Transform Your Network: Unlock Cloud Management with Catalyst 9000

During today's session, you'll have the opportunity to ask any questions that you might have related to the topic. You can just type your questions in the Q and A panel.00:10And you can find three dots on the, you can find it on the three dots where you can see, you can click on it and you'll have the Q and A panel where you can type in your questions. You'll also have the opportunity to raise your hands. If in case your question is not noticed, you can type in your questions, you can raise your hands and please.00:19Lower your hands once the question is answered. With that, I will hand over to Hardik to start off with the 1st half of session. Over to you, Hardik. Thank you. Hello everyone, good morning and welcome to this sessions. This session.00:36Question is more about how you can onboard your favorite catalyst.00:56A platform right onto the Meraki. I, I believe that you have heard of many things with respect to catalyst centers and Miraki that these are the disjointed platforms and the other things. Cisco has done multiple things with respect to integrating the catalyst center or Catalyst devices.01:01With the Miraki dashboard to give the single pane of view, right? Now, what the Cisco has done is about integrating the native cloud iOS XE or a catalyst platform with the Miraki Cloud experience.01:20Right? With that, what you can able to do is when you integrate the Miraki mean catalyst send catalyst devices with the Miraki, right? You will have, you will have very less dependency.01:39Why I'm saying dependency is because earlier when iOS XE was there to integrate with Miraki, you require the the basically the software to run on top of the switches as a container. Now, with the iOS XE seventeen.fifteen release.01:55And beyond, right? You can directly integrate catalyst, infrastructures with the Miraki without any dependency, right? So that is one.02:15That there is a less dependency, it improves your scalability and the compatibility with other devices as well. Okay. The main thing, right? If you, if you see here is that you can, you can use your catalyst infrastructure as it is.02:24Right, with your trusted iOS XE software, right? And with that, right? What you can, what you can have is you can have the Miraki cloud experience as well as underneath, you will have the your trusted underlying infrastructures, ok, which, which will do your.02:44Day to day job of routing and switching, switching perspective, right? Now, if I move to a little ahead, right? Now, if you see that if you are having a 9800 controller.03:05Right? Then what you, what you need let me scribble it up. Yeah, if you have the 9800 controller, right? What, what basically you need is the seventeen.twelve and seventeen.fifteen or later releases right to on.03:20Onboard. What we recommend is to, for a 9800 controller, you should at least have seventeen.eighteen release.03:40Right? What it supports, it supports up to around 2000 access points and 20000 clients as as a scalability. Now, with, we come, we come to this part where in the Miraki, you are having two options to onboard your catalyst infrastructure, right? One.03:49Is the configuration source cloud or a cloud configurations. Another is a configuration source device, ok, which is a device configuration. Now with the cloud configurations, you will have full capability of Miraki and you manage your cloud configurations directly from the.04:09Jackie dashboards.04:29Right? With the device configurations, right? What you have is a hybrid approach, ok? You will have, for a monitoring purpose, you will have the Meraki cloud experience and your configurations and management part, right? Which you will handle it using.04:30Your traditional web UI or a CLI options.04:50Now, let's let's do more about the cloud and a device configuration, right? How, how it differentiates. So very 1st part that the when you have the cloud configurations, it's exclusively managed by the Meraki dashboards. Here you are having a flexibility.04:57Ability of the Miraki Miraki UI plus the CLI.05:14Which is your traditional iOS XECLI. With the, if you, if you go for 2nd one, which is perform configurations on the dashboards, ok? Here you will do, you will configure your devices with your favorite CLI options.05:22Another thing that configurations are stored in the cloud and sync with the switches, right? Because entirely you will do your management with the Meraki dashboards. With, with the device configurations, the device configurations you do it locally using the web UI or CLI and other option.05:40This is, you will have you can say the backup of those configurations will also will be managed by the Miraki Cloud as well, right? Here you will have only read only CLI because configurations will managed by the Miraki UI.06:00Here you will have read and write CLI support. For the cloud configurations, the basic requirement is to have the Miraki license. If you have the catalyst license licenses, you can migrate to Miraki one and if you, for the device configurations, you, you only need is.06:18As your essentials or advantage tire license, right? With respect to the platform support, so 90 2935, all, all will be supported with the, the cloud configurations.06:38On the device configurations again all the platforms of catalyst, is supported onto for the device configuration as well. Let's moving on it. Now with respect to the pre on pre onboarding requirements or prerequisites, right? Very 1st part.06:52That you need if you are going for a cloud configurations, you need to migrate your licenses with the Miraki one, with the device config, you need your essentials and advantage license.07:12Okay, the simple configurations that you require to onboard your devices is, very 1st part that you need your default VRF with your DNS and NTP access for a device configuration mode. You need to enable the IP routing.07:26You need to have a default route to your default gateway, the name servers.07:45IP the IP domain local lookup and the NTP servers, right? You need to have your local users as well, ok, for the device configurations for for a 1st time, right? Then for the cloud configurations, you need to have your, you need to have your VLAN.07:50The interface VLAN and default route and the client IPHTTP client source as your VLAN, right? Now, note, note here is that when you move your existing configurations to the existing devices into the cloud configuration mode, you need to migrate.08:10The devices, right? And when you onboard the devices, it will completely wipe out your configurations and you need to do that configuration from the UI, right? So these are the basic configuration that you need to have, ok, for your connectivity to the Meraki cloud.08:30Let's let's look at the steps, right? The 1st part that check whether your device is supported where device is supported, right? Second, you need to have seventeen.fifteen release at least for the switches part, right? For the.08:51Wireless part we recommend to go for seventeen.eighteen release with the you need to issue from the CLI the service miraki connect ok which will which will basically register your switches you can say with the with the Meraki cloud.09:10On the output, you need to, you need to have the cloud ID. So you just copy that cloud ID, and put that cloud ID when you are claiming the device into the Miraki, right? So.09:29Yeah, and here you need to select whether you want to go for a cloud configurations or you want to go for a device configurations. Okay, so for when you are moving to a cloud, it's basically reset your reset your configuration.09:44Right, so.10:04Another thing that, Yeah, so that's it and your your Miraki, you can able to monitor your devices if you are into a device configurations, and if it is a cloud configuration, then you can able to manage the devices. So these are the simple eight steps that you can.10:06Can follow it here, ok. Now let's, let's look this from the demo directly, right? So, ok. So I logged into logged into the my switches, right? And I.10:25Put the command like show version to check the compatibility and show Miraki compatibility to check whether my device are compatible or not. It, it will it shows whether device is compatible here and which is which is my device, right? I also check the, the connection.10:44Activity to the Miraki cloud as well, right? These are all compatible other models with the Miraki experience.11:04Okay, very 1st part we change we check the ping which is dashboard.Miraki.com and we see whether our clock is in a in a proper sync with the NTP or not.11:13Okay, we we move to configure terminal and here we need to put the command service miraki connect. Once we put that command and then we need to put show Miraki Connect.11:32Show miraki connect will will show you, the cloud ID, which is basically the twelve digital decimal number twelve digit alphanumeric numbers, ok? And that particular cloud ID you just copied it.11:47And you put it into the Miraki, right? So what you need to, what you need to do is you need to go to switch and you click on the add switches. Once you click on the edge switches, it will give you the options of add devices. Here you.12:06Claim the devices. Here you will put your cloud ID and say claim, and say claim devices. Once you do that, it will show you in the particular device you can able to see it on the Meraki dashboard here.12:26Right? Then you need to select whether you want it to go for a cloud configurations or a device configurations. Here I'm I'm selecting the device configuration for for now. And then you need to provide the user local username and password.12:44For your device to be monitored, right? And here you will see that device is being showed in the Miraki dashboards on a switch switch segment.13:05And once you click on that device, you will see all the details of the device, like serial number, cloud ID, what versions are on, what is which IP it is getting connected from, what is your public IP?13:24And the different other different other things, right? Here if you click on the cloud CLI, right? You will see the options to launch the terminal. And once you provide the password.13:43It will show you the the CLI terminal of your of your of your 9300 series switch, which we have just recently onboarded. Okay, here you can provide, you can go either a config D and and do the configurations if you are into the cloud cloud.14:02Management mode.14:22That's back to the presentation, right? So here I, what Cisco is doing, right? To, to aise the migrations from your existing catalyst switches.14:27If you are not having the catalyst center, then you can move your existing catalyst switches or catalyst infrastructures to the Miraki cloud experience. For that, Cisco is giving a free X, you can say.14:44Access if you are having a valid DNA essentials and DNA advantage license up to the Feb 12029. And from then onwards you, it, you might need to move from your DNA essential and advantage license to the Miraki license, right?14:59So for for now up to 2029.15:19Right? If you are having a DNA essentials and DNA advantage license, you can use that license to onboard your devices onto the Miraki UI, right? So just to add, right, who should, who should go for.15:22Experience. One, if you want to experience the Miraki part then you can move move your devices to the Miraki experience.15:43Okay or if you are, if your company is having the cloud 1st approach, you can move your devices to the Miraki dashboards, right? The catalyst center options is, is there for any on prem preferred means the customers who preferred the on prem part, right?15:51There is, and in future also, I I would say that if you are preferring the on prem part, then use the catalyst center. Let's let's move to the how, what are the assurance capabilities?16:11Or how your dashboards look like, right? Okay, so very 1st part I will key launchpad.16:30And let me go to ok so can you just remove those calendar invites? It's blocking sure.16:46Okay yes, so I'm I'm into the I'm into the Meraki dashboard. Okay, I select my network, which is San Francisco here.17:06Okay, so very 1st part that I move into the overview here and within the overview, what I will, what I will, within the overview, what I will get is.17:26How many networks that I have configured on to on my key UI, right? So there are different networks that I have configured somehow still processing. Just wait. Yeah.17:41So these are all my networks, which is which is which I have configured here, right? And these are the tags that I have given to my network to easily filter the network in, in the letter sections. There are, these are the different tags that I've used it in Meraki and these are.17:58A list of devices which have been onboarded onto the Meraki, right? Another thing with respect to organizations as a whole, I will go I will go to a summary part, right? Where you will get the overall view about your entire network, right? What you will get is how many uplinks.18:18Are are having the issues, how many when appliances are online and working fine, how many switches or how many alerts with respect to the switches I'm having similar way with the wireless, right? Here you will get the overall view with respect to if, if it is a green part.18:38Then, it's all ok if it is you can say alert part, then there are there are some issues with respect to the switches and some issues with respect to the access point.18:58Okay, so this is the overall view that you will get with respect to what are the usage with respect to traffic, what are the, how many clients are getting connected, and these are my different tags that have assigned to my networks.19:09Right? Let's go on to the network, network wide and the ok story. Yes, clients. So in the network wide clients part, right? What I will, what I will get is done.19:25Number of you can say users that are currently onboarded onto Myraki connected devices.19:45Okay, very 1st part I will get as, as earlier, right? I will get the overall status about the links, when appliances, which is and access points. I also get the view about my application usage, right? So if I click on here, I will get the number of applications which has been.19:54You can say in use by my end users.20:15Okay, I will get the usage, I will get percentage of usage from the overall utilization perspective and the group usage.20:20Okay, the next thing I will go to assurance and overview ok in the in assurance overview, I will start with my health score, right? So, these are the.20:38This is my health score, which is for my specific San Francisco network, which is saying that around 9390, hundred, hundred out of 9093, right? Are, are the health of my devices. Now, the health of the devices depends upon many things with respect to utilizations, how.20:57How is your iOS whether it is on the recommended release or not or there are, there are some.21:17If if there are some issues within your switches or wireless infrastructures, the health score varies accordingly, right? So here is if you see from last 24 h last 2 h onwards, which is over here, I can able to select whether I wanted to see for last 2 h, last day, last week or any of the custom.21:23Time range, right? Based on that, these all data will will change, right? Here I will see how is my client is doing, right? There are I I see there are some eight clients which are having some issues and with respect to wired wireless.21:44And I can see how is my network devices are doing and how is my other infrastructure is doing, right? Let's go to the services. Now services is very important for every every network with respect to DHCP, DNS, radius, how is three of my important services in.22:00The network is doing. Again, I can able to select.22:20How much time I mean it's what what kind of data I wanted to see, whether 2 h 8 h, and the different ranges, right? I can also able to select if, if I wanted to watch with respect to some specific SSID on the wireless part.22:25Right? These are the the high level view about the clients that is connected, and the number of clients is connected over a period of time, right? Then you will see here the graph view which which basically you can able to correlate with any.22:42If you are facing some issues.23:02In your network, right? And these are the different DNS or DNS DHCP servers in your network to look after, right? And you can see how, how all these servers are doing with respect to the health, and I come to the experience metrics.23:04Where you will see how your connected clients are doing.23:24Again I'm having a different filters which I can select as per my need. I'm having a connected clients, how is my wireless connections are doing and if there is any, if there is any issues found by the Miraki Miraki, then it will, it will highlight it. So I can check on the.23:28Authentications and how is my authentication is working. So here if you see that.23:48Handshake timeout is 99 percents and invalid credentials. Yeah, it's zero and other other issues are zero, right? So here my focus area will be the handshake timeout, right? And I also have some summary with respect to the authentications which is which has been selected over here.23:53Here, and I can also have a view about the different ssids, right? So how is my SSID doing? How many clients are connected to each of the SSID? How is the failure rates and other part, right? Which I can.24:13See it from here, right? Next thing I will move to the alerts. These are the alerts across the across my, across my San Francisco network. This is the view of the alerts, how it is being configured how it is being said.24:33Put to the Miraki UI, right? And you will see different critical and warning alerts as you hover your mouse towards it.24:53The blue line basically shows that when the configurations change has happened, right? So based on the configuration change, you can correlate it with your alerts as well. So in case if you had done some configurations and then your alerts are getting increased, you can able to correlate.25:02That because of your some some configurations this this many alerts has increased over ah during that period, right? Then I will have the different alerts currently all all of my alerts are are zero.25:23But if if you have any of the alerts, you can click on that alerts and that those alerts will, will, only those alerts will be displayed over here. Let's go to the clients view again. The clients view that we have already seen from the name.25:41Network wide, the similar view, similar view is over here.26:01Let's go to the event logs, these are the different different events which has been identified by the Miraki Miraki Miraki dashboards with respect to different.26:06You can say appliances maybe switches or wireless or SSID, so these are the different issues or alerts has been identified by the miraki. So if you see on 8 July I'm having the insufficient RSSI RSSI value for this particular.26:24Gateway, and for this particular.26:45Network, right? So that way you can able to drill down into each and every event, so e.g. and how is my, the how is my RSSI value, which is 92 % currently and the cutoff was 85 %. That's why that's why this event has been recorded.26:48Let's, come to the intelligent captures. Now this intelligent capture part is, I would say a very, very, I would say useful because earlier we need to go to the particular particular locations, connect our laptop to that.27:11Which monitor that port and lots of stuff that we need to do it to capture something here.27:29It's it's becoming very, very easy on on the meraki. You just need to select the respective, so very 1st part that you need to select whether you want to capture either the campus gateways or access points, switches, security appliances or cameras, right? So what, what things, what traffic you want.27:36To capture. So e.g., I wanted to go for a switch, right? And then I will say it will say whether it's a single switch or a multiple switch. If you select on multiple switch, you can select multiple switch over here. Here I will select that I wanted to capture from this 9200 series switch.27:56Or what interface you wanted to start capture, say 101, where you want to save the output, whether you wanted to save it on, on the cloud, a download or you wanted to have a quick view, right? So let's say save to cloud.28:16What is the duration that you wanted to start, whether it is 60 s or more? You can put any filters which is generally the PCAP filter that you generally put it on the Wireshark related tools or related tools.28:32And this is this is what the file name that it will, it will be saved to, right? And when you start captures, it will start capture for 60 s and once 60 s is complete, it will, create a file onto the cloud.28:48Right? The next options where you can access your stored captures or download the captures and you can even schedule the captures in in your future time as well, ok? Now, there are very, I would say a very important.29:03Part is the topology, right? So this topology view view the infrastructure topology view is being automatically generated by the Meraki Miraki dashboards and it, it will show you the different things, right? These are, these are my devices. These are my cameras.29:23These are my switches. If there is any alerts on the switches.29:43It will show it directly here as well and it will also show the, the hierarchies. E.g., these are my distribution switch, these are my, sorry, these are my core switches, core switch off the network, these are my distribution, these are my access and what whether it is an end users or any of the, any other.29:47The devices which are connected to this network, right? So I can have the complete view with respect to layer two topology or a layer three topology.30:06Very, very important part. It's a compliance, right? So if you see, there are different kind of compliance that we follow and track manually. Now you can able to, you can say view any of the best practices, network best practices.30:24Over here, right? So if you see here.30:42That, certain support FIPS 140, you can you can know more about the FIPS FIPS policies and what is FIPS onto the documentations part. You can also see that.30:45Best practices that you need to use SNMP V three now, which is a little standard, so it will it will show you that yes in your some of the devices on your network, which, which only help.31:04Which which are configured with the SNMP two and you need to have the SNMP V three selected so right so if you click on the SNMP settings, you can directly move to that SNMP setting and you can change those settings as well, right? So there are different compliance part, right? We which you can directly.31:19Do it from your dashboard.31:39Yeah. So that this traffic analytics part let me search any other network.31:51Oops.32:26Okay, never mind. So basically the traffic analytics parts will show you how is the complete utilizations of your networks with respect to different applications and how is your access parties there with respect to the specific network in case it's in this case it's a.33:06San Francisco, right? So let's do.33:27Let's do it, yeah. So it will show you the client count and the usage in the bits or a megabit spot. Let it load if it is there.33:30Okay. Okay, so let's let's go into the very important part with respect to the upgrades, so you can go to organizations and the firmware upgrades where you will see the summary of your devices and how how what all devices are there on which versions.33:53Right? So e.g., the versions of access point which is access point is 30 two.17, which was released on 5th of May 2026, and you can schedule the upgrades from here, right? So if you click on.34:12Any of any of the networks you can go to the schedule upgrades and you can select here which, switch you want sorry which access point or.34:30The access point in this network, you want to upgrade with which particular versions, so you need to select the that versions. You can go next enable it for a pre download and or you want, ok? And.34:46What is your upgrade strategy whether it is upgrade time related or it's a client downtime related, so you can select any of the things which is required. You can perform the upgrade now or you can schedule the upgrade later, right? So this way it's very, very easy for you to upgrade any of your, any of your.35:02Devices. One thing to note here that in the particular network, one should be in the, the set of devices should be on the same upgrade release, right? So here, here you will see only the network, it's not the devices.35:22Right, so that way you only, the particular network should be on the particular release, right? Whether it is a switch or whether it is a wireless.35:40Yes, I wanted to go with the report. So report is the very very important part of the any network in the it is available on on tip of your fingers. So e.g., I wanted to have.35:57And, you can say report on my retail stores, right? I can have these retail stores things. I can customize the report, I can select what other things that I required in my report.36:15E.g., I will select all things that I need to have with respect to applications, client, usage part, everything. This is the how your entire report will look like.36:32And this reports are very, very important thing for any of the leaderships, right? So you can either export it on the Excel or you can email to your group ID or you can even schedule the this entire report to be delivered.36:47Weekly or maybe a fortnightly or daily, right? So it depends upon your requirement. So that's it from my side. I will hand it over to Satish for the next sections.37:08Sure over to you? Thank you Hadk. Let me share my screen. Okay hope everyone can see the screen. So just wanted to give a background of like whatever we have.37:25Covered till now. So Hardik has covered if you onboard, let's say if you don't have a catalyst center and if you want to leverage cloud dashboard in order to manage and monitor your cat nine K infrastructure, with the device configuration mode, you can get the assurance or monitoring cap.37:45From the cloud. So what I'm going to cover is.38:05I'm going to cover the cloud configuration mode where you can get both automation and assurance capabilities from the cloud. So, you must be seeing this demo. So whenever we try to claim the device, it's going to ask you for the cloud ID, and once you provide the cloud ID.38:08Here and if you claim the device.38:28Then you have to add it to the network. This is where it's going to ask you whether you wanted to onboard a device in the device configuration mode or in the cloud configuration mode. I just wanted to highlight the difference between both the modes. Let's say if you onboard the device on the device configuration mode, your cat nine K configuration will be pre.38:32So the existing configuration will be preserved and after onboarding the devices from the cloud, you'll be able to monitor your devices or you can get all the assurance capability that Hardik was talking about right now. But let's say if you choose cloud configuration mode.38:511st of all, your configuration will be wiped, your your all your existing configuration will be wiped and the con device will try to get the IP address from the DHCP and onboard it on the catalyst Meraki dashboard from the scratch.39:12So any configuration that you wanted to do for the cloud configuration mode, you have to do it only from the cloud. The CLI will be locked for that devices. So prior selecting the cloud configuration mode, you have to, you have to know that your existing configuration will be low lost and you have to do the configuration.39:30From the scratch on the Meraki dashboard. So you can do the configuration prior to onboarding also in the help of template and you can map it to a particular network. But make sure you do you do have all this configuration on the devices when you select the device in the cloud configuration mode. So as I said.39:50Device needs to get an IP address automatically in a VLAN and it needs to have the reachability to the cloud. So this is the primary like prerequisites in order to onboard the device on the cloud mode.40:10So with that, I'll show you what are the differences between, the device configuration mode and cloud configuration from the dashboard perspective. So right now I'm into a network called San Francisco and I do have like six switches with me. And if you see.40:27On the right most there is a column called configuration source. By default, you will not see this option. If you want to add this into your inventory, you can go here and you can select this configuration source over here. So you, you see there are two types of configuration source, some of the device are in the device configuration source.40:47And some of the device are in the cloud configuration mode. So let's say if I click any one of the device in the device configuration mode.41:07So you get all the monitoring functionality which was talking about. However, if you wanted to do any port level configuration or any configuration for these devices, you'll not be able to do it from the Meraki dashboard. So you will not get the option of edit itself for this device for.41:15For this particular, any of this port. Whereas you have an option of cloud CLI where you can launch a terminal, it is basically taking an SSH of the switch and you can do the configuration of the switch from the cloud CLI or you can locally take an SSH of the switch and you can do the configuration. And when you onboard a device on the device.41:35Configuration mode, as I said your none of your configuration will be deleted, your existing configuration will be preserved. Whereas I'll click one of the device which is in the cloud configuration mode.41:55So the difference is, on the top you you see right now it is configuration sources cloud. So the difference is if you click a port, you'll be able to make any changes on the port level or any configuration from the Meraki dashboard itself.42:06You can click edit and you can make any configuration on the ports over here. Also you get the monitoring functionality as well. So that's the difference between the device configuration mode and the cloud configuration mode. Whereas in the cloud configuration mode, if you onboard, your existing configuration will be preserved and you have to do the configuration from.42:22From the scratch from the cloud dashboard. So this is very important if you want to know about the differences.42:41And most of the configuration is supported from seventeen.fifteen itself. Let's say if you wanted to do a boot level configuration you can do if you wanted to do a layer three configuration, like let's say if you want to create a route, you can do it like under switching, you will, you can go to the routing and.42:48CP and you can do the configuration related to the layer three also can assign an IP address to the port VLAN, a static route, multicasting route. You can also configure the OSPF of BGP. Every, every configuration you can do it from the seventeen.fifteen itself. But there are some set of.43:08Configuration which you cannot do, like whatever the iOS XE is capable, you, you will not be able to get all the option on the dashboard. So those configuration are supported only from the newer version, so in this particular session I wanted to talk about those functionality which is introduced on seventeen.eighteen, which you can con.43:28Configure it on the Meraki dashboard for your cat nine K especially when the device is on the cloud configuration mode. So I'll just go back to the PPT here if you see, so these are all the configuration. So this slides basically it covers the enterprise grade switching capabilities powered by iOS and.43:48See in 1718 one.44:08So this that is designed for the advanced routing and high availability for your cloud managed cat nine case. So by combining the agility of cloud management with the power of iOS XE, we are delivering an enterprise which solution that does not compromise performance security and the uptime. So let's try to deal.44:10Today on each and every feature and understand how it can be configured from the cloud dashboard. And these all can features are supported only from the iOS XE 1718 one.44:30However, you can onboard the devices on from 1715 itself. So the 1st functionality that I wanted to talk about is the router port. So let's say if you onboard a switch in 1715, you'll not be able to configure an IP address on the physical port, which is supported on a.44:43In a CLI environment, whereas you have to do the assignment of IP only on the VLAN itself. But from seventeen.eighteen, so you have a routed port. So a routed port is basically a physical switch port configured to operate as a layer three interface, which can be used for the routing IP packets instead of switching the layer.45:03Get two frames. So the router ports are ideal for your point to point link between the switches, routers and the firewall or enabling the direct L three connectivity and reduce the VLAN ID conception on your network.45:22In cloud dashboard, the router puts can be configured on supported switches like cat nine case and you can also optionally configure DHCP VRF OSPF features as well. So we are supporting it for cat nine case model like 9200 9300.45:38And 9500 starting from 1718 one in a cloud dashboard.45:58Also we support, also we support BGP functionality that can be configured for your cat nine case from the Meraki dashboard starting from 1718 one. So with that, you can configure the BGP between your cat nine case and 3rd party devices as well. The cat nine K configuration can be automated.46:07From the cloud dashboard. You can also do some filtering control policies, manipulation of the routes under the BGP protocol. So the BGP supports for your cat cat nine 9200 CX 9390 500 and it is supported from 17 dot.46:26At eighteen.one version onwards.46:46We do always also support VRF from 1718 onwards. So VRF enables you to do a macro segmentation that scales by creating an isolated routing domains instead of relying on the bloated ACLs on every interface. It also provides you.46:50Efficient route handling and forwarding mechanism for your routes. So we are supporting it for 9290 390 500 starting from 1718 onwards.47:10Also we support stackwise virtual control configuration, so we can create a stack in order to create a loop free topology with active active forwarding. This enhances your network availability and scalability by enabling the redundancy and increased bandwidth without need of any.47:24To stop redundancy protocols. So we support stack based virtual control over SSO and as well as NSF allowing the seamless failover with minimal traffic disruption making it ideal for your resilient campus network designs. So we support this feature only for 9500.47:439524 port or 48 port or 32 QC, starting from 1718 on onwards.48:04So we support the firmware upgrades from the clouds. So let's say if you are upgrading your cat nine case from the cloud, we also support ISSU on top of the upgrade. So ISSU is basically a process that upgrades the device software image while the network continues to forward the traffic. This minimize our element.48:15We need the downtime during the software upgrades and it leverages the install mode for upgrades, upgrades of each and every packages individually in order to avoid the network outage. So we support ISSU for your SVL switches starting from supported on catalyst 9500.48:36From seventeen.eighteen one version onwards. So finally we also started to support rapid PVST plus which is a Cisco implementation protocol and in order to ensure the loop free layer two topology.48:54And rapid convergence.49:14It also improves the network stability by quickly recalculating your spanning tree in less than one seconds. So I wanted to show you on a dashboard, how do you configure all these features before going into the next topic. So let me quickly go to the Meraki dashboard.49:16So under switching, 1st let me start with the routed port configuration. So, let me go to a different network.49:36So when you onboard a cat nine K on a, cloud dashboard, though, each and every interface can be like three, three types. One is the VLAN interface, the other one is the routed interface, other one is the loopback interface. So what I'm going to talk is the router.49:47Interface for this particular switch.50:06So you can see this particular interface is assigned with an IP address and so when you configure any port, e.g., let me go to one of the switch, you will see the switch ports are.50:08Into three types.50:28So on a routed port, e.g., here you can see the access and trunk ports. Similarly, you can see the routed ports also. So e.g., in this access two switches, it's a port number one, it is a routed port where you can configure the IP addresses on the switch on the port level itself.50:30So next thing I wanted to talk about is the BGP functionality. So if you want to configure the BGP on the switches, let me go back to the San Francisco site.50:52Under switching you have an option of configuring the BGP routing. So you can go to BGP routing and you can create a BGP routing between the switches. So you can select what are the switches that wants to participate on the BGP neighborship. So, you can select the AS number and.51:10You can select the switches and you can configure the BGP routing between the switches. This is also supported for your cat nine case starting from 1718 one onwards.51:30So, with that I wanted to cover the next feature which is switching stacks. So under switching and switch stacks, so you you have an option of creation of stack over here. So you can create a new stack, create stack, and you can select the multiple switches and you can create a stack.51:39So I I'll show you the stack that is already created for catalyst 9300.51:59So you can click the stack and that will tell you what are all the members of the stack and for this stack, you can configure the layer three routing over here. So you can configure the IP addresses of the stacking over here. So it can be the VLAN interface which you can, which will be common for both the stack members. You can.52:04Create the stack interface over here. So stack name is campus core, so instead of configuring the IP address individually on the switches, so I have configured the layer three routing information on the stack, ok?52:24So if you wanted to create a rapid spanning tree enabled on your layer two network, you can go to switching and switch settings. So here you have an option of configuring the RSTP. So that is also supported from.52:36Yeah, that is also supported from 1718 one onwards for your cat nine case. So with that I'll just show to go to the next feature, so I wanted to cover, then smart port automation. So basically this feature is to solve the problem of highly replied.52:54So whether you have the same or variety of port settings on your network or attributes, smart port configuration allows you to create a set of attributes basically like a profile and you can bind this profile to thousands of ports on your network. So you don't need.53:18To Define each and every port configuration individually rather you can configure the profile.53:34On thousands of ports on your network. So with smart ports, a profile can be bound directly to the port as a configuration or else you can dynamically assign the port profile to the interfaces based upon two ways. One is through the smart port automation. So smart.53:40Port automation is a feature which identifies the endpoint connected to the switchboard and automatically assign or configure the port profile based on the endpoint details. Let's say your IP phone is connected to a port, so the port configuration will be configured based on the IP port VLAN or.54:00Those things. Alternatively, you can also use the radius AV pair in the radius response packet of the endpoint and the radius AV pair is will be used to select the port profile and assign it to the interfaces.54:20So let me try to walk you through, what is this smart port automation and what actually does in a real network. So at center you can see a Cisco Meraki dashboard. So this is where all the intelligence sits. So it is a cloud managed, so everything is configured centrally and pushed to.54:37Down to the switches. So now just below that we have a cat nine case switch.54:55Where actual automation takes place at the access layer. So on the left hand side, you can see the workflow. 1st we create a port profiles. These are basically the new reusable configuration port level configuration like VLAN setting PoE, port profiles, all those things. Instead of configuring ports one by one.55:01We define them as a profile, and next we define the automation rule on top of it. So this is where the intelligence comes in. The switch can identify the endpoints or the devices connected to the port automatically using the LLDP and MAC address patterns and then we can apply the rules to the port. So this could be a.55:21A single port or it could be a thousand of ports across your network. And finally, when the device connects.55:40And finally, when the device connects, the system automatically applies the correct configuration to the port where the device connects. So you don't have need any manual intervention on it. Now, if you look at the bottom section, you will see the real example. An IP phone connects, it gets a voice VLAN profile automatically. An access point connects.55:48A data VLAN is automatically assigned to that port. So this approaches saves time because you are not manually configuring the port. It reduces the error since everything is standardized and it improves the efficiency because the network adapts automatically. And importantly, it scales easily across hundred.56:07Bits and thousands of switches on your network.56:27So in this slide, we are looking at the complete smart port automation workflow from start to finish. So the process begins with creating the smart profile as I mentioned. It could be your PoE profile VLAN settings, QoS policy, anything. Once the profile is created.56:33The admins have can apply this profile across multiple switch port statically or there are some automation behind it. So the next, the two automation are available in order to assign the smart port profile to the ports are one is.56:48Through the automation workflow. So I'll show you on a demo. It will be like a kind of if then logic, so if a endpoint connected to this port with this characteristics, assign this port or port profile automatically, it will be like kind of this or else you can use the radius based dynamic assignment. So each and every endpoint when it connects with.57:05When it authenticates with eyes or any other AAA server, it derives the radius AV path, and when the switch switchboard sees an AV path, based on the AV path, it will assign the assign the port profile automatically. I'll try to show the demo of both the automation functionality for the smart port.57:25Profile. So finally, the dashboard provides monitoring and verification capabilities also for the event logs and track automation usages.57:44So with that, I'll just go to the demo of smart port proto automation. So 1st let me show you how to create a smart boot profile. So under switching, you have an option of smart ports. Just click here, you will get have an option of creating a smart port profile. So I have a profile already created, but let's say if you want to create a profile, click.57:56That profile, so you can define the port profile name, like, test or a VLAN or access port something like that or a voice VLAN.58:16Here you have an option of configuring the radius AV pair. So you can enable this and configure a AV pair. It can be a just a name, it can be like test A ten. I'll show you how to match this value on the I server.58:26And you can configure the port character characteristics like trunk access, the VLAN, the PoE settings, RSTP settings, all the configuration can be configured over here. And once you configure the port profiles, as I said, there are two options to assign the port profiles.58:43To the switchboard other than configuring it manually under the switchboard. One is through the automation, so you can click automation and create an automation saying that.59:03You can create a trigger, can select any one of the profile. So this profile needs to be assigned if the port learning this Mac address in this particular range or if the port learns the LLDP system description particular name, like e.g. IP phone.59:16Then, this workstation profile will be assigned. In case if it is not, if it is getting a different LLDP description, you can make sure the default action is configured as a use existing port configuration. So in this ICE is not involved, you can do the port automation like.59:38Like if else condition like kind of an ACLs.59:57Or else if you have an ICE with ice server or any AAA server with you, we can do it with the help of auto radius AV pair also. So whenever you create any port profiles, you have an option of configuring the radius AV pair. As I mentioned, you can enable this radius av pair.01:00:00And you can configure a value over here. So under ICE.01:00:20If you go to the policies and results under the authorization profiles, if you click any one of this profile and edit, so this is where you get the sgts for the endpoints. E.g., if you want to assign the sgts, so you will say.01:00:24Like the sgts and you and assign the sgts to the VLAN. So I'll come into the adaptive policy and the other use cases of sgts in upcoming session.01:00:44Upcoming topics, but this is where you will configure the radius AV pair. So if you scroll down, you have an option of interface template. So you need to match this radius AV pair over here. So what happens whenever the user authenticate with the eyes with this authorization profile along with the VLAN and sgts, so they will get this AV.01:00:55Also and over here under the smart port profile, you're also assigning an AV pair over here, like the same AV same name over here. So let's say if the import sees an endpoint is getting this AV pair test in from the eyes, so this workstation will be assigned to that particular port, where the endpoint is connected.01:01:15So this is another way to configure the port profile automatically to the ports or else you have a static way also. You can go to the switchboard and you can configure the you can click the switch port edit, and you can assign the smart port profile also.01:01:35So you can click edit. Here also you have an option of assigning the smart port profile, so you can select one of this. This is a manual way of doing it. If in case if you're not familiar, if you are not ready to do it with the help of automation, we have the manual ways also. So with that, I'll just go to the next topic.01:01:56Yeah, so I wanted to talk about the adaptive policy as a next topic, but over here I wanted to talk about the real time real time challenges in terms of segmentation. So managing the end to end security is complex when policy must be configured per site basis. You have different types of site.01:02:18HQ branch A branch B leading to gaps in a security posture. So maintaining a user and device identity across the sites becomes difficult as move as users move between the location. As a traditional VLAN based mechanism is tied to a physical network, you have to do all the segmentation based on.01:02:38The IP address and the ACLs.01:02:58So scaling the granular segmentation for a different mix of users like devices, IoT endpoints is a labor intensive work and it can lead to error prone environment as well. So the key takeaways are, your traditional methods are static and site centric, which hinders the agility.01:03:01Required for a modern digital businesses. To address these challenges, the organization typically shift to the policy based or automated segmentation which decouples your network policy from the physical location and enables you the consistent security across the entire network enterprises.01:03:21So this slides introduce the adaptive policy which is a Cisco's approach to identity based segmentation and security enforcement. So traditionally, the network segmentation relied heavily on the VLANs and the ACLs while effective while effective those approaches becomes difficult.01:03:44In order to manage the complex environment, we have the adaptive policy which changes the focus to identity based segmentation without depending the physical topology. So the key concept here is the security group tags. We we call it as sgts also. So these.01:04:05These sgts will be carrying the identity of the users directly with the traffic flow. This allows the security policy to follow the user and you can create the security policy with the help of these sgts. One of the biggest advantages is the policy becomes properly.01:04:25Topology agnostic. So you can define the policy in any any kind of topology and admins NO longer need to redesign the policy every time when the network changes.01:04:45So this aligns very closely with zero test architecture where organization want a granular or identity based control over the access layers. It also improves the visibility and creates more scalable security management across the enterprises.01:04:57So sgts are essential for identity label assigned to a user devices or a traffic flow. So instead of relying on an IP address or a VLAN assignment, network now defines what the devices or user actually represents. E.g..01:05:16The traffic maybe tagged as employ employee traffic or IoT traffic or a contractor traffic for e.g. in this particular screenshot if you can see, the packet carries an SGT values as it is an employee. And the major advantages, the security policy can be enforced consistently across.01:05:35The identity. Rather building a large number of complex ACL so that admins can define the policy between these sgts.01:05:55So this is all because now the switch can carry this SGT information on the data traffic generated by the client. So you can see the CMD field in the data packet where the SGT is coded. So you can also propagate this packet to a different switches through SGT inline and enforce this.01:06:04Policy on the destination edges.01:06:24So there are two primary approaches shown here in order to define how an SGT can be assigned to the user. Either it can be a static assignment or it can be a dynamic assignment. So static assignment involves you can assign SGT to a switchboard where the endpoints are connected or.01:06:31Can assign it to the VLANs, ssids or IP subnets. Whereas dynamic assignment is more flexible and scalable. So in this model, sgts are automatically assigned using the radius authentication and identity information. So the network can make decision of assigning.01:06:51SGT based upon the user credential, active directory group or partial information or even the location as well. So this is extremely valuable in an enterprise environment where the users and devices frequently changes location and roles.01:07:11And the final slides brings everything together by showing how an adaptive policy delivers a consistent security enforcement across your network. The key idea is the policies is configured centrally through your cloud dashboard and automatically the policy is distributed to the.01:07:32Adaptive policy enabled edges. Because the policy is based on the identity rather than the physical topology enforcement remains consistent even if the users or devices move between the location. Admins NO longer need to maintain the large number of VLANs or ACLs across the different devices.01:07:52So let me quickly go into a demo and we'll show you how to create an adoption adaptive policy. So adaptive policy always comes under organization. So if you go to organization, you have an option of adaptive policy over here. And this is where you actually create the security groups 1st.01:08:12You can create a different security groups in your network over here.01:08:32And these security groups can be assigned to the interface VLANs, subnets, or even you can push this sgts through authorized profile, authorization profile through the eyes whenever they get authenticated with the.one next. So as I said, you can click here and you can select I will come into the VM.01:08:37Part later, but you can select what SGT that the user needs to get once they get authenticated and gets the authorization profile.01:08:57So once the user gets the sgts that is defined over here, then you have a policy dashboard. So you have all the source sgts on the, on the Y axis and destination sgts on the X axis and each and every blocks define what.01:09:07What is the policy that needs to be assigned between the sgts. So e.g., if I wanted to restrict the access between employee sales to the physical security sgts, you can click this box and you can define the ACLs over here. You can click edit and you can define the ACL.01:09:27What ACL needs to be blocked. Either it could be permit or it could be permit like this or it could be denied or you can also create a custom ACL. Custom ACL says that a two SGT needs to communicate with all the protocol except ICMP. So kind of a custom A rules can.01:09:47Can also be created between the HGT communications.01:10:07And you cannot, you also need to assign this adaptive policy per network wise because all the configuration that you are doing it in organization level, so you you have to do it on each and every network you need to say whether the adaptive policy is enabled or not. So the devices that are mapped to that particular network.01:10:11So we'll be able to get the SGT policies and implemented on the edges.01:10:30So this is what I wanted to cover it on the adaptive policy. Let me go back to the deck and I'll start my last topic, which is, a fabric in the Meraki. So, so I wanted to talk about the VXLAN BGP EVPN overlay architecture that can be built on the cloud.01:10:36Dashboard. Because this design is an industry standard for a modern fabric, which provides the robust and scalable way of connecting devices in the system. Because, when I say fabric, it has its own control plane, data plane, and the policy plane. So let me start with the control plane of the.01:10:57Fabric. So the control plane is handled by the BGP EVPN, so at heart of our control plane we use as MPBGP because it is a standard based protocol which can be used across the different windows and it allows us to support various data planes as well.01:11:16So the data plane that we use, for this fabric is VXLAN.01:11:36So, it, it is a transport independent, meaning it runs over any layer three underlay could be OSPF BGP or EIGRP. A key advantages here is the 24 bit VNID, which provides almost 16 million unique identifiers for you.01:11:41This gives you a massive flexibility for network segmentation and scaling across our infrastructure. And then we have a policy play.01:12:02So whatever I covered in the previous section, an adaptive policy is a policy plane for your fabric. So you can define your sgts and you can create a policy between your sgts from the cloud dashboard. So in a summary, by combining the intelligent of BGP with the flexibility of VXLAN, we are.01:12:12Creating a high performance fabric that powers the modern connected enterprises.01:12:32In a, in a in a fabric, there are different roles for each and every devices. I'll try to cover it in upcoming slides. So before going to the roles in a fabric, I wanted to talk about how VXLAN is giving a flexibility on the fabric.01:12:39So to understand why VXLAN is powerful or why we choose vxlan as a data plane, we need to look at how it evolves from the traditional ethernet frame. While a standard ethernet frame, the VLAN rely on twelve bit tag.01:12:58VXLAN is signifi significantly expanding the capabilities. So in a classic ethernet frame, we are limited to have only 4096 VLAN because of the.one.1Q tag is only of twelve bits. Whereas on the VXLAN, it overcomes this by using a 24 bit VNI frame.01:13:13Which can provide you a 16 million unique identifiers on your network. We achieve this through Mac and UDP encapsulation. As you can see in this diagram, we encapsulates the original layer two frame within a new UDP and ID IP header and this adds yeah this adds a.01:13:33Total overhead of 50 bytes to your existing packet, but in exchange, we are gaining a complete independence from your underlying physical network. By decl decoupling the logical network from the physical topology.01:13:53VXLAN allows you to scale far beyond the limitation of traditional networking by providing massive flexibility on the segmentation side. And also I wanted to remind you about the CMDB field that I was covering on the last slide.01:14:08Dot one Q header is NO longer needed because you don't need don't require a SGT in line to be enabled across the source to destination edges because your, your segmentation is taken care of by the VXLAN header which encapsulates the whole layer two frame.01:14:25So, this is one of the important slide that that I wanted to cover about the different roles of devices in a fabric. In a traditional network, as we have a core distribution and access, we have a different name for the fabric architecture. So at the top you have a border.01:14:48Which act as a gateway connecting your BGP VPN fabric to the external network domain. For intermediate layer, we can also leverage your any Meraki managed devices in order to provide the transport and forwarding plane between the border and the spine switches.01:15:08Spine switches should be your cat 9300 or 9500 H switches, which act as a core intelligently basically it is like your route reflector of your fabric. So all your spine switches will form a BGP connection MPBGP connection with all your leaf switches in your network.01:15:28So leaf switches will advertise the layer three and layer two prefixes EVPN prefixes to the spine and spine will advertise those prefixes to the other leaf switches.01:15:48And finally, we have a leaf nodes, basically edge of the fabric, where all your endpoints are connected, and this is where all the VXLAN overlay is also built. Any encapsulation and decapsulation on the VXLAN, it will happen only on the leaf switches.01:16:01So by assigning these specific roles to our catalyst hardware, we create a highly structured or scalable fabric that supports both layer two and layer three, exchange services that seamlessly across works seamlessly across the entire network.01:16:18The Cisco cloud managed fabric is designed to simplify how we handle the EVP and VXLAN deployment. It also transformed the way we manage our network traditionally by treating by treating the entire fabric as one single logical entities. So, we have an option.01:16:41Of securing your network with the help of a policy plane, basically your adaptive policy. We also build a flat free subnet stretch, so you're not relying on your layer two network. You will also get some data to operational assurance in order to monitor your fabric infrastructure.01:17:01Let's discuss how we achieve the segmentation at scale with our cloud managed fabric. So we are using a concept of VRF, we call it as VN instances in order to provide the 1st level of network segmentation. This ensures, absolute isolation between the one VN to another VN.01:17:21And also this architecture allows you to securely consolidated multiple virtual network into a single physical network maximizing the efficiency, but without compromising the security. But within the VN, we also have the micro segmentation which implements this.01:17:41Secure group tags or adaptive policy within the VN network. As I have mentioned in an adaptive policy, this helps you to segment your environment by specific lines of businesses within the VRF or a VN. So the user within the SG, you have a control between the user has.01:18:02Having a different sgts are within the same sgts.01:18:22Oh, and this is how a simplified fabric dashboard will look like. We have four pillars on the fabric. 1st is the design pillar where you create your fabric or you specify the devices to a different polls like spine leaf, and border. You configure the VRF.01:18:27And subnets in one place, and then we have a provision pillar where you can final, where you can see all the parameters before deploying the fabric into your network. And then we have a policy plane where you can build your adaptive policy, basically the policy between your sgts.01:18:47On your network. And finally, we have an assurance pillar where you can monitor your health of the fabric. So with that, I'll just go to a demo and I'll show you how a fabric will look like. I'll not be able to cover the, like entire information about the fabric, but I just wanted to give you a high level overview of how the fabric will look like.01:19:06Right, so if you go to organization, you have an option of fabric.01:19:26So this is where you create any new fabric on your network. So I'll show you an existing fabric that I already created. So if you click the fabric on a summary, you can see how many devices are there, how many devices are getting a single role or multi role on your deployment.01:19:31What is the status of the BGP, so this is where the assurance pillar come into picture. So what is the status of the BGP peer, the external border peer, the status of the tunnels, the overlay subnets, all those things. And over here you can see the different aspects of border, the BGP peers and everything between the source and destination IP. If you want to.01:19:47Deep dive and see why a specific BGP peers in the fabric is down, you can see it over here. And if you wanted to see the device role, you can click the device role and you can assign the device role to a spine or a leaf or a border in this particular tab. And you can create your layer three.01:20:07The vns basically a VRF over here.01:20:27And you can create your border configuration. Let's say if you want to have a communication between a fabric to the external world, from the spine you can create your border configuration. So basically a transit configuration on your borders from this particular dashboard, and you can specify your layer two VN subnets over here. So what.01:20:29All the different subnets. So if you see all the layer two vns are mapped to a single layer three VN which is fabric that is created under a fabric. So you can create multiple fabric subnets over here. So all this can be created in a single workflow, like a create new fabric. So you can, you have an option of creating your fabric.01:20:49VRF, the layer two subnets, the fabric border routing configuration, all these things in the single workflow. So with that I'll go back to the deck and I'll hand over to Padma in order to conclude the session.01:21:09Thank you Satish. Thank you once again. For very detailed explanation and a clear walkthrough. Thanks to everyone who has stayed till the very end of session. For the next step, please keep an eye out for a survey from us. It'll be from the Cisco Cisco customer experience.01:21:31Please do take 2 min to help us provide you feedback to improve our future offerings. With that we'll have the session close to the day. Thanks everyone.01:21:48