New and Changed Features

The following tables summarize the new and changed features in Release 1.3.

General Feature Support

Plug and Play supports the following features, depending on the Cisco IOS software release on the device:

• AAA device credential support: The AAA credentials are passed to the device securely and the password is not logged. This feature allows provisioning a device with a configuration that contains aaa authorization commands. This feature requires software release Cisco IOS 15.2(6)E1, Cisco IOS 15.6(3)M1, Cisco IOS XE 16.3.2, or Cisco IOS XE 16.4 or later on the device.

• Image install and upgrade for Cisco Catalyst 9200 Series, Catalyst 9300 Series, Catalyst 9400 Series, Catalyst 9500 Series, Catalyst 3650 Series, and Catalyst 3850 Series switches are supported only when the switch is booted in install mode. (Image install and upgrade is not supported for switches booted in bundle mode.)

Secure Unique Device Identifier Support

The Secure Unique Device Identifier (SUDI) feature that allows secure device authentication is available on the following platforms:

• Cisco routers:

  • Cisco ISR 1100 Series with software release 16.6.2

  • Cisco ISR 4000 Series with software release 3.16.1 or later, except for the ISR 4221, which requires release 16.4.1 or later

  • Cisco ASR 1000 Series (except for the ASR 1002-x) with software release 16.6.1

• Cisco switches:

  • Cisco Catalyst 3850 Series with software release 3.6.3E or 16.1.2E or later

  • Cisco Catalyst 3650 Series and 4500 Series with Supervisor 7-E/8-E, with software release 3.6.3E, 3.7.3E, or 16.1.2E or later

  • Cisco Catalyst 4500 Series with Supervisor 8L-E with software release 3.8.1E or later

  • Cisco Catalyst 4500 Series with Supervisor 9-E with software release 3.10.0E or later

  • Cisco Catalyst 9300 Series with software release 16.6.1 or later

  • Cisco Catalyst 9400 Series with software release 16.6.1 or later

  • Cisco Catalyst 9500 Series with software release 16.6.1 or later

  • Cisco Catalyst IE3300 Series with software release 16.10.1e or later

  • Cisco Catalyst IE3400 Series with software release 16.11.1a or later

• NFVIS platforms:

  • Cisco ENCS 5400 Series with software release 3.7.1 or later

  • Cisco ENCS 5104 with software release 3.7.1 or later

Note

Devices that support SUDI have two serial numbers: the chassis serial number and the SUDI serial number (called the License SN on the device label). You must enter the SUDI serial number in the Serial Number field when adding a device that uses SUDI authentication. The following device models have a SUDI serial number that is different from the chassis serial number: Cisco routers: Cisco ISR 43xx, Cisco ISR 44xx, Cisco ASR1001-X/HX, Cisco ASR1002-HX Cisco switches: Cisco Catalyst 4500 Series with Supervisor 8-E/8L-E/9-E, Catalyst 9400 Series

Management Interface VRF Support

Plug and Play operates over the device management interface on the following platforms:

• Cisco routers:

  • Cisco ASR 1000 Series with software release 16.3.2 or later

  • Cisco ISR 4000 Series with software release 16.3.2 or later

• Cisco switches:

  • Cisco Catalyst 3650 Series and 3850 Series with software release 16.6.1 or later

  • Cisco Catalyst 9300 Series with software release 16.6.1 or later

  • Cisco Catalyst 9400 Series with software release 16.6.1 or later

  • Cisco Catalyst 9500 Series with software release 16.6.1 or later

4G Interface Support

Plug and Play operates over a 4G network interface module on the following Cisco routers:

• Cisco 1100 Series ISR with software release 16.6.2 or later

Backup and Restore Limitations

Backup and restore limitations and restrictions include:

• You cannot take a backup of one version of Cisco DNA Center and restore it to another version of Cisco DNA Center. You can only restore a backup to an appliance that is running the same Cisco DNA Center software version, applications, and application versions as the appliance and applications from which the backup was taken.

• After performing a restore operation, update your integration of Cisco ISE with Cisco DNA Center. After a restore operation, Cisco ISE and Cisco DNA Center might not be in sync. To update your Cisco ISE integration with Cisco DNA Center, choose System Settings > Settings > Authentication and Policy Servers. Choose Edit for the server. Enter your Cisco ISE password to update.

• After performing a restore operation, the configuration of devices in the network might not be in sync with the restored database. In such a scenario, you should manually revert the CLI commands pushed for authentication, authorization, and accounting (AAA) and configuration on the network devices. Refer to the individual network device documentation for information about the CLI commands to enter.

• Re-enter the device credentials in the restored database. If you updated the site-level credentials before the database restore, and the backup that is being restored does not have the credential change information, all the devices go to partial-collection after restore. You must then manually update the device credentials on the devices for synchronization with Cisco DNA Center, or perform a rediscovery of those devices to learn the device credentials.

• Perform AAA provisioning only after adjusting network device differential changes to the restored database. Otherwise, device lockouts might occur.

• You can back up and restore Automation data only or both Automation and Assurance data. But you cannot use the GUI or the CLI to back up or restore only Assurance data.

HA Limitation

In this release, Cisco DNA Center provides HA support only for Automation and Cisco SD-Access. HA for Assurance is not supported.

Cisco ISE Integration Limitations

Cisco ISE integration limitations and restrictions include:

• ECDSA keys are not supported as either SSH keys for Cisco ISE SSH access, or in certificates in Cisco DNA Center and Cisco ISE.

• Full certificate chains must be uploaded to Cisco DNA Center while replacing an existing certificate. If a Cisco DNA Center certificate is issued by a subCA of a rootCA, the certificate chain uploaded to Cisco DNA Center while replacing the Cisco DNA Center certificate must contain all three certificates.

• Self-signed certificates applied on Cisco DNA Center must have the Basic Constraints extension with cA:TRUE (RFC5280 section-4.2.19).

• The IP address or FQDN of both Cisco ISE and Cisco DNA Center must be present in either the Subject Name field or the Subject Alt Name field of the corresponding certificates.

• If a certificate is replaced or renewed in either Cisco ISE or Cisco DNA Center, trust must be re-established.

• The Cisco DNA Center and Cisco ISE IP or FQDN must be present in the proxy exceptions list if there is a web proxy between Cisco DNA Center and Cisco ISE.

• Cisco DNA Center and Cisco ISE nodes cannot be behind a NAT device.

• Cisco DNA Center and Cisco ISE cannot integrate if the ISE Admin and ISE pxGrid certificates are issued by different enterprise certificate authorities.

  Specifically, if the ISE Admin certificate is issued by CA server A, the ISE pxGrid certificate is issued by CA server B, and the pxGrid persona is running on a node other than ISE PPAN, the pxGrid session from Cisco DNA Center to Cisco ISE does not work.

• The Cisco ISE internal certificate authority must issue the pxGrid certificate for Cisco DNA Center.

Brownfield Feature-Related Limitations

Brownfield feature-related limitations include:

• Cisco DNA Center cannot learn device credentials.

• You must enter the preshared key (PSK) or shared secret for the AAA server as part of the import flow.

• Cisco DNA Center does not learn the details about DNS, WebAuth redirect URL, and syslog.

• Cisco DNA Center can learn only one wireless controller at a time.

• For site profile creation, only the AP groups with AP and SSID entries are considered.

• Automatic site assignment is not possible.

• SSIDs with an unsupported security type and radio policy are discarded.

• For authentication and accounting servers, if the RADIUS server is present in the device, it is given first preference. If the RADIUS server is not present, the TACACS server is considered for design.

• The Cisco ISE server (AAA) configuration is not learned through brownfield provisioning.

• The authentication and accounting servers must have the same IP addresses for them to be learned through brownfield provisioning.

• When an SSID is associated with different interfaces in different AP groups, during provisioning, the newly created AP group with the SSID is associated with the same interface.

• A wireless conflict is based only on the SSID name, and does not consider other attributes.

Wireless Policy Limitation

Wireless policy limitations include:

• If an AP is migrated after a policy is created, you must manually edit the policy and point the policy to an appropriate AP location before deploying the policy. Otherwise, Policy Deployment failed is displayed.

Cisco Plug and Play Limitations

Plug and Play limitations and restrictions include:

• Virtual Switching System (VSS) is not supported.

• The Cisco Plug and Play Mobile app is not supported with Plug and Play in Cisco DNA Center.

• The Stack License workflow task is supported for Cisco Catalyst 3650 and 3850 Series switches running Cisco IOS XE 16.7.1 and later.

• The Plug and Play agent on the switch is initiated on VLAN 1 by default. Most deployments recommend that VLAN 1 be disabled. If you do not want to use VLAN 1 when PnP starts, enter the following command on the upstream device:

  pnp startup-vlan <vlan_number>

AP Provisioning Failure Limitation

Configuring APs in FlexConnect mode before provisioning the locally switched WLANs bypasses the AP provisioning error. Otherwise, the AP provisioning fails when the locally switched WLANs are provisioned on the wireless controller or APs through Cisco DNA Center.

After the provisioning failure, the AP rejoins the wireless controller. You can reprovision the AP for a successful provisioning.

AP Performance Limitation

Provisioning of 100 APs takes longer in Cisco DNA Center, Release 1.3, than compared to 3 minutes in Cisco DNA Center, Release 1.2.10. The amount of time varies depending on the "wr mem" time of the Cisco Catalyst 9800 Series Controller, which includes Cisco Catalyst 9800-40 Wireless Controller, Cisco Catalyst 9800-80 Wireless Controller, and Cisco Catalyst 9800-CL Cloud Wireless Controller devices.

Inter-Release Controller Mobility (IRCM) Limitation

The interface or VLAN configuration is not differentiated between foreign and anchor controllers. The VLAN or interface that is provided in Cisco DNA Center is configured on both foreign and anchor controllers.

CMX Limitation

When integrating Cisco DNA Center with CMX 10.6.1, the site hierarchy that is created in Cisco DNA Center might not synchronize fully with CMX.

This problem occurs when CMX 10.6.1 is used and the site hierarchy in Cisco DNA Center contains one or more area elements that are children of other area elements; for example, Global > Area1 > Area1.1 > Building > Floor. CMX version 10.6.1 (and earlier) supports only hierarchies in the form of Global > Area > Building > Floor. CMX 10.6.1 does not support nested area elements.

The workaround is to rearrange the hierarchy in Cisco DNA Center so that there are no nested area elements. In other words, make sure the hierarchy is in the form of Global > Area > Building > Floor.

Intelligent Capture Limitations

Intelligent Capture limitations and restrictions include:

• Cisco DNA Center might not receive anomaly packets.

  Under the following conditions, an AP does not send anomaly packets to Cisco DNA Center; therefore, anomaly events don't have correlated captured packets in Cisco DNA Center:

  • An anomaly event throttle limit is reached inside an AP

  • An AP consumes high CPU

  • A client roams to a non-Intelligent Capture AP

  • A wireless controller sends delete mobile to an AP before an anomaly timer is triggered

• Enabling live or scheduled packet capture fails because the wireless controller exceeds the 16 MAC address limit for partial packet capture.

  Because the wireless controller can support a maximum of 16 MAC addresses for partial packet capture, if the list of MAC addresses on the wireless controller is not synchronized with Cisco DNA Center, enabling live or scheduled packet capture for a client fails with the following error messages:

  Failed to enable partial packet trace. NCSP10001: User intent validation failed.

  Failed to enable partial packet trace. config icap global subscription client packet-trace partial filter add [CLIENT MAC] Max filters configured:Failed to add new filter.

  Failed to enable client RF statistics. NCSP10001: User intent validation failed.

  Failed to enable filter channel. NCSP10001: User intent validation failed.

  Any of the following events can cause an out-of-synch condition:

  • Partial packet capture is enabled directly on the wireless controller rather than on the Intelligent Capture UI

  • Cisco DNA Center is reimaged or upgraded without first disabling all Intelligent Capture features

  • The wireless controller is deleted and then rediscovered on Cisco DNA Center

• Enabling data packet capture fails because there is an existing MAC address in a full packet trace subscription on the wireless controller.

  Because the wireless controller supports only one MAC address for full packet capture, if there is an existing MAC address for full packet capture on the wireless controller, enabling data packet capture fails on that wireless controller. The following warning message is displayed:

  Max filter allowed for this topic is 1. Remove existing client filter before adding a new filter.