Contents

Introduction

Prerequisites

Requirements

Components Used

Configure

Pre-checks

Home Page Actions

Groups

Group to Group Communication

Multiple Groups to Multiple Groups view.

Single Group to Multiple Groups View

Single Group to Single Group View

Reports

Related Information

Introduction

This document describes the Cisco DNA Center Group-Based Policy Analytics tool basic concepts.

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

- Cisco UCS M4 or M5 appliance, 44, 55 or 112 cores

- Cisco DNA Center software

- Cisco Identity Service Engine (ISE)

- Group-Based Policy Control

Components Used

The information in this document is based on Cisco DNA Center running release 2.3.5.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Configure

Pre-checks

Check 1. You must enable NetFlow to use Cisco Group-Based Policy Analytics. This table shows the various ways in which NetFlow can be enabled on different network devices.

Table 1.Device Support

Network Devices

Series

NetFlow Configurable in telemetry section of Network Settings in Cisco DNA Center UI (Flexible NetFlow or Application Visibility and Control Based NetFlow)

NetFlow Configurable using the template hub tool in the Cisco DNA Center UI (Flexible NetFlow or Application Visibility and Control Based NetFlow)

NetFlow Collection in Fabric Deployment

NetFlow Collection in Nonfabric Deployment

Routers

Cisco 1000 Series Integrated Services Routers (ISR1K)

Yes

Yes

Yes

Yes

Cisco 4000 Series Integrated Services Routers (ISR4K)

Yes

Yes

Yes

Yes

Cisco Cloud Services Router 1000v Series (CSR 1000v)

Yes

Yes

Yes

Yes

Cisco 1000 Series Aggregation Services Routers (ASR1K)

Yes

Yes

Yes

Yes

Switches

Cisco Catalyst 9200 Series

Yes

Yes

Yes

Yes

Cisco Catalyst 9300 Series

Yes

Yes

Yes

Yes

Cisco Catalyst 9400 Series

Yes

Yes

Yes

Yes

Cisco Catalyst 9500 Series

No

Yes

Yes

Yes

Cisco Catalyst 9600 Series

No

Yes

Yes

Yes

Cisco Catalyst 2k Series

No

Yes

NA

Yes

Cisco Catalyst 3560 Series

No

Yes

NA

Yes

Cisco Catalyst 3650 Series

No

Yes

Yes

Yes

Cisco Catalyst 3850 Series

No

Yes

Yes

Yes

Cisco Catalyst 4k Series

No

Yes

Yes

Yes

Cisco Catalyst 6500 Series Switches

No

Yes

Yes

Yes

Cisco Catalyst 6800 Series Switches

No

Yes

Yes

Yes

Wireless Controllers

Cisco 3504 Wireless Controller (AireOS-Based)

Yes

Yes

No

Yes, only central switching SSID

Cisco 5520 Wireless Controller (AireOS-Based)

Yes

Yes

No

Yes, only central switching SSID

Cisco 8540 Wireless Controller (AireOS-Based)

Yes

Yes

No

Yes, only central switching SSID

Cisco Catalyst 9800 Based Controller

Yes

Yes

Yes

Yes

Check 2. Make sure that you Network Devices has Cisco DNA Advantage or Cisco DNA Premier license enabled.

Check 3. On Cisco DNA Center GUI navigate to System > Software Management > Currently Installed Applications and confirm that the Group-Based Policy Analytics application is installed.

Group-Based Policy Analytics application installed

Check 4. Cisco ISE needs to be integrated and Available over ERS and PxGrid with Cisco DNA Center. Confirm on System > System 360.

Home Page Actions

On Cisco DNA Center GUI navigate to Policy > Group/Based Access Control.

Group-Based Access Analytics Home Page

In this page you can find:

1. Title box - Click it to navigate to the Scalable Groups communication flow.

2. Search bar - Helps out to filter on any group type, filter can be done by IP address or MAC address.

3. The Favorite icon - Shows the recent or saved searches.

4. Configuration icon - Shortcut to either Policy settings or Analytics settings,

The tile boxes show the unique traffic flow counts for the past 14 days for Scalable Groups, ISE Profiles and Stealthwatch Host Groups (If configured).

A unique traffic flow is defined as traffic with a unique protocol and server port (like TCP port 80 or UDP port 123)

As the example, if Stealthwatch is not configured, that tile box is not going to be shown.

Groups

Network visibility is shown for these three types of groups.

1. Scalable Group (SG). Known as Security Group in ISE and TrustSec group in routers, switches and WLCs

2. ISE Profile.

3. Stealthwatch Host Group (HG).

Group to Group Communication

Groups communication can be separated in three levels:

1. Multiple Groups to Multiple Groups (many-to-many)

2. Single Group to Multiple Groups (one-to-many)

3. Single Group to Single Group (one-to-many)

Click on the Group of your preference and the flow view is presented, on it the Source is always on the left-hand side and Destination is always on the right-hand side. The first view presented is the Multiple Groups to Multiple Groups.

The flow view is a Sankey Diagram which is a type of flow diagram in which the width of the arrows is proportional to the flow rate of the depicted property.

Multiple Groups to Multiple Groups view.

Flow chart for Scalable Groups

In this page you can find:

1. Search bar - You can filter the Source groups.

2. Talking to option - Only if the source is a scalable group you can choose the destination group type.

3. Time range - Click on it to change the date and time range. The range can be 1 hour, 12 hours or 24 hours.

4. Switch tool - Switch between the Flow view and the Table view.

5. Source Group - Click on a group to drill down to the Single Group to Multiple Groups view.

6. Link - Hover over a link and click it to drill down two levels and end up in the Single Group to Single Group view.

Note: The Multiple Groups to Multiple Groups view shows the top 25 source groups with the most flows.

Table view for Multiple Group to Multiple Group

Tip: Yo can always expand the range to see more than the first 25 entries.

Single Group to Multiple Groups View

In this view the flow chart can be shown in Outbound and Inbound options.

Outbound view shows a source group communication with all the destination groups you talks with.

Outbound single group to multiple groups view

Inbound view shows all the source groups communicating with a single destination group.

Inbound view for single group to multiple groups

In this page you can find:

1. Search bar - Enter a value to filter the Destination groups if Outbound, and the source groups if Inbound.

2. Communicating with option - Only if the source is a scalable group you can choose the destination group type.

3. Time range - Click on it to change the date and time range. The range can be 1 hour, 12 hours or 24 hours.

4. Switch tool - Switch between the Flow view and the Table view.

5. Navigation path - Click on any level of the path to move along it.

6. Link - Hover over a link and click it to drill down one level to end up in the Single Group to Single Group view.

7. Inbound | Outbound selector - Select the direction of traffic.

8. Create Report and Download Report -  Export data from this page to create a report or download a previously created report.

9. Group - Select a new Source Group.

10. Pagination - Move to the previous or next page or change the number of records per page.

Single Group to Single Group View

On this view the you can see a source group communication with a destination group.

In this page you can find:

1. Time range - Click on it to change the date and time range. The range can be 1 hour, 12 hours or 24 hours.

2. Switch tool - Switch between the Flow view and the Table view.

3. Navigation path - Click on any level of the path to move along it.

4. Arrow icon - Click on it to swap the Source and Destination groups.

5. Filter - Filter per column.

6. Find - Filter on all existing data.

7. Create Report and Download Report -  Export data from this page to create a report or download a previously created report.

8. Pagination - Move to the previous or next page or change the number of records per page.

Reports

Export data is available for:

- Any Group to Group Communication table

- IP/MAC address

Report options

Tip: Report section is not available for read-only user role.

Related Information

- Cisco Technical Support & Downloads