In the Cisco Wide Area Bonjour service filter policy configuration XLS template, the Selective Services (Advanced) sheet is deprecated. For advanced service routing scenarios where service distribution from Cisco DNA Center must be limited to a specific user endpoint (connected port) or VLAN, you can use location groups.

General Feature Support

Plug and Play supports the following features, depending on the Cisco IOS software release on the device:

• AAA device credential support: The AAA credentials are passed to a device securely and the password is not logged. This feature allows provisioning a device with a configuration that contains the aaa authorization commands. This feature requires software release Cisco IOS 15.2(6)E1, Cisco IOS 15.6(3)M1, Cisco IOS XE 16.3.2, or Cisco IOS XE 16.4 or later on the device.

• Image install and upgrade for Cisco Catalyst 9200 Series, Catalyst 9300 Series, Catalyst 9400 Series, Catalyst 9500 Series, Catalyst 3650 Series, and Catalyst 3850 Series switches are supported only when the switch is booted in install mode. (Image install and upgrade are not supported for switches booted in bundle mode.)

Secure Unique Device Identifier Support

The Secure Unique Device Identifier (SUDI) feature that allows secure device authentication is available on the following platforms:

• Cisco routers:

  • Cisco Catalyst IR 1800 Series with software release Cisco IOS XE 17.5.1 and later

  • Cisco ISR 1100 Series with software release Cisco IOS XE 16.6.2

  • Cisco ISR 4000 Series with software release Cisco IOS XE 3.16.1 or later, except for the ISR 4221, which requires release Cisco IOS XE 16.4.1 or later

  • Cisco ASR 1000 Series (except for ASR 1002-x) with software release Cisco IOS XE 16.6.1

• Cisco switches:

  • Cisco Catalyst 3850 Series with software release Cisco IOS XE 3.6.3E or Cisco IOS XE 16.1.2E or later

  • Cisco Catalyst 3650 Series and 4500 Series with Supervisor 7-E/8-E, with software release 3.6.3E, Cisco IOS XE 3.7.3E, or Cisco IOS XE 16.1.2E or later

  • Cisco Catalyst 4500 Series with Supervisor 8L-E with software release Cisco IOS XE 3.8.1E or later

  • Cisco Catalyst 4500 Series with Supervisor 9-E with software release Cisco IOS XE 3.10.0E or later

  • Cisco Catalyst 9300 Series with software release Cisco IOS XE 16.6.1 or later

  • Cisco Catalyst 9400 Series with software release Cisco IOS XE 16.6.1 or later

  • Cisco Catalyst 9500 Series with software release Cisco IOS XE 16.6.1 or later

  • Cisco Catalyst IE3300 Series with software release Cisco IOS XE 16.10.1e or later

  • Cisco Catalyst IE3400 Series with software release Cisco IOS XE 16.11.1a or later

  • Cisco Catalyst IE9300 Series with software release Cisco IOS XE 17.8.1 or later

• NFVIS platforms:

  • Cisco ENCS 5400 Series with software release 3.7.1 or later

  • Cisco ENCS 5104 with software release 3.7.1 or later

Note

Devices that support SUDI have two serial numbers—the chassis serial number and the SUDI serial number (called the License SN on the device label). You must enter the SUDI serial number in the Serial Number field when adding a device that uses SUDI authentication. The following device models have a SUDI serial number that is different from the chassis serial number: Cisco routers: Cisco ISR 43xx, Cisco ISR 44xx, Cisco ASR1001-X/HX, and Cisco ASR1002-HX Cisco switches: Cisco Catalyst 4500 Series with Supervisor 8-E/8L-E/9-E, and Catalyst 9400 Series

Management Interface VRF Support

Plug and Play operates over the device management interface on the following platforms:

• Cisco routers:

  • Cisco ASR 1000 Series with software release Cisco IOS XE 16.3.2 or later

  • Cisco ISR 4000 Series with software release Cisco IOS XE 16.3.2 or later

• Cisco switches:

  • Cisco Catalyst 3650 Series and 3850 Series with software release Cisco IOS XE 16.6.1 or later

  • Cisco Catalyst 9300 Series with software release Cisco IOS XE 16.6.1 or later

  • Cisco Catalyst 9400 Series with software release Cisco IOS XE 16.6.1 or later

  • Cisco Catalyst 9500 Series with software release Cisco IOS XE 16.6.1 or later

4G Interface Support

Plug and Play operates over a 4G network interface module on the following Cisco routers:

• Cisco 1100 Series ISR with software release Cisco IOS XE 16.6.2 or later

• Cisco Catalyst IR 1800 Series

Cloud Connectivity Through SSL Intercept Guidelines

Some Cisco DNA Center applications, such as the Cisco AI Network Analytics agent on the Cisco DNA Center appliance, require establishing a secure communication to the cloud with mutual authentication, using X.509 certificates.

In addition to direct connectivity, use of a proxy is also supported, as long as the SSL communication is terminated directly at the agent and cloud endpoint, without any SSL interception device in between.

Caution

Cloud connection through an SSL intercept device is not supported and might result in connectivity failures.

Backup and Restore Guidelines

• You cannot take a backup of one version of Cisco DNA Center and restore it to another version of Cisco DNA Center. You can only restore a backup to an appliance that is running the same Cisco DNA Center software version, applications, and application versions as the appliance and applications from which the backup was taken.

• After performing a restore operation, update your integration of Cisco ISE with Cisco DNA Center. After a restore operation, Cisco ISE and Cisco DNA Center might not be in sync. To update your Cisco ISE integration with Cisco DNA Center, choose System > Settings > Authentication and Policy Servers. In the Actions column, click Edit adjacent to the corresponding server. Enter your Cisco ISE password to update.

• After performing a restore operation, the configuration of devices in the network might not be in sync with the restored database. In such a scenario, you should manually enter the CLI commands that are pushed for authentication, authorization, and accounting (AAA) and configuration on the network devices. See the corresponding network device documentation for information about the CLI commands to enter.

• Re-enter the device credentials in the restored database. If you updated the site-level credentials before the database restore, and the backup that is being restored does not have the credential change information, all the devices go to partial collection after the restore. You must then manually update the device credentials on the devices for synchronization with Cisco DNA Center, or perform a rediscovery of those devices to learn the device credentials.

• Perform AAA provisioning only after adjusting network device differential changes to the restored database. Otherwise, device lockouts might occur.

• You can back up and restore only Automation data or both Automation and Assurance data. But you cannot use the GUI or the CLI to back up or restore only Assurance data.

Cisco ISE Integration Guidelines

• ECDSA keys are not supported as either SSH keys for Cisco ISE SSH access or in the certificates in Cisco DNA Center and Cisco ISE.

• Full certificate chains must be uploaded to Cisco DNA Center while replacing an existing certificate. If a Cisco DNA Center certificate is issued by a subCA of a rootCA, the certificate chain uploaded to Cisco DNA Center while replacing the Cisco DNA Center certificate must contain all three certificates.

• Self-signed certificates applied on Cisco DNA Center must have the Basic Constraints extension with cA:TRUE (RFC5280 section-4.2.19).

• The IP address or FQDN of both Cisco ISE and Cisco DNA Center must be present in either the Subject Name field or the Subject Alt Name field of the corresponding certificates.

• If a certificate is replaced or renewed in either Cisco ISE or Cisco DNA Center, trust must be re-established.

• The Cisco DNA Center and Cisco ISE IP address or FQDN must be present in the proxy exceptions list if there is a web proxy between Cisco DNA Center and Cisco ISE.

• Cisco DNA Center and Cisco ISE nodes cannot be behind a NAT device.

• Cisco DNA Center and Cisco ISE cannot be integrated if the Cisco ISE Admin and Cisco ISE pxGrid certificates are issued by different enterprise certificate authorities.

  Specifically, if the Cisco ISE Admin certificate is issued by CA server A, the Cisco ISE pxGrid certificate is issued by CA server B, and the pxGrid persona is running on a node other than Cisco ISE PPAN, the pxGrid session from Cisco DNA Center to Cisco ISE does not work.

Device Onboarding Guidelines

For IE-3200-8P2S-E/A, IE-3200-8T2S-E/A, IE-3300-8P2S-E/A, and IE-3300-8T2S-E/A devices with Cisco IOS XE 17.8.1 or later, we recommend that you boot the devices in install mode before onboarding them.

If you upgrade an onboarded IE3200 or IE3300 device to Cisco IOS XE 17.8.1 or later, ensure that the device is in install boot mode before upgrading.

Upgrade Limitation

In-Service Software Upgrade (ISSU) is not supported in Cisco SD-Access deployments.

License Limitations

• After changing the enterprise IP address or FQDN, before you attempt a licensing-related task, all services must be up and running.

• The Cisco DNA Center License Manager supports Smart Licensing only for wireless controller models that run Cisco IOS XE. The License Manager does not support Smart License registration of the Cisco 5500 Series AireOS Wireless Controller when the connection mode is smart proxy.

• The Cisco DNA Center License Manager does not support the following operations under Actions > Manage License Reservation for Cisco IOS 17.3.2 and later:

  • Enable License Reservation

  • Update License Reservation

  • Cancel/Return License Reservation

  • Factory License Reservation

Fabric Limitations

• IP address pools that are reserved at the area level are inherited at the building level in the Design > Network Settings > IP Address Pools window. However, these IP address pools are not listed in the Host Onboarding window if the fabric site is defined at the building level. If the fabric site is defined at the building level, you must reserve the IP address pools at the building level. If the fabric site is defined at the area level, you must reserve the IP address pools at the area level.

  To work around this issue, release and reserve the IP address pool at the same level (area or building) as the fabric site, or reconfigure the fabric site at the same level as the reserved IP address pool.

• Cisco DNA Center supports only native multicast across multiple fabric sites that are connected by an SD-Access transit. Head-end replication is not supported over SD-Access transit.

• Multicast routing over LISP/BGP SD-Access transit is not supported.

Existing Feature-Related Limitations

• Cisco DNA Center cannot learn device credentials.

• You must enter the preshared key (PSK) or shared secret for the AAA server as a part of the import flow.

• Cisco DNA Center does not learn the details about DNS, WebAuth redirect URL, and syslog.

• Cisco DNA Center can learn device configuration only once per controller.

• Cisco DNA Center can learn only one wireless controller at a time.

• For site profile creation, only the AP groups with AP and SSID entries are considered.

• Automatic site assignment is not possible.

• SSIDs with an unsupported security type and radio policy are discarded.

• For authentication and accounting servers, if the RADIUS server is present in the device, it is given first preference. If the RADIUS server is not present, the TACACS server is considered for design.

• The Cisco ISE server (AAA) configuration cannot be learned through existing device provisioning.

• The authentication and accounting servers must have the same IP addresses for them to be learned through existing device provisioning.

• When an SSID is associated with different interfaces in different AP groups, during provisioning, the newly created AP group with the SSID is associated with the same interface.

• A wireless conflict is based only on the SSID name and does not consider other attributes.

High Availability Limitation

Cisco DNA Center does not support HA for the Cisco Embedded Wireless Controller on Catalyst Access Points.

Wireless Policy Limitation

If an AP is migrated after a policy is created, you must manually edit the policy and point the policy to an appropriate AP location before deploying the policy. Otherwise, the Policy Deployment failed message is displayed.

AP Limitations

• Configuring APs in FlexConnect mode before provisioning the locally switched WLANs bypasses the AP provisioning error. Otherwise, AP provisioning fails when the locally switched WLANs are provisioned on the wireless controller or APs through Cisco DNA Center.

  After the provisioning failure, the AP rejoins the wireless controller. You can reprovision the AP for a successful provisioning.

• The Cisco Catalyst 9130AXE AP with antenna C-ANT9104 does not support the Disable option for Dual Radio mode.

• The Cisco Catalyst 9124AXE AP does not support the Auto option for Dual Radio mode.

Inter-Release Controller Mobility (IRCM) Limitation

The interface or VLAN configuration is not differentiated between foreign and anchor controllers. The VLAN or interface that is provided in Cisco DNA Center is configured on both foreign and anchor controllers.

IP Device Tracking Limitations

• With IPDT on trunk ports, rogue-on-wire detection is impacted. Cisco DNA Center does not show all the clients connected to a switch through an access point in bridge mode. The trunk port is used to exchange all the VLAN information. When you enable IP device tracking on the trunk port, clients connected on the neighbor switch are also shown. Cisco DNA Center does not collect client data if the connected interface is a trunk port and the neighbor is a switch. As a best practice, disable the IP device tracking on the trunk port. Rogue-on-wire is not detected if IP device tracking is enabled on the trunk port.

• When you add a line card to a chassis, or remove a line card from a chassis, the changes take several minutes to get updated on Cisco DNA Center. IPDT configurations, if any, are pushed to the device automatically for newly added interfaces.

• When you add a device to a stack pool, or remove a device from a stack pool, the changes take several minutes to get updated on Cisco DNA Center. IPDT configurations, if any, are pushed to the device automatically for newly added interfaces.

  To add or remove a device from the stack, you must use manual CLI configurations.

Encryption Limitation with SNMPv3

AES192 and AES256 encryption is not fully supported for SNMPv3 configuration. If you add devices with AES192 or AES256 encryption to Cisco DNA Center, Assurance data is not collected for those devices.

As a workaround, to collect Assurance data, add a device with AES128 encryption. Cisco DNA Center supports AES128 and gathers Assurance data for devices with AES128 encryption.

IPv6 Limitations

If you choose to run Cisco DNA Center in IPv6 mode:

• Access Control Application, Group-Based Policy Analytics, SD Access, and Cisco AI Endpoint Analytics packages are disabled and cannot be downloaded or installed.

• Communication through Cisco ISE pxGrid is disabled because Cisco ISE pxGrid does not support IPv6.

• LAN automation is not supported.

• Adding devices to a site is supported, but provisioning is not.

• ITSM integration is not supported.

• Cisco DNA Center does not support integration with Cisco ISE when it’s also configured for IPv6. It only supports the use of Cisco ISE as a AAA server.

Cisco Plug and Play Limitations

• Virtual Switching System (VSS) is not supported.

• The Cisco Plug and Play mobile app is not supported with Plug and Play in Cisco DNA Center.

• The Stack License workflow task is supported for Cisco Catalyst 3650 and 3850 Series switches running Cisco IOS XE 16.7.1 and later.

• The Plug and Play agent on the switch is initiated on VLAN 1 by default. Most deployments recommend that VLAN 1 be disabled. If you do not want to use VLAN 1 when PnP starts, enter the following command on the upstream device:

  pnp startup-vlan <vlan_number> 

Cisco Group-Based Policy Analytics Limitations

• Cisco Group-Based Policy Analytics supports up to five concurrent requests based on realistic customer data. While it is desirable for GUI operations to respond within 5 seconds or less, for extreme cases based on realistic data, it can take up to 20 seconds. There is no mechanism to prevent more than five simultaneous requests at a time, but if it does happen, it might cause some GUI operations to fail. Operations that take longer than 1 minute, time out.

• Data aggregation occurs at hourly offsets from UTC in Cisco Group-Based Policy Analytics. However, some time zones are at a 30-minute or 45-minute offset from UTC. If the Cisco DNA Center server is located in a time zone with a 30-minute or 45-minute offset from UTC, and the client is located in a time zone with an hourly offset from UTC, or vice versa, the time ranges for data aggregation in Cisco Group-Based Policy Analytics are incorrect for the client.

  For example, assume that the Cisco DNA Center server is located in California PDT (UTC-7), where data aggregations occur at hourly offsets (8:00 a.m., 9:00 a.m., 10:00 a.m., and so on). When a client located in India IST (UTC+5.30) wants to see the data between 10:00 to 11:00 p.m. IST, which corresponds to the time range 9:30 to 10:30 a.m. PDT in California, no aggregations are seen.

• Group changes that occur within an hour are not captured. When an endpoint changes from one security group to another, Cisco Group-Based Policy Analytics is unaware of this change until the next hour.

• You cannot sort the Security Group and Stealthwatch Host Group columns in the Search Results window.

• You might see discrepancies in the information related to Network Access Device (including location) between Assurance and Cisco Group-Based Policy Analytics.

Application Telemetry Limitation

When configuring application telemetry on a device, Cisco DNA Center might choose the wrong interface as the source for NetFlow data.

To force Cisco DNA Center to choose a specific interface, add the netflow-source command in the description of the interface. You can use a special character followed by a space after netflow-source, but not before it. For example, the following syntax is valid:

netflow-source
MANAGEMENT netflow-source
MANAGEMENTnetflow-source
netflow-source MANAGEMENT
netflow-sourceMANAGEMENT
netflow-source & MANAGEMENT
netflow-source |MANAGEMENT

The following syntax is invalid:

MANAGEMENT | netflow-source
* netflow-source
netflow-source|MANAGEMENT

IP Address Manager Limitations

• Infoblox limitations:

  • Infoblox does not expose a name attribute; therefore, the comment field in Infoblox is populated by the IP pool name during a sync.

  • For a pool import, the first 50 characters of the comment field are used. If there are spaces in the comments, they are replaced by underscores.

  • If an IP pool name is updated for an imported pool, the comments are overwritten and the new name is reflected.

• BlueCat: There are no limitations identified with BlueCat integration at this time.

• You may see the following error when editing an existing IPAM integration or when adding a new IPAM manager:

  NCIP10283: The remote server presented a certificate with an incorrect CN of the owner

  To correct this, regenerate a new certificate for IPAM and verify that any one of the following conditions are met:

  • No values are configured in the SAN field of the certificate.

  • If a value is configured, the value and type (IP address or FQDN) must match the configured URL in the System > Settings > External Services > IP Address Manager window.

• Cisco DNA Center supports integration with an external IPAM server that has trusted certificates. In the Cisco DNA Center GUI, under System > Settings > External Services > IP Address Manager, you may see the following error message:

  NCIP10282: Unable to find the valid certification path to the requested target.

  To correct this error for a self-signed certificate:

  1. Using OpenSSL, enter one of the following commands to download the self-signed certificate, depending on your IPAM type. (You can specify the FQDN [domain name] or IP address in the command.)

     • openssl s_client -showcerts -connect Infoblox-FQDN:443

     • openssl s_client -showcerts -connect Bluecat-FQDN:443

  2. From the output, use the content from ---BEGIN CERTIFICATE--- to ---END CERTIFICATE--- to create a new .pem file.

  3. Go to System > Settings > Trust & Privacy > Trustpool, click Import, and upload the certificate (.pem file).

  4. Go to System > Settings > External Services > IP Address Manager and configure the external IPAM server. (If the IPAM server is already configured, skip this step.)

  To correct this error for a CA-signed certificate, install the root certificate and intermediate certificates of the CA that is installed on the IPAM, into the Cisco DNA Center trustpool (System > Settings > Trust & Privacy > Trustpool).

• You may see the following error if a CA-signed certificate is revoked by the certificate authority:

  NCIP10286: The remote server presented with a revoked certificate. Please verify the certificate.

  To correct this, obtain a new certificate from the certificate authority and upload it to System > Settings > Trust & Privacy > Trustpool.

• You may see the following error after configuring the external IPAM details:

  IPAM external sync failed:
  NCIP10264: Non Empty DNAC parent pool <CIDR> exists in external ipam.

  To correct this, do the following:

  1. Log in to the external IPAM server (such as BlueCat).

  2. Confirm that the parent pool CIDR exists in the external IPAM server, and remove all the child pools that are configured under that parent pool.

  3. Return to the Cisco DNA Center GUI and reconfigure the IPAM server under System > Settings > External Services > IP Address Manager.

• You may see the following error while using IP Address Manager to configure an external IPAM:

  NCIP10114: I/O error on GET request for "https://<IP>/wapi/v1.2/":
  Host name '<IP>' does not match the certificate subject provided by the peer
  (CN=www.infoblox.com, OU=Engineering, O=Infoblox, L=Sunnyvale, ST=California, C=US);
  nested exception is javax.net.ssl.SSLPeerUnverifiedException: Host name '<IP>'
  does not match the certificate subject provided by the peer (CN=www.infoblox.com, OU=Engineering,
  O=Infoblox, L=Sunnyvale, ST=California, C=US) |

  To correct this, do the following:

  1. Log in to the external IPAM server (such as Infoblox).

  2. Regenerate your external IPAM certificate with the common name (CN) value as the valid hostname or IP address. In the preceding example, the CN value is www.infoblox.com, which is not the valid hostname or IP address of the external IPAM.

  3. After you regenerate the certificate with a valid CN value, go to System > Settings > Trust & Privacy > Trustpool.

  4. Click Import and upload the new certificate (.pem file).

  5. Go to System > Settings > External Services > IP Address Manager and configure the external IPAM server with the server URL as the valid hostname or IP address (as listed as the CN value in the certificate).

Reports Limitation

Reports with significant data can sometimes fail to generate in the Cisco DNA Center platform. If this occurs, we recommend that you use filters to reduce the report size to prevent such failures.

Custom Application Limitation

If a custom application is configured as a part of the default bucket, Cisco DNA Center doesn't push the configuration to the managed devices.