Step 1

Click the menu icon () and choose Provision > Zero-Trust Overview.

Step 2

Under Explore and start your journey to SD-Access Zero-Trust Workplace, do the following:

1. For Network Connectivity settings, choose the required options:

   • Enable With Wireless to use wireless devices in your zero-trust workplace journey.

   • Enable With CAT9K to use Cisco Catalyst 9000 Series devices or enable With Traffic Telemetry Appliance to use the Cisco DNA Traffic Telemetry Appliance in your zero-trust workplace journey.

2. For Services settings, choose the required options:

   • Enable With ISE to use Cisco Identity Services Engine in your zero-trust workplace journey.

   • Enable With Talos to use Talos Intelligence in your zero-trust workplace journey.

   • Enable With CBAR Enabled to use Controller-Based Application Recognition (CBAR) in your zero-trust workplace journey.

3. (Optional) To view details about each recommended step in the journey map, hover your cursor over the corresponding step around the journey map.

Step 3

Under I’m Done Exploring and Ready to Start My Journey, choose one of the following options:

• To create a fabric network and start your journey towards a zero-trust workplace, click Start my journey with creation of network fabric.

• If you already have fabric network connectivity and want to start your journey towards zero-trust workplace with endpoint visibility, click I already have connectivity and want to start with Endpoint Visibility.

Step 4

Click Start My Journey.

Step 5

In the Modify Journey Map dialog box, do the following:

1. Review your journey map settings.

   Note	Cisco DNA Center displays a message if it doesn't discover the selected services for your network. Cisco DNA Center displays a message if it discovers additional services that were not selected in the journey.

2. (Optional) To remove a selected service from your journey map settings, uncheck the corresponding check box.

3. Click Confirm.

Step 1

Click the menu icon () and choose Provision > Zero-Trust Overview.

Step 2

Under Your Journey Map, click Modify My Journey.

Step 3

Under Explore and start your journey to SD-Access Zero-Trust Workplace, do the following:

1. For Network Connectivity settings, choose the required options:

   • Enable With Wireless to use wireless devices in your zero-trust workplace journey.

   • Enable With CAT9K to use Cisco Catalyst 9000 Series devices or enable With Traffic Telemetry Appliance to use the Cisco DNA Traffic Telemetry Appliance in your zero-trust workplace journey.

2. For Services settings, choose the required options:

   • Enable With ISE to use Cisco Identity Services Engine in your zero-trust workplace journey.

   • Enable With Talos to use Talos Intelligence in your zero-trust workplace journey.

   • Enable With CBAR Enabled to use Controller-Based Application Recognition (CBAR) in your zero-trust workplace journey.

3. (Optional) To view details about each recommended step in the journey map, hover your cursor over the corresponding step around the journey map.

Step 4

Under I’m Done Exploring and Ready to Start My Journey, choose one of the following options:

• To create a fabric network and start your journey towards a zero-trust workplace, click Start my journey with creation of network fabric.

• If you already have fabric network connectivity and want to start your journey towards zero-trust workplace with endpoint visibility, click I already have connectivity and want to start with Endpoint Visibility.

Step 5

Click Modify My Journey.

Step 6

In the Modify Journey Map dialog box, do the following:

1. Review your journey map settings.

   Note	Cisco DNA Center displays a message if it doesn't discover the selected services for your network. Cisco DNA Center displays a message if it discovers additional services that were not selected in the journey.

2. (Optional) To remove a selected service from your journey map settings, uncheck the corresponding check box.

3. Click Confirm.

Step 1

Click the menu icon () and choose Workflows > Create Layer 3 Virtual Networks.

Step 2

If the task overview window opens, click Let’s Do it to go directly to the workflow.

Step 3

In the Layer 3 Virtual Networks window, do the following:

1. In the Layer 3 Virtual Network name field, enter a name for the Layer 3 virtual network.

2. (Optional) To create another Layer 3 virtual network, click the plus icon () and enter a name for the Layer 3 virtual network.

Step 4

In the Fabric Sites and Fabric Zones (Optional) window, configure the following:

1. Click Select Fabric Sites and choose the fabric sites.

   You can assign a virtual network to multiple fabric sites. To choose the fabric sites, do one of the following:

   • Click the plus icon () next to the required fabric sites.

   • Click the fabric site name and click Add Selected.

     Note	To choose multiple fabric sites, press Shift, click the fabric site names, and click Add Selected.

   • To choose all the fabric sites, click Add All.

   Repeat this association for all the Layer 3 virtual networks that you created.

2. Click Assign.

3. Click Select Fabric Zones and do one of the following:

   • Click the plus icon () next to the required fabric zones.

   • Click the fabric zone name and click Add Selected.

     Note	To choose multiple fabric zones, press Shift, click the fabric zone names, and click Add Selected.

   • To choose all the fabric zones, click Add All.

4. Click Assign.

Step 5

Review the Layer 3 virtual network settings in the Summary window.

Step 6

In the Created and Deploy (Step 1 of 2) window, click Create to create the context of the virtual network.

Step 7

In the Created and Deploy (Step 2 of 2) window, click Deploy to assign the virtual network to the selected sites.

Step 8

To verify the virtual network creation, click View Layer 3 Virtual Networks.

Step 1

Click the menu icon () and choose Workflows > Create Layer 2 Virtual Networks.

Step 2

If the task overview window opens, click Let’s Do it to go directly to the workflow.

Step 3

In the Configuration Attributes window, configure the following:

1. In the VLAN Name field, enter the VLAN name.

2. In the VLAN ID field, enter the VLAN ID. The valid range for VLAN ID is from 2 through 4093.

   Note	The VLAN IDs from 1002 through 1005 and 2046 are reserved VLAN IDs.

3. From the Traffic Type area, choose Data or Voice.

4. Check the Fabric-Enabled Wireless check box to enable wireless.

   The Layer 2 Flooding check box is enabled by default for a Layer 2 virtual network.

5. To add another Layer 2 virtual network, click the plus icon () and repeat 3.a to 3.d.

Step 4

In the Associated Fabric Sites and Fabric Zones window, choose a fabric site for the Layer 2 virtual network from the Fabric Sites drop-down. Optionally, to choose the fabric zone to associate with this Layer 2 virtual network, do the following:

1. Click Select Fabric Zones and do one of the following:

   • Click the plus icon () next to the required fabric zones.

   • Click the fabric zone name and click Add Selected.

     Note	To choose multiple fabric zones, press Shift, click the fabric zone names, and click Add Selected.

   • To choose all the fabric zones, click Add All.

2. Click Assign.

Step 5

In the Summary window, review your Layer 2 virtual network settings and click Create.

Step 6

In the Create window, click Deploy to deploy the Layer 2 virtual network.

Step 7

To verify the virtual network creation, click View Layer 2 Virtual Networks. In the Virtual Networks window, the Layer 2 tab displays the details of all the Layer 2 virtual networks.

Step 1

Click the menu icon () and choose Provision > Virtual Networks.

Step 2

Under SUMMARY, click the number that indicates the count of Layer 3 Virtual Networks.

Step 3

In the Layer 3 tab, check the check box next to the Layer 3 virtual networks for which you want to edit the fabric site association.

Step 4

Hover your cursor over More actions, and choose Edit Fabric Site and Fabric Zone Associations.

Step 5

In the Fabric Sites and Fabric Zones (Optional) window, configure the following:

1. Click Select Fabric Sites and choose the fabric sites.

   You can assign a virtual network to multiple fabric sites. To choose the fabric sites, do one of the following:

   • Click the plus icon () next to the required fabric sites.

   • Click the fabric site name and click Add Selected.

     Note	To choose multiple fabric sites, press Shift, click the fabric site names, and click Add Selected.

   • To choose all the fabric sites, click Add All.

   Repeat this association for all the Layer 3 virtual networks.

2. Click Assign.

3. Click Select Fabric Zones and do one of the following:

   • Click the plus icon () next to the required fabric zones.

   • Click the fabric zone name and click Add Selected.

     Note	To choose multiple fabric zones, press Shift, click the fabric zone names, and click Add Selected.

   • To choose all the fabric zones, click Add All.

4. Click Assign.

Step 6

Review the Layer 3 virtual network sites on the Summary window.

Step 7

In the Created and Deploy (Step 1 of 2) window, click Update to assign the Layer 3 virtual networks to the selected sites.

Step 8

In the Created and Deploy (Step 2 of 2) window, click Deploy to deploy the Layer 3 virtual networks.

Step 9

To verify the virtual networks, click View Layer 3 Virtual Networks.

Step 1

Click the menu icon () and choose Provision > Virtual Networks.

Step 2

Under SUMMARY, click the number that indicates the count of Anycast Gateways.

Step 3

In the Anycast Gateway tab, click Create Anycast Gateways.

Step 4

If the task overview window opens, click Let’s Do it to go directly to the workflow.

Step 5

In the Layer 3 Virtual Networks window, select one or more virtual networks to add a gateway.

Step 6

In the left pane of the Configuration Attributes window, choose the Layer 3 virtual network for which you want to create the anycast gateway and do the following:

1. From the IP Address Pool drop-down list, choose an IP address pool.

2. For INFRA_VN, do the following:

   • Choose AP or Extended Node from the Pool Type drop-down list.

   • Enter a valid VLAN Name or check the Auto generate VLAN name check box.

   • Enter a custom VLAN ID for the virtual network.

   • To onboard a supplicant-based extended node, check the Supplicant-Based Extended Node Onboarding check box.

     Note	This check box is active only when you choose the Extended Node pool type.

3. To enable the IP-Directed Broadcast feature, check the IP-Directed Broadcast check box.

   Note	When you enable Directed Broadcast, Cisco DNA Center automatically enables Layer 2 flooding. Routers and Cisco Nexus 7000 Series Switches don’t support Directed Broadcast. Before enabling Directed Broadcast, ensure that you have enabled underlay multicast.

4. To enable the intrasubnet routing, check the Intra-Subnet Routing check box.

   Note	When you enable intrasubnet routing, Cisco DNA Center automatically disables the Fabric-Enabled Wireless and Layer 2 Flooding check boxes.

5. Enter a valid VLAN Name or check the Auto generate VLAN name check box.

6. Enter a custom VLAN ID for the virtual network.

   Note	VLAN IDs 1, 1002-1005, 2046, and 4095 are reserved and can’t be used. If you don’t provide a custom VLAN ID, Cisco DNA Center generates a VLAN ID in the range of 1021–2020.

7. Choose Data or Voice from the Traffic Type area.

8. From the Security Group drop-down list, choose a security group.

9. To include this IP pool in the critical IP address pool, check the Critical VLAN check box.

   A critical pool is used for closed authentication profile when an authentication server isn’t available. A critical VLAN is assigned to the critical pool and all unauthenticated hosts are placed in the critical VLAN in the absence of an authentication server.

   Note	When you enable critical VLAN, Cisco DNA Center automatically generates the VLAN name.

10. To enable this IP pool as a wireless IP address pool, check the Fabric-Enabled Wireless check box.

11. To enable Layer 2 flooding, check the Layer 2 Flooding check box.

    Note	Layer 2 flooding requires underlay multicast, which is configured during LAN automation. If you don't provision the underlay through LAN automation, configure the underlay multicast manually.

12. To enable onboarding of bridge-mode virtual machines that are connected to the fabric-enabled wireless network, check both the Fabric Enabled Wireless and the Multiple IP to MAC check boxes.

13. To enable a wired host to have multiple IPv4 addresses (IP aliasing), check only the Multiple IP to MAC check box.

    You can have a maximum of 1000 IPv4 addresses for a single MAC address.

14. To associate more IP pools, click the plus icon () and repeat the steps.

Step 7

In the Fabric Zones (Optional) window, do the following:

1. Click Select Fabric Zones and do one of the following:

   • Click the plus icon () next to the required fabric zones.

   • Click the fabric zone name and click Add Selected.

     Note	To choose multiple fabric zones, press Shift, click the fabric zone names, and click Add Selected.

   • To choose all the fabric zones, click Add All.

2. Click Assign.

Step 8

Review the anycast gateway settings in the Summary window.

Step 9

In the Create window, click Deploy.

Step 10

To verify the gateway creation after you see a success message, click View Anycast Gateway.

Step 1

Click the menu icon () and choose Provision > Fabric Sites.

Step 2

Click Create Fabric Sites and Fabric Zones.

Step 3

If a task overview window appears, click Let's Do It to go directly to the workflow.

Step 4

In the Fabric Site Location window, choose an area, building, or floor to add as a fabric site.

Step 5

In the Wired Endpoint Data Collection window, ensure that the Wired Endpoint Data Collection check box is checked.

Step 6

In the Authentication Template window, do the following:

1. Choose an authentication template for the fabric site:

   • Closed Authentication: Any traffic before authentication is dropped, including DHCP, DNS, and ARP.

   • Open Authentication: A host is allowed network access without having to go through 802.1X authentication.

   • Low Impact: Security is added by applying an ACL to the switch port, to allow limited network access before authentication. After a host has been successfully authenticated, additional network access is granted.

   • None

2. (Optional) If you choose Closed Authentication, Open Authentication, or Low Impact, click Edit to edit the authentication settings:

   • First Authentication Method: Choose 802.1x or MAC Authentication Bypass (MAB)

   • 802.1x Timeout (in seconds): Use the slider to specify the 802.1x timeout, in seconds.

   • Wake on LAN: Choose Yes or No.

   • Number of Hosts: Choose Unlimited or Single.

   • BPDU Guard: Use this check box to enable or disable the Bridge Protocol Data Unit (BPDU) guard on all the Closed Authentication ports.

   • Pre-Authentication Access Control List​: Enable the toggle button to configure preauthentication control for Low Impact authentication. From the Implicit Action drop-down list, choose an implicit action. Enter a description for the rule. To add an access contract, click Add Contract Action, choose the rules, and click Apply Table.

Step 7

In the Fabric Zones window, to designate fabric zones and create scoped subnets, click Setup Fabric Zones Now.

Step 8

In the Summary window, review the fabric site settings.

Step 9

Click Deploy.

Step 1

Click the menu icon () and choose Provision > Fabric Sites.

Step 2

Under SUMMARY, click the number that indicates the count of fabric sites.

Step 3

For the fabric site where you want to designate fabric zone, under the Actions column, hover your cursor over the ellipsis icon () and choose Edit Fabric Zone.

Step 4

In the Fabric Zones window, choose an area, building, or floor.

Step 5

Review the fabric site settings in the Summary window.

Step 6

Click Deploy.

Step 1

Click the menu icon () and choose Provision > Virtual Networks.

Step 2

Under SUMMARY, click the number that indicates the count of Layer 3 Virtual Networks.

Step 3

In the Layer 3 tab, check the check box next to the Layer 3 virtual networks for which you want to edit the fabric zone associations.

Step 4

Hover your cursor over More actions, and choose Edit Fabric Site and Fabric Zone Associations.

Step 5

In the Fabric Sites and Fabric Zones (Optional) window, configure the following:

1. Click Select Fabric Zones and choose the fabric zones.

   You can assign a virtual network to multiple fabric zones in a fabric site. To choose the fabric zones, do one of the following:

   • Click the plus icon () next to the required fabric zones.

   • Click the fabric zone name and click Add Selected.

     Note	To choose multiple fabric zones, press Shift, click the fabric zone names, and click Add Selected.

   • To choose all the fabric zones, click Add All.

2. Click Assign.

3. Repeat this association for all the Layer 3 virtual networks.

Step 6

Review the Layer 3 virtual network zones on the Summary window.

Step 7

In the Created and Deploy (Step 1 of 2) window, click Update.

Step 8

In the Created and Deploy (Step 2 of 2) window, click Deploy to deploy the Layer 3 virtual networks.

Step 9

To verify the virtual networks, click View Layer 3 Virtual Networks.

Step 1

Click the menu icon () and choose Provision > Virtual Networks.

Step 2

Under SUMMARY, click the number that indicates the count of Layer 2 Virtual Networks.

Step 3

Click Fabric Site: Global.

Step 4

In the Select Fabric Site slide-in pane, choose a fabric site and click Select.

Step 5

In the Layer 2 tab, check the check box next to the Layer 2 virtual networks for which you want to edit the fabric zone associations.

Step 6

Hover your cursor over More actions, and choose Edit Layer 2 Fabric Zone Associations.

Step 7

In the Associated Fabric Sites and Fabric Zones window, configure the following:

1. Click Select Fabric Zones and choose the fabric zones.

   You can assign a virtual network to multiple fabric zones in a fabric site. To choose the fabric zones, do one of the following:

   • Click the plus icon () next to the required fabric zones.

   • Click the fabric zone name and click Add Selected.

     Note	To choose multiple fabric zones, press Shift, click the fabric zone names, and click Add Selected.

   • To choose all the fabric zones, click Add All.

2. Click Assign.

3. Repeat this association for all the Layer 2 virtual networks.

Step 8

In the Summary window, review your Layer 2 virtual network settings and click Create.

Step 9

In the Create window, click Deploy to deploy the Layer 2 virtual network.

Step 10

To verify the virtual network creation, click View Layer 2 Virtual Networks. In the Virtual Networks window, the Layer 2 tab displays the details of all the Layer 2 virtual networks.

Step 1

Click the menu icon () and choose Provision > Virtual Networks.

Step 2

Under SUMMARY, click the number that indicates the count of Anycast Gateways.

Step 3

Click Fabric Site: Global.

Step 4

In the Select Fabric Site slide-in pane, choose a fabric site and click Select.

Step 5

In the Anycast Gateway tab, check the check box next to the anycast gateways for which you want to edit the fabric zone associations.

Step 6

Hover your cursor over More actions, and choose Edit Fabric Zone Associations.

Step 7

In the Fabric Zones (Optional) window, do the following:

1. Click Select Fabric Zones and do one of the following:

   • Click the plus icon () next to the required fabric zones.

   • Click the fabric zone name and click Add Selected.

     Note	To choose multiple fabric zones, press Shift, click the fabric zone names, and click Add Selected.

   • To choose all the fabric zones, click Add All.

2. Click Assign.

Step 8

Review the anycast gateway settings in the Summary window.

Step 9

In the Create window, click Deploy.

Step 10

To verify the gateway creation after you see a success message, click View Anycast Gateway.

Step 1

Configure a network range for the extended node. See Configure IP Address Pools. This step comprises adding an IP address pool and reserving the IP pool at the site level. Ensure that the CLI and SNMP credentials are configured.

Step 2

Assign the extended IP address pool to INFRA_VN. See Create Anycast Gateways. Choose Extended Node as the Pool Type.

Step 3

Configure the DHCP server with the extended IP address pool and Option 43. Ensure that the extended IP address pool is reachable from Cisco DNA Center.

Step 4

Connect the extended node device to the fabric edge device. You can have multiple links from the extended node device to the fabric edge.

Step 5

Create a port channel on the fabric edge node that is connected to the extended node. For a subsequent extended node in a ring or daisy chain, create the port channel on the previous extended node it connects to.

1. Click the menu icon () and choose Provision > Fabric Sites.

2. In the Fabric Sites tab, click the number that indicates the count of fabric sites.

3. Select a fabric site.

4. In the Fabric Infrastructure tab, choose a fabric edge node (or an extended node, depending on the connection).

5. In the slide-in pane, under the Port Channel tab, click Create Port Channel.

6. Complete the following:

   • Choose an Extended Node in the Connected Device Type drop-down list.

   • Enter a description.

   • Choose Port Aggregation Protocol (PAgP Desirable).

     Starting with Cisco IOS XE Release 17.1.1s, IE 3300 and IE 3400 devices support PAgP.

   • Select On for IE 3300 and IE 3400 devices if they are running versions earlier than Cisco IOS XE Release 17.1.1s.

     Note	Link Aggregation Control Protocol (LACP) doesn’t work for extended node onboarding.

   • Choose the ports to be bundled as a port channel.

7. Click Done.

Step 6

Power up the extended node device if it has no previous configuration. If the extended node device has configurations, reset the device configuration to factory default and reload it.

Step 1

Change the license level on the device from Cisco DNA Essentials to Cisco DNA Advantage, using the Cisco DNA Center License Manager:

1. Click the menu icon () and choose Tools > License Manager.

2. In the Devices tab, select the device.

3. Choose Actions > Change License > Change DNA License.

4. In the Change DNA License Level window, click Advantage.

5. Click Confirm.

6. In the Success message window, click OK.

   The device reloads.

Step 2

Wait for the node to become Reachable and get to the Managed state.

Step 3

If you see a Netconf Connection Refused error, resynchronize the device. Repeat the resynchronization process until the error is no longer displayed.

1. In the Provision > Network Devices > Inventory window, select the device.

2. Choose Actions > Inventory > Resync Device.

Step 4

Upgrade to policy extended node.

1. In the Provision > Fabric Sites window, select the site in which the device is onboarded.

2. In the Fabric Infrastructure tab, click a device to edit its attributes.

3. In the Fabric tab, click the Policy toggle button under Extended Node Attributes.

4. In the Policy Extended Node Upgrade window that is displayed, click Upgrade.

Step 1

Remove the extended node device from the fabric.

1. Click the menu icon () and choose Provision > Fabric Sites.

2. In the Fabric Sites tab, click the number that indicates the count of fabric sites.

3. Select the fabric site that contains the extended node device.

4. In the Fabric Infrastructure tab, click the extended node device.

5. In the slide-in pane, click Remove From Fabric.

6. Click Add.

Step 2

Delete the device from Inventory.

Step 3

For a supplicant-based extended node device, delete the port assignment configuration in the fabric edge node or the FIAB.

Step 1

Click the menu icon () and choose Workflows > Configure REP Ring.

Step 2

If a task overview window appears, click Let's Do It to go directly to the workflow.

Step 3

In the Select a fabric site window, select a site that has both edge node and extended nodes.

Step 4

In the Select a fabric edge node window, choose a fabric edge node.

Step 5

In the Select Extended Nodes connected to Fabric Edge window, choose the extended nodes that connect to the fabric edge node.

Step 6

Review and edit (if necessary) your fabric site, edge node, and extended node selections.

Step 7

To initiate the REP ring configuration, click Provision.

Step 8

The REP Ring Summary window displays the details of the REP ring that is created along with the discovered devices.

Step 9

After the creation of the REP ring, a success message is displayed.

Step 1

In the Cisco DNA Center GUI, click the menu icon () and choose Provision > Fabric Sites.

Step 2

In the Fabric Sites tab, click the number that indicates the count of fabric sites.

Step 3

Select a fabric site from the list that displays all the fabric sites.

Step 4

In the Fabric Infrastructure tab, click the fabric edge node or the fabric in a box (FIAB).

Step 5

In the REP Rings tab, click View to see the REP Ring Topology Status.

Step 1

Click the menu icon () and choose Provision > Fabric Sites.

Step 2

In the Fabric Infrastructure tab, click the fabric edge node that terminates the REP Ring.

Step 3

In the REP Rings tab, for the desired REP Ring, click Actions (…) > Delete.

Step 1

Manually remove the extended node devices from the network.

Step 2

Click the menu icon () and choose Provision > Fabric Sites.

Step 3

In the Fabric Infrastructure tab, click the fabric edge node that terminates the REP ring.

Step 4

In the REP Rings tab, for the desired REP ring, choose Actions (…) > Rediscover.

Step 1

Configure AAA server settings in Cisco DNA Center.

1. Define Cisco ISE as the AAA server for device authentication in the System > Settings > External Services > Authentication and Policy Servers window.

   For the complete procedure, see "Configure Authentication and Policy Servers" in the Cisco DNA Center Administrator Guide.

2. Add the Cisco ISE server to the global site. For information, see Add Cisco ISE or Other AAA Servers.

Step 2

(Optional) Configure Cisco DNA Center to authorize the device before onboarding.

1. Click the menu icon () and choose System > Settings > Device Settings > PnP Device Authorization.

2. Check the Device Authorization check box to enable authorization on the device.

3. Click Save.

Step 3

Configure the Cisco DNA Center appliance to manage your PKI certificates.

1. Click the menu icon () and choose System > Settings > Trust & Privacy > PKI Certificates.

2. In the PKI Certificates window, click Use Cisco DNA Center.

3. In the CA Management tab, click Download CA Certificate.

4. Add the certificate to the Cisco ISE Trusted Certificate Store. For more information, see the Cisco Identity Services Engine Administrator Guide.

   If you use an external certificate, add that certificate to the Cisco ISE Trusted Certificate Store.

Step 4

Configure the DHCP server with the extended IP address pool and Option 43. Ensure that the extended IP address pool is reachable from Cisco DNA Center.

Step 5

Enable Closed Authentication and disable Bridge Protocol Data Unit (BPDU) Guard on the fabric Site.

Step 6

Assign an extended IP address pool to INFRA_VN, as described in Create Anycast Gateways.

Step 7

Connect the extended node device to the fabric edge node or the FIAB.

Step 8

(Optional) Authorize the device.

1. Click the menu icon () and choose Provision > Plug and Play.

2. In the Plug and Play window, select the supplicant-based extended node device and choose Actions > Authorize.

   The authorization process provisions the supplicant-based extended node device for completing a certificate-based EAP-TLS authentication with Cisco ISE. After authentication, Cisco ISE authorizes the supplicant-based extended node device for complete access. The supplicant-based extended node device is then fully onboarded into the SD-Access fabric.

Step 1

To replace the supplicant port, follow these steps:

1. Clear the configuration on the new supplicant port.

2. Copy the existing configuration from the current supplicant port to the new supplicant port to allow 802.1X authentication.

Step 2

To replace the authenticator port, follow these steps:

1. Assign the supplicant port to the new interface of the authenticator. For information on port assignment, see Configure Ports Within the Fabric Site. Choose Supplicant-Based Extended Node as the Connected Device Type.

2. Clear the existing port assignment on the old interface of the authenticator.

Step 3

Disconnect the physical connection between the old ports of the authenticator and the supplicant. Connect a cable between the new ports of the authenticator and the supplicant. Bring this link up.

Step 4

After the link between the new ports of the authenticator and supplicant is up, follow these steps:

1. Resynchronize the device information in Cisco DNA Center by performing an Inventory > Resync Device for both the authenticator and the supplicant. See Resynchronize Device Information.

2. Assign the new supplicant port to the authenticator. For information on port assignment, see Configure Ports Within the Fabric Site. Choose Authenticator Switch as the Connected Device Type.

3. Clear the port assignment on the old supplicant port.

Step 1

Import the CA certificate into Cisco ISE:

Step 2

Configure the following authorization profiles with their RADIUS attributes:

SBEN-DHCP:
Access Type = ACCESS_ACCEPT
Filter-ID = SBEN_DHCP_ACL.in

SBEN_LIMITED_ACCESS_AUTHZ:
Access Type = ACCESS_ACCEPT
Filter-ID = SBEN_MAB_ACL.in
cisco-av-pair = interface-template-name=SWITCH_SBEN_MAB_TEMPLATE

SBEN_FULL_ACCESS_AUTHZ :
Access Type = ACCESS_ACCEPT
cisco-av-pair = interface-template-name=SWITCH_SBEN_FULL_ACCESS_TEMPLATE

Step 3

Define the device profiling policy in the Profiling Policies window.

1. From the Cisco ISE main menu, choose Policy > Profiling > Profiling Policies.

2. In the Profiling Policies window, add a new DHCP-v-i-vendor-class condition for the Cisco-Device: Cisco-Switch policy.

   

3. Create a new child policy for the supplicant device, under Cisco-Switch and apply the CdpCachePlatform and V-I-Vendor-Class conditions.

   Ensure that the Minimum Certainty Factor value for the child policy is higher than that of the parent policy.

   

Step 4

Set the global Change of Authorization (CoA) type to Reauth.

To configure the CoA Type, from the Cisco ISE home page, navigate to Work Centers > Profiler > Settings.

Choose Reauth from the CoA Type drop-down list.

Step 5

Define the authorization policy in the Authorization Policy window.

1. From the Cisco ISE home page, choose Policy > Policy Sets > Default > Authorization Policy.

2. Ensure that the default MAB policy is set to CONTINUE option for the If User not found field.

   

3. In the Authorization Policy window, configure the authorization policies for the supplicant device and associate the policies with the authorization profiles that were created earlier (SBEN-DHCP, SBEN_LIMITED_ACCESS_AUTHZ, SBEN_FULL_ ACCESS_AUTHZ).

   

Step 1

Click the menu icon () and choose Provision > Fabric Sites.

Step 2

Under SUMMARY, click the number that indicates the count of fabric sites.

Step 3

Select a fabric site.

Step 4

In the Fabric Infrastructure tab, click a fabric edge node.

Step 5

In the Port Channel tab of the slide-in pane, click Create Port Channel.

Step 6

From the Connected Device Type drop-down list, choose the type of connected device:

Step 7

Enter a Description for the new port channel.

Step 8

Choose a protocol:

Step 9

From the list of ports displayed, choose the ports to be bundled.

Step 10

Click Done.

Step 1

Click the menu icon () and choose Provision > Fabric Sites.

Step 2

Under SUMMARY, click the number that indicates the count of fabric sites.

Step 3

Select a fabric site.

Step 4

In the Fabric Infrastructure tab, click a fabric edge node.

Step 5

In the slide-in pane, click the Port Channel tab.

Step 6

From the list of port channels displayed, click the port channel to be updated.

Step 7

Update the port channel.

Step 8

Click Done.

Step 1

Click the menu icon () and choose Provision > Fabric Sites.

Step 2

Under SUMMARY, click the number that indicates the count of fabric sites.

Step 3

Select a fabric site.

Step 4

In the Fabric Infrastructure tab, click a fabric edge node.

Step 5

In the slide-in pane, click the Port Channel tab.

Step 6

Check the check box for the port channel and click Delete.

Step 7

At the prompt, click Yes.

Step 1

Click the menu icon () and choose Workflows > Configure Multicast.

Step 2

If a task overview window appears, click Let's Do It to go directly to the workflow.

Step 3

In the Fabric Site window, select a site in the site hierarchy pane.

Step 4

In the Replication Mode window, choose the method of multicast implementation for the network from the following:

Step 5

In the Virtual Networks window, select the virtual network for which you want to set up multicast.

Step 6

In the Multicast pool mapping window, select an IP address pool from the IP Pools drop-down list. The selected IP address pool is associated with the chosen virtual network.

Step 7

In the Multicast Mode window, choose the type of multicast to implement:

• SSM (Source Specific Multicast)

• ASM (Any Specific Multicast)

• Select SSM and ASM to configure both together.

Step 8

Do the following:

1. On selecting SSM, configure the SSM list by adding an IP group range for each virtual network. You can add multiple IP group ranges for a virtual network.

   1. By default, 232.0.0.0/8 range of IPv4 address is selected. You can optionally modify the IPv4 address range.

      Choose an IP group range from 225.0.0.0 to 239.255.255.255.

   2. For IPv6 addresses, FF3x::/32 is reserved for SSM.

2. On selecting ASM, in the Multicast Group to Rendezvous Point Mapping window, configure the rendezvous point for each virtual network:

   1. Choose the type of rendezvous point: External or Fabric.

   2. Configure the rendezvous points in the respective tabs: IPv4 RP and IPv6 RP.

   3. You can define any number of external rendezvous points.

   4. Optionally, you can define a group-to-rendezvous point mapping. There could be one or multiple IPv4/IPv6 multicast groups that are associated with a rendezvous point.

   5. You can either have a rendezvous point with no mapping or with mapping. Both can't be configured together.

   6. The permitted multicast group ranges for IPv6 and IPv4 FF00:/8 and 225.0.0.0/8 - 239.0.0.0/8 respectively.

Step 9

In the Summary window, review the multicast settings. To modify any of the settings, click Edit.

Step 10

In the Deploy Multicast window, click Now or Later to indicate when you want to start the multicast configuration.