What's New in Cisco Catalyst WAN 20.18.x

Oh what we do not cover is the sorry what we will learn our understanding of everything that is coming in the, in the twenty.eighteen release trend.00:00And what we'll not cover is the deep dive into all the nitty gritty details of every feature. So there's a lot of content, so some of it will be more high flying, there will be reference slides in there, but but the details how to do this, this and that, you'll have to go to the documentation to see.00:19So with that, few agenda points here, we introduced new platforms, we'll talk a bit about that, then of course key features and then what else is new in the in the in the new SD WAN software stack.00:38So, last year, around June we introduced a new entire portfolio of Cisco secure routers that will be evolved over time even more. So this last week in Cisco live, we, we launched a few new SKUs as well on the 8200 series. They are covered in newer releases.00:52For not in slides today, but they are there now and ready for you to start using and buying and selling from that perspective.01:11But they are requiring 20 six.one, which will be the next release that came up also a few weeks ago. So just to show you, 2018 three.one just came out three days ago. So that is the latest release we have on the twenty.eighteen train, and a new set of features came in.01:19To that as well, I will highlight those when we, when we go along.01:39But 1st thing 1st, one of the biggest, one of the bigger changes that we're looking at with the introduction of twenty.eighteen is the resilient infrastructure program. So if you look across time and you look about all our platforms we have and have had it over time.01:42A lot of those are legacy and also a lot of the features on those are legacy. So there's this is quite interesting read here on the side about an attack that was a few few months back where people was actually exploring or exposing some old legacy features and what that was causing them the.02:01When attack service they hadn't thought about. So what we've decided internally across Cisco is to start.02:21Addressing those gaps and addressing those things with actually starting to remove and deprecate features that are NO longer seen as secure. So there are some default changes that will, that will go in, but also moving forward beyond seventeen.eighteen and twenty.eighteen, we will start deprecating actual features.02:27Those features could be features like TFTP, FTP, HTTP, BOOTP. So some of those features that we all know is not secure by default, but we tend to use anyway because it's easy, they're always there and have been working for the last 30 years, but we now start to need to start rethinking.02:47And and start doing that.03:07What you will see in 20 eighteen.two is we will start imposing warnings in the CLI, so if you go in and configure something either on autonomous mode or in SD WAN mode, you will start seeing warnings saying this is NO longer secure, you should do this instead. So, so that's some of the things that are coming from every.03:09That's an infrastructure program. What's important to understand is this is a feature Cisco wide initiative, so it will also come on switching, wireless, whatever you have of iOS XE devices, this behavior will start to go in there.03:29So it's a very big program for us because we are doing a lot of recoding, we are removing a lot of code snippets from old days, so it takes a few releases to get there. But now you know that things are coming in in that direction. I'll not go through all the details on these next few slides because that's sort of highlights of all the features that are coming with the different soft releases.03:42Of seventeen.eighteen. So what I'll do is just happen there for your reference and then you will see them when we go through the slides. But for your reference, when you get the deck back or what feature came in 17 eighteen.two, then you have these overview slides to look at.04:02With that, let's go into the operational simplification part 1st. There's a ton of features there and one of them is the global search. So one of the things that people have been complaining about is it's very hard to find things.04:18In the SD WAN manager. Where is this? Where is that? Search for anything is very hard. So now we have introduced a very nice search bar in the top of the frame, so you can actually do a search across anything. So when you do a search, you will get the results across configuration groups, device names, policy groups, policies, and whatnot. So.04:35You have a very and easy way to search for anything inside the SD WAN manager. There are some limitations around how many results you will see, but basically a very nice search engine is now inside the SD WAN manager.04:55For those of you who are deploying SD WAN manager on prem or in your own cloud environments, it has been a bit tedious to get the initial startup to work. You need to do things in the CLI, then move over to the UI and do things there. What you will see now if you installed a brand new platform from twenty.eighteen is.05:07Is that you have two ways of going through a guided workflow from the day zero perspective.05:27Getting your IP addresses in for NCP configure, proxy TNS settings, all those stuff that usually took you all around the place in the manager is now collectively put inside the same workflow. Very easy for you to use. And again for CDCS deployments or cloud deployments.05:32This is NO longer relevant because we are doing that for you as a Cisco perspective. If you are deploying an MC cluster, you will only be shown in the, in the provider tenant, and then all the subsequent tenants will not have the needs to go through this because it doesn't matter for them. But basically it helps you do the initial onboarding of the SD WAN manager.05:50So, one of the things when we are talking about configuration groups and UX two point oh and and those kind of things, one of the things we have been lacking is the support for the control components. So control components has been tied into the device and feature templates, same.06:11It's the drawn of time.06:29But twenty.eighteen, we now have a new way of doing that as part of the UI and the UX two point oh feature set, which means that that was one of the last things we were missing to actually focus only on UX two point oh. So you now get a new comprehensive way of configuring your control components within the, the UI without having to build templates.06:31As such. Another part that is being introduced here, that's why it says another US updates is the tagging feature has been evolved a lot. So you can now based on tags, add your devices directly to your CT, your policy group.06:51And your topology rules as well. So suddenly instead of having to think, ok, I'm onboarding a new site, it belongs to this topology region I need to go in and add it manually there. I need to add it to this policy group and then I can deploy it. Actually with twenty.eighteen.three.07:09Based on the tagging, they will be also assigned to the right groups based on your rules. And then when you click deploy on the 1st configuration group, it will actually ask you, do you also want to deploy the policy group associated with that tag as well as the topology group will be enabled. So suddenly you have one way of holistically going through that.07:26Without having to to click deploy three times in a row to get everything rolled out for initial site. So a lot of automation and and feature availability.07:46Moving on, advisory dashboard. So, and Mike will sit on his fingers because he has this very nice feature under him. So in twenty.eighteen we introduced the security and UX advisory dashboard. Basically what we do is we allow the cloud services to feed information about your devices.08:00Serial number software version, and if you enable the advanced scan also your conflict. Based on that, we will take that and compare it to the unknown advisories that we have. You all know that there's been a lot of P search coming out the last six months, but based on that compare with what you have with what we know.08:20Know about advisories and then show that directly in the UI. So you have these amount of advisories that is.08:40Either very important or not important and what can you do to fix them? What we have done in twenty.eighteen.three, we have actually both that even further, which is the oh sorry that's a slide missing, let me just move on to that slide that comes down here.08:47Sorry for that. There we go. But what we have done with the advisories dashboard in twenty.eighteen three is we evolved it even further and added the new feature set called live protect.09:06Life protect is a way for us to provide shield capabilities for blocking some of those very important vulnerability directly on the manager and controller and validator but without having to do go through the upgrade. So the way it works is the same advisory dashboard now has been added.09:18The monitoring and protect capabilities of using this Cisco Live protect. The shield itself is running directly on the node, so manager controller and validator for now and will be able to to sort of protect the infrastructure for that known vulnerability.09:38The shield will be created by Talos whenever they do the analytics on the and then decide this we can fix with the shields or this requires a normal upgrade. So the intention behind this is very fast and easy way to protect your infrastructure day zero, day one, day two.09:56Until you can plan your normal software upgrade in a, in a more scheduled fashion. So you don't have to scramble every time there's a new.10:16P cert with a score ten, you need to upgrade now, now, now. No, we can shield it off and then upgrade whenever it's more applicable for you from a production perspective. In the target release, it's 2018 sorry in twenty.eighteen.three it's for the controllers and you can say limit data is what we call it.10:25And we expect to have it on the platform so the routers themselves with with high memory I would say in 20 seven.one. It uses some memory to run these things directly in the kernel, and therefore requires a bit more memory than the all the smallest boxes can do for now.10:44We're trying to expand that and and enable that on on more platforms as well. And just because we really liked this feature I've actually created a small demo I want to show you here, so we'll start with that and then we'll pivot back to some of the slides afterwards. So what you have here is the SD WAN manager and I'll just start rolling the video.11:01As you can see, classical manager dashboard and on the monitoring page here you have the advisories on the far right. And in a short while we will click on that and then the video should continue on. It goes there.11:21So now you can see here the advisories dashboard. It shows all the known advisories right now we we have on this platform, but also which of them do we have shields available for? In this case here manager and controller.11:37These shields can then be enabled in either monitoring mode, what happened for the video? Sorry for that. Let me just, there we go. So they can either be enabled in monitoring mode where we can track if something has happened.11:53Or we can enable them protect mode and simply block the traffic. So depending on what the vulnerability is and how important it is, we can sort of take an action based on that. So, what's the video perfect.12:09So here you can see I just simply just select the CVE, click on monitoring mode, and then it will enable that. There we go. So then it will deploy the shield. It roughly takes 30 to 60 s to deploy, and then.12:26It will be installed and enabled, enabled for, for that CVE. Let me just have the video continue. Here we go. Here you can see we initiated the department task. And once that is updated and it goes like a normal task like anything else that we do in the manager.12:43And once we come back, we will see we have a shield.13:03Enabled? There we go. So now that shield is in monitoring mode across the manager and the controller for this specific CVE. If we open the CVE, we can see the control status on the, on the shield as well as how many hits we are seeing.13:06And if we decide to say yes, we would like to block it as well, we can go into protect mode. We have both options to to make it. You can say I'm monitoring space to make sure that we are not blocking any traffic that we actually want through. And then we can always decide to go into protect mode. So now it's going to protect mode, which means that this CVE.13:26Even though it's still a score ten is sort of air gapped or or or controlled and then we can upgrade the manager whenever we see fit and therefore remove the CVE at that point in time. I hope that makes sense. Let me just go back to where we came from.13:45This is where we were. So that was the evolution of how the EOX and and security advisory board advisory dashboard has evolved from actually from twenty.eighteen.one to twenty.eighteen.three. But the idea was to, to make sure you get all these information.14:05The UX part is shown in the device overview where you can see my software is UX or what is the timeline left on that as well as your physical platforms. Moving on license management.14:21For those of you who have been running SD WAN since the donor of time know that licenses has always been the thing you need to buy to stay compliant, but there is NO way of putting them anywhere inside the manual. The 20 where you now are available to do.14:36All your license management features within the SD WAN manager, you can track what you are having, what you're using, but also when you start using some of the new platforms that I showed in the beginning, they're actually a license blocking coming in. So if you take a new secure router, join onboard without the license, you're not able to deploy your configuration.14:53Initially.15:14It's not that if your license, when your license run out and you forget to renew that your network will stop working, the the enforcement is being done on the day zero part. So that's why it's important to start looking at license management if you haven't done so already and starting to to make sure that you have your integrations working and.15:15Getting your licenses assigned to your devices, not just the but also your tier licenses and your normal licenses for the secure routers. There's a new analytics engine onboarded by default, you can also get access to analytics, so that's a change in the licenses.15:35So and links now is available for everybody that also buys essentials. So when you look at that, you can see here when you're buying essentials, then you will have.15:56Few limitations on the the analytics side in terms of how much data you get, but also some of the dashboards will be blocked in in this case here. Control components are great Many of you have probably tried to do that in the past and have seen a lot of issues around that.16:101st of all, doing it the manual way, 1st the manager, then the the validator and then the controllers at the end. What we have done is created a very nice new automated workflow that 1st of all does a lot of prechecks, so if there's anything under the hood.16:29Not in the right order or not aligned correctly, we will block you from upgrading. Once that once that pre check is done, we will go through the upgrade and run the pre check the post check afterwards to make sure that everything went well and we will do all the control components in order automatically, so it's a one click upgrade process as such.16:44What has come as well is if you are cloud tethered, it's the ability to actually download the SD WAN software directly from CCO by simply just choosing it in the dropdown menu. So you don't have to download it 1st, upload it to the manager. You're gonna have the manager do that directly if you allow it to.17:05So it's a very nice easy way to to do your upgrade as well. It will also check in that pre check for software versions on your devices. So let's say you have a seventeen.fifteen, and then you are running with devices running on seventeen.nine.17:22The edges or similar similar platforms, then you will not be allowed to upgrade to seventeen.oh sorry to twenty.eighteen and you will get a message that you can't because you have these devices associated and you need to to remove those 1st before you can do a a successful upgrade.17:41Patch upgrade as well. It's a beta function. We are trying to make sure that for minor things we can do patch upgrades. Until now, I've not seen it in production. We have it as a function but usually it's a full upgrade every time. But we have the capability to do patches or smus as we have it on the on the software on.18:00Platforms as well.18:20Diagnostics center. That's a very interesting one for those of you who have tried to upgrade and then sit and wait and nothing happens and you're not sure what's going on. So we have added a very lightweight web server in the beginning of the load of the device on the sorry the site. So when it boots up, before all.18:24All the services are up, it will show you this diagnostic center and this bar that loads and show tells you how many services are waiting.18:44And when you log into the diagnostic center, you will be able to see all the system services that you can also see from the CLI, but in a much easier fashion to see what's going on, why is this service restarting over and over again? Oh I need to open a tech case or similar things like that, but gives you more information on where we are instead of just the old picture man.18:52And they just say something is not right. So giving you more information on how things are going when you're reloading or software upgrading.19:12Underlay health visibility. So what we have tried to do here is to get better information into what's going on in the underlay itself. So giving you capabilities of seeing 1st of all alarms for the underlay, but also data plane drops widgets and monitor and overview on how things are going through the box.19:22So you get more visibility into the underlay itself.19:42And we've also added temperature and energy widgets to the main dashboard so you can actually see how devices are operating under those kind of things. N WPI, so network wide wide path insights has been there for quite a while. We have tried to.19:46Evolve it over time with the different releases. What is some of the problems today is that the the auto tasks will support the limited set of of options and and granularity on when they wanted to be started.20:06But now we can actually do more. So what was coming is now we can enhance that, so we can trigger for QS congestions SLA violation events, introduce new auto on test trigger for van loss. So if my van connection fails for whatever reasons start the NWPI trace.20:20So we can get some information about what's going on, how is it working? So a lot of new things there from a triggered perspective and how often you want to do the recurrence of those auto tasks.20:40So for those of you who are using NWI, a lot of new things there. So this slide says all private preview, but the AI system is now GA that came in three weeks back I think. Again, the AI system runs on the side of the SD WAN manager and therefore not attached directly to a.20:52But now it's actually GA and ready to go and you can do these common tasks about 1st of all documentation, but also how is my network running and also manage your tech cases directly through the AI system on the SD WAN manager.21:13Of course you need to have the cloud services enabled with analytics on board as well, because that's where we are taking most of the data at this point. And then we came back to live protect so let me just move on from there.21:28So that was all we had about, usability perspective. Now we're moving into cloud. So what is happening in the cloud space? 1st of all connecting we have enough, but.21:45Before we couldn't connect to an existing TTW, inside the, the cloud on ramp for multi cloud workflow. So we had to make sure it was a greenfield when we deployed all these things. So if you had any sort of extra things already deployed in your network.22:02You needed to skip out of the automation to do things manually. What we are doing now is we have added some of support for connecting the CDW later or discover existing cdws, both supporting the device and featured templates as well as the configuration group, and it's introduced for, for the connect.22:20Based and VPN based approaches for TDW.22:40And there are some minor caveats about things you can't do here SD routing support and branch connect support is not there, there are some other things around we can't discover tbpcs as well as we can't reuse the configuration groups, but basically we have a new thing here for for brownfield.22:44Oh Catalyst 8000 V in OCI. For those of you who might have customers working with that, that's been a big pull, a push for us to get this supported. So now we have officially CAKV supported in the Oracle Cloud infrastructure.23:05We have four sorry two new shapes, the four vcpu with the 16 vcpu, and we have tested it up to approximately ten gig of throughput.23:24There is a terraform script and also a guided video to show how you do it. It's not a part of the cloud on ramp for a multi cloud, but it's a way to install this manually and get it to work with SD WAN within Oracle cloud. Google Cloud performance. So for those of you who were.23:35Customers or yourself are operating in Google. The N one instances are starting to be deprecated and not available in all regions, so therefore we had to take new instances in and verify those. So we are now supporting the M two, which is now supported for the n2-eight and-four.23:55As well as the N4-four and N4-thirty two, which gives you up to roughly ten gig on the on the on the SD WAN side when using the n4-thirty two. It supports both for autonomous and controller mode, and it's for now not supported for the cloud on ramp for multi cloud.24:14Cloud automation, but that will come in a later release.24:34As you can see here, a lot of focus has been on putting new performance or new improvement performance on the CAKV. So we will introduce we have introduced performance enhancements for the AKV on the ESXi and Red Hat.24:39And we have seen that for both SD WAN and SD routing mode, and we will have we have throughput performance improvements across the board from four eight and 16 vcpus. And again depends on the physical infrastructure that runs underneath in terms of how fast we can get.24:55Cloud on ramp free user defined cloud apps. So we introduced a very simple workflow for cloud on ramp for SAS, for sites and configuration for, for, for policy groups.25:17But not for custom apps. So that's what we are closing the gap on here with the twenty.eighteen release. So we can now build custom apps and use that for the cloud on ramp for sass solution. Right now eight apps, Eris is there a problem?25:31Andre is asking if you are sharing, I can see yeah I can see your slides ok I'll continue then. Otherwise, please stop me if something else goes wrong. Okay, so we can now build custom apps and that's our define custom apps.25:51Can use that across the cloud on ramp for SaaS solution and with the with the different capabilities that gives us.26:10Moving on to the security part of the house, we have added and and here was it gets a bit tricky. We have added a few new integrations over the last six months. 1st of all is the SD WAN manager and security cloud control integration or SCC four.26:19Firewall and here where it needs to be very strict on what I'm saying. So with the firewall integration of SCC, we're able to build and define firewall policies in security cloud control that can be pushed to firepower or to the SD WAN manager or to multi cloud defense.26:39What has been explored further than that is integration into Cisco secure access or what we now call sassy management, which is not tied to a specific release as such, but that's a more cloud approach for where SD WAN goes on. I'll take that at the end, but that's just to make sure.26:58Sure that you understand there are multiple ways of doing this and we get different value out of each. But what I'm showing here on this slide is for the firewall rule set that is now able to be managed from the security cloud control. The use case has been if the customer has both firepower and wants to start using security on the SD WAN.27:18Manager site, the security team would have one place to manage their security rules and didn't have to learn the SD WAN manager and how to go in there. They could simply define rules and when whenever the networking team has built the integration, they can define the rules where they used to do and then use it across the different platforms.27:38We have added, let's just fill out the slide. So one of the things that has always been a pain for us from an SD WAN manager perspective historically has been how to log all these security events that we can enable on the platforms.28:00With twenty.eighteen, we now have the historical traffic locking where we are using the analytics engine as well to gather all the high speed locking from the devices and then put it into the analytics engine and give you a way to search through what's going on.28:17So we can do, provide this centralized log visi virtualization and then do custom time filtering across multiple devices and sites and therefore give you a better visibility into what's going on.28:3324 exports per 24 h and one request at a time across the system. That's the only limitations we have for now at least. IPS, so we've had IPS for quite a while. One of the things that have been lacking has been the way to do.28:49To custom signature sets. So what we introduced in twenty.eighteen is the pre packet max detect signature set, and we can then visualize and browse the signatures and rules inside a signature packets.29:08We could also do NO rules active signature set can be used as a base for completely customized feature set, and then we can override on a group level as we see fit. So that's some of the ways we can tune the ideas, IDS to to the specific needs. So yeah, that's a new feature in 20.29:25About 18 as well.29:44On the security control perspective for the the UI side, one of the major things that has been a pain for security customers on the twenty.fifteen side was that we couldn't do any rollback or version control on the security policy itself.29:48So whenever someone did a change, fine hopefully they had documented and pushed it out. But if I wanted to go back because for whatever reason it didn't work, I need to know what have I changed in the previous push and then need to manually roll back.30:05With twenty.eighteen that is now gone. We can have up to 30 rollback versions supported inside the same policy which means whatever I do I can always go a step back or four steps back or five steps back if that's what I need. I will be able to compare the different things between the two policies.30:21What do I want to change now? What have I changed? So I know what's going on and and we have a capability of of rolling that back and make sure that we have different versions running on that side.30:40Mike, is there any questions we need to cover verbally at this point? No, I tried to answer any questions in the chat, so perfect. Just want to for a second.30:53Are you done with all the features? No, NO NO. We have more features to come it was a good time to take a full stop here and just make sure we'll on into infrastructure and services. So on the infrastructure and services side, we will get into some of the more.31:11You can say nitty gritty details of things that are coming into the platform. 1st up if is QoS queuing statistics. So one of the ways we have been able to see that has only been in the interface level on the device three 60 page.31:30And if a class had a policy, we couldn't see the queuing monitoring displayed on those classes, so it was quite hard to monitor your QS statistics as such. We do now support that queue monitoring for both interface level and tunnel level. We have included policy policy and support for the interface level visibility.31:47And we are introducing a new tunnel level visibility for each of the endpoints for both queuing and policing.32:07It's only supported on SD WAN mode and it's more max four K per tunnel session where that will be displayed. And only supported is bandwidth priority red and policy policing.32:14OSPF V three IPsec authentication. OSPF V three authentication is a leg legacy feature that protects the OSPF V three routing payload with an IPsec encryption and hashing. That has not been there in the in the early releases so it's a common standard now.32:31And we haven't been able to do that or we won't be able to do that without the authentication enabled on the on the.32:50On the peering. So with the new solution, we now support that OSPF free authentication both for IPV four and V six. We support the share one authentication algorithm and bridging that parity gap with autonomous mode where we have had it for quite some time.32:59For the caveat side, it's only supported on the interface level for IPsec authentication using UX two point oh and one point O and only authentication is supported not encryption, so that's the way it has to be for now.33:17System IP hardening, we have in the past, you might have tried that as well, have a device that was just coming up from a legacy perspective and had some old conflict that suddenly had a duplicated system IP.33:32We are now doing some more checks and balancings to ensure that when those duplicate system IP conditions are rises, they do not have any impact. So the the SD WAN manager make sure to whatever you push out to validate that that manager or that IP is not used, and.33:48Basically trying to avoid that session to, to occur.34:08Remember I talked about the resilient infrastructure program. That was started post seventeen.one where we brought out this feature where a specific customer said, I want to make sure Telnet is NO longer able to be configured on my box. So that's what we have with the telnet disabled capability.34:17Ability that came out here.34:37So basically you can run that command and make sure that Telnet is disabled completely from the, from the device. But succeeding with resilient infrastructure Telnet will be deprecated in an upcoming release, so you can say this is a band aid to begin with and then it will be re revoked and removed later on as well.34:38T logs to SP mapping so one of the issues with colors is that that's a, you can say uniform name or logical name, but it might not make you know if you have multiple MPLS providers. Am I using MPLS with Verizon or am I using.35:04To Ethernet with AT and T or whatever I'm doing. So what we are trying to do is here to give you the capability of adding.35:24A name to the T block. So if you have private one, private two, private three, you can actually say this is provider one, provider two, provider three as well. So you have that color description, which should make it easier for that mapping when you need to have the different show commands and make sure that you, you can see.35:31What's going on inside the network. Just be mindful, it's only CLI when you do the show commands directly on the box. It will not show up in any reporting or anything else like that at this point in time.35:51Okay, here's the behavior change for those of you who have been using controller affinity before. It was in previous releases the way that.36:03If you configured a controller group on a device, and that controller group disappeared, the device will just look up and say, oh, where's there another controller group and join that, even though that was not what I wanted.36:20So what we have seen is you can say cascading events, a controller group crashes, all the devices that were served by that controller group suddenly goes to the next controller, which was already running on the edge because it had so it serves a ton of other sites. So suddenly that controller's group crashes.36:34And then the full pile of devices stopped moving on to the last controller group which eventually means that crashes as well. So to avoid those kind of things, we have changed the default behavior, so we will not just let the device connect to the next controller group. It will go to the controller group that it's configured, and then if that's.36:54Gone for whatever reason, we will remain headless.37:14Until you do something differently, but that makes it more controllable and not just ronduring around and saying, well, my controller will not there, now go over here and just fill up. So, so that's the behavior change. So if you have controller groups configured, just be mindful of the changes that comes in seventeen.eighteen.one on that part.37:17Those of you who are using private certificates or enterprise certificates knows that it's a hassle to manage all of those certificates going back and forth. You need to do it manually, and it's quite time consuming every time you need to renew it. Fiena.37:38We now have support for SCAP and secure transport with EST, so you can automate that part as well. So automated certificate management that will greatly mitigate and all these issues about streamlining and managing the certificate manually.37:54But also doing the enrollment insecurely to automate the process of managing all these enterprise certificates. There are some gaps and limitations. I'll let you yourself read them afterwards, but basically that is what we get from from here on now.38:09Yeah main major change, I would say from an API perspective, until now we have been using, you can say a session based approach on on how we can go in and use the API stack on the SD WAN manager.38:26We are flipping to the JW or JSON web token approach, which is today now that the facto standard for most API resources, so that's now also on the SD WAN manager. If you're on a cloud hosted environment, you will generate your token within your user profile. If you are on a classical.38:43Environment you will do the same, but you will have another endpoint to reach.39:04But basically we're switching from a user context with the username and password to a token based approach instead. It removes a lot of tension on the SD WAN manager and therefore scales better with more and more APIs going in and calling on the SD WAN manager side.39:08So that's, that's a good thing to know if you have built your own automation or anything else around that. It's fully documented in the API guides and also how to connect to the different platforms. So feel free to go in and read on the documentation on the developer.cisco.com for that.39:24Yeah on the UX two point oh side, more updates I would say. So one of the things that we were lacking in the in the early releases on the firewall rule set and object group.39:39Was the capability of using in the right way in the UX two point oh. So we now provide commensive support for rule sets and object groups and IPV six support. We can collect the rules that have been created and wants to use them in multiple rules across the different policies, and we can use object groups and and policy management to.39:57Prove all this.40:17So so that's some of the things that has come in. I think this came in 20 as well. Another new thing is when you're looking at sassy or Cisco Secure Access, we have two main use cases in 20.40:19Seen the normal secure internet gateway came out.40:38Which gave you the capability of securing devices behind a branch to go out to Cisco secure access or any other SASE provider and then being secured by that cloud instance of of security. What we didn't have was the opposite direction where you have a customer or user that has a VPN client on their device.40:41Device wants to connect to the cloud, but then through the cloud get connected back through the SD WAN fabric to your home based or or private apps hosted behind the SD WAN fabric. We now have that with twenty.eighteen.two so you can have that traffic going the other direction.41:01Works in the similar fashion, but we are enabling BGP on the on this on on the device between Cisco secure access and the device to exp export the routes. So secure access knows where to go when you connect your VPN client.41:20It works quite well and it's fully automated now. So we we have that working with twenty.eighteen.two. Moving on to more routing features. So some of these features are for autonomous mode as well, so I'll try and highlight those when.41:36When we come along.41:55So for those of you who are working a lot with IPV six, we have been having a challenge with map T and handling how we can do these things between V four and V six. So map T is now supported from a CPE to CPU use case.41:58Using this new feature.42:16It's supported on the specific platform mentioned here and not any others, so be wareful for that when needed. SRV six, SRV six is being, you can say more and more developed on the IRS xe side to fit into you can say more service provider.42:20Network where the secure routers will act up as CPEs or PEs to some extent, and so therefore we are evolving the SRV six support.42:39So we can now support the, we have these new features on the right. You can say flex algorithm, MVPN and two discovery designs, but also the SRV six policy that can be distributed across. So that is the the new.42:49Sort of feature set on the RS XE side. Those of you who have bought the UCP, I'm not sure how many of you who have done that, we now support virtual rate and selected new name modules for that platform. We'll not spend a ton of time on this because I'm exp.43:06Expecting that not many of you have bought this platform, but just for your information, it's there.43:26This one is more interesting as we see more and more cellular, so cellular serviceability and debuggability enhancement addresses that we can now get the locks collected from a central point. We don't have to go in and do it locally on the box so we can generate admin check files for cellular gateways.43:34And get all the information that we need for, for tech cases. Before that was a bit of a hassle to do that manually on the box itself.43:54So voice on the secure routers, I hope you have learned a lot about the secure routers already. One of the things that is not there on the on the modules themselves is PVDM. So we are replacing PVDM to the with the virtual DSP technology in.44:07Step, so we are moving it from the physical hardware into a software component on the box itself. That's the blessing of having faster hardware and more powerful hardware is that we can remove functions from, from one other side to the other.44:27So, we can enable dynamic allocation scaling of these few resources and software and remove or improve the scalability and flexibility and we remove the reduces at least the operational expense by having modules that you need to move around. It's supported on.44:41The main or the larger platforms of the G twos, and it's in autonomous mode only at this point. There's NO support for NO SD routing yet. You need to be in service playing heavy mode and you need to have the right licenses to to make it work.44:59So that's, that's for the side of the house at least. Now we're getting into a very nerdy detail here. So SRMPLS and IPv six still for enhancement for critical network infrastructure. So customers that are operating some of those networks.45:17They usually require the ability to deploy SR MPLS with from one side to another, which is currently not supported. So basically we are adding that support with the IPv four GRETP tunnel as protected link.45:37With OSPF and isis, and we can also do it with V six with isis or the TILFA solution here. Then we have done a lot of scale enhancements and testing there.45:54So the on these platforms here, the old scale was ten K of tunnels.46:13And now we can push it all the way up to twelve K tunnels across these large platforms and then a few more enhancements on the map T side. I think this is the same slide that's been repeating. So let.46:18Let's just skip that for now. Yeah, there's some duplicate slides here. Sorry for that. Mike, any questions for now? Nope, there is a one question about converting the template to conflict group. I'm just looking for the documentations of conversion two.46:38Yes, good question. So we have, there's two ways of doing it. From a configuration perspective, you can either say, oh, I don't want to keep all my stuff that I've been doing for the last eight years. I've learned a lot. I will take the chance to actually start from scratch.46:56Taking the knowledge that I already have learned and then move into the configuration groups by just building it out from scratch. Or you can use the migration tool that is hosted on SSP, so go into sSP.STWAN.cisco.com, sign in with your CTO credentials. Then in the bottom left corner, you will see.47:15Conversion tool, click there.47:36Either you can connect it directly to your manager if your manager is exposed to the internet. If it's behind cloud or any other sort of white list, there is a specific IP you need to whitelist, it's shown directly in the portal as well. Or if you don't want it to connect directly to your manager, you can export your templates.47:38Put them into the configuration tool, then it will convert it and push back with your configuration groups you can then import into the manager. So, so that's the the easy way of going around that part. It can convert your templates as well as your policy.47:57But of course there are tons of ways of things of, of how customers have configured their network and therefore they, they, there might be some bugs here and there. So there is also support mailer where you can write if you're running into any issues as such.48:13But it's there and it's been there for quite a while and it's heavily used. I'm just returning from Cisco Live where we had a lab with 30 customers doing a lot of configuration group assignments but also trying out the conversion tool. So it is it's out there and well used.48:30Talking about configurations and configuration groups and device templates. If you haven't started already, I will sincere in trying to you to start using the configuration groups at least familiarize yourself with them because that is the way to go moving forward.48:50Any of the new boxes are only supported on on the configuration group side. Any other questions Mike? You're talking on mute, so I can't hear you.49:08Alright, so yeah, that's the tree. There should be an AI feature to unmute you when you're talking but anyway, so not necessarily any other specific questions but there were a couple of questions about the light protect that they tried to answer. Light prote.49:29It is very, interesting concept and this is one of the ways that Cisco tries to address a lot of concerns about the new wave of the vulnerabilities and pieces that might be introduced by AI and especially new AI frontier models like Mythas.49:47So for sure like can help Cisco and Cisco is I think the only vendor out there that introduces such a capability, you know, for the enterprise and for the infrastructures, for the networking infrastructures. I haven't seen any other networking vendor to have such.50:05Capability.50:25And that's one thing, one point that I wanted to mention at the end of this presentation is seventeen.eighteen and twenty.eighteen is the last release of the previous cycle of how we were releasing the new images for the routing and.50:26So the historically the way that we were releasing software was three releases in a given year, which two of them were like short lived release, new features were introduced, but those releases are not supported more than one year and their last release of any given year we.50:46Which was going to be like in August similar to twenty.eighteen seventeen.eighteen was the long live release that we supported for like more than five years.51:06Moving forward, 1st of all, the numbering will change. It will have like two releases per year and the 1st two digits of the release represents the year and 2nd digit represents the number of release in that year, like 2061 and 20 six.two.51:16E.g., other releases in 26, in 2026 here and both of them will be long leave released supported. So I think Lars is bringing up a slide deck representing how these will change. One of the major changes is, as I said.51:34Both of them are long leave released.51:54So you are not logged into just one release in a given year for supporting long live releases and you can see the extensions of the end of life and of support and end of vulnerability support for those images. And that's across the board that we are changing naming. So you will see 2nd.51:56On catalyst switches, on catalyst wireless, as well as on Meraki MX. So it will be across the board that we are changing numbers in that sense.52:17Yeah, there is a question about which models start to support thousand eyes. Thousandeyes is supported on almost all models that are supported in the SD WAN. I'm not aware of any model that doesn't support thousandeyes in the SD WAN. So the rule of thumb is eight gig of memory, then you should.52:30By default have support for thousand eyes. And if you haven't explored in twenty.sixteen, I believe we brought a new automation workflow, so you can say if you've seen what is on twenty.fifteen and you're now seeing twenty.eighteen, we could have put that in as well. But there's a new automation workflow that is much more.52:48Seamless than what it was before. So you can actually go in, select.53:08The device you want to onboard thousandeyes, you can actually just put tests enabled tests directly inside the don't even have to go to the thousand eyes dashboard to deploy your common agents as such. So, so there's a lot of details there as well. I would love to you for for you to explore more when you get that.53:12The I can see there was a question around the 8200 did not support it. So if we start the 8200 L, you're correct, the 8201 N4T or whatever it's called, it should have it you're right.53:43Any other question? Yeah, and if you have any verbal questions, feel free to raise your hand and then we will on mute Julie if that's easier. Don't be scared. We won't bite.54:11Oh, right, I think if there is.54:23Any other question Lateris and the rest of the team?54:43Are there for you? You can reach out to them and if they need more help from BU, we are always here to support you guys. Yeah, probably this is the right time to ask.54:49Topias is asking about the like NWPI tools so for the to read, different commands, they need the right access and he's asking if it's.55:04I need to check. I've just read the question here to be honest, thank you for the question 1st of all, what you're asking for is more granular support for MW as I read it, so I have to circle back with you, I can't remember on the top of my head where the knobs are set. I think you're right that it is full or nothing, but but.55:21Let's see what we can do there. Should we explore more? Yeah. And there is another question. Can you elaborate regarding the analytics licensing? Yes, so analytics always has been sold and positions as part of the advantage license.55:41And even though the licenses are per device analytics is the fabric level capability, meaning that you know in in an environment that you have a mix of essential and advantage, essentially you are not entitled to use the analytics because it is not selectively for devices. You cannot still use it, nothing actually.56:00Prevention. Now, the main part is to be able to use like different capabilities within the analytics. Currently analytics from twenty.fifteen onwards is embedded into the SD WAN manager. They are not like completely two separate products anymore.56:20So under there are some widgets that are completely served out of the analytics engine, and those widgets are liked until you have at least one advantage license in the network. But even having one advantage license in the network, even though it gives you the analytics capability.56:38From the entitlement perspective, you are not subject to use that and you will be out of compliance from the licensing perspective. But still, you can see the widgets and the other capabilities for some of the widgets, the length of the data that you can see if you don't have advantage license in the network.56:56It is limited to seven days. But when you have an advantage license in the network, it will be increased up to 30 days for those widgets. So these slides.57:14I think it is not publicly available. We can essentially you know pass it to the team and if posting, yeah we'll be posting the video link to the EI session page.57:31Yeah, that will be one of the resources that is externally available. Okay.57:50Does anyone have any other questions?58:25Okay guys, thank you for joining us and once I'm closing the webinar, you will get like a feedback or a survey, please feel it will help us to understand what are your needs on for other like topics in the future.58:36Thank you, Lars. Thank you Mike. I appreciate your help today. Thank you. It's a pleasure.58:52