export import method. So again, once we build the configuration group on the lab or any type of situation that will be right, you are satisfied with that. You click on export.34:48This window will open and you will have an option to select configuration group. You can select all of them or if you are interesting only on the specific one, you just check that specific one. And this is true even if you have policy groups or topology, you can export those as well.35:06And on the other router, let's say from lab to production, you click import, you find where you downloaded that file and you import and that is very easy migration from one V manage to another V managed.35:24And the catalog menu, right? So this is again, this is a library that Cisco is building. It's existing on the cloud. You do that, you do configuration catalog configuration catalog, something to keep in mind if you don't have cloud service.35:43Enabled, you will see this kind of warning when you go on that menu.36:03And this is easy to enable, just you go to the same things and you need to put the, smart account and virtual account credentials. And once you do that, this is how the, the, the page will look like. Probably because we are updating probably some names or more cutoff.36:09Locus are there but the main things are you still have chose the label, so if you want SD WAN or SD routing, right? You can choose the label or you can just scroll down and look everything. If you are interested in let's say in this single router.36:29Catalog before you install, right? You can click view details to see more and again the catalog is coming not only with the configuration group but will have policy groups and topology all built in one installation. Okay.36:48Couple of things to keep in mind like when when you view, you can see something like that. These customer fields, you can edit those if that is not the case right zero zero could be a specific situation when you need a different value. And there are some Cisco default fields. These are not editable.37:06But after you, you take a look and you are ok with what you see and you can download the detailed as a PDF, you see more, you can click on install, right? And again, this is what I was explaining, right? Some of these fields can be editable and some of them are not editable.37:26And once you click install, the process will fail. This is what I wanted to explain this. If a catalog group exists or a policy group, right? Depends, catalog group or a policy group exists with the same name.37:45The process will fail. The pre process will not fail if the catalog configuration group or policy group name don't don't exist, but you may have a profile. We'll will you see here it will say, ok, the profile with this name already exists.38:03Being important. So we'll not fail but will not bring that specific profile.38:23Let's say you have a transport profile that is matching the name that this catalog is using, will not fail but will just keep the profile from this catalog, basically. And like the same.38:28Installation task right you can see all the steps the same like we are doing with the configuration groups. And once that is done, the only thing is you will see that catalog, but you are not able to edit the catalog right away.38:47Did this as a similar to device templates when you see default and NO default. On the default device templates that are already in the V manage, you are not able to edit them right away. You need to copy and after you copy them, you are able to edit. Exact same thing you see here. So you can see the catalog.39:06All the configurations are there for you, but to start this you need to copy by clicking these three dots and do the copy. And the same exact same thing as I was explaining for the policy and topologies, right? It's the same single router as the WAN branch.39:26You will see there will be the policy and the same concept. You are not able to edit this policy right away, you need to copy. And the origins you will be able to see when you see the configuration group, you will be able to see who created right will be a user and will.39:46To give you which user.40:06And you will see if it's been added by a catalog or if it's important as well and again it's going just showing that.40:10These are read only, right? Even the the features profiles as well. When we go, let's say we're done with this catalog, we are not very convinced, you can you have an option to uninstall it.40:29A couple of things to keep in mind. You can uninstall but you don't need to have associated router or a router being deployed on this. If that is the case, 1st you need to remove the router from this specific.40:44Configuration group before you uninstall right. And now I know probably I gave you a lot of information to kind of recap what I spoke, I'm passing the ball to Mohammed so he can go and walk us through through a demo. So probably.41:04We will understand better what we went through again I'm back here with some demo Hopefully you see my screen and.41:22So this is a lab demo that I have for my side here, this is the 1st of all, I want to mention this is version twenty.fifteen.4.2I have another version twenty.fifteen.five that shows some other features, but the main.41:39Of the demonstration today is gonna be on this one in here. So.41:59What the or what the mentioned about the configuration groups and the enhancement that we have in UX two.O, we can find that in the configuration section in here if you go to configuration groups.42:05There's also a lot of other new enhancements that we have in UX two.O in terms of policy, network hierarchy, topology and and other ones. Okay, so mainly we're gonna spend more time in the configuration groups in here. So as you can see here once you get to this this here, I do have already two.42:25Configuration groups, we're not gonna use this one. We're gonna create a new ones. So you can see that you have the configuration groups, you have.42:45The system profile, the transport profile, you have the policy profile and the other ones that are like CLI like unified communication voice, other profiles also. So we do have a couple of profiles already existing in system transport and services, but what we are going to do is once you get to the configuration.42:55Group so you have this blue button in here. So you have the other option that is import export on the side.43:15But in this single button in here, create configuration groups, you have only the three options in there. So if you click on the on the the listing here, you will find two other two hidden options there that are either create from a workflow or you can import from.43:22The catalog. And if you click on the blue in here, this is the manual option. This is where you can need to provide create manually the configuration group. So you say e.g. I am having, I want to create a hub configuration group.43:42For my, for my hub devices, then you can have, you have, you can give it description and then you can select it is, this is gonna be a CLI configuration group now, I'm not gonna use that. I'm gonna use features. So you have the option here to select either it is a single router or the dual router, right? So let's say e.g..44:03I'm creating a single router.44:23Configuration in here. Now, the other before moving on, let me just go back a little bit and then verify about what the is mentioning here. So you have the configuration group here for the SD one, you can also select other ones for SD routing or any other type of configuration that you want. But right now we're gonna concentrate on the.44:26The one so when you go to the create a configuration group like this one in here for the hub or my hub devices.44:46If you expand that configuration groups, you can see there that you have two masked profiles that you need to ask to to to use for this configuration group. You can add more, you can add the service profile. This is mainly if you have a branch and you have the line.44:53Inside of your of your of that branch that you want to, this device is gonna serve. This is a service profile, so is it gonna serve all the services that are inside of that, that branch. You can add more profiles, CLI, I invite communication, anything that you want.45:13So here in the option in here, you can either select if you have already some system profiles already configured, you can select them in here or you can create a new one. So let's say e.g., I want to use a new configuration for the system profiles, so you create a new one, you give.45:31We give it a name. So hub this is system profile, but once you click on create it will bring you to the configuration of that. So you can see here that you have some.45:51And persons that you need to to fill in in here for the global for AAA B OMP, all this configuration in here you need to configure them. So you say e.g. the basic, I'm going to create a new parcel and then they give it a name.46:10Basic for the hub, I'm gonna save it in here. I'm gonna keep all of these the default values in here. So you can see here, there's a lot of default values that are already predefined for you on best practices that we we we.46:27We we have given all the experience that we have with serving customers and we see like what are the the best practices so we have everything already in here. You can still go through this and you change them as you want. You can change for the device group location, you can give it it's device specific.46:46Check me mainly if it is a location in different sites. So you can have all this this this configuration changes in here.47:06You can add new features, obviously the grey gray ones are already on the listing here. You can add new ones, you can add a banner, ATP, and you define all the all these features in here. If you don't like this design configuration in here, you can list them and it will give you the list.47:14So, basically here right now I have only one feature provide that I have in here, one partial that is created so that's the only one that is showing in here. So once you start filling all these features with the with partials, I mean, adding all the parcels in here, you're gonna list.47:34Later on in here. So you do the same thing with the transport, you do the same thing with with the systems, all of the the configuration that you create, for the transport profile you need to fill them here for for this configuration group. So let's say e.g. if you go to.47:54To the system profiles, they can see all my system profiles that they created. I have here this option in here which is saying the shared if this system profile is shared between different configuration groups. So let's say e.g., I have this hub that this go e.g. now it's shared only on.48:13This configuration group, so if you go to this one in here and then I select this one in here. Now, if I go back to the system, profiles, it's shared between two configuration groups and then you have some information here about the creation time when it was updated.48:33And and all of that. So this is about the manual configuration, right? So you need to go through all the configuration, you need to add the profiles to to to to this in here. And this is basically what you're gonna do if you have, e.g., a green field configuration deployment.48:53Right, you need to create the configuration and if you decided to go manually do it, so this is how you do it. Now the other option is if you decided to use.49:13Yeah if you decide to use a workflow, right? So you can either go from here and you select this option here and bring you to the workflow. So this is what it brings you to in here or you can go let me just from here. You can go to the workflows in here and this is where you have all the workflow, not only for the configuration groups what you.49:23Have others e.g. for the software upgrade for for other ones. We create in here it will bring you to the same place. So you give it a name, so.49:43Test workflow workflow, right? You can give you the description, you click on next. So once you click on next, this is the 1st option that you get, either it is this is for a single router or dual router and then you have this visual image in here that shows you how is the representation of your configuration.49:52Right now so you have the transport which is three transport here and the You have the land part, the service side, which define four four segments with with four VPNs, so you can either go through that, you can also.50:12Second please so you can have also the representation for the there. This also gives you the option to define the, the one interfaces. You can.50:34You can either keep them as they are just go back to the router in here. So you can keep, e.g., you can delete the AT if you don't want the AT, you don't have the AT for that branch, the land side is so e.g. this is the definition of your all the VPNs, you can keep them as they are, you can change.50:50The way how you want. You can delete if you have only e.g. three panes and then you go, the other thing that I want to mention is once you see this green check in here, it means like all.51:11The required configuration are good. But if you have, e.g., let's say I go ahead and then I remove this, right? So if I do this like it's gonna bed one here that's something is missing here.51:23You can put this back here, ok, so I can go next. Next, I have a summary in here and then I create configuration. And once this is done, you can see here that it created transport profile, the system profile, and then the services profile.51:39Right. And when it's done, it will ask you either you want to associate a device right now or you can do it later on. So let's go back to the configuration groups in here and we see what we created. So that's this is what we created with the three different profiles that we have. System services, and you can still go in here, have a look, see the.51:59The Option that you did, you can list them here in term of a list. You can add similar as we did in the manual one, but you can have all this simplicity and you have all this flexibility to do this. Now the other option that we have for the configuration is this is let's say e.g. you have a lab.52:19And the prod, you can go in here, import and export. So let's go e.g. they have another lab in here, so.52:39If I go to configuration groups back in here and then I go to export, I can select the configuration that I want to export. E.g., this one, I export this configuration only done. Then I can go back to the other one this is e.g. this is the.52:46The prod and the other one was the lab so you can go here and then they can import this one and in couple of clicks it will import the new configuration that they have from the other one. So you can see here the west region is in here.53:05Yeah, this is the 3rd option. The other option is the catalog. So if you go from here, you can go either from here from this side in here, it will bring you to the catalogue page or you can go from the configuration side and then you can go to the configuration catalog.53:21Now as my colleague Iris mentioned, you will need cloud services enabled to get in here. Normally, if you don't have that, you will see a page where it asks you for the credential. This is basically similar as if you go to the settings, you go to cloud services and then you, you will.53:37Have an option in here to enable cloud services and provide the smart account credentials. So once you do that, you go back here and then you see the options in here, all the configuration, this is basically the way how we see some predefined like configuration and.53:57The best practices for different use cases, let's say e.g. this for the industry router because it is different a little bit than the usual tradition usual branches e.g. so this we say e.g. a site a mining site or something like that. So maybe the configuration a little bit.54:17Different. So you can see all these options in here, different ones. You have also for the dual router for the branch, you have the single router for the branch. Now, when I mean unfortunately this morning it didn't want to work for me. It gives me an error. I'm looking into this, but basically it's similar once you.54:37Clicking the install, it will.54:57Put the configuration in the configuration groups. However, you cannot, you can, you can provide the values for all your variables, but you cannot change the predefined Cisco values. So what you have to do in that case, so let's assume this is, this is the configuration. You will need to go to the option in here, you copy.54:59And make a tune of that configuration and then you can use it as your own and you have the flexibility of changing anything on that configuration. Features, values, variables, you can do all the changes that you want. So I'm gonna provide back the ball to my colleague. He's gonna go through the conversion tool and then we go.55:18Back again to to demo that.55:39Thank you. Thank you Mohammed, thank you for this amazing demo walking us through. We have 30 more minutes left. I'm excited. We are going to talk about the conversation tool. This is more important, right? Since we have already device template.55:42Right, so we have a conversation tool what the tool will do.56:02We'll check your V manage will find out what are the device template and all the feature template associated with that and what are the policies centralized policies. This tool has been around from 2012, it's been improved on 2015.56:08And a little bit more on 2018.56:28We'll copy something to note. It's this tool will copy only the device templates that have device attached. So main basically anything that is live, a device template that is live and all the feature template associated with that, the same with.56:31Centralized policy. Normally, you will have only one active or live centralized policy and that is when, that conversation tool will copy that and we migrate to the policy profile. Okay.56:51So, this is how the tool looks like to access the tool. If you haven't seen that already, you need to go on your self service portal. All the customer have a self service portal. This is the IP and the menu here could be a little bit different, but you will find some.57:09Something like configuration.57:29Conversation. This is the tool. If you are on prem or you have a firewall rules applied, this is the IP that you need to kind of allow. So this tool will be able to communicate with your vmanage. And once you have this this.57:31Completed, then the process is kind of straightforward. You put that FQDN of the V managed or the IP address of the V managed username and password. The username that you are using needs to be an admin with the admin rights, right? And if you have a port, you need to put.57:50Support here by default will take that 443 or 8443, right? You click next. You will see something like this, right? You click collection. Important to notice right now we are just collecting, the tool is just collecting is not changing anything.58:09Your manage. After you click collect, you will see all the the steps that he's doing is collecting feature templates, device templates policy list, everything related with the policy, if you have a firewall like a security policy as well and so on.58:27You have an option to upload or download, meaning that if you do that, you will get everything as a JSON file. I will recommend to do that. It's important to keep and you can review that later just in case if you forget an information about a specific configuration.58:47Specific variables and so on, right? And you click next.59:07Here you can see the devices that will be able to be converted. Again, only devices, device templates that are attached or other line that have basically at least one device attached.59:11In this example, only these three device templates will be converted because only this has a device attached. And we click convert. Again, this is the process that is going. Nothing will change.59:27To the router, so meaning the data plane is not being affected, it's very safe. You can do this process without you need to have a maintenance window, right? And once you see everything that is being converted.59:42Not yet pushed to the V manage you click upload. Only when in the step seven, basically when you click upload, then this tool will start creating your configuration groups policy, groups, topologies, everything that will be converted.01:00:00And, you have an option, right? Not only to collect, but if you have what we were discussing about the exporting, you have.01:00:18This option to upload that template. So this is on the 2015, this is available on.five. It's very new feature on 2015. If you are 2015 four, where is now our gold release, you don't have this feature, but 20.01:00:34Fifteen.five is available so you can download your device template by clicking this configuration conversation, you export the file and that is the file that you can upload here and do the conversation if you want to without allowing this.01:00:54IP through your firewalls. That is another way and a couple of things I wanted to go through this so, it's important when you go go through these steps.01:01:12You do a copy of the device values, right, from the device template. Of course, we talked about the doing the configuration groups manually or any other ways like a workflow or conversation tool. We need to deattach a device from the device template.01:01:30Only then the device will be able to be attached on the configuration group. Once we deattach, we can associate, we can deploy and there are not huge but there are few kind of differences on the variables so we are highly recommended.01:01:47To take a look on those variables just to in case if you see something that are not mapping correctly for you. And as a, as a last recommendation try to keep the same name schema of the variables so that will be an easy transition.01:02:07And this is how it looks like. I am rushing a little bit so you can see more on the demo, but basically this is how we detach a device. Once we detach a device, we will be able to associate that device on the configuration group.01:02:26And once we associate we are ready to deploy and after we feel that this is why we are saying it's important to save that device basically the template CSV files and prepare that before you import.01:02:43And once you import, you have all your variables values filled for you and you can at this stage here, you can push right away, we are recommending to click the previous CLI, so you can see the differences side by side similar to what you do with device configuration device template.01:03:03And this is the the CSV file portion. Again, before you deattach, download the CSV file, prepare the new CSV file for the configuration group and you should be good to go at that point.01:03:23And once everything is migrated, the difference now will be when you see you will not see the team template name, but now for those routers that part of the configuration group, you will see the configuration group name and that is the the difference. So you can see what how many devices are one.01:03:40Device template and how many are configuration groups.01:04:00And I am passing the ball back to Mohammed for the demo so you can see more. Thank you, yeah, now we're gonna go through the conversion conversion tool. This is mainly if you have only the templates, right? So you brownfield.01:04:04And deployment and you want to migrate from the old templates to the new configuration group. So in my case in here in this lab, I'm going to go to the process step by step. I do have couple of device templates in here. I mean I have a lot, but they are not used I have only this.01:04:23Three ones that are used one for the smarts, but we are gonna focus on the four the the 1st one which is attached to four devices, right?01:04:43Now the 1st thing that you need to make sure is you have access to the service portal is the one service self portal. So the link is in here, all our customers should have them the access to to the tool. Now when you go to the, your dashboard and.01:04:51Your portal, you're gonna see on the dashboard something here, but I don't have any portal fabric for myself but for yourself you're gonna see a lot of details about about your deployment. And then here there's an option for the configuration conversion, right? And this is what it brings you to this page in here where you need to provide this actually.01:05:11The two way of doing it. Either you permit this.01:05:31IP to communicate with your SD WAN manager and then from the SSP portal is gonna directly collect all of that as explained by my colleague or if you are air gapped environment or you don't want any other external communication, you can use this option.01:05:35And as explained by my colleague, this is available only.01:05:55It's available only in version twenty.fifteen. So e.g., if I go to my, my environment in here, if I go to the templates, this is what I see, right? And this is version twenty.fifteen.four.01:06:02But if you go to the, to another one this this other lab which is in version twenty.fifteen, this is twenty.eighteen, but these actually this feature is available starting from twenty.fifteen.five. It was.01:06:22Actually 1st introduced in twenty.eighteen, but our customers they wanted this this feature to to to use it in the version twenty.fifteen, so we introduced it in version twenty.fifteen.five. So if you go to the templates in twenty.fifteen.five, you're gonna see there.01:06:40An option in here that it will permit you to export the configuration from the this page in here. Now for version twenty.fifteen.four, you don't have that here. I'm going to use.01:06:58For this portal I'm gonna use the IP options now what I need to do is take the IP of my SD WAN manager and I provide it in here, I have already the permission to this to this.01:07:13To this manager, I'm gonna take user name password, provide them, provide them in here. This is my HTTPS, I don't need to provide the port it's already by default 443, so again go next.01:07:30And this is what happened. It will, once you get in here, you have the communication, you have the permission to go this. So you go click on collect and then it will start collecting the template, feature templates, device templates policy and everything.01:07:48And it will go step by step, one by one, feature templates, then device templates, then you're gonna go through also the policies, then then the the the group of that you have already configured so you can go and see all of this. This is the option if you want to upload you download the the.01:08:03User file, then you go next and you can see here that it brings me to the template that we have.01:08:23And this templates, this is the one that I'm gonna, that I'm gonna focus on that is attached to four devices. And then I convert this configuration and you can see here that it gets confirm converted into this configuration group, which have.01:08:30Three feature profiles, and I explain here, one system one transport one services and inside of this feature profile there is multiple features here. So you can see here that you have 17 features and you can go.01:08:48Just to show you, if you go to the templates, you can see that I have here 17 different features. Now, there's also some other group of entries, but let me go back to the the you can see on the configuration while my colleague was presenting, I did a little bit of cleaning, right? So we have.01:09:05Again, two.01:09:25Configuration groups, I removed all the system profiles, the transport and services. So this is what I have now. So once I get here, I can go to upload. What is going to do is gonna take all of this configuration that is gets converted and uploaded it back to a.01:09:28The one manager. It's not gonna apply anything. It's just gonna upload the configuration to the manager and then you can review it over this. So we're gonna click upload and I confirm, and you're gonna go back to.01:09:48The configuration groups in here and give it a little bit of time and you can see that it will show up in here with the name that we saw in this. So you can see here what happened. You can see also like there's a warning there's one person to upload. You can see the reports, you can click on the report.01:10:02You can generate a JSON or PDF. You can click on the PDF and then.01:10:22It will show you like, ok, there is an invalid payload. The reason is because it's duplicated, so it gives you an information about why something didn't happen and this is a warning because this is duplicated, it didn't need to convert it again. So it's already converted.01:10:26So we gonna close this then go back to, so we can see here that we got the new configuration converted and been applied in the configuration groups in here. We can expand this. We can see that.01:10:45Here is the three profiles that are associated with these configuration groups already also created and they are here. So now what we are going to do is we're gonna go to the templates and this is the process of immigration. So we have four devices that are attached in here. Now what we are gonna do 1st.01:11:05So we're gonna export the CSV, right? If we want to immigrate all of these devices at the same time, we export the CSV, and this is what's gonna happen in here. Let me bring the file and open this one.01:11:25So this is what it shows me. So I have all my four devices and with the number in here and all the variables for these templates and all the names, all the values of this, right? So I can take this one and keep it and then use it to.01:11:46I think.01:12:06You are sharing only that application. We don't see the file. Can you share the full screen? Yeah, sorry 1 s. So I can see here like the excel file with all let me go back a little bit. So all my CSV, so this is the CSV that they exported all the chooses number here for all the four devices.01:12:07And all the values and the all the variables and their values. So now I'm gonna focus on my side. I'm gonna focus only on one.01:12:27So I'm going to, to detach one device, so this is the device I'm going to detach from this template and it will detach from the template.01:12:35Now what happened here is the device is actually going from the managed mode to the CLI mode. Nothing gonna change in terms of configuration, only the management of the devices. Now it's gonna be a CLI mode, so it's not gonna get any configuration.01:13:02From manager. So we can see here that the change in the device configuration model to CLI.01:13:18And when it's done, it will be changed to configuration to so now the device is functioning like control wise, data plan wise, it's functioning hundred percent. It's only it's managed by what I'm going to do is I'm gonna go.01:13:24Go to the configuration group.01:13:44Can I associate this device with associate this device with the new configuration group. So we can see this is the device that I detached. I'm gonna save it. At this moment, I did not deploy anything to the device. I'm simply attached.01:13:47Simply associated the device.01:14:07Do the configuration. So if I want to deploy the configuration, I need to go to deploy. So I'm gonna click on deploy select the device, click on next, and then it will give me in here and it will show me all the profiles that I have, and they expand them and it is expecting me to give.01:14:09To provide the values of all the variables. Now I can I'm going to do the best practice for this is to export the CSV file, which is going to ask me to provide all the values for the variables.01:14:29It's not this one, so this one. So this is the CSV file from the configuration group. So it is expecting me to provide all these values in here. And you can see here I have only one device because I did detach only one device I'm associating only.01:14:51One device. So it's expecting me to provide all of these values. Now I know that I have those values in the in the file that I exported here. So let's say e.g., I'm gonna bring the file that have only one, only one.01:15:10Only one device will be somewhere. So this is the file. Let me close this one. So moving a little bit to explain this. So this is because this is very important and this is what most of the time you're gonna.01:15:31Spend doing this migration. So this is the template, this is the file that they exported from from the template, and this is the one that I exported from the configuration group.01:15:52So instead of providing all these values that I have in here, what I can do is only copy the the the variable and look what is the place of it in the template, right? And then change that.01:16:02With with the with the with the new variable name. So we can go here e.g. and then let's say this is the value, this is the variable and then they can pass it in here and change it. So for the easy for the for the sake of this process, I already have.01:16:20The con the I already have them the variable swapped from the config, from the config to the template that I already have the values assigned to the variables in here in this file in the config.01:16:37And this is the process what you have you have, how you have to do it. And if you have multiple devices, it makes sense because you're gonna just swap the variables. You're not gonna swap all the values. It's better to swap the variables than the values. Now for the this example because I have only one device.01:16:58It doesn't make a difference if you swap the variables of the values. But think if you have like.01:17:18Tens of tens of devices that are listed in here with the with the values, it's better to change the variables than to change the values. Now the other thing that I want to mention is if when you do, when you export the variables from the config group, you will see that there is some extra variables like this one.01:17:24One like this one and like this one.01:17:44And what is asking you, it's asking you to provide the password or anything that you have encrypted as a password in your configuration simply because we cannot de encrypt what your password that are encrypted in your file. So what we are gonna do, what are are we doing is you are asking you to provide.01:17:46Right, those passwords in the, in the, in the in the the new variables.01:18:06So now when I get in here, I'm going to go to provide these values as I have already exchanged the variables between the files I'm gonna go imports and this is in this file. I'm gonna provide, now you can see successfully provided and you can see here and you see all the values.01:18:13Views are associated with the the corresponding variables. Now we're gonna go next and this is 2nd part where you want to spend more time. Where you're gonna go to the preview CLI and you want need to make sure that.01:18:33The the the old configuration from the template, it matched the new configuration from the configuration group. And there is couple of things that are gonna be changed. Why? Because if you have something that you lift as default from in the.01:18:49Complete. When you get the new configuration groups in the configuration groups what we did, we put a lot of best practices. So let's say e.g., you can see here the differences between the old and the new and I'm gonna just give you an example here, e.g., for this interface.01:19:09So for this tunnel interface under the gigabit ethernet two, which is color internet, you can see here that we have some differences, right? So you in the old templates, we did allow DHCP, we did allow ICMP.01:19:29Now, this is what's left as a default in there. Now in the new configuration group, our best practice is to do not allow DHCP and P under the tunnel interface.01:19:49You can change it if you want, you can go back and look into the configuration group and allow the ICMP if you want, but the default value in the configuration group is our best practices which is we do not ICMP. So this is where you need to spend a little bit of time and make sure like the.01:20:04The difference between do is actually good. Then when you are satisfied with that, you go, you go and deploy the configuration and go back to view deployment statements, that is.01:20:24And then you make sure that deployed now error in there so the device has pulled the configurations and now when you go back to the configuration.01:20:44You will see that, ok, I have one device associated and and they have one device in sync which is it's already deployed. I hope this is very clear the process. I'm gonna give a couple of minutes to my colleague because he need to go back to a couple of slides.01:21:00Have this the errors. Thank you.01:21:20Thank you Mohammed, I appreciate it. And thank you everybody for staying with us and learning about configuration group as a recap, we reviewed the differences between UX 1.0 and UX 2.0. What are some ways how to do.01:21:24Or create the configuration groups using workflows, manual way export, import. We spent some time on the conversation tool and some demo about like how to migrate one device from a device template to a configuration group.01:21:43I really thank you for the all the questions and thank you to and Paul for answering those questions and this is kind of the closing of the session. I put in some links here so you can go and read more and understanding more of these features everybody including us.01:22:00Last year are learning as we go to this is very new feature for us as well. Your questions, your.01:22:20Challenges that you face on the field are helping us to improve the tool and asset Cisco right? And we have some ask me anything. These are kind of, as a continues of this expert series. If you have questions about this specific.01:22:27Speak.01:22:47Session that we went today or if you have some other questions overall with SD WAN, ask the questions there and we will do our best to respond and kind of clear your questions or doubts.01:22:49Thank you again, I'm going to close the session. When I close the session, you will get a kind of feedback. Please spend a couple of seconds more and tell us how we did it and what we need to improve and what kind of session you are interested into.01:23:10And see more from us and learn more with SD WAN and we will do our best to kind of accommodate your requests. Again, thank you everybody for spending time together. Thank you Mohammed to Sharp Paul for helping on this session and see you soon on the other session. Bye for now.01:23:30