Step 1

From the main menu, choose Provision > Zero-Trust Overview.

Step 2

Under Explore and start your journey to SD-Access Zero-Trust Workplace, do these steps:

1. For Network Connectivity settings, choose the required options:

   • Enable With Wireless to use wireless devices in your zero-trust workplace journey.

   • Enable With CAT9K to use Cisco Catalyst 9000 Series devices or enable With Traffic Telemetry Appliance to use the Catalyst Center Traffic Telemetry Appliance in your zero-trust workplace journey.

2. For Services settings, choose the required options:

   • Enable With ISE to use Cisco Identity Services Engine in your zero-trust workplace journey.

   • Enable With Talos to use Talos Intelligence in your zero-trust workplace journey.

   • Enable With CBAR Enabled to use Controller-Based Application Recognition (CBAR) in your zero-trust workplace journey.

3. (Optional) To view details about each recommended step in the journey map, hover your cursor over the corresponding step around the journey map.

Step 3

Under I’m Done Exploring and Ready to Start My Journey, choose one of these options:

• To create a fabric network and start your journey towards a zero-trust workplace, click Start my journey with creation of network fabric.

• If you already have fabric network connectivity and want to start your journey towards zero-trust workplace with endpoint visibility, click I already have connectivity and want to start with Endpoint Visibility.

Step 4

Click Start My Journey.

Step 5

In the Modify Journey Map dialog box, do these steps:

1. Review your journey map settings.

   Note	Catalyst Center displays a message if it doesn't discover the selected services for your network. Catalyst Center displays a message if it discovers additional services that were not selected in the journey.

2. (Optional) To remove a selected service from your journey map settings, uncheck the corresponding check box.

3. Click Confirm.

Step 1

From the main menu, choose Provision > Zero-Trust Overview.

Step 2

Under Your Journey Map, click Modify My Journey.

Step 3

Under Explore and start your journey to SD-Access Zero-Trust Workplace, do these steps:

1. For Network Connectivity settings, choose the required options:

   • Enable With Wireless to use wireless devices in your zero-trust workplace journey.

   • Enable With CAT9K to use Cisco Catalyst 9000 Series devices or enable With Traffic Telemetry Appliance to use the Catalyst Center Traffic Telemetry Appliance in your zero-trust workplace journey.

2. For Services settings, choose the required options:

   • Enable With ISE to use Cisco Identity Services Engine in your zero-trust workplace journey.

   • Enable With Talos to use Talos Intelligence in your zero-trust workplace journey.

   • Enable With CBAR Enabled to use Controller-Based Application Recognition (CBAR) in your zero-trust workplace journey.

3. (Optional) To view details about each recommended step in the journey map, hover your cursor over the corresponding step around the journey map.

Step 4

Under I’m Done Exploring and Ready to Start My Journey, choose one of these options:

• To create a fabric network and start your journey towards a zero-trust workplace, click Start my journey with creation of network fabric.

• If you already have fabric network connectivity and want to start your journey towards zero-trust workplace with endpoint visibility, click I already have connectivity and want to start with Endpoint Visibility.

Step 5

Click Modify My Journey.

Step 6

In the Modify Journey Map dialog box, do these steps:

1. Review your journey map settings.

   Note	Catalyst Center displays a message if it doesn't discover the selected services for your network. Catalyst Center displays a message if it discovers additional services that were not selected in the journey.

2. (Optional) To remove a selected service from your journey map settings, uncheck the corresponding check box.

3. Click Confirm.

Step 1

From the main menu, choose Workflows > Create Layer 3 Virtual Networks.

Step 2

If the task overview window opens, click Let’s Do it to go directly to the workflow.

Step 3

In the Layer 3 Virtual Networks window, do these steps:

1. In the Layer 3 Virtual Network name field, enter a name for the Layer 3 virtual network.

2. (Optional) To create another Layer 3 virtual network, click the plus icon () and enter a name for the Layer 3 virtual network.

Step 4

In the Fabric Sites and Fabric Zones (Optional) window, do this configuration:

1. Click Select Fabric Sites and choose the fabric sites.

   You can assign a virtual network to multiple fabric sites. To choose the fabric sites, do one of these tasks:

   • Click the plus icon () next to the required fabric sites.

   • Click the fabric site name and click Add Selected.

     Note	To choose multiple fabric sites, press Shift, click the fabric site names, and click Add Selected.

   • To choose all the fabric sites, click Add All.

   Repeat this association for all the Layer 3 virtual networks that you created.

2. Click Assign.

3. Click Select Fabric Zones and do one of these tasks:

   • Click the plus icon () next to the required fabric zones.

   • Click the fabric zone name and click Add Selected.

     Note	To choose multiple fabric zones, press Shift, click the fabric zone names, and click Add Selected.

   • To choose all the fabric zones, click Add All.

4. Click Assign.

Step 5

Review the Layer 3 virtual network settings in the Summary window.

Step 6

Schedule the task for deployment.

Step 7

On the Tasks window, monitor the task deployment.

Step 1

From the main menu, choose Workflows > Create Layer 2 Virtual Networks.

Step 2

If the task overview window opens, click Let’s Do it to go directly to the workflow.

Step 3

In the Configuration Attributes window, configure the required Layer 2 virtual network attributes.

1. In the VLAN Name field, enter the VLAN name.

2. In the VLAN ID field, enter the VLAN ID. The valid range for VLAN ID is from 2 through 4093.

   Note	The VLAN IDs from 1002 through 1005 and 2046 are reserved VLAN IDs.

3. From the Traffic Type area, choose Data or Voice.

4. Check the Fabric-Enabled Wireless check box to enable wireless.

   The Layer 2 Flooding check box is enabled by default for a Layer 2 virtual network.

5. For Layer 2 Flooding, you can choose the flooding address type and assign a custom flooding IP address, if required.

   • Flooding Address Assignment: Choose Shared or Custom.

   • Flooding Address: If you chose Custom, enter a flooding IP address for the Layer 2 flooding—the supported IP address ranges are 239.0.0.0/8 for IPv4 and FF30::/96 for IPv6. You cannot edit the flooding address for a Shared address type.

   Layer 2 Flooding is supported on anchored and inherited virtual network in these ways:

   • If Layer 2 Flooding is disabled on anchored virtual network, it is disabled on inherited virtual network as well.

   • If Layer 2 Flooding is enabled on anchored virtual network, it can be enabled or disabled on the inherited virtual network. If it is enabled, the flooding address assignment type and the flooding address must be same as the anchored virtual network.

6. Check the Flood Access Tunnel check box, to enable flood access tunnel. It is enabled by default for a Layer 2 virtual network if Fabric-Enabled Wireless is enabled.

7. Check the Resource Guard check box to block the SSDP traffic in the fabric.

8. To add another Layer 2 virtual network, click the plus icon () and repeat 3.a to 3.d.

Step 4

In the Fabric Sites and Advanced Attributes window, choose a fabric site for the Layer 2 virtual network from the Fabric Sites drop-down. Optionally, you can follow these steps to choose the fabric zone to associate with this Layer 2 virtual network:

1. Click Select Fabric Zones and choose one of these options to add the fabric zones:

   • Click the plus icon () next to the required fabric zones.

   • Click the fabric zone name and click Add Selected.

     Note	To choose multiple fabric zones, press Shift, click the fabric zone names, and click Add Selected.

   • To choose all the fabric zones, click Add All.

2. Click Assign.

Step 5

(Optional) In the Fabric Sites and Advanced Attributes window, click the Advanced Attributes toggle button on to associate a Layer 3 virtual network to this Layer 2 virtual network.

Step 6

In the Summary window, review your Layer 2 virtual network settings.

Step 7

Schedule the task for deployment.

Step 8

On the Tasks window, monitor the task deployment.

Step 9

After you see a success message, click View Anycast Gateway to verify the gateway creation.

Step 1

From the main menu, choose Provision > Virtual Networks.

Step 2

Under SUMMARY, click the number that indicates the count of Layer 3 Virtual Networks.

Step 3

In the Layer 3 tab, check the check box next to the Layer 3 virtual networks for which you want to edit the fabric site association.

Step 4

Hover your cursor over More actions, and choose Edit Fabric Site and Fabric Zone Associations.

Step 5

In the Fabric Sites and Fabric Zones (Optional) window, do this configuration:

1. Click Select Fabric Sites and choose the fabric sites.

   You can assign a virtual network to multiple fabric sites. To choose the fabric sites, do one of these tasks:

   • Click the plus icon () next to the required fabric sites.

   • Click the fabric site name and click Add Selected.

     Note	To choose multiple fabric sites, press Shift, click the fabric site names, and click Add Selected.

   • To choose all the fabric sites, click Add All.

   Repeat this association for all the Layer 3 virtual networks.

2. Click Assign.

3. Click Select Fabric Zones and do one of these tasks:

   • Click the plus icon () next to the required fabric zones.

   • Click the fabric zone name and click Add Selected.

     Note	To choose multiple fabric zones, press Shift, click the fabric zone names, and click Add Selected.

   • To choose all the fabric zones, click Add All.

4. Click Assign.

Step 6

Review the Layer 3 virtual network sites on the Summary window.

Step 7

Schedule the task for deployment.

Step 8

On the Tasks window, monitor the task deployment.

Step 1

From the main menu, choose Provision > Virtual Networks.

Step 2

Under SUMMARY, click the number that indicates the count of Anycast Gateways.

Step 3

In the Anycast Gateway tab, click Create Anycast Gateways.

Step 4

If the task overview window opens, click Let’s Do it to go directly to the workflow.

Step 5

In the Layer 3 Virtual Networks window, select one or more virtual networks to add a gateway.

Step 6

In the left pane of the Configuration Attributes window, choose the Layer 3 virtual network for which you want to create the anycast gateway and configure the required attributes.

1. From the IP Address Pool drop-down list, choose an IP address pool.

2. For INFRA_VN, configure these attributes:

   • Choose AP or Extended Node from the Pool Type drop-down list.

   • Enter a valid VLAN Name or check the Auto generate VLAN name check box.

   • Enter a custom VLAN ID for the virtual network.

   • Check the Supplicant-Based Extended Node Onboarding check box to onboard a supplicant-based extended node.

     Note	This check box is active only when you choose the Extended Node pool type.

   • Use the Enforcement check box to enable or disable the enforcement of group-based policy for your network. By default, the Enforcement check box is checked.

     Note	The option to disable the enforcement of group-based policies can be useful while onboarding devices in networks that have a default policy set to deny. The Enforcement option won’t be available after the check box has been unchecked.

3. Check the IP-Directed Broadcast check box to enable the IP-Directed Broadcast feature.

   Note	When you enable Directed Broadcast, Catalyst Center automatically enables Layer 2 flooding. Routers and Cisco Nexus 7000 Series Switches don’t support Directed Broadcast. Before enabling Directed Broadcast, ensure that you have enabled underlay multicast.

4. Check the Intra-Subnet Routing check box to enable the intrasubnet routing.

   Note	When you enable intrasubnet routing, Catalyst Center automatically disables the Fabric-Enabled Wireless and Layer 2 Flooding check boxes.

5. Check the TCP MSS Adjustment check box and input the required value to customize the TCP maximum segment size (MSS) value for the anycast gateway.

   TCP MSS Adjustment value can range from 500 to 1440. TCP MSS Adjustment value is applicable for the TCP sessions over both IPv4 and IPv6.

   TCP MSS Adjustment value is applied to all the anycast gateway switched virtual interfaces (SVIs).

6. Enter a valid VLAN Name or check the Auto generate VLAN name check box.

7. Enter a custom VLAN ID for the virtual network.

   Note	VLAN IDs 1, 1002-1005, 2046, and 4095 are reserved and can’t be used. If you don’t provide a custom VLAN ID, Catalyst Center generates a VLAN ID in the range of 1021–2020.

8. Choose Data or Voice from the Traffic Type area.

9. From the Security Group drop-down list, choose a security group.

10. Check the Critical VLAN check box to include this IP pool in the critical IP address pool.

    A critical pool is used for closed authentication profile when an authentication server isn’t available. A critical VLAN is assigned to the critical pool and all unauthenticated hosts are placed in the critical VLAN in the absence of an authentication server.

    Note	When you enable critical VLAN, Catalyst Center automatically generates the VLAN name.

11. Check the Resource Guard check box to block the SSDP traffic in the fabric.

12. Check the Fabric-Enabled Wireless check box to enable this IP pool as a wireless IP address pool.

13. Check the Layer 2 Flooding check box to enable Layer 2 flooding.

    Note	Layer 2 flooding requires underlay multicast, which is configured during LAN automation. If you don't provision the underlay through LAN automation, configure the underlay multicast manually.

14. For Layer 2 Flooding, you can choose the flooding address type and assign a custom flooding IP address, if required.

    • Flooding Address Assignment: Choose Shared or Custom.

    • Flooding Address: If you chose Custom, enter a flooding IP address for the Layer 2 flooding—the supported IP address ranges are 239.0.0.0/8 for IPv4 and FF30::/96 for IPv6. You cannot edit the flooding address for a Shared address type.

    Layer 2 Flooding is supported on anchored and inherited virtual network in these ways:

    • If Layer 2 Flooding is disabled on anchored virtual network, it is disabled on inherited virtual network as well.

    • If Layer 2 Flooding is enabled on anchored virtual network, it can be enabled or disabled on the inherited virtual network. If it is enabled, the flooding address assignment type and the flooding address must be same as the anchored virtual network.

    Note	The IP-Directed Broadcast feature adopts the Flooding Address Assignment and Flooding Address configurations for Layer 2 flooding, if they are configured.

15. Check both the Fabric Enabled Wireless and the Multiple IP-to-MAC Addresses check boxes to enable onboarding of bridge-mode virtual machines that are connected to the fabric-enabled wireless network.

16. Check only the Multiple IP-to-MAC Addresses check box to enable a wired host to have multiple IPv4 addresses (IP aliasing).

    You can have a maximum of 1000 IPv4 addresses for a single MAC address.

17. Check the Flood Access Tunnel check box, to enable flood access tunnel. This option is available only when Fabric-Enabled Wireless is enabled.

18. Click the plus icon () and repeat the steps to associate more IP pools.

Step 7

In the Fabric Zones (Optional) window, add the fabric zones.

1. Click Select Fabric Zones and choose one of these options to add the fabric zones:

   • Click the plus icon () next to the required fabric zones.

   • Click the fabric zone name and click Add Selected.

     Note	To choose multiple fabric zones, press Shift, click the fabric zone names, and click Add Selected.

   • Click Add All to choose all the fabric zones.

2. Click Assign.

Step 8

Review the anycast gateway settings in the Summary window.

Step 9

Schedule the task for deployment.

Step 10

On the Tasks window, monitor the task deployment.

Step 1

From the main menu, choose Provision > Fabric Sites.

Step 2

Click Create Fabric Site.

Step 3

If a task overview window appears, click Let's Do It to go directly to the workflow.

Step 4

In the Fabric Site Location window, choose an area, building, or floor to add as a fabric site.

Step 5

In the Wired Endpoint Data Collection window, ensure that the Wired Endpoint Data Collection check box is checked.

Step 6

In the Authentication Template window, do these tasks:

1. Choose an authentication template for the fabric site:

   • Closed Authentication: Any traffic before authentication is dropped, including DHCP, DNS, and ARP.

   • Open Authentication: A host is allowed network access without having to go through 802.1X authentication.

   • Low Impact: Security is added by applying an ACL to the switch port, to allow limited network access before authentication. After a host has been successfully authenticated, additional network access is granted.

   • None

2. (Optional) If you choose Closed Authentication, Open Authentication, or Low Impact, click Edit to edit the authentication settings:

   • First Authentication Method: Choose 802.1x or MAC Authentication Bypass (MAB)

   • 802.1x Timeout (in seconds): Use the slider to specify the 802.1x timeout, in seconds.

   • Wake on LAN: Choose Yes or No.

   • Number of Hosts: Choose Unlimited or Single.

   • BPDU Guard: Use this check box to enable or disable the Bridge Protocol Data Unit (BPDU) guard on all the Closed Authentication ports.

   • Pre-Authentication Access Control List​: Enable the toggle button to configure preauthentication control for Low Impact authentication. From the Implicit Action drop-down list, choose an implicit action. Enter a description for the rule. To add an access contract, click Add Contract Action, choose the rules, and click Apply Table.

Step 7

In the Fabric Zones window, to designate fabric zones and create scoped subnets, click Setup Fabric Zones Now.

Step 8

In the Summary window, review the fabric site settings.

Step 9

Schedule the task for deployment.

Step 10

On the Tasks window, monitor the task deployment.

Step 11

It takes a few seconds for the site and zones to be provisioned. A success message displays to confirm the creation.

Step 1

From the main menu, choose Provision > Fabric Sites.

Step 2

Under SUMMARY, click the number that indicates the count of fabric sites.

Step 3

For the fabric site where you want to designate the fabric zone, under the Actions column, hover your cursor over the ellipsis icon () and choose Edit Fabric Zone.

Step 4

In the Edit Fabric Zones window, choose an area, building, or floor.

Step 5

Review the fabric site settings in the Summary window.

Step 6

Schedule the task for deployment.

Step 7

On the Tasks window, monitor the task deployment.

Step 8

It takes several seconds for the fabric site and fabric zones to provision. A success message displays to confirm the provisioning.

Step 1

From the main menu, choose Provision > Virtual Networks.

Step 2

Under SUMMARY, click the number that indicates the count of Layer 3 Virtual Networks.

Step 3

In the Layer 3 tab, check the check box next to the Layer 3 virtual networks for which you want to edit the fabric zone associations.

Step 4

Hover your cursor over More actions, and choose Edit Fabric Site and Fabric Zone Associations.

Step 5

In the Fabric Sites and Fabric Zones (Optional) window, do this configuration:

1. Click Select Fabric Zones and choose the fabric zones.

   You can assign a virtual network to multiple fabric zones in a fabric site. To choose the fabric zones, do one of these tasks:

   • Click the plus icon () next to the required fabric zones.

   • Click the fabric zone name and click Add Selected.

     Note	To choose multiple fabric zones, press Shift, click the fabric zone names, and click Add Selected.

   • To choose all the fabric zones, click Add All.

2. Click Assign.

3. Repeat this association for all the Layer 3 virtual networks.

Step 6

Review the Layer 3 virtual network zones on the Summary window.

Step 7

In the Created and Deploy (Step 1 of 2) window, click Update.

Step 8

In the Created and Deploy (Step 2 of 2) window, click Deploy to deploy the Layer 3 virtual networks.

Step 9

To verify the virtual networks, click View Layer 3 Virtual Networks.

Step 1

From the main menu, choose Provision > Virtual Networks.

Step 2

Under SUMMARY, click the number that indicates the count of Layer 2 Virtual Networks.

Step 3

Click Fabric Site: Global.

Step 4

In the Select Fabric Site slide-in pane, choose a fabric site and click Select.

Step 5

In the Layer 2 tab, check the check box next to the Layer 2 virtual networks for which you want to edit the fabric zone associations.

Step 6

Hover your cursor over More actions, and choose Edit Layer 2 Fabric Zone Associations.

Step 7

In the Associated Fabric Sites and Fabric Zones window, do this configuration:

1. Click Select Fabric Zones and choose the fabric zones.

   You can assign a virtual network to multiple fabric zones in a fabric site. To choose the fabric zones, do one of these tasks:

   • Click the plus icon () next to the required fabric zones.

   • Click the fabric zone name and click Add Selected.

     Note	To choose multiple fabric zones, press Shift, click the fabric zone names, and click Add Selected.

   • To choose all the fabric zones, click Add All.

2. Click Assign.

3. Repeat this association for all the Layer 2 virtual networks.

Step 8

In the Summary window, review your Layer 2 virtual network settings and click Create.

Step 9

In the Create window, click Deploy to deploy the Layer 2 virtual network.

Step 10

To verify the virtual network creation, click View Layer 2 Virtual Networks. In the Virtual Networks window, the Layer 2 tab displays the details of all the Layer 2 virtual networks.

Step 1

From the main menu, choose Provision > Virtual Networks.

Step 2

Under SUMMARY, click the number that indicates the count of Anycast Gateways.

Step 3

Click Fabric Site: Global.

Step 4

In the Select Fabric Site slide-in pane, choose a fabric site and click Select.

Step 5

In the Anycast Gateway tab, check the check box next to the anycast gateways for which you want to edit the fabric zone associations.

Step 6

Hover your cursor over More actions, and choose Edit Fabric Zone Associations.

Step 7

In the Fabric Zones (Optional) window, do these steps:

1. Click Select Fabric Zones and do one of these tasks:

   • Click the plus icon () next to the required fabric zones.

   • Click the fabric zone name and click Add Selected.

     Note	To choose multiple fabric zones, press Shift, click the fabric zone names, and click Add Selected.

   • To choose all the fabric zones, click Add All.

2. Click Assign.

Step 8

Review the anycast gateway settings in the Summary window.

Step 9

In the Create window, click Deploy.

Step 10

To verify the gateway creation after you see a success message, click View Anycast Gateway.

Step 1

Configure a network range for the extended node. See Configure IP address pools. This step comprises adding an IP address pool and reserving the IP pool at the site level. Ensure that the CLI and SNMP credentials are configured.

Step 2

Assign the extended IP address pool to INFRA_VN. See Create anycast gateways. Choose Extended Node as the Pool Type.

Step 3

Configure the DHCP server with the extended IP address pool and Option 43. Ensure that the extended IP address pool is reachable from Catalyst Center.

Step 4

Connect the extended node device to the fabric edge device. You can have multiple links from the extended node device to the fabric edge.

Step 5

Create a port channel on the fabric edge node that is connected to the extended node. For a subsequent extended node in a ring or daisy chain, create the port channel on the previous extended node it connects to.

1. From the main menu, choose Provision > Fabric Sites.

2. In the Fabric Sites tab, click the number that indicates the count of fabric sites.

3. Click a fabric site.

4. In the Port Assignment tab, choose More Actions > Create Port Channel.

5. Complete these tasks:

   • Choose the fabric device for which a port channel has to be created.

   • Choose an Extended Node in the Connected Device Type drop-down list.

   • Enter a description.

   • Choose Port Aggregation Protocol (PAgP Desirable).

     Starting with Cisco IOS XE Release 17.1.1s, IE 3300 and IE 3400 devices support PAgP.

   • Select On for IE 3300 and IE 3400 devices if they are running versions earlier than Cisco IOS XE Release 17.1.1s.

     Note	Link Aggregation Control Protocol (LACP) doesn’t work for extended node onboarding.

   • Choose the ports to be bundled as a port channel.

6. Click Done.

Step 6

Power up the extended node device if it has no previous configuration. If the extended node device has configurations, reset the device configuration to factory default and reload it.

Step 1

Change the license level on the device from Essentials to Advantage, using the Catalyst Center License Manager:

1. From the main menu, choose Tools > License Manager.

2. In the Devices tab, check the check box next to the device.

3. Choose Actions > Change License > Change Cisco License.

4. In the Change Cisco License Level window, click Advantage.

5. Choose a license type.

   Click the required license type: All, DNA, or CNS

6. Click Continue.

7. Check the Reboot device on update check box to reboot the device when its license level updates.

8. (Optional) In the Task Name field, update the task name.

9. Choose a schedule for updating the license level.

   • Now: Immediately update the license level and reboot the device.

   • Later: Schedule the date and time, and define the time zone to update the license level and reboot the device.

10. Click Confirm.

Step 2

Wait for the node to become Reachable and get to the Managed state.

Step 3

If you see a Netconf Connection Refused error, resynchronize the device. Repeat the resynchronization process until the error no longer displays.

1. In the Provision > Inventory window, choose the device.

2. Choose Actions > Inventory > Resync Device.

Step 4

Upgrade to policy-extended node.

1. In the Provision > Fabric Sites window, choose the site in which the device is onboarded.

2. In the Fabric Infrastructure tab, click a device to edit its attributes.

3. In the Fabric tab, click the Policy toggle button under Extended Node Attributes.

4. In the Policy Extended Node Upgrade window that displays, click Upgrade.

Step 1

Remove the extended node device from the fabric.

1. From the main menu, choose Provision > Fabric Sites.

2. In the Fabric Sites tab, click the number that indicates the count of fabric sites.

3. Choose the fabric site that contains the extended node device.

4. In the Fabric Infrastructure tab, click the extended node device.

5. In the slide-in pane, click Remove From Fabric.

6. Click Add.

Step 2

Delete the device from Inventory.

Step 3

For a supplicant-based extended node device, delete the port assignment configuration in the fabric edge node or the FIAB.

Step 1

From the main menu, choose Workflows > Configure REP Ring.

Step 2

If a task overview window appears, click Let's Do It to go directly to the workflow.

Step 3

In the Select a fabric site window, select a site that has both edge node and extended nodes.

Step 4

In the Select a fabric edge node window, choose a fabric edge node.

Step 5

In the Select Extended Nodes connected to Fabric Edge window, choose the extended nodes that connect to the fabric edge node.

Step 6

Review and edit (if necessary) your fabric site, edge node, and extended node selections.

Step 7

To initiate the REP ring configuration, click Provision.

Step 8

The REP Ring Summary window displays the details of the REP ring that is created along with the discovered devices.

Step 9

After the creation of the REP ring, a success message displays.

Step 1

From the main menu, choose Provision > Fabric Sites.

Step 2

In the Fabric Sites tab, click the number that indicates the count of fabric sites.

Step 3

Click a fabric site.

Step 4

In the Fabric Infrastructure tab, click the fabric edge node or the fabric in a box (FIAB).

Step 5

In the REP Rings tab, click View to see the REP Ring Topology Status.

Step 1

From the main menu, choose Provision > Fabric Sites.

Step 2

In the Fabric Infrastructure tab, click the fabric edge node that ends the REP ring.

Step 3

In the REP Rings tab, for the desired REP ring, click Actions (…) > Delete.

Step 1

Manually remove the extended node devices from the network.

Step 2

From the main menu, choose Provision > Fabric Sites.

Step 3

In the Fabric Infrastructure tab, click the fabric edge node that ends the REP ring.

Step 4

In the REP Rings tab, for the desired REP ring, choose Actions (…) > Rediscover.

Step 1

Configure AAA server settings in Catalyst Center.

1. Define Cisco ISE as the AAA server for device authentication in the System > Settings > External Services > Authentication and Policy Servers window.

   For the complete procedure, see "Configure Authentication and Policy Servers" in the Cisco Catalyst Center Administrator Guide.

2. Add the Cisco ISE server to the global site. For information, see Add Cisco ISE or other AAA servers.

Step 2

(Optional) Configure Catalyst Center to authorize the device before onboarding.

1. From the main menu, choose System > Settings > Device Settings > PnP Device Authorization.

2. Check the Device Authorization check box to enable authorization on the device.

3. Click Save.

Step 3

Configure the Catalyst Center appliance to manage your PKI certificates.

1. From the main menu, choose System > Settings > Certificates > Certificate Authority.

2. In the Certificate Authority window, click Use Cisco DNA Center.

3. In the CA Management tab, click Download to download the CA Certificate.

4. Add the certificate to the Cisco ISE Trusted Certificate Store. For more information, see the Cisco Identity Services Engine Administrator Guide.

   If you use an external certificate, add that certificate to the Cisco ISE Trusted Certificate Store.

Step 4

Configure the DHCP server with the extended IP address pool and Option 43. Ensure that the extended IP address pool is reachable from Catalyst Center.

Step 5

Enable Closed Authentication and disable Bridge Protocol Data Unit (BPDU) Guard on the fabric Site.

Step 6

Assign an extended IP address pool to INFRA_VN, as described in Create anycast gateways.

Step 7

Connect the extended node device to the fabric edge node or the FIAB.

Step 8

(Optional) Authorize the device.

1. From the main menu, choose Provision > Plug and Play.

2. In the Plug and Play window, select the supplicant-based extended node device and choose Actions > Authorize.

   The authorization process provisions the supplicant-based extended node device for completing a certificate-based EAP-TLS authentication with Cisco ISE. After authentication, Cisco ISE authorizes the supplicant-based extended node device for complete access. The supplicant-based extended node device is then fully onboarded into the SD-Access fabric.

Step 1

To replace the supplicant port:

1. Clear the configuration on the new supplicant port.

2. Copy the existing configuration from the current supplicant port to the new supplicant port to allow 802.1X authentication.

Step 2

To replace the authenticator ports:

1. Assign the supplicant port to the new interface of the authenticator. For information on port assignment, see Configure ports within the fabric site. Choose Supplicant-Based Extended Node as the Connected Device Type.

2. Clear the existing port assignment on the old interface of the authenticator.

Step 3

Disconnect the physical connection between the old ports of the authenticator and the supplicant. Connect a cable between the new ports of the authenticator and the supplicant. Bring this link up.

Step 4

After the link between the new ports of the authenticator and supplicant is up, do these steps:

1. Resynchronize the device information in Catalyst Center by performing an Inventory > Resync Device for both the authenticator and the supplicant. See Resynchronize device information.

2. Assign the new supplicant port to the authenticator. For information on port assignment, see Configure ports within the fabric site. Choose Authenticator Switch as the Connected Device Type.

3. Clear the port assignment on the old supplicant port.

Step 1

Import the CA certificate into Cisco ISE:

Step 2

Configure these authorization profiles with their RADIUS attributes:

SBEN-DHCP:
Access Type = ACCESS_ACCEPT
Filter-ID = SBEN_DHCP_ACL.in

SBEN_LIMITED_ACCESS_AUTHZ:
Access Type = ACCESS_ACCEPT
Filter-ID = SBEN_MAB_ACL.in
cisco-av-pair = interface-template-name=SWITCH_SBEN_MAB_TEMPLATE

SBEN_FULL_ACCESS_AUTHZ :
Access Type = ACCESS_ACCEPT
cisco-av-pair = interface-template-name=SWITCH_SBEN_FULL_ACCESS_TEMPLATE

Step 3

Define the device profiling policy in the Profiling Policies window.

1. From the Cisco ISE main menu, choose Policy > Profiling > Profiling Policies.

2. In the Profiling Policies window, add a new DHCP-v-i-vendor-class condition for the Cisco-Device: Cisco-Switch policy.

   

3. Create a new child policy for the supplicant device, under Cisco-Switch and apply the CdpCachePlatform and V-I-Vendor-Class conditions.

   Ensure that the Minimum Certainty Factor value for the child policy is higher than that of the parent policy.

   

Step 4

Set the global Change of Authorization (CoA) type to Reauth.

To configure the CoA Type, from the Cisco ISE home page, navigate to Work Centers > Profiler > Settings.

Choose Reauth from the CoA Type drop-down list.

Step 5

Define the authorization policy in the Authorization Policy window.

1. From the Cisco ISE home page, choose Policy > Policy Sets > Default > Authorization Policy.

2. Ensure that the default MAB policy is set to CONTINUE option for the If User not found field.

   

3. In the Authorization Policy window, configure the authorization policies for the supplicant device and associate the policies with the authorization profiles that were created earlier (SBEN-DHCP, SBEN_LIMITED_ACCESS_AUTHZ, SBEN_FULL_ ACCESS_AUTHZ).

   

Step 1

From the main menu, choose Provision > Fabric Sites.

Step 2

In the Fabric Sites tab, under SUMMARY, click the number that indicates the count of fabric sites.

Step 3

In the Fabric Sites window, click a fabric site to configure port channels.

Step 4

In the Port Assignment tab, hover your cursor over More Actions, and click Create Port Channel.

Step 5

In the Select your fabric devices window, select the fabric devices for which a port channel has to be created.

Step 6

To specify the number of port channels and configure each port channel, do these tasks in the Determine number of port channels window:

1. From the Connected Device Type drop-down list, choose the type of connected device:

   • To create a port channel between a fabric edge node and an extended node or between two extended nodes, choose Extended Node.

   • To create a port channel with a fabric edge node or extended node on one side and a third-party device or a server port on the other side, choose Trunk.

     Configure Native VLAN and Allowed VLANs values for the trunk port.

     • In the Native VLAN field, enter a value for the native VLAN.

       The valid range is from 1 to 4094. The default value is 1.

     • In the Allowed VLANs field, you can choose to allow all VLANs, a specific VLAN ID between 1 and 4094, or specify a range of VLANs. For example, you can enter 100, 200, or 300-400. The default value is All.

       Note	When templates override default values, update the trunk configuration to align with the values that are specified for each port in the template.

2. Enter a Description for the new port channel.

3. Choose a protocol:

   • For the extended nodes that run Cisco IOS XE Release 16.12.1s and earlier releases, choose On as the protocol.

   • For the extended nodes that run Cisco IOS XE Release 17.1.1s and later releases, choose Port Aggregation Protocol (PAgP) as the protocol.

   • Don't select Link Aggregation Control Protocol (LACP) as the protocol for extended nodes. You can only connect the trunk ports or the server ports in the LACP mode.

Step 7

From the list of available interfaces, choose the interfaces to be bundled as a port channel.

Step 8

In the Summary window, review the port channels that are created.

Step 9

Schedule the task for deployment.

Step 10

On the Tasks window, monitor the task deployment.

Step 1

From the main menu, choose Provision > Fabric Sites.

Step 2

In the Fabric Sites tab, under SUMMARY, click the number that indicates the count of fabric sites.

Step 3

In the Fabric Sites window, click a fabric site to update the port channels.

Step 4

In the Port Assignment tab, choose the port channel to be updated.

Step 5

Hover your cursor over More Actions, and click Edit Port Channel.

Step 6

Follow the onscreen guidelines to update the port channel configuration.

Step 7

Schedule the task for deployment.

Step 8

On the Tasks window, monitor the task deployment.

Step 1

From the main menu, choose Provision > Fabric Sites.

Step 2

Under SUMMARY, click the number that indicates the count of fabric sites.

Step 3

Click a fabric site.

Step 4

In the Port Assignment tab, choose the port channel to be deleted.

Step 5

Hover your cursor over More Actions, and click Delete Port Channel.

Step 6

At the prompt, click Yes.

Step 7

Schedule the task for deployment.

Step 8

On the Tasks window, monitor the task deployment.

Step 1

From the main menu, choose Workflows > Configure Multicast.

Step 2

If a task overview window appears, click Let's Do It to go directly to the workflow.

Step 3

In the Fabric Site window, select a site in the site hierarchy pane.

Step 4

In the Replication Mode window, choose the method of multicast implementation for the network from these locations:

Step 5

In the Virtual Networks window, choose the virtual network for which you want to set up multicast.

Step 6

In the Multicast pool mapping window, select an IP address pool from the IP Pools drop-down list. The selected IP address pool is associated with the chosen virtual network.

Step 7

In the Multicast Mode window, choose the type of multicast to implement:

• SSM (Source Specific Multicast)

• ASM (Any Specific Multicast)

• Select SSM and ASM to configure both together.

Step 8

Do these steps:

1. On selecting SSM, configure the SSM list by adding an IP group range for each virtual network. You can add multiple IP group ranges for a virtual network.

   1. By default, 232.0.0.0/8 range of IPv4 address is selected. You can optionally modify the IPv4 address range.

      Choose an IP group range from 225.0.0.0 to 239.255.255.255.

   2. For IPv6 addresses, FF3x::/32 is reserved for SSM.

2. On selecting ASM, in the Multicast Group to Rendezvous Point Mapping window, configure the rendezvous point for each virtual network:

   1. Choose the type of rendezvous point: External or Fabric.

   2. Configure the rendezvous points in the respective tabs: IPv4 RP and IPv6 RP.

   3. You can define any number of external rendezvous points.

   4. Optionally, you can define a group-to-rendezvous point mapping. There could be one or multiple IPv4/IPv6 multicast groups that are associated with a rendezvous point.

   5. You can either have a rendezvous point with no mapping or with mapping. Both can't be configured together.

   6. The permitted multicast group ranges for IPv6 and IPv4 FF00:/8 and 225.0.0.0/8 - 239.0.0.0/8 respectively.

Step 9

In the Summary window, review the multicast settings. To modify any of the settings, click Edit.

Step 10

Schedule the task for deployment.

Step 11

On the Tasks window, monitor the task deployment.