Transitioning from Classic Policies to Policy Groups

Oh today we are going to cover the topic of migration from classic policies to the policy groups that we have in UX 2.2 and we have.00:00I have two very experienced amazing presenters for this topic.00:20Oh Sam and Jose. Before that, please join the slide though, we have the QR in all of these introductory slides just for you to be able to give us some kind of information. We want to get to know a bit of the base.00:25So where are you getting?00:45From why why are you joining this webinar? I mean, how experienced are you with the topic and how comfortable and we we really like to gather this information because it helps us to adjust the sessions, adjust the level maybe of these webinars.00:47It's really useful for us to have this data.01:07Now, you can scan the QR code from here and from these slides as well. Starting with our 1st presenter, Josem is an a very experienced network engineer with over 20 years of experience and he's based in Jordan in Aman, and he is.01:10The CCA certified engineer.01:30On enterprise networking. And our second presenter is. He also is very very experienced with 20 plus years of experience and based in Saudi Arabia Indian, and he has ccca's and a CCD.01:33And now he's part of our CSS SD one team with a focus on enterprise networking solutions. On the side, Meanwarkers are going to be answering any questions that you have. So you can find how to ask in the Q and A.01:50From the bottom right of your, of your Webex, where you have the Slido, you can open the Q and A there and ask any questions that you have, we are going to be here throughout the whole se.02:09Question in parallel to the presentation and answering anything that you might need clarifications on.02:28And with that, let me take it over Tom. Sure, thanks Asia, and welcome team to our session as part of the expert insight series, Whereas Anestasia mentioned, we are going to cover the.02:34The UX two.O policy and how you can migrate to. So, before I start, like a quick disclaimer here disclaimer that this is a session that's got like an intermediate session.02:54So we are not going to touch on the basics on how you can configure the policy group or the configuration group, ok? From agenda perspective, so we are going to cover four more, more pillars. The 1st one we're going to quickly touch on the.03:11Cisco as the one policy in in UX one.O ok so how it looks like. Then we'll zoom in and we'll have to spend more time on the UX two.O policy elements. After we understand both, we then need to map between the UX one.O policy versus the UX two.oh.03:28Policy. And finally, we'll go through the migration process from the UX one top policy to UX two top policy.03:48Okay, so in in the the old or the since you know starting from Cisco as the one solution, we have in the policy section, we have two more more categories of from policy construct. So we have the centralized policy and we have the localized policy. The difference is how the configuration is being.03:59Be pushed. Both will be configured by the V manage. So centralized policy in UX one.O is being configured by the vmanage. Then by netconf protocol it's being pushed to the policy to the controller and the controller will execute some of the config like the app our routing policy or data policy or netflow, to the edge devices.04:19While the localized policy, it's the configured by the vmanage then pushed directly to the edge device using the netconf. Now in centralized policy, as I mentioned, we have two more two main categories. The one is the topology policy and the vbn membership where we form the traffic shape and the tunnel shape in the SD WAN fabric.04:39We have the traffic policies that knows about the application aware routing policy and data policy within the flow. If we look into the right side where we have the localized policy, localized policy, it's a mix of two mainly. We have the localized policy that has the routing from service side, the routing policy on the service.04:58Data policies and the quality of service, access list et cetera. We have also the security policy.05:19Which is which covers the immediate security feature as part of Cisco SD one solution like the IPS, next generation firewall IDS and DNS security. This is in term of UX one.oh. Now, if we zoom in into the the UX two.oh, the user experience two.oh, ok? From configuration element, we have four.05:26Four main different configuration element in UX to the tool. We have the configuration group.05:46We have the policy group, topology and network hierarchy. In previous session, it's about the configuration group and network hierarchy has been already, you know, presented and described. So if you want to learn more about this, you can go back and listen to the recording.05:51For this session, we are going to focus on the other two elements, which is the policy groups and the topology. Now, if we look into the policy group, what, what, what, what is the construct of the UX to the policy group? We have four main profiles, policy profile as part of the policy group.06:07Those are the application priority, SLA and SLA.06:28We have the next generation policy profile SIG and SSE and the DNS security. Each will have different feature elements. In the application priority, we have the classification, we have the SLAs that comes as part of the application aware routing policy, we have the queuing for the quality of service. In the next generation firewall application.06:32Okay policy profile.06:51We have the IVS firewall and the URL filtering. Similarly for the sake, we have the Zscaler and the secure access, and finally for the DNS, we have the umbrella. Now, once we configure the policy group, what is the policy group? Policy group is more of a container, ok, that you will have each will have one or.06:53More policy profile. In our example we have two policy group, one for EMEA, one for America. So we can see I mean we do the correlation. So we attach different policy profile, we can reuse the same policy profile across two or more policy groups. Okay, so this enhanced the reusability.07:13And you excluded all. Once we create the policy group, then we associate the policy group to different edge devices for configuration to be pushed and executed. So this is how the configuration, the different policy group elements as part of the UX to the. The next one is the topology.07:33Now in topology, it's exactly the same as before. So we are manipulating the routing and the T locks in order to form the topology for the VPN for the tunnels or the traffic topology, ok? So it can be mesh full mesh, it can be hub and spoke or it can be a customized. Now.07:53You can see I mean and we'll go in the demo and show it, show it to you in in live demo, but you can see it's now, it's not part of the centralized policy as in the classical, it's now it has its dedicated option as part of the configuration where we have the topology section.08:13Now in if we zoom in into the topology, we'll, we'll have almost exactly the same as before in the centralized policy under topology section. We can either configure the the hub and spoke right from the GUI, you can assign the hub, assign the spoke or you can do customization where you.08:31You can assign different rule. That rule will be based on routing or in T lock in order to filter out the, the, the routes or filter out the T locks for for tunnel formulation, ok? So it's exactly the same, but it's now, you know, it has its its dedicated option as part of your.08:51One note here to to keep in mind that topology it is assigned to a site, so you can have you you cannot have two different topologies configured for site for the site. So it's either you can only have one active topology policy per site, ok? So this is the other element of our configurator of.09:09Of our policy in in in UX two.oh.09:29Now, we understand UX one.oh, we understand the different policy elements on UX two.O Now how we can map between the two? In order to understand how we map the UX one two UX two.oh policy, we need to understand the anatomy of the.09:34Out of config in the Cisco SD WAN fabric.09:53So when you start the the router, the edge drop the edge router in Cisco SD one, you will have the bootstrap or the startup config that once it's put up, these will be part of the running config in the, ok? After that the device, the edge device will be registered to the Cisco controllers.09:55The manager, Cisco SD one manager, and the SD WAN manager will push the configuration templates, the localized policy, and the additional policies into the edge device under the running configuration section or file of the Cisco edge router.10:15After that, we will have the application policy or the application configuration data policy and AR that will be pushed from vmanage to the controller and the controller will send or execute the configuration on the edge device under the policy configuration section in the environment.10:34So we have two main elements running config and policy config so far. And finally, we have the routing updates where this is like an route information that will be sent from the, the controller to the edge device. So this is like a quick view on the anatomy of how configuration is being pushed.10:50To the to the edge device. Now, if we need to map between these configuration in this configuration in from UX one to two UX two to all, so we are talking again about running config and policy config. And running config, we have different components localized policy.11:11Device template policy and from policy config we have the policy configuration. Policy configuration has the OMB for topology and for tunnel I mean for topology section, we have the data policy and we have the AR.11:31If we look into the UX two.oh different different element of the of the policy, we have the topology, we have the configuration groups, and we have the policy, the the policy group. So how to map between the two, between the UX one.oh and two.O?11:48We'll start with device template. So device template in UX 122 oh now it's been pushed or migrated to the configuration group. If we look into the quality of service, quality of service was part of localized policy and now is moved under the policy groups.12:02For the access list and route and route policy, that was part of the localized policy in new X1 now it's been part of the migrated to, to be part of the configuration group. And for security, security was also part of the temp device template. Now it's been pushed as to be part of the policy.12:17For the OMB.12:38It was part of the centralized policy section, now it's been moved under the topology. The data policy and the AR are part of the policy groups. So you can see now how things the different elements that make make up the device the edge device configuration is not where where it was.12:41And UX one.O and how it is mapped to the UX two.O configuration elements.13:00So this is, I mean a quick view on the mapping section just to dig deep even into the different option of how things is being mapped between UX one to two and UX two.oh. We'll start again just again this slide has a lot of details, so I'll give just a few examples and will be there for you guys. But if we look in.13:08To the configuration device template in UX one.oh and we have configuration group in UX two.O.13:28Well I'll give you one example here. If we look into the quality quality of service, I mean in UX one.oh it was part of the policies where you can configure the the the the quality of service. Now, if you look into the configuration group, it's NO longer there. You can't see the quality of service under the configuration group because it's been shifted to be part of the.13:33On the signal.13:53If we take another example like the BFD, BFD was part of the basic config feature in the feature template, now it's being part of system profile under the configuration group. So this is like a mapping between configuration group or device template to configuration. Similarly.13:54If we look into the policy, again, policy before So before we have the centralized localized security policy and voice, and under the centralized we have the topology and aware that the policy is similarly for the localized any new.14:14Policy and the new policy element that we have described, we have service insertion, we have topology and policy groups. You can see here I mean the the policy group has the application we already discussed in the slide that it has the three different profile application priority profile, next generation DNS and SSE, and under the application priority you can do a.14:34They are traffic policy and quality of service. Similarly for the topology that we have the T lock and the and the app aware, and finally we have the service insertion.14:54Now from execution of or pushing the configuration for these different elements for the policy group, it's been associated to the devices for the topology and the service insertion, it's being pushed to the devices While topology is being pushed to the controller, so it's not pushed to the.15:03To the devices because again and routing has been manipulated in the or in the controller, not in the edge devices.15:24So this is just to give you an, a quick view on how to map between the UX one.O configuration and policy elements with UX two.oh. So having said that, I'll jump into the lab just to show you a quick demo on.15:33How the, there are different elements look like in the lab, in the in the the manage in the SD WAN manager. So this is the lab environment, ok? Just like we are running a 2015.15:54Release, so the policy group configuration group or anything related to UX two.oh, we always recommend customer to go to 2015 or higher. It's not recommended for customer who has less than 2015 to move to the UX two configuration elements.16:10If we scroll scroll down into the widget just to show you what are the different devices that we have, we can we having we are having some devices. Again, this widget will show you how many devices and how it's been configured. So we can see we have four devices configured using the config group. We have ten devices using the the the template and we have like n many.16:26Or undiscovered yet edge devices. But we have four versus ten config group and templates.16:46Now if we move into the left the right menu, again, we can see in the top the different configuration elements in configuration group policy group, network hierarchy and topology. While in the bottom you can see the templates, the policies and security and the the one that we used to in the 20.16:53Twelve or before.17:12Okay, now if we access the policy group, again, configuration group as I mentioned, it was discussed and covered as part of the previous section. So in the policy group, we can see we have different policy profile, application priority, next generation firewall, SEG and DNS security.17:13You can write from the window here you can create, add a policy, ok? Add a policy into the a policy group. This is a policy group. Within the policy group, you can associate different policy profile.17:32Okay, so you have again the four different profile profile you can you can you can configure and you can reuse, I mean you can reuse the same policy profile that has been used by other policy group in the you know our demo policy group.17:48Once you create the policy group, you need to associate the device, ok? And one note here, association for the devices, you can you need to have the device configured using the configuration group in order to be able to associate or execute the policy using the policy groups.18:05So you cannot have a device that is configured using the template, the classical template and you know push the policy group to it to it. So it's it has to be part of config group before. Now you need to associate the device. You can select the device. Now selecting the devices.18:21It's as mentioned in the previous again session, you need to create a network hierarchy because in network hierarchy you can configure the device, select the devices. You can see this is like comes as part of the network hierarchy section where you can select the site and within that site you can select different devices. Once you associate the device.18:38Again you finish the association you either can do and deploy the config right after or you can do it later. If I do it later and and I went back into the main window, I can then deploy the configuration whenever I feel it's it's the right time, ok? So this is in term of how you can configure the policy group. Again, if I take one example.18:56Tell about the different policy profile. I'll take like the policy profile for the application priority. Again, this one is used to configure the AAR, the data policy, the quality of service.19:16Okay, so these are the different policy profile policy features that comes under the policy profile for the app aware or or for the app priority and SLA. Just one note here and if you click on the additional settings, you will have the.19:27Two different option application visibility and flow visibility where you can turn it on. That was part of the localized policy before. So if we go to the classical.19:47The classical policy, you will see the these two options part of localized policy in order to be able to see the application that traverse the SD one, you were needed to do the, the application visibility and netflow under the localized policy. But now it's been part of the.19:58Of the policy group under the policy profile of the application, so you can edit, you can just turn it on from, from there, ok? So you can just switch on the app visibility under the application priority profile in the app policy.20:18Similarly for the flow visibility, you can turn it on and you can configure the collector under the network hierarchy, if you go to network hierarchy under you can select a bare site or the region or globally where you can configure different collectors if you wanna send the netflow details.20:34Data into an external server, ok? So this is part of the policy group. Again, in the policy group also you can reuse, you can copy, so you can copy the same policy group with different policy profile associated and then do the edit for for these policy groups or even for the different policy profile, you can copy.20:53You can then create a new one or copy the existing one and then do the changes and attach it to the new policy group you created. So you have the flexibility to.21:13Create copy and then associate to different devices. This is for the policy group. If we move into topology, now in topology, again, you can, it's again it this is where you define how the traffic flow between different sites or the tunnels establishment or the formulation between the sites.21:24You can create.21:44Create a new policy. Once you created again, you can have a quick one. I mean you can define hub and spoke, ok? And when where you can add the hub sites, you can add the spoke sites and the configuration will automatically created and pushed to the devices or you can customize. Again, it's similar to the one that we have in the UX one.21:48Put over you need to define a rule. And that rule will be as you know, you can filter based on route, you can filter based on T logs, you can set the base action, either reject or accept and then execute or activate the policy, and again the activation for the policy will be per site. So you cannot have.22:07Two, topology policies executed their site, so the site has to be part of one topology policy, ok? And again, for any configuration we can see in the UX two.oh you can import and export. So you can from export perspective, again, I can export any.22:25Configuration group, I can export any policy group or any topology policies and I can export it and then, you know, it will be exported as a JSON format. You can then keep it as a backup or you can, you know, change it if you, if you can do a JSON scripting.22:45For coding. Ok, so that's it from my side. Now I'll I'll leave you with my colleague, San who will take you through the how we can migrate from UX one to two to UX two.oh.23:04Thank Youssan. Let me just start by sharing my screen ok So can you see my screen?23:25Yes. Okay, that's good. So, so right now we will start talking about the migration process itself. So gave us a very good overview of the elements of the policy.23:41So right now we will talk about how we move from UX.one policy, the classic policy to the new type of policy. So we start with the migration planning. So the migration planning, there's nothing here.23:58Like special everything here is, is what you do when you do any any change. For for policy groups and configuration groups you you need to.24:17Take a very good look into your inventory. So you need to understand the the device templates, how many devices are attached per template. You need to understand the the hardware models that you have, see CLI all the CLI templates that you have.24:32You need to understand the the the policy that that you have applied to your environment whether it is centralized policy at the time of topology and so on. So.24:52I understand that in your operation you could be someone who didn't designed your SD WAN, maybe you are you didn't implement it and maybe you didn't start to the operation. Maybe you came in after one year or two years in in operation.25:05And usually people get busy with day to day work and you don't have the chance to really understand what they have. But this is a very good opportunity that you do a thorough inventory to your environment just to understand all the elements that you have.25:25Again twenty.fifteen or twenty.eighteen, these are the recommended releases if you want to use our UX.two.25:45We highly recommend to match the iOS version that runs on the router with the the software version that runs on on the controllers. Again, understand all of the dependencies on the network and again.25:55Before you do anything you should you should have a clear rollback, a strategy when you do changes and of course prepare for the worst and make sure that you have backup of all your configuration.26:14Is a is a is a tool that you can use to do a backup or you do whatever type of backup that you are currently doing.26:34When you, when you do the migration, whether you are migrating to twenty.fifteen or, twenty.eighteen, make sure that you do a gap analysis, understand all of the conflict that you currently have especially for the add on templates.26:44I would say most of the configuration that you currently can do in the pre twenty.fifteen SD WAN is pretty much covered in uX.two, but in in some cases there will be some like feature parity, so.27:03You need to make sure that that all the features that you currently are configuring is already.27:22Supported and you do this by reading the the software releases for the version that you are migrating to. Network hierarchy, we we covered this in detail in the last expert inside series, but this.27:29Is a crucial part to when you move from UX.one to UX.two is to define your network hierarchy. And in network hierarchy, there are some elements of the policy, like the collectors they fall into the network hierarchy and they follow an inheritance.27:49Behavior. So whatever is in the hierarchy and you didn't specify it in the configuration groups or policy groups, they would be inherited from the network hierarchy.28:09So next we will talk about the localized policy migration. As I'm already covered most of that but we're just flushing it out more just to show you all.28:19Oh, with repetition there will be a better understanding. So if you see, if you look at the, the, the classic localized policy, when you, when you edit a policy that you currently have, you will start with the policy overview and the policy overview will give you.28:34Some additional settings for your policy. So our focus here is on NetFlow and application visibility. So application visibility is the one that enables in bar in your in your router and allow the router to do the packet inspection. These configuration.28:54Patient has moved to policy groups.29:14And then under application priority and SLA if you hit, if you click on additional settings, you will be presented with this pop up window where you can activate or or enable, application visibility and netflow for IBV four and IB.29:17V six.29:37So next, quality of service, so quality of service are part of the localized policy in in localized policy you configure QS maps and the and these QS maps are then pushed to the router once the local.29:39Device policy is part of the device template. This will be moving to policy groups.29:58Under application priority, you will need, you can configure the policy in two different ways. You could use the symbol view or the advanced view but with the advanced view you will be, you will, you will be able to configure.30:07The, the, the quality of service queues over here, so you can add the queue, so here you define the clause, the queue and also the bandwidths and buffer for each of of the of the queues. And then in this section you configure the rules.30:26So you match the traffic and here we are defining specific forward class for this matching traffic. So next we will talk about access lists. We mentioned this also before in the last.30:44EIS session. So access list are part of the center are part of the localized policy and this also moves to the configuration groups. So when you configure an access list before.31:07Before we configure the body of the access list under localized policy, we push it to the router, and then we go to the interface under the feature template, under the interface feature template, and then we configure or we reference the access list name. So in UX the two it become much easier where you when you are configuring the.31:23And so whether this is a service VPN or a transport VPN, if you go to the interface itself and you you click on the plus button, you can add access list under the interface. So with uX.two, this process become much easier.31:45The same for route policy. So with route policy, we used to configure the body of the route policy under the localized policy, and then we reference it under the.32:04The the BGP OSPF configuration in in in the in the policy. So, so here becomes much easier this moved also under the configuration group.32:19So when you are configuring transport VPN or a service VPN and you have a routing instance BGP or OSPF, if you click the plus button over here, it will show you the route policy and you can configure the route policy that will, will be part of your BGP filtering.32:35So next we will talk about the migration of centralized policy and with centralized policy, we have multiple elements to the centralized policy, we have the topology which basically a manipulation of of OMP routes, and OMP routes, we have two main.33:03Types of routes we have the IP routes and the and the T lock T look routes. So the manipulation of topology is basically manipulation of T lock and IP routes.33:21So if we have a centralized policy, you might have multiple topologies or multiple like route policies and these route policies will have an application scope, so they can be applied to different scope of sites.33:39These policies are applied.33:58Per direction and pair site, site scope. So when we do the migration, we have two main options. Option one is to detach the policy all together. So we edit the policy, detach the the policy.34:01And then, activate the policy on UX two two. The other option is to edit the scope. So if I want this policy, this policy applies to ten sites, so I can create a new scope that has only five sites.34:18And this exclusion method is very suitable for if you are doing.34:38Like a scheduled approach for your for your migration. So here or or or or or if you are doing a pilot migration, which we will do today, we will do more full pilot migration today.34:46So again, so you detach the policy altogether delete it from the policy or you can just edit the scrub and exclude the sites that will be applied to to the UX two two policy. So how this will look like it will look like this. You have a policy that has.35:02Topology VPN membership and these are the the the data policies or the traffic rules. The migration will be that you will delete the VPN membership and topology from the policy.35:23And then you will activate the policy in or you'll activate the topology in UX.two. The full migration steps, these are just recommended steps, so you you will create the uX.two topology in the topology section.35:37And then you will have an active centralized policy, so you the recommendation is not to edit it but to copy it and create a new version, so this will give you an easier way to do a rollback. You will edit the new copy.35:56You navigate to the topology section and you can detach the policy. So this is a policy that's been edited. We migrate, we we navigated to topology and then this is the policy that we have or the topology that we have. So we detach it and then we save.36:12The policy and once we save this policy, we can activate it. And once we activate it, there will be NO topology active at this at this time once this policy is activated and then in UX two, so we will navigate to UX to two topology.36:32And then activate the policy that we created in step number one.36:52I'm not sure if we can demo this but I think yeah we can we can demo this option right now. So let me jump to my lab, so we have a policy over here.36:58So we have this policy. If we edit this policy, this is a centralized policy. This policy has has a topology applied. There is application routing, and there is data policy and policy. So.37:17What we will do is in order to move to.37:37To migrate the topology from your point to UX are the two. So 1st we start with we go to topology over here. So this is the uX.two and then we create a policy. So this policy has been created.37:41And, the scope is all the sites that I have in my environment. This option is very good if you have very simple topology like hub and spoke topology and that's it. But if you have a more complicated.37:58Topology construct like hybrid mesh or something like that, a phased approach will be much better. So what we will do, we will go to the classic policy, we will do a copy from it.38:14So we would call it UX two did all topology or we just we call it.38:30Centralized policy version twelve, and this is topology are removed or moved.38:49To UX to the topology. So we'll take a copy of it and we will edit it.39:04Navigate to the topology section and we just simply detach this policy. So we will save the the the policy changes. So now we have two policies, so this one is not active, but before we activate it, let's just jump to one of the routers.39:24Just to show you the effect of this of this change. If we do show SD WAN BFD sessions, we can see that this router has only the hub, which is site eleven so it has only tunnels to, to the hub.39:44Because this is hub and spoke topology.40:04So if we activate 2nd policy over here, remember that the policy we are activating, the topology has been changed or has been removed. And this will cause that the network will fall back to a full mesh. So if you have a large environment and.40:06You have small routers, these routers will hit the limit of their tunnels very quickly. So you you need to understand how you need to do this this process and how it will affect your environment and how long of a downtime that you can afford in your operation.40:25So this is being pushed, so now the policy has been removed and if I check the BFD session, so this spoke is creating a full mesh with all of the active sites. So the next step is to go to topology in uX.two and activate.40:45This policy. So this is the exact same policy that we just removed, so we're putting it back again.41:03So theoretically this should be a brief disruption of your network operation. If you have a large environment like thousands of devices, it's better to do a phased approach, which we will show it, show it to you in the next demos.41:19So we're waiting for this to complete. So this is has been completed, so if we go back to our router, we'll see that the the policy has been applied. Before we move forward, let me do a rollback.41:43So if I go to, back to my topology over here, so I will deactivate this policy. So let's say something went wrong and you want to roll back. So we will deact deactivate the uX.two.41:59Topology.42:19And we will activate the previous one.42:22So this is done. So we'll go to the classical policies again and then we will activate the old one. So this will be your complete rollback.42:42Okay, while this finished we will just continue with the slides.43:17So this is option one is to do a full topology replacement. 2nd option is, is basically to do a site exclusion method. So in this method, you will edit, you will be editing.43:21The the scope of the policy. So each of these policies apply to a certain set of sites, so you will edit this site list and create a new site list that exclude the pilot sites that you will move to the UX to to policy topology.43:38And in this method, you will have two active policies.43:58Or two active topology policies. One is active under the classic UX to upon policy, and one will be active under the UX to topology. The key here or the, the main conflict that could happen is the site score.44:03So as long as there's NO site scope, activated in the 1st policy, 2nd policy will execute fine. If there's any overlap, you will get error and you will not be able to activate the policy.44:23So again, the main steps here, you will create a new site list where you exclude your pilot sites or the patch of sites that you are migrating, create a copy of the, of the centralized policy that you currently have.44:38Edit the application scope.44:58Of the, of the topology and then you save the policy and activate it. And then in UX.two, you will also activate the UX to two topology or the scope of these pilot sites that you just.45:01Executed. And we will demo this at the end of the session.45:21So next we'll talk about migrating we're still on the topic of centralized policy. We finished topology but and we will move to traffic rules. So for, for a centralized policy, we start with application aware routing policy, so application aware routing.45:29Policy again it moves to a priority and SLA section. So over here you can configure all of your classes.45:48So when you configure the SLA class, you configure loss latency and jitter, and again similarly with UX two, you get the same experience when you configure more most of the policies. So it's exactly the same as you are configuring quality of service.45:57And the traffic rules will be over here.46:18For the data policy, it's very, very similar. Again, it moves to application priority SLA and you can configure the rules over here say flow D safely D, which is the net flow.46:24So basically, you will be configuring the netflow collectors in the centralized policy and then you apply the policy to a specific site to a specific site while in the new method, in the network hierarchy.46:42Once the site is part of, a group, and then you configure in the group, you enable it and you, you configure the collectors. So once the site is part of a group that has CFUD configuration, the site will inherit these configuration.47:01Automatically.47:22So you don't need to configure it and then attach it to sites. So that's why the network hierarchy, I think it's the very, very 1st step when you are configuring or moving to your two whether you are configuring configuration groups or policy groups.47:24So, these are few migration best practices before we we move to the lab. I think we have plenty of time this time so.47:44Again, you'll need to to try this is moving to UX to two is not the simplest process, but once you start trying to to do it.48:02E.g., if you start with a lab, to validate or design your configuration groups and, and policy groups and then start with some pilot sites before you do full migration, then break down your network into batches.48:19Maybe by region or by city, and then you can finish with a full production.48:38These are general, again, best practices think about the rollback. Do not detach routers on templates before you have prepared both configuration groups and policy groups.48:47Because again, when you detach the router from a template, the router will lose some of the policies that under the localized policy. So you and and the replacement is in the policy group. Some people.49:07Get the wrong understanding that I move device templates to configuration groups and then later on I will move my policies to policy groups. So it doesn't work like that. That's why we had a full section that talks about the mapping, and so there are overlapping features from device.49:22Split two config group and policy groups. So before you even start your 1st production move.49:42All your config groups and policy groups need to be need to be ready again rollback don't edit anything. Just take a copy 1st and then edit it.49:51Automation use automation as much as you want as you can because with automation you will be able to at least the creation of your configuration groups. So once you get your design finalized, you can use automation to read all of the configuration elements.50:11That you currently have on device templates and create.50:30The configuration groups and policy groups for you. And then you will be doing like one step which is to do the review of what the your script has created. If you have established CICD or DevOps operation that will also be.50:35Very good to integrate. So your face the approach.50:55Once you you test your design and your configuration in the lab and in some pilot sites and everything is fine, then you can start with creating a pipeline for this for this change in your DevOps operation.50:59So next we will, we will have a full demo for a pilot site. So let's say you you have an environment that is up and running and you want to migrate a pilot site. So the site that we have is.51:19It's 1402. This router or this site has two transport gold and private two, and on private two it has it is running BGP and I think static routes.51:38And it has three service VPNs So we will start from scratch. We will even cover the configuration groups. So right now this device has a device template and the device template has the sections, the normal sections that you that you know, and also.51:55This site is target of some of the centralized policies. So it is part of the scope of these of these policies. So let's jump to the lab and just start showing you the configuration for the site. So we'll start with the templates.52:15So the site is 1402 and the site is attached to this template. So if we edit this template.52:36You can see this is the basic information section. This is the, the interfaces for transport and management service VPN we have three VPNs and we have some additional templates. We have the global template.52:55We have a CLI add on template, we have localized policy, and we have a security policy, and we will be migrating all of these policies. So we tried to focus on this session on this example and make it as real as possible to our real.53:12A customer use case.53:32So, so the the very the very 1st step is to exclude the site from the centralized policy. So remember at this stage, you have designed your configuration groups, you have designed your your policy groups.53:35And you are ready to do other migration. So all of these elements has been designed and, and.53:55Reconfigured in the new structure. So the 1st step, some customers make this mistake, they start with configuration groups to migrate the site to a configuration, a configuration group, but once the site is migrated from configuration group.54:02And you want to migrate this site from the centralized policy. Eventually it will work and the site will be up and running but you will not have like the best experience because once it it moves to.54:21Configuration group. If you detach these policies, the router will still retain the configuration. So it could it could be a positive thing to have or a negative thing. It depends on your in your operation. But I'm I'm just giving you.54:37The cleanest wave of of doing it. So the 1st step is to execute your pilot site from the centralized policy. So we'll start again with creating as a new site list is the same steps that we showed to you before.54:56Oh, we will create the exclude list and then we will copy the policy and then we remove the site from from the centralized policy. So let's do this in the lab. So if we go to policies.55:13So the 1st step is to go to lists and then site and again this is my spokes, and this has all of my this has all of my sites and and I have created a new.55:29A site list over here, topology migration execute and we removed 14 so we we we don't have 14 two in the new list. So now we have the old list. This is the one that is in use as you can see.55:46And this is the new one that we'll be using here. So we'll go back to centralized policy. Again, we will copy the active policy, but this will be a centralized.56:04Policy, version 13, and this is excluding site 1402 from old policies.56:20So the process is very simple. We will edit.56:41And we will start, the exclusion. So this exclusion will happen on the application step over here. So we'll start with topology. As you can see, topology is applied to this site list spokes. So we will edit.56:44And we will put the new list. So this is the new list that excludes the pilot sites. So next we'll move to application aware routing. Again, it's applied to spokes. So we will we will change this to the new.57:02Site list. Same for traffic data we will change it to the new site list. Is the same.57:20So we will remove it from, we will we will update this the site list. So the information will be inherited from the hierarchy. Once the site moves from.57:39Template, the configuration group, it will inherit the C flow D information. So we will save the the changes. So now the changes are saved, but before we activate the the policy, let's take a.57:55Look on the router itself and see the elements of of these configurations.58:15So again, on this router, if I do a show is the policy from this month, so remember right now we are moving the topology and the data policy. So these are the policies that are applied. So if.58:21If I.58:41Do a bit of filtering over here so we have, we have a data policy. Okay, we have data policy.58:42We have C flow D and we have application aware routing. So these are the, the data part of the centralized policy. And if I do show is the BFD sessions, so these are the tunnels that are.59:02From the spoke to the hub. So this is the topology part. So once we activate the policy, once we activate this policy, the router will lose all of this configuration and it will also.59:21Build the full mesh to all of the sites. So we will activate this policy and this policy is basically excluding this.59:36A router or the site from the current policy.59:52So we're waiting for this to.01:00:23To be completed. So this is completed, so if you go back to the router, let's check the topology 1st. You can see it lost the hub and spoke configuration, and if we do again the SD WAN policy from.01:00:25You can see that we have NO we have NO policy. So the next step here is to, to at least to do that the topology part. So we will migrate the topology. So.01:00:41I have created this policy, and the scope over here is for this site only. So if I edit, so it's the same policy but the scope is only this site.01:00:59Which is the pilot site. So I would come over here and I will activate this policy. So right now we have an active.01:01:15Centralized policy with topology element in it and in the same time we will have an active policy or an active topology policy over here. So the two po the two policy groups or the the two topology groups are active.01:01:31About because there is NO conflict in the in the scope, in the site scope, it's it will be it will be fine. So remember that this topology is also bushed to.01:01:48To the controllers. So it's also considered a centralized policy because it's the same to the central system which is the controller. So this is active if I go back here.01:02:03You can see that this this policy is activated here. And if I go back to, sorry, if I go back to the classic policy, this policy also is activated and it also has topology but it applied to different, different sites.01:02:21So the next step is to, is to migrate the device from device template to, from device template to configuration groups. So the device template will be a configuration group.01:02:42The configuration group will have different feature profiles and these feature profiles are a translation of these device template feature feature templates. So the basic information will be under system profile.01:03:01At transport and management VPN will be under the transport and management profile service VPN will be service profile. And in the additional templates, we have a template for for like a global template. This will move to.01:03:20Under the system profile the add on template will move to the the CLI add on profile. So once this is finished, so this is remember, this is the device template and these are all the elements of the device template. The localized policy and security policy.01:03:39Once we attach the device to the new configuration group, the router will lose, the router will lose the localized policy, which is the basically the quality service configuration and it will also lose the security configuration.01:04:00Until we add these using the the policy groups. So the 1st step to, to do that, so again, so let's demo it as.01:04:16Sorry, so the 1st step is to go to templates and.01:04:32We will detach this router from the template, so this will be the 1st step so this.01:04:51Doesn't affect the router at all, the router will just will not be managed by vmanage. It will be in CLI mode. So NO configuration changes. So.01:05:10Until this finishes, so let's take a look on the configuration on this router. So if I do show SD WAN run and section policy map, so this is basically the localized policy configuration for quality of.01:05:21Service.01:05:41And if I check the security policy, so this is the.01:05:47This is the zone based firewall configuration So let's let's go back to the lab. So this is success. So the following step is to configure the.01:06:03The configuration groups. So again, all this configuration has been designed from the start. Let me just refresh here.01:06:22Sorry, I get a small glitch in over here ok so so this is the configuration group and I will associate the router.01:07:07So once the site is excluded or detached from the template, it will appear in this in this list. So this is my site. I will save it. So now this site is associated with this configuration group. The next step is to deploy it.01:07:24So to push the configuration that are that is here. So once again, once we do that, as we mentioned, we will lose the localized policy.01:07:43Configuration or the router will lose this set of configuration. So this is the site. Again, these are all the variables, so I will just import it quickly.01:07:54So this is what was successful, so hit next. So the crucial step here is to do the CLI preview. So this is a very important step that you go through the account configuration on the router and the new configuration that will be will be be pushed and try to identify if there is any.01:08:15Missing configuration that you have, that you might have missed.01:08:35And we should see clearly here that we are missing the localized policy configuration this is taking a little bit longer.01:08:50Okay, so you will do the review and see what makes sense. Config template was none, and now this will be the new conflict template, which is so up to.01:09:09I'm not sure what which version but the configuration group will still be called config template so this is the name of the of the co of the config of the config group. So don't don't be confused by.01:09:29The word template over here. So if we check e.g. for like policy map, you can see that the policy map configuration policy map, you can see the policy map configuration is in red, so this means all of this configuration is.01:09:44Missed in the new in the new version. The same will be for.01:10:04The zone payer configuration. So the zone payer configuration for the zone based firewall is is also missing. So we've done the review, everything seems to be good except for the localized policy and then we will deploy.01:10:11So once we deploy, you can view the status from deployment status over here, and once the configuration group, once the router is associated to a configuration group and you push the configuration, the router will.01:10:29Inherit all of the collector information that are in the hierarchy.01:10:49So this is in progress.01:10:58So, the device.01:11:33As pulled the configuration, so.01:11:34It should finish soon and this was a success. If I hit back to if I go back to configuration groups, you can see that I have one device and the green tech means the device has the.01:11:39Configuration of this configuration group. And so.01:11:59No devices are in are out of sync. So now we have moved all of this configuration to the to the router using the configuration group. So guys, there's only one.01:12:04Demo left, so we'll do it after you take a quick scan for this QR code, give us the feedback on this session. Your feedback is very crucial to us and will help help us design better sessions in the future.01:12:21So this QR code will be also on the next slide. So, we covered all of this configuration, so all of this configuration now are is on the router except for the localized policy.01:12:41And except for the routing and the data policy, the centralized policy part. And this is will be done using the the policy groups. So we will build a policy group that will have all of these configuration elements and the policy group that we have will have an.01:13:00Next year generation firewall and air priority policy, just these two policies. The app priority policy will have the quality of service element in the localized policy. Also, if the localized policy has a visibility, this will be activated under the app priority policy additional settings.01:13:19We will also have aware routing.01:13:41Rules and we will have the data rules from the centralized policy. So the security policy will be part of the next generation firewall policy profile, localized policy, basically translate to the the quality of service configuration, the upperware routing policy and the data policy will.01:13:44To be part of the.01:14:03The app priority policy under the application aware routing policy and data policy. There's NO specific section for any of these policies. They are all just traffic rules or application rules in the graphical user interface. In terms of.01:14:06Application, the next generation firewall will be applied directly to the router, so these are just pushing configuration to the router.01:14:25The same for the quality of service, which is basically the policy map that we showed to you. However, the application that we're routing policy and the data policy will be pushed to the controller. So once we associate this router to the, the policy group.01:14:33In the deployment, the deployment will happen in two sets of devices, the routers and the controllers. So let's demo. So we will go back to the lab.01:14:48We navigate to policy groups but before, before we do that, let's let's again go to this router and check the zone based firewall configuration.01:15:05So so you can see we just only have the time zone, but we don't have the zone based the security policies.01:15:25And also the policy map was for the quality of service and we don't, we don't also have it so when we associated this router to a configuration group, we lost, we lost this configuration and also for.01:15:35The the centralized policy, the centralized the traffic rules, ok? So, so this is the policy that we will use and we will associate this router.01:15:55Again as has mentioned, only if the device is associated to a configuration group, you will it will appear here. So if this router is not, is not associated to a configuration group, it will not it will not show here.01:16:13So this is the site, and then I will associate this device. I will provision it right away because we, we want to to do it. So over here I will select, so you can associate hundreds of devices to the configuration, to the policy group, but you can deploy them one by one.01:16:31So you, so typically if you associate a lot of devices, you'll have a lot of devices here and you can select which devices or which sites that you want to actually deploy.01:16:51So again here if you have any variables in the policy, it will show here and you will need to fill it. In my case I don't have, and now we are ready to to deploy. Again, if you do a CLI review, you can see here that I have configuration that will be pushed to the controllers, as you.01:17:06Mentioned this is the application aware routing policy.01:17:26So this is like centralized policy, it is pushed to the controllers and the rest of the configuration that our the localized policy will be pushed directly to the router. So let's just check the.01:17:35The configuration on the router, just for the sake of time, and if we check.01:17:51Zone based firewall zone pair. You can see it's green here, so it's not on the router right now but it will be pushed and the same for the policy map. You can see it's in green over here. So this is all of the.01:18:08Viewing for the quality of service. And this will be the last piece of missing configuration on the router by associating the router to the policy to the policy group. So at that point, the router configuration will be complete and the router will.01:18:25Can be fully operational as before.01:18:45Remember that moving forward, Cisco will be developing features, new features based on the UX to two configuration. So configuration groups and policy groups. So once there's a new feature, you'll find that these features are on the new configuration construct, not the classic one.01:18:53And also there are new routers, the new secure Cisco routers and the new generation of the routers you only can configure them using configuration groups and policy groups. So if you are, if you have upcoming.01:19:12Hardware refresh coming to your environment it's it's it's a very good opportunity that to start planning for this move right now. So now the configuration has been pushed to the router and if we check again the policy from the smart.01:19:29Which is the centralized policy.01:19:49Yes, we have. So we have the policy and the policy map for the quality of service. We have, we have it and also the last one will be.01:19:59At the zone based firewall configuration, and of course, in your change for a certain site you need to test your applications, have a a follow user acceptance test.01:20:14Like testing and make sure that the site is up and running and all of your configuration has been restored on on the router. So, so again, if you didn't have the chance to scan the code scan it now.01:20:36And thank you guys for joining us today. I hope you guys the panelists have answered all of your questions and we will see you in the next expert insight series. Thank you.01:20:52