What's new in Catalyst Center 3.x

Good morning, good afternoon, good evening wherever you're joining from.00:13So today we will be discussing about the new features that are there in center three.one.x. Now, next slide, we do have two amazing speakers today.00:16So let me just give you a brief introduction about themselves. Akshay is a customer success specialist on the Cisco Enterprise Networking in APJC region and is the center wireless certified. Actually has an overall experience of over ten years in enterprise networking in his past years.00:33And he was working as a network analyst and a project implementation engineer for several customers in health, education, enterprise, banking, and current technical focus is on Cisco catalyst center, software defined access, Cisco Meraki and Cisco pieces.00:52And as a demo specialist, we have Madhura who is also specialist for enterprise in APJC region. She has ten plus years of experience working on Cisco's network management solutions, automating and routing and switching technology at various stages of customer engagement.01:09Also carries several industry certificates including CCNP routing and switching and have worked with my enterprise customers and service providers. Next slide please. Before we.01:28Start the session. Let me just tell you few housekeeping rules that we can follow to have a smooth and seamless meeting. So your microphones are muted and that is for comfort for everybody. And now we have Q and A open that is.01:44You'll be able to see a Q and A option on the Slido on your right side of your screen and then there is closed captioning available in the left side bottom of your screen. If you would like to use it, please do so. And you can raise your hand.02:01And also use the emojis and this session is getting recorded and you will be getting the recording on your email. And also at the end of the sec session, once you end the session, you'll be receiving an option to give a feedback which we would really appreciate if you give. It would take just 2 min and very.02:17We really feel that improvement is always there for everybody. Next slide. And before we actually get into the topic, we would like to know if you are aware about the spiking and have onboarded already.02:37So we would like to give our audience what is Cisco IQ in just 2 min. So next slide please. So Cisco IQ is a new tool that we have recently launched. So what it does is we have a lot of data out there like these nodes.02:56Troubleshooting guides and vulnerabilities, field notices, best practices, configures, a lot of other documentation. And then we have your assets. We have, you have your assets and the data.03:14Okay, everything is working in silos. Now what we have done is we have brought a tool which will bring all this data together. So what it will do is it will generate personalized insights based on your data for you, for you.03:31But but that would be like now you have your assets. So what assets would we actually gonna go Ldos in next 6 min so six months. So that is based on your data, all that LDOS information and let's say you have, now let's there is a new vulnerability out there.03:49Now you want to know if your asset is actually hit by that vulnerability. Then in that case, we can get to know that proactively using Cisco IQ. So Cisco IQ will be predicting which assets would be actually affected by a vulnerability automatically and will be showing you everything on this dashboard.04:08So those are very few features that are there but that I have mentioned but there are a lot others which we can let you know in other sites we can give you the recording. So I'll now hand it over to start the actual presentation.04:26Hey, thanks. Thanks Lasha for the introduction and taking us through Cisco IQ. Hope I'm audible and my screen is visible as well. Good morning, good afternoon, everyone, and thank you for joining us today. So before we start off right.04:45We start off with what's new with three.one. We 1st need to understand the catalyst centers upgrade path, which is a crucial for planning your network solution. Now this slide here illustrates the recommended upgrade paths to ensure a smooth transition to the latest portions. As you can see, there are specific sequential ones which include.05:03To even the one.one.series as well. Hopefully.05:23The we we don't have anyone in that version sitting. So if you can just put in like what version you guys are currently running on your catalyst center in the chat or in the Q and A is where it would be good for us to know. The critical takeaway here is the part to Cisco catalyst center three.one.or three.X series, which is our.05:29Latest latest available or which is going to be the latest version which is going to come up, right? It's important to always follow the documented upgrade procedures to ensure data integrity and system stability. Please note that older versions such as one.three.one have reached the last date of.05:51Long back which is in 2023. Even some of the the two.two.series will also have received their end of life and end of support dates, right? So we we strongly encourage you to plan your upgrade to three.one or three.series to leverage all the new capabilities and some of.06:11Those we'll discuss and and we'll see today as well right so the upgrade process itself.06:30Something that is probably not everybody's favorite topic which is upgrades especially when we are talking about say catalyst center because nobody wakes up in the morning and says today I really want to update my network management appliance. With, with the move to the three.X architecture, there was an important platform level change.06:40Change some of the performance improvements required repartitioning of the existing price which meant a traditional upgrade approach was not always possible. So the three.X upgrade process is designed to make this transition much smoother, right? So catalyst center performs a series of these prechecks as.06:58You can see on screen 1st, then it installs the three.X software converts the existing backup of your two.237 version.07:18Into the three.X format and finally starts to convert back. So from an administrator's perspective, the important message is the platform is doing a lot of the migration heavy lifting for you and let me ask you this again, right? So how many of you have had an upgrade where the actual upgrade was just 30 min?07:28But the preparation, and recovery plan took more than a couple of weeks time, right? I just saw.07:47One question, what is the recommended release? Last year if you can just paste the link for the available latest and the the suggested releases in the chat section, it would be great.07:58Moving ahead, so what's new in, in three.one, right? So I have a quick slide and now that we've covered the whole upgrade story, let's look at what's actually new in three.one.X with quite a few enhancements across platforms, netops, AI ops, secops.08:16Since we have limited time today, we're going, we'll not be able to cover every single enhancement in three.one. Instead we'll focus on some of the important and impa impactful features that we believe are most relevant from an operational and customer perspective. And rather than simply going through a few features.08:37Like us to look at these from three angles. What was your challenge earlier? What has changed in three of one?08:56And more importantly, how does that change make our network operations better? So as we go through the slides, I'll also pause at a few points and get your thoughts and experiences as well and please don't wait until the Q and A at the end. If something comes to your mind, feel free to ask as we, as we go along.09:06A good chunk of panelists on the call who would jump on and answer your question as soon as possible. Otherwise, it's just me who will be talking for the next 20 30 min, right? So I'm sure none of us wants that, so please, please do put in your questions and our queries in the chat or the Q and A panel.09:26So we'll focus, we'll start off with the platform changes itself, right?09:45There are three things I'd like to you to keep in mind, deployment flexibility, access control and centralized visibility, right? We have catalyst center running in different environments. We have custom, we have customers with different operational teams and increasingly we have customers running multiple catalyst center instances as well. So these announcements are real.09:49About making catalyst center easier to fit into the enterprise rather than forcing the enterprise to fit around the catalyst center itself, right? So 1st one is the catalyst center as a virtual appliance and on on Azure. Traditionally if I wanted to deploy catalyst center as an appliance I had to think about the.10:09Rackets, stack it, cable it power it, and then explain to the facilities team why I need another box. With the Azure virtual appliance we get more deployment flexibility.10:31We can leverage the Azure environment and its native capabilities including HA while avoiding the physical appliance deployment overhead, right? So the documented sizing here is 302V virtual CPUs, 02:56 GB of memory and a 3 tb of storage for it to function properly. So.10:43For customers who already have an Azure strategy, this gives them another way of, of consuming catalyst center.11:03A quick question. How many of you have, have heard this, this comment? We are moving everything to cloud, right? So usually that's followed up with except the network. So this is one way of bringing the network management platform into the cloud strategy as well.11:11Moving on, next we have site based so this next enhancement has been one of the key call outs from a lot of customers as a feature enhancement and finally we have it here. This particularly becomes very important in large enterprises. Imagine that I have.11:29If a global catalyst center deployment, but I don't want my administrator and say Mumbai configuring devices in London unless of course they're specifically responsible for London. With custom roles, I can control what features a user can access. Then access groups allow me to associate those roles with specific sites.11:48And the granularity can go down to the area, building and even floor level. So we're separating two questions. What are you allowed to do? And where are you allowed to do it? Right, so.12:08That's a very useful distinction when you have regional network teams operating from the same catalyst center platform. Now, let's imagine even a bigger environment. You don't have just one catalyst center, you have several catalyst center, maybe one in India.12:20Another one for Europe one for the US and another one because somebody deployed another one before we had this conversation. That's where catalyst center global Manager comes in. The objective is to provide.12:40A centralized view across multiple catalyst center instances, we get the capabilities such as global visibility, global search, cross launch, issues visibility and situational dashboards as well. So instead of constantly asking which catalyst center manages the site, we have a more centralized operational view. So the import.12:53Important dependency is that the catalyst center instances need to meet the supported version and connectivity requirements that are there for this CCGM. So think of CCGM as.13:13The management layer above multiple catalyst center deployments. So with that, let me quickly pass pass the ball to take us through a few demos from, from the netops section.13:25From the platform sections. Yeah, so thank you team you'd see my screen, right? So this is the recorded video that I have for the site based access control. So this feature is like was requested by customers, lot of customers because.13:43Of the ease and granularity of the operation. Now it is here in three.one.14:03So quickly I'll show you the version that I'm running it's 315 currently 316 is released in general availability in the like I think some one week back. So you see the appearance is different. It's not like how.14:10It was in two.X version or maybe earlier version also. So you need to get familiar with this appearance. If you have handled Meraki before, it somewhat looks like that.14:30This is the catalyst center, which we have looks similar to Meraki. Appearance is same, but the functionalities are somewhat that we already handled, ok? So what do you see in the home screen is, how many issues are there in routing? How are the.14:42Distribution access devices are doing, how are the endpoints as in clients doing, how are the application? There is a separate tile for software defined network that you will have something related to compliance because this is a homepage.15:03It's like Monday morning you come here and see how your network is doing. Even the recent activities, if somebody would have done anything, maybe upgrades or initiated something that you would be able to see. So this is how the old.15:17Page was looking, but now there is a way you can switch to new homepage as well. There is a, this, this option was earlier there in two.X also if you would have explored. So to see what all features you already have in your catalyst center, there is a.15:34The Explore button here, in menu if you go at the last, this explore will come where your features from the product itself are.15:54They are segregated into AI OPs, net OPs, devops, and secops. So you can see which all features you are using if you you're not using anything like any particular one, it will be showed to you in a different color.16:06Okay, so this actually shows on adoption journey of your product that you have already purchased or where do you stand? So, so as to monetize the product properly. Now this was there earlier also just that with three.x, you will have the newest.16:21Newer features also and you will get to know that from here, that explore dashboard. So if let's say for secops, you have the zero trust workspace, how much of your using it, how many features you would like to explore that you can check.16:41Okay now let's go and understand about the side based control. So for the site side based RBAC like.17:01You know, we have to do everything from a super admin role. You have to be at the top of the hierarchy to set this. So, ok. Quickly, this is my catalyst center global manager, which actually based upon.17:18If you have multiple catalyst centers in any form factor, you can use it to see everything in a one single pane. So this is like as promised, Catalyst Center global manager will be your single pane of glass where you can see everything.17:36Globally on a global level. So from this also you will be able to jump to your catalyst center that you have three.x. Now, I am super admin here. So I have to go into the system and users and roles.17:55To check the access control. Now you would see there is a role based access control added here, which was not there earlier. So this is a recorded video. There is a local credential that is created.18:13With the access group. Now there is a concept of access group that comes here. So there is a access group already created. You can create few more, you can create the new roles. We have to tie that up. We'll see that how.18:35So you start a workflow of creating a new role. I'm giving name as webinar two. So whichever granular access, if you want to make it only the read or both read and write.18:53Right or deny the access itself. You can do that from here. Choose what level of permissions you want to give to the user that you are defining. So this was there earlier also. You would have been familiar.19:11Oh I select, I want to give some right access to the assurance part and then, yeah, for network design I want it. Okay done. Now this is about the rule.19:29So webinar two is the role that I have created with this as a summary. I save the role. What is next? This is the additional task. Now I want to create the access groups. So there is already one access group I created, but let's create.19:46Like if you click click on this create access group, you will get to see the workflow. Again, in that workflow, you have to give a name. You have to assign the roles into the access groups and this is where, you can go to the granular on a site based level.20:03You can assign this on a particular site. So this particular webinar group is there only for this particular site. Now we'll see how we can create another access group.20:23So I'm assigned I'm creating webinar two as an access group, assigning it the N six as a building, and then the role that we created webinar two is allocated under this access group.20:42Now we will add user into this. So there is already one user that I have created for Julio. I'm changing the access group to webinar two. Now once it is.20:59Done, what we can expect it, currently I logged in as an admin, I had super admin global credentials and the access. I'm logging it out. Now we will log in through the new.21:17User that was there and with the side based control, it should ideally show only the site.21:35Which I'm supposed to look. So let's see that in working. Any questions put please put it in a chat. So now I have logged in.21:49I can see the inventory which is there for this particular building because this is the site on which my credentials, the Julius credentials has been given access to. This is what it looks like. So the access group that you see here is webinar two that we created.22:07So this sums up the demo for side based access control, which is, which was a long time ask from customer side. So now I'll hand it over to Akshay for the next features in the net OPs group.22:27Yeah, thanks, thanks for that quick demo. Hopefully my screen is visible. Yeah, it is. Okay, so now let's move into netops, right? So this is where things get very practical because ultimately a network management platform.22:44Performance just by one simple question, does it make the network team's daily life easier? So we're going to look at some of these improvements around discovery, onboarding, software upgrades, compliance, and configuration management. Starting off, there are some discovery, some, some enhancements in the discovery dashboard itself. Previously.23:03If I had.23:23Multiple scheduled discovery options running I had to go to activities and tasks to monitor them that went jumping between different parts of the application just to answer a fairly simple question, right? So what is happening with my discovery job. In catalyst center version three.one and above, the discovery dashboard provides.23:24It's an option to monitor and manage the scheduled operations sheet scheduled network operations directly. So this is not necessarily a flashy feature.23:44But these are the kinds of improvements that save operational time, right? And as we all know, saving 5 min once is nothing but saving 5 min every day across 15 engineers suddenly somebody is presenting an ROI slide, right? So, that is where the benefits come in, right? Next.23:53We have some enhancement in the onboarding site, right? So one of the challenges again previously was that there were multiple ways of onboarding devices, discovery workflow, inventory device additions CSV upload and so on. Now we have a more unified workflow, so we can discover a single device or range of.24:12Devices select the required credentials and assign the device to the appropriate site. So the idea is to simplify the initial journey from I have a device on the network to catalyst center knows about it, has its right credentials and understands where it belongs, right? So that's a small workflow improvement, but at scale on the.24:32Adding hundreds of or or thousands of devices becomes much, much easier.24:52Next, we have swim, software image management. So if you've ever managed software upgrades manually, you already know the story. 1st you find the image, then you check whether the, whether you have it in the repository, then you check compatibility, decide what devices we are upgrading, and then somebody asks can you.24:59Send also send me a report, right? So that's where the new swim dashboard helps. The objective is to bring the software image information and upgrade operations onto a more centralized experience. So rather than navigating multiple pages, we have a much clearer view of the software image life cycle itself. For larger environments, this becomes.25:17Particularly valuable because software management is not.25:37Just an upgrade task, it's an operational life cycle itself. Now this one is particularly interesting from a network operations perspective, intent based configuration is powerful, but there are still configurations that customers and you guys may need.25:42To order even if those configurations were not originally pushed to. That's where rule based compliance comes in.26:01We can define rules to check whether a specific configuration is present or absent. So e.g., instead of asking only, did, did the catalyst center configure this device correctly? I can also ask does the configuration exist on the device right now.26:09And and the most important part is that these rules can be created once and reused across sites. So this gives your network teams a more flexible configuration audit mechanism. Moving on, now let's switch to.26:26Wireless there are several enhancements around global wireless configuration itself. We have improvements around flow monitor exporter, and, and monitor configuration mobility global manager and peer configuration, device classifier settings, AP image upgrades, AP geoloc.26:45And optimized roaming as well. The common theme here is centralization.27:06So instead of logging in individual controllers and configuring the same global parameters repeatedly, we are bringing more of those capabilities into the catalyst center itself. So and for, for anyone.27:11For anyone managing multiple wlcs, you already know the word, know the value of the word centralized way. Yeah. Now moving to network settings, here.27:26We have enhancements around SNMP version three user groups and DHCP persistence. These may look relatively small additions, but network settings are foundational. The more of these configurations we can consistently manage from the catalyst center, the less the the the less we.27:45Depend on device by device configuration.28:05And and that's really the larger direction we are heading towards. Less CLI driven repetition and more centralized and consistent network operations. Now, yeah, the next section that we have is the configuration cloning is is.28:08This is another very practical enhancement. Today if I have multiple wlcs, I need similar and I need similar configurations. I don't want an engineer manually recreating everything on every controller.28:28With configuration cloning, we can clone supported wireless profiles such as the WLAN profile the the policy profile and the AP join profile. So if I have one configuration that I've already validated and I want to replicate that across multiple controllers, I can simply use cloning rather.28:42Than rebuilding it from scratch. So because.29:02Let's be honest, if you ask an engineer to configure the same thing 20 times, eventually number 17 is going to be slightly different. So that's why this feature will be greatly helpful in the operations of, of, your, your environment. Yeah. So with that, let me quickly call upon Madhura back to take us.29:05So some of these feature sets, yeah. Over to you mother.29:25Cool, thank you. So let's run through few of the demos recorded that I have for you and then rule based configuration specifically will see the light demo. So, if you have catalyst center, obviously you are using it for the software image management.29:30This demo is just to show you.29:50What is different or how the workflow has evolved for the software image management? So earlier software image management, if you remember, was from the provisioning tile, from the inventory. Now we have a separate tile. If you can see here, you have to go into the provision.29:53Because we understood that software image management is a crucial task that is getting done from get listener. It is considered as a separate feature under provision now. So you have the images, updates like a summary page here.30:14When you go, and click on the software image management tile from provisioning. If you have any workflows that has been started by you, even those will be part of it. Now let's see images we store under the images tab.30:30For the particular product family, if you click on it, you will see what all images are available. Earlier you used to make it as a golden image. Now we call it as a standard, so you can mark it as a standard. You can just keep it as a downloaded.30:46You can see which all are available for the download and whichever are the latest and recommended. So you can just click on this and say download from cisco.com, it will check the credentials that you have connectivity with the cco credentials and it will start downloading. So now let's say.31:03I have started downloading 1715 four image.31:23For 9300 family. Now let it go for the download. If you face any download error, it is advised to check about the credentials that you have. Now you'll see the available image which is standard. If you click on it, you can see from the image advisory.31:28Details perspective. Why it is important? It's important from the security aspect.31:48So which all like advisory it has, which is the mode like install mode. If you have any advisories on it, the CVSS score of it as well you will get to see from here. So this is to help you choose the image properly. Nobody would.31:54Like to have a critical.32:13Advisory image in their production, right? So this is like a new dashboard that comes up to your help where you can find everything for software image management. Now let's get back to the dashboard. Now, you see all the devices which are eligible for the upgrade are here. So if let's say.32:15Say this particular one device, it needs an upgrade, it is flagged as a warning because it is in a constant loop to check. Now you can start the readiness check then and there or you can start the upgrade as well.32:35The upgrade as a process remains same. What changes here is the visuals that were needed for you because of be for the operations simplicity. Now the prechecks, post checks, the scheduling remains same. Now I'm scheduling like it's.32:53It's a two part process, you know, software distribution and activation. I am scheduling the activation just after.33:13The distribution. I'm not operating it now, but just letting you know, you can see the update status of the upgrades here. Like you have to go into the software image management, just one with one.33:20Tile, you will be able to see all the images, all the devices that are undergoing the upgrades. And ideally it's an ease of operation that you.33:41Reached to from here. So this is about the software image management. Any questions, please let us know. It will take some time, like it will take some time, obviously, to get you familiar with this.33:56Let me just quickly share my screen for the role based access because this is something, rule based access compliance is something that everybody wants and now is getting from the catalyst center. So this is my lab catalyst center, so the devices are very.34:13Limited here, but.34:33I'll let you know how to do this rule based compliance in your system. So I need a hundred percent of your attention if you are in the webinar, please drop if you are doing anything else because this is something that is gonna be very helpful. So what you have to do here is go into the.34:36Policy under compliance which was not there earlier in two.X version, you can see the rule based compliance policies. Now, look keenly here, you can have these policies defined on any hierarchy. I'm currently defining on a global level.34:55I have already created one policy, but just for the demo, I'll create one more here. So you can have any policy name, let's say I want one particular policy for device.35:13NTP level configuration. So I'm creating the NTP policy. I can assign to any sites, any level just for the demo I'm assigning to the global. Now.35:29What rule I'll set defines what this policy will check, ok? So the rule name is NTP server check, ok? And you can see.35:45What impact and suggested fix should be there if this rule is violated. So basically what you can do here is create a particular compliance rule to check if some configuration is available in the device config or not.36:01If it is missing, what to do? Now I'm selecting this for iOS XE devices, let's say switches, under switches, I have 9350, so I'm selecting 9350 here, smart switches.36:18Let's go ahead. So this is about the devices to which family the rule is applicable. Now what we have to do is add the conditions. So do I need to check this against some configuration or against some device command output? So I'm checking.36:38Let's say show NTP status and I need this NTP should contain the string or maybe let's say it should not contain.36:55I'm just giving it randomly. If this rule hit a device, it checks showing TP status and then it should not see or it does not see this particular.37:13IP under this status, it should do this action. So the action is raise a violation. I want this violation to be major because I need my devices to be in to be synced. If there are any customer violations, you can like custom message, you can do it from here.37:30Now I'm saving it. So what this rule states basically is any device in your network does not have NTP state NTP random IP. Just forget, forget this IP.37:49Particular NTP for your enterprise, if it is not there, it raises a violation. How cool is that feature? Now, you can add multiple conditions under NTP server check from the compliance standpoint. And if you want to test it, correct? So there is a test condition also.38:05So I want to test it against, let's say this device. These devices will appear as per the devices group that you have chosen for the policy while creating the policies. So I have chosen 9350 so it is coming for 9350 and I'll be able to test the conditions. So it is saying, ok.38:24One violation is found, obviously 888 is not there under show NTP status, so it is showing the major severity violation because I chose so. If I edit this and saying that NO, this is this has to be a critical.38:45And, check NTP or let's say configure NTP server and high priority obviously I'm saving this. Let's check against it should raise a violation.39:00Same device or any device for that matter because none of the device has this. Yeah, so you see the critical severity is generated, the violation message configure NTP server is appearing here because this is violated. So, systematically.39:20It is advised to create this rule based compliance policies and you can run it against all the network that you have for the basic configuration or golden configuration that has to be there. That should not be violated at all.39:36So this is the cool feature that I wanted to show. Another thing that I would like to show you is about the config learning. Now.39:53This is also one of the feature, this is one of the recording that I have, one of the features that is completely new, ok? So what do, what do we do here? We learn the conflict from the devices.40:11Be apply these conflicts or check against the conflicts to the rest of the devices. So let's get to it. How you go to this is go to provision. Under that you will find the campus networks, networks, and group profiles. So this feature is under beta, but just because I felt this is very used.40:28Useful I'm kind of adding this in our session. So this is a brand new feature where you can have your devices grouped into your in like something called as network.40:47And then you can have a group profiles defined. These group profiles can be learned from the device and can be compared against another devices. So now let's create a network, it's a webinar.41:06I'm adding United States as a site for this. And then we create a device name. So let's say I have the wired devices, I want to create a policy or I want to create a config for them. So I selected the edge devices.41:22So these two edge devices I have select selected and I'm creating a network. Okay, let's add border also. So we created a network where we have three devices. Let's create the device group if needed.41:40Oh, all these three devices, they would have some configuration. I want to understand what configuration this particular have. So for that, 1st thing is I'll have to create a group profile.41:59So what type of profile I can create? I can create a security profile or any template profile or layer two profile. Let's go with the layer two for the start. So there is an option to do it manually, but the smart way is to understand the config from the devices. So let's say I have a golden config already on the edge one.42:16I want to understand the layer two templating from it and I'm giving the name as a webinar L222 just because it should not overlap. Now it is learning this from the devices.42:36This type of feature was all like already there for the wireless for the WLC learning. Now it is applicable to any suite. So now you see the discovery protocols, the STP conflicts, VTP conflicts, they are getting learned from the device.42:53Once I say ok, we have learned it. Now, I'll check like this was my golden config against which how the other devices are holding up from the compliance perspective because if it needs correction I'll be able to do it.43:11So I'll see compare the configuration for all the devices. What is the profile type? Layer two, and then we will select the profile that we have created from learning the device, give it some time because it is.43:31Betting.43:51And then you will see the configuration was created or learned from one switch, obviously it will have a full match with that. But there is NO match with the other edge and border configuration.44:02So we'll check what is there. What is the difference? So you can see some of the discovery protocol LLDP disabled. So now, if you want to change it to make it as a golden config, even though authentication is different. So.44:17You know what is missing from the golden config to the other device on in an automated way. Manually we can do the difference, but we live in the world of automation. Similar way for.44:37Border also we checked. So usually it is advised to have a similar group of devices to be grouped and having a group profile which is similar because the type of device changes the configurations obviously. So this is how we create the group under that we.44:54Add the, devices, then we compare, let's say there is another profile that I have already created security profile. Now against that I check and I understand few of the devices they are not compliant for the security device like security.45:14Rules that I have set as a golden configuration and I can tackle those from there. So that is about the features. Now, let me give it back to Akshay.45:32For the rest of the presentation thanks, thanks for that quick demonstration. As I've mentioned earlier, if you guys have any questions to put them in the chat section.45:48And we'll answer them as soon as possible. Now we're moving into one of the areas that I I I think is particularly interesting, which is AI ops. Because we've, we've we've kind of reached a point where networks are generating enormous amounts of telemetry events and operational data. The challenge isn't necessarily.46:07Collecting the data anymore, the challenge is what do I do with all of it, right? So and this is where analytics and AI can help us move from simply seeing information to identifying what actually needs attention.46:27Let's start with energy management. Traditionally, our network teams haven't always had good visibility into how much energy their network infrastructure is consuming, especially when you start looking at switches and PoE connected devices at scale. Catalyst center version three.one.three.46:43And above along with the required ISF XE version, which is 1715 two and above, provides visibility into energy consumption through dashboards, reports and APIs we can aggregate the information by a device or a site and and even look at the trends over time.47:01But there there's another interesting dimension here, cost and carbon emissions. So this isn't only a network performance conversation anymore. It can become part of the cost of of your sustainability and operational efficiency conversation as well. And for customers with thousands of switches and PoE devices, even small efficiency improvements can.47:22Become meaningful at scale.47:41Second at ice authentication failures sorry yeah here's one that, that the network teams and as well as the.47:47Security teams will appreciate. So when if when a when a client fails authentication, 1st question from the network team is usually why? And historically you might need to jump into an ICE and, and, and look through the live logs to find the actual authentication failure reason. With the ICE integration catalyst center assurance can provide.48:04Visibility into the client onboarding failure reason as well. So now the troubleshooting workflow becomes much more integrated instead of catalyst center says authentication failed.48:24Okay, let me open up ICE and see what's what's there. Let me find the endpoint. Let me find the log. We can get much more closer to the actual reason from the assurance workflow itself. Fewer browser tabs, that's already a feature.48:36Here's his sorry we are yeah sorry now this is where your.48:54AI becomes particularly useful. So imagine you have thousands of events coming from your network, looking through all of them manually, is obviously not practical, right? So the AI outliers.49:10Capability looks for locations where, there is a significant change in event volume. So it identifies buildings with increasing event volumes as outliers and provides a visualization through through the sanky chart, right?49:26So instead of asking which of these, thousands of, of events should I investigate, we are getting a more focused question. Which locations are behaving differently from what we normally expect. And that is much more useful starting point for an operations team.49:46111 personal note that I would put I would like to put here is AI doesn't replace the engineer here, right? So it helps the engineer decide where to look 1st. Now moving on we'll get into the security operations the capability we are looking at here.50:06Is the sec the security service insertion or SSI, and the basic problem we're solving is how do I selectively steer traffic through a security device when I need inspection without forcing all traffic through that firewall? So that's where the SD access integration becomes particularly interesting.50:25Now let's walk through the concept here, right? So, in an SD access fabric, we may have traffic that needs to be inspected as it crosses an untrusted segment, but we don't necessarily want every packet in the environment.50:45Sorry, 1 s. The slide just moved, right? Yeah, so we don't know you're back, right? And importantly the policy can be based on the source SGT and destination sgt. So we are NO longer thinking only in terms of IP addresses, we are thinking in terms of, I don't know why it's moving back and forth.51:02So we're not just moving in terms of IP addresses. We are thinking in terms of identity and security policy. The catalyst center workflow takes us through the required steps. 1st run the pre check and select the fabric site, map the firewall IP address, configure the policies, I don't know why it's doing it. Sorry guys.51:23The benefit is that the workflow is orchestrated through catalyst center rather than requiring the administrator to manually configure multiple pieces of the fabric and because we are can selectively redirect traffic, we can potentially reduce the amount of traffic processed by the firewall, which can both, which can have both CapEx and.51:42So the simple way to remember SSI is don't send everything to the firewall send what the policy says needs inspection. Now.52:03These are some of the key SD access enhancements. There are three areas I want to highlight. 1st, is native and allowed VLANs on trunk interfaces. Before three.one.three.52:14Edge node and extended node trunksport defaulted to native VLAN one and allowed VLAN all. Starting with three.one.three, administrators can customize these values for individual trunk and port channel trunk interfaces directly through the SD access UI itself. Second is the voice VLAN.52:29Mostly the authentication template defaulted the voice VLAN to 2046 as in the VLAN to 2046. The problem is that some endpoints couldn't unintentionally send traffic into that VLAN.52:49With three.one.three, we have the option to disable voice VLAN 2046 during five fabric site creation or even at a later process later step. And 3rd is SSBP blocking. This gives us better control over.53:01Multicast SSDB traffic in the fabric, so resource guard can be used for specific layer two vns and anycast gateways. So overall these changes give administrators more control over how traffic behaves inside the SD access.53:19And whenever I hear the word default, right? I I always ask one question is the default actually my with what my production network means? Now catalyst center gives us more flexibility to change that, that way required, right? The next feature set that we have is the the overlapping IP address pools.53:35This has historically caused a lot of design discussions, the overlapping IP addresses in in catalyst center version three.one and above overlapping IP pools are supported for specific SD access use cases. Each overlapping pool gets a unique name.53:57An overlap ID and these pools can be used for scenarios such as anycast gateway and multicast. E.g., in the deck in in the slide that you see here, it, it shows overlapping CIDR such as one.one.1.0/ 24 and/sixteen being used for different vns.54:17Virtual networks, but, and, and, and this is important. Overlapping IP doesn't mean anything goes, right? So there are still restrictions, e.g., your overlapping pools cannot be used for L three handoffs, LISP extranet or or the infra VN to say, right? So don't walk away with this don't walk away from this.54:37Like thinking great from tomorrow nobody needs to worry about unique addressing anymore, right? So we still need proper IP planning. The key, the key takeaway is that catalyst internal supports overlapping pools for specific SD access scenarios while maintaining defined design limitations as well.54:57Hey.55:17Next, we'll quickly move into DevOps, as this is something that becomes increasingly important at network scale as as networks scale, how do we integrate network management into automation, right? So because nobody wants the network to be the part, be the one part of the IT environment.55:18Environment where automation stops at the login screen. Catalyst Center provides APIs that allow external systems and automation platforms to interact with the platform programmatically, and three.one.X expands that capability across multiple areas. So here.55:38So we're looking at the API ecosystem itself, catalyst center three.one and above includes new and updated APIs across areas such as wireless, applications, backups, clients, devices, energy analytics, LAN automation sites, swim, a lot more, right? So there are more.55:58Also new APIs around areas such as config archive swim. And more importantly we have some of the APIs replicated as well. So if you have existing automation built around catalyst center APIs and upgrade isn't just a software upgrade, you also want to check what APIs in your automation is using and whether any of them.56:18Have have changed or have been deprecated.56:38You should be able to find the developer documents. I'll also try to paste it in the chat section for your reference. Now, before we move to the next demo, right? I would like to quickly point out that catalyst center.56:43With catalyst centers, we are trying to evolve the feature sets, but making sure that the stability stays, right? So that is where the key statement I would like to make is we are adding in new features or we are making sure that the solution is stable, yeah? So quickly over to you Madhra. Thanks.57:02Minutes.57:22Yeah, you're on mute Madhura? Yeah, NO, yeah, yeah. Yeah. So this is one feature which actually just touched based upon, but I want to elaborate more in the demo section is about the energy management. So sustainability is the world of.57:23All everywhere, and everybody is keen on seeing how the organization is doing on that. So this energy management dashboard will help you to.57:43See how you are saving on the energy consumption side. So you just have to deep dive into this energy management. You can select auto refresh of the data which is advisable every 5 min your data will be.57:53Refreshed. Now, there are several tabs. We'll go through each one by one. We might have to push for like five more minutes than the scheduled call, but I think it's worth it. This is my lab environment. So if you see the energy consumption is not that heavy and that is the reason the.58:10Costing and the saving is also not that much, but you can see the granularity of the energy consumption like how much is for switches, how much is for PoE.58:29You can select also for POV, only some 10 % of the energy is getting consumed ok let's select on the switches. Maybe it will give yes. So what you get to see is energy consumption.58:40Trend, how many devices are there for at the moment like for that particular time. So I selected the 24 h time frame, so it is likewise. What else you get to see is about the car carbon emissions like how many estimated carbon emissions are there? If there are any savings that you are doing.58:59Being as a result of power profiling to your access points, it will be also shown here.59:19So if you click on the carbon emission, you get to see how much is the total emission, how much is the energy mix, and as a networking person, I think this is of least interest, but as a management, this is the talk of the town. So if you can fetch something like this.59:24Then, obviously it will be of more use to the organizational level management. So you can see the emission level trend where you can have the pink line as a carbon carbon intensity that the emitted carbon and the emissions, ok?59:42Again currently there are NO savings here because we don't have any our profiling applied in our lab because it's very small lab. But if you are an industry where you can have the power profiling applied for the night set night, as in you can have the one of the AP radio for AP shutdown.01:00:03And other radio serving the clients when there is a very less density of the clients on the floor. Obviously these savings can go till eleven to 12 % that is what.01:00:23We are claiming from catalyst center site because we have seen those out outcomes in some of the customer environments. And then, yeah, you can have the comparisons of the sites, let's say for all these factors, the usage, the carbon emissions, the total cost and everything. So.01:00:36So you can see comparison you can do from particular time period as well, to check which site is doing good. Similar way report generation is also there. This is one of the report that I, that was added as well.01:00:56So you can see the energy consumption, whatever you saw on the dashboard, same you can let's say I want to fetch it on a global level, you get to see these fields, the sustainability fields, the data, the cost, the emissions, the carbon intensity, and the energy consumptions.01:01:14So I'll stop here because of the time constraint back to you ok I'm just answering to a few questions in the chat. Yeah, there were there is a question related to energy management. So this dashboard is not like this available.01:01:34Or for energy management or sustainability standpoint, but there is already a PoE dashboard available where you can just check the power profiling details as well as how much energy is saved.01:01:54Okay yeah so thank you thank you guys for your patience and listening to us for this much time. I'll I'd like to quickly summarize today's session. Let's keep let's let's just recap the following key points about the catalyst center.01:02:09Three.one starting off the 1st one doing site based role based access control. This is a game changer for security and operational efficiency. It enables can.01:02:29Access control to catalyst center features and specific network sites and you can go down till building and floor level. Second is the new swim dashboard and campus network automation. The new swim dashboard provides a centralized simplified experience for managing software images and upgrades coupled with campus network automation.01:02:40And it it introduces a flexible model for creating networks and device groups. Then we have discovery and onboarding enhancements. We have streamlined operations by consolidating the monitoring of of scheduled network discovery operations into a unified dashboard for the.01:03:00More device onboarding workflows have been enhanced for both individual devices and device ranges, making network deployment and maintenance much simpler and faster. And finally, the, the energy management dashboard, this powerful new tool offers comprehensive visibility into the power consumption of.01:03:20Your switches and your PoE interfaces through dashboards reports and APIs, it helps you monitor operational costs and track carbon emissions supporting your organization's sustainability sustainability goals. These enhancements collectively empower you with greater control efficiency and.01:03:40And inside into your network operations itself. Yeah. So with that, let me quickly call upon Lassia to take us through and include the session. Over to you Lassia.01:04:00Hey thank you for that very detailed presentation and demo. Team, it's time for live Q and A If you have any questions, please do ask as you're doing currently upgrading to or wait until it is.01:04:15So you recommend upgrading to three.one now or we then it is the recommended release? Can somebody take this question? I'll yeah ok if you want you can go ahead.01:04:30So, I mean if you are ready to explore more, definitely go ahead and upgrade it to three.13.one is generally available as well now, right? So you can definitely go ahead but our suggestion would be to, to 1st go through the.01:04:48Release notes, right? Have a look at, at, at what is available as as we saw in the section rate that were certain APIs that got deprecated as well. So go through the release notes 1st. Analyze if, if that's the right move for you.01:05:06Then accordingly make or or go ahead with the upgrade. But definitely as as as we've been discussing throughout the session, right? It brings a lot of lot of feature enhancements and and capabilities to it. But yeah, as, as you've also mentioned Nick.01:05:22Yeah, currently it is not, I don't think it is the recommended release. If you can just check that. Yeah, it is not a recommended release actually, but my take here is obviously there are some good features like tool based compliance, and if you have like more than one catalyst center, we.01:05:42Less burden catalyst center, you can upgrade that to three.one as a pilot and check because the GUI is also different. Your team might need some time to adjust to it. So the recommendation that we are suggesting to customers is take your light loaded catalyst center, upgrade it to three.one, check for the stability.01:06:02In your enterprise, have your teams to work on it because the GUI changes are here and there diff little bit if you have already worked on Meraki it's somewhat similar so it's not a big challenge as as as I see, but then familiarity is something which we all appreciate, right?01:06:21So, take that approach, Nick.01:06:41Thank you. I think soon it will be recommended version there are yeah so there are stuff that is in a pipeline where customers more the more and more customers are adopting, it will sooner be pushed as a recommended version from the stability standpoint it is stable.01:06:47Yeah for your insights and love for the, I mean what all options you have, what it can show in the visibility that we'll have to try it. We can get few information like.01:07:04Sorry, sorry last year. I think the question from lab was with regards to onboarding non Cisco switches. So catalyst center does support onboarding of non Cisco inventory as well as long as it supports two as as as a section.01:07:21I'm just trying to find out a link that that mentions like what all the features would be available obviously being a non Cisco product, there would be limitations.01:07:41Yeah, so, just to addition here, all the non Cisco switches like in the compatibility metrics also you will be able to find it, which all are supported, but from assurance standpoint, any 3rd party device should be pullable if they support SNMP MIP two family. Now, having said.01:07:51That it is limited to assurance only. The automation is still not much in the scope, but this is supported from 2379 onwards only. So it doesn't have any dependency on three.x. So lab if you have 2379 onwards release, just give it a try because we do have.01:08:11HP devices, Palo Alto devices, even some firewalls onboarded on catalyst center in some of the customers.01:08:31Yeah, so one of the devices you will be able to see device details, interface details, very few features in 237, but yeah, again, you can give it a try by onboarding. All it needs is requirement connectivity to the device and.01:08:40Okay please post your questions and thank you for being there on call till now. Hope the session was helpful to you. Thank you.01:09:02Yeah, so we will wait for two more minutes if we get any more questions, we will be happy to answer else thank you and have a good day.01:09:17Oh. Thank you. I think after this session you are you will be getting a survey report, so feel free to give that as a survey and the feedback.01:09:36To us for any topics that you want next. Thank you team. We are there so if you guys still have questions, we would be able to answer them. Maybe for the next 5 min, we'll still stay on the bridge here.01:09:51Yes, you will be getting a recording of the session and for past recordings you can go to this link, the one that we already have given, let me paste it again. So we are onboarding dells, which is in our data center, can we onboard them.01:10:12As well.01:10:30So again, these also will be coming under 3rd party devices and you can absolutely if you if your devices have been supported, then absolutely those also can be onboarded on.01:10:31