Ability to define an IP address pool as a wireless pool

Cisco DNA Center, Release 1.3.0.6 provides the ability to select an IP pool as a wireless pool. You can choose from only the defined wireless pool while configuring the wireless SSID for the fabric.

To enable the Wireless Pool toggle button, from the Cisco DNA Center home page, click Provisioning > Fabric > Fabric Name > Host Onboarding > VN Name > Advanced View.

Localization

You can view the Cisco DNA Center GUI screens in English (the default), Chinese, Japanese, or Korean.

To change the default language, simply change the locale in your browser to one of the supported languages: Chinese, Japanese, or Korean.

Network hierarchy

When you select an area, building, or floor on the Network Hierarchy, Network Settings, or Provision page, the hierarchical selection is retained when you switch between these pages.

Design usability enhancement

The options under the Design menu are available as a drop-down list.

Policy usability enhancement

The options under the Policy menu are available as a drop-down list.

Provision page navigation enhancement

The Inventory and Plug and Play menu options are available under Provision > Device as a drop-down list.

Inventory

Starting in Cisco DNA Center, the Inventory feature is merged with the Provision page.

From the Cisco DNA Center home page, click Provision. From the Provision Devices page, choose Actions > Inventory to view and use the inventory features.

Image Repository

Starting in Cisco DNA Center 1.3, the Image Repository tool is merged with the site-based Image Repository that is available as part of the Design page.

Starting in Cisco DNA Center 1.3, you can assign a software image to device series filtered from cisco.com as well as to custom device series.

IPv6 support

You can now create and reserve IPv6 address pools in addition to IPv4 address pools.

System 360 overview

The System 360 Overview tab is updated to provide metrics of various functions of Cisco DNA Center in dashlets. The metrics include Hosts, High Availability, Cluster Tools, System Management Updates, Backup, Application Health, Identity Services Engine (ISE), and IP Address Manager (IPAM).

ROMMON upgrade

A ROMMON upgrade is included in the add-on for software image upgrade. For the ROMMON upgrade, the cisco.com configuration is mandatory. When a device is added, the latest ROMMON details are retrieved from cisco.com for applicable devices. Also, you import a base image or tag a base image, the ROMMON image is downloaded automatically from cisco.com.

Device upgrade readiness prechecks

Prechecks such as NFVIS Flash, Service Entitlement, Interface, CDP neighbors, Running Config, Spanning Tree Summary, and AP Summary are included as enhancements.

Retry option to resync Cisco ISE connectivity

If the Cisco ISE server configuration fails due to a password change, you can update the password and resync the ISE connectivity in the Authentication and Policy Servers page.

Ability to import new certificate file and export certificate details

You can import a new certificate file from your local system and export certificate details on the System Settings > Settings > Trustpool page.

Schedule discovery

You can schedule discovery for a later time.

Include SSH key information in exported device credentials

You can include information such as the SSH key and initial SSH key algorithm in the exported device credentials.

View additional device details in the Topology page

You can view additional device details such as device IP address and device name suffix in the Topology page.

View all options available in the Topology page

By clicking the Take a Tour link, you can view the details of all options available in the Topology page.

Support for N+1 High Availability

Cisco DNA Center Release 1.3 introduces support for N+1 High Availability (HA) on the Cisco Wireless Controller and Cisco Catalyst 9800 Series Wireless Controller platforms.

N+1 HA allows a single Cisco Wireless Controller to be used as a backup controller for multiple primary controllers. These wireless controllers are independent of each other and do not share configuration or IP addresses on any of their interfaces.

Cisco DNA Center supports primary and secondary controller configurations for N+1 HA. N+1 HA is configured at the AP level, not at the global level. Configurations are pushed directly to the AP.

Support for guest anchor Inter-Release Controller Mobility (IRCM)

Inter-Release Controller Mobility (IRCM) supports seamless mobility and wireless services across different Cisco Wireless Controllers with different software versions.

Cisco DNA Center supports guest anchor functionality for the following device combinations:

• Cisco AireOS Controller as a foreign controller with a Cisco AireOS Controller as an anchor controller.

• Cisco AireOS Controller as a guest anchor controller with a Cisco Catalyst 9800 Series Wireless Controller as a foreign controller.

• Cisco Catalyst 9800 Series Wireless Controller as a foreign controller with a Cisco Catalyst 9800 Series Wireless Controller as an anchor controller.

New platform support for Cisco Catalyst 9800 Embedded Wireless Controller for Catalyst 9000 Series

The Cisco Catalyst 9800 Embedded Wireless Controller for Catalyst 9000 Series supports the following platforms in this release:

• Cisco Catalyst 9400 Series Switches

• Cisco Catalyst 9500 Series Switches

• Cisco Catalyst 9500 High Performance Series Switches

Advanced SSID configurations for enterprise and guest wireless network settings

The following advanced SSID configurations are added in this release:

• Fast Transition over the DS

  Fast Transition over the DS is not applicable for wireless enterprise-open and guest network.

• MFP Client Protection

• Session Timeout

• Client Exclusion

• 11v BSS Transition Support: The following configurations are sent:

  • Max idle enable

  • Client user idle timeout

  • Directed multicast service

• 11k: Neighbor list configuration is sent. This allows 11k capable clients to request neighbor reports containing information about known neighbor APs that are candidates for roaming.

AAA per SSID

The AAA per SSID feature solves the behavior of different AAA servers being mapped to different sites, buildings, and floors, which are managed by the same Cisco Wireless Controller. Cisco DNA Center pushes an SSID with respect to the AAA server.

A network profile with an SSID and different sites is mapped with different AAA servers. Based on the AAA server, the SSID with a different name is pushed to the wireless controller after the wireless controller provisioning.

Only two AAA servers are supported per site, building, and floor.

Only one ISE server is mapped to a particular site, building, or floor.

Brownfield is not supported.

You cannot map the ISE server as the primary and the AAA server as the secondary to a particular site.

IPv6 endpoint support in fabric

Fabric devices can now onboard IPv6 wired and wireless clients into a Cisco SD-Access fabric that has an IPv4 underlay. The following features are supported for IPv6 endpoints:

• Layer 2 border handoff

• Multicast, Broadcast and Link Local multicast

• Layer 3 handoff

• DHCP and DNS servers accept IPv6 addresses, in addition to IPv4 addresses

• Client IP address assignment supports static IP, SLAAC, and DHCP

• IPv6 and IPv4 clients can co-exist in the same VLAN.

• IPv6 multicast support for both native and headend replication in the overlay.

Note the following constraints:

• IPv6 guest VN is not supported in Cisco SD-Access.

• IPv6 is not supported on Cisco Catalyst 9800 fabric devices.

LAN automation enhancements

Cisco Catalyst 9400 Series Switches with 40-G ports now support LAN automation.

Cisco Catalyst 9500 High Performance Series Switches running IOS XE 16.11.1 support LAN Automation. The switches now boot up in Layer 2 mode instead of Layer 3 mode.

Validation of LAN subnet reachability from Cisco DNA Center: if the primary device on the LAN subnet is not reachable from Cisco DNA Center, an error message is displayed.

The LAN Automation page now refreshes automatically.

The following Cisco Catalyst 9500 High Performance series switches can be used as seed devices and PnP agents for LAN automation:

• C9500-32C

• C9500-32QC

• C9500-24Y4C

• C9500-48Y4C

Support for extended node

Extended nodes are those devices that run in Layer 2 switch mode and do not support fabric technology natively. You can now configure extended nodes in a Cisco SD-Access fabric.

For information on configuring an extended node, see the Configure an Extended Node section in the Cisco DNA Center User Guide.

Support for port channels

You can now create or delete port channels between the fabric edge ports and the extended node uplinks.

Device support for Fabric in a Box

You can now configure a Cisco Catalyst 9500 High Performance Series Switch to function as a Fabric in a Box.

Ability to create a new AP_VLAN (2045) and template (ApAutzTemplate) on edge devices for AP connectivity

In Cisco DNA Center 1.2.x, when you perform a VN-to-IP pool assignment for an AP pool under the INFRA_VN, a VLAN with a name syntax like <ip pool>_INFRA_VN is created in every site where the assignment occurs.

In Cisco DNA Center 1.3.x, a dedicated AP VLAN with the name AP_VLAN and VLAN ID 2045 is created with a corresponding SVI interface. After you perform the VN-to-IP pool assignment under INFRA_VN for an AP pool, the IP address is assigned to the SVI interface. This can be used in Cisco ISE to assign the VLAN for AP profiling.

This feature does not delete or change the existing fabric behavior for 1.2.x upgrades, which continue to use the old VLAN. If a new fabric site is created, a VLAN is created with the AP_VLAN name and VLAN ID 2045. If you want to standardize the AP_VLAN name to use in the Cisco ISE profile, you must remove the old VN-to-IP pool assignment and recreate the VN-to-IP pool assignment for the AP pool. This change requires network downtime; therefore, plan this change for a maintenance window.

Layer 2 border local endpoints: scale of 32,000

Cisco Catalyst 9500 Switches or Cisco Catalyst 9400 Switches deployed as a Layer 2 border can now have up to 32,000 local endpoints connected to them.

AAA per SSID

AAA per SSID feature solves the behavior of different AAA servers being mapped to different sites, buildings, and floors, which are managed by the same Cisco Wireless Controller. Cisco DNA Center pushes an SSID with respect to the AAA server.

A network profile with an SSID and different sites are mapped with different AAA servers. Based on the AAA server, the SSID with a different profile name is pushed to the wireless controller after the wireless controller provisioning.

Only two AAA servers are supported per site, building, and floor.

Only one ISE server is mapped to a particular site, building, or floor.

Brownfield is not supported.

You cannot map an ISE server as primary and AAA server as secondary to a particular site.

New platform support for Cisco Catalyst 9800 Embedded Wireless Controller for Catalyst 9000 Series

The Cisco Catalyst 9800 Embedded Wireless Controller for Catalyst 9000 Series supports the following platforms in this release:

• Cisco Catalyst 9400 Series Switches

• Cisco Catalyst 9500 Series Switches

• Cisco Catalyst 9500 High Performance Series Switches

Advanced SSID configurations for enterprise and guest wireless network settings

The following advanced SSID configurations are newly added in this release:

• Fast Transition over the DS

  Fast Transition over the DS is not applicable for wireless enterprise-open and guest network.

• MFP Client Protection

• Session Timeout

• Client Exclusion

• 11v BSS Transition Support: The following configurations are sent:

  • Max idle enable

  • Client user idle timeout

  • Directed multicast service

• 11k: Neighbor list configuration is sent. This allows 11k capable clients to request neighbor reports containing information about known neighbor APs that are candidates for roaming.

Fabric border and control plane node

Cisco Catalyst 9600 Series Switches

C9600-SUP-1

C9600-LC-48YL

C9600-LC-24C

Cisco Catalyst 9600 Series Switches can be configured as a fabric border node, fabric control plane node, or both.

Fabric border node

Cisco Nexus 7700 Series Switches

N77-SUP3E

The Nexus 7700 Series Switch with the Supervisor Module-3 (SUP 3E) can be configured as a fabric external border node, only with the M3 line card.

Fabric edge node

Cisco Catalyst 9200 Series Switches

C9200L-24PXG-2Y

C9200L-24PXG-4X

C9200L-48PXG-2Y

C9200L-48PXG-4X

Cisco Catalyst 9200 Series Multigigabit switches can be configured as a fabric edge node.

Fabric edge node with SD-Access Wireless support

Cisco Catalyst 9200 Series Switches

-

All Cisco Catalyst 9200 Series Switches, except the Catalyst 9200L Series, support fabric edge with wireless to terminate VXLAN tunnel.

Note that the Cisco Catalyst 9800 Embedded Wireless Controller is not supported on either the Cisco Catalyst 9200 Series or Cisco Catalyst 9200L Series Switches.

Access Points

Cisco Catalyst 9100 Series Wi-Fi 6 (802.11ax) Access Points

C9120AXI-x

C9120AXE-x

C9120AXP-x

The Cisco Catalyst 9100 Series Access Points can be configured as a Fabric Wireless node.

Application Experience enhancements

Enhanced the Health > Application Health window:

• Added timeline range option for 7 days.

• Changed non-standard NBAR applications to display their HTTP host name or SSL common name, if available.

• For the Application dashlet, the following data columns can be added to the table: Jitter, Client Network Latency, and Server Network Latency.

Enhanced the Application 360 window:

• Added a filter for application data based on location.

• Added charts for the Application Experience slide-in pane for the following metrics: Jitter, Client Network Latency, and Server Network Latency.

• Added the Observed data column under DSCP to the Application Experience dashlet table. The Observed column indicates the application's current DSCP value.

Enhanced the Device 360 window for routers:

• Added filters in the Application Experience category that enables you to filter application data from specific VRFs and router interfaces.

• Changed non-standard NBAR applications to display their HTTP host name or SSL common name, if available.

• Added the Observed data column under DSCP to the Application Experience category table. The Observed column indicates the application's current DSCP value.

• Added the Jitter data column for the Application Experience category table.

IPv6 address support for wireless and wired clients

Enhanced the Health > Client window:

• Fixed the IPv6 Address data column to display the client's IPv6 address in the following locations:

  • Client Health Summary dashlet in the slide-in panes for Wireless Clients and Wired Clients

  • Client Devices dashlet

  Note	Assurance supports clients with multiple IPv6 addresses. You can view the additional addresses by hovering your cursor over the tooltip link in parentheses. For example, (1 more).

• Added filtering for IPv6 addresses in the Client Devices dashlet table.

Enhanced the Client 360 window:

• Fixed IPv6 above the timeline to display the client's IPv6 address.

• Added IPv6 to the Onboarding category.

• Added IPv6 to the Event Viewer category.

• Fixed IPv6 Address from the Detail Information category to display the client's IPv6 address.

Simplifies the health score formula for wireless clients

• Simplifies the individual health score calculation for wireless clients.

• Simplifies the RSSI and SNR connectivity scores calculation for wireless clients.

Support KPIs and baselining for On-Device AI (on-premises)

Added the following enhancements:

• View the issues generated by Assurance for excessive onboarding. The root causes for the excessive onboarding issues are AAA, DHCP, and Association. The issues are generated through the baseline.

• In the Global Issues window, you can click an issue in the Issue Type column to open a slide-in pane with additional details. In the slide-in pane, click an issue in the Issue Instance column to view more details about the issue instance.

• While configuring issue settings, if you set the Device Type as All and Category as Onboarding as the trigger condition, you can set the trigger condition to generate either baseline-based issues or threshold-based issues.

• In the Client Health dashboard, for the Client Onboarding Times and Client Count per SSID dashlets, you can click the Trend tab to display a trend chart. Under Trend, you have the option to select Baseline to view the onboarding time baseline data (trend chart) or to view the client count data (trend chart) per SSID.

Intelligent Capture

• Added the following location to manage Intelligent Capture for clients:

  Assurance > Manage > Client Intelligent Capture

• Added the following location to manage Intelligent Capture for Access Points:

  Assurance > Manage > AP Intelligent Capture

Cisco ISE configuration unification

• Centralized Cisco ISE configuration for all of Cisco DNA Center in the NCP (Network Control Platform) location:

  Settings > System Settings > Settings > Authentication and Policy Servers

  After a Cisco ISE server is successfully configured, NCP sends the configuration details (that is, pxGrid nodes, keystore, and truststore files) to Network Data Platform (NDP).

• Added the following location to enable anonymization for PPI (personally identifiable information):

  Settings > System Settings > Settings > Anonymize Data