An Administrator can design a network hierarchy that reflects multiple sites spread across multiple geographies. This hierarchy provides a consolidated view of the area, buildings, and floors which house nodes comprising of switches, routers, wireless controllers, IOT nodes, and access points. These nodes are discovered by Cisco DNA Center using the Discovery tool (which leverages automation). The administrator can then assign these nodes to the corresponding sites without needing to be physically present at any of these sites. Access points are added to the Cisco DNA Center inventory via the PnP workflow, which intelligently assigns them to the corresponding wireless controllers.

Cisco Identity Services Engine (ISE) is integrated with Cisco DNA Center through a PxGrid association. This association inherently gets to know the Cisco ISE clustered environment with Active/Standby pxGrid and PAN personas. The following figure illustrates the Cisco ISE persona information displayed by Cisco DNA Center on the System 360 page.

In Cisco DNA Center's Network Settings page, you can map multiple Policy Service Nodes (PSN) to the appropriate sites in order to efficiently manage and load balance the policy service requests propagating across different locations.

The network devices assigned to the site in this example create a Network Access Device entry for the equivalent devices in Cisco ISE.

The intent to be consumed has been designed in Cisco DNA Center until the previous step. The device provisioning workflow takes care of converting the intent into CLIs. The AAA/RADIUS configurations would then be provisioned on the corresponding network node, which completely binds the node in the RADIUS and Group-based Policy boundary for the Access, Distribution, and Core/Router device roles. Wireless controllers are brought into the Group-based Policy boundary with the help of Template Programmer.

Administrators can segment users, guests, and IoT/medical devices into the appropriate logical network to limit the movement of threats around a network.

In this section, we'll describe an end-to-end use case that covers communication between hospital staff, who access critical patient records with CTS enforcement points being the wireless and wired segments. A basic knowledge of group-based policies is a prerequisite for understanding this use case.

Not all endpoints in a wireless network support the 802.1x supplicant for secure attachment. The endpoints that don't can use WPA-PSK instead. Since all users in the same WLAN using PSK share the same preshared key, it exposes the key to possible misuse, resulting in unauthorized access. To overcome this security gap, IPSK allows you to assign a unique preshared key to a particular user or user group. IPSK security can be further enhanced with peer-to-peer blocking when there is a requirement to disallow users with the same PSK (or users in the same or different WLANs) from interacting with each other.

The following diagram illustrates users connected to the same WLAN with the allow-private-group option enabled in the WLAN profile. In this scenario, the users which were authorized by the same authorization profile on Cisco ISE are able to communicate with each other (since they share the same IPSK tag). Users with different IPSK tags were authorized using unique Cisco ISE authorization profiles. As a result, these users will not be able to communicate with each other. For a description of how to enable peer-to-peer blocking, see the "Create a Model Config Design for Advanced SSID" topic in the Cisco DNA Center User Guide.

9840-ha#show wireless client summary ipsktag 
Number of Clients: 5

MAC Address    AP Name                                        State            Ipsk Tag
-----------------------------------------------------------------------------------------------
009a.d2f0.591a AP687D.B402.D02C                             Run              b0a8b704cbc54008 
6887.c6f0.6176 AP687D.B402.D02C                              Run              7166848ee93a1c8f
98af.65a6.d966 AP7079.B333.8CD2                              Run              ea52373d6bfc33f0
b2aa.e402.9228 AP687D.B402.D02C                             Run              b0a8b704cbc54008
d037.45a7.f5f1 AP84F1.4782.1858                                 Run              b0a8b704cbc54008

Cisco DNA Center has a rogue management application which detects and classifies WLAN threats and enables the network administrator/operator to monitor them. Rogue APs are used to hack sensitive information in the WLAN. Consider a hacker transmitting a series of Clear to Send (CTS) frames, which mimic an AP instructing one client to transmit while instructing other clients to wait, which results in a disruption of service to the legitimate clients. A user could also plug in a rogue AP in the WLAN and build an ad-hoc network to intercept network traffic and hijack client sessions. Cisco DNA Center constantly monitors all nearby APs and automatically discovers and collects information about rogue APs. When Cisco DNA Center receives a rogue event from a managed AP, it responds in the following ways:

• If the unknown AP is not managed by Cisco DNA Center, Cisco DNA Center applies the rogue classification rules.

• If the unknown AP is not using the same SSID as your network, Cisco DNA Center verifies whether the AP is connected to the corporate wired network and extends to the wired network. If the rogue AP is physically connected to the corporate network's switch port , Cisco DNA Center classifies the AP as Rogue on wire. Cisco switches managed by Cisco DNA Center are required for the Rogue on wire feature to work.

• If the AP is unknown to Cisco DNA Center and is using the same SSID as your network, Cisco DNA Center classifies the AP as Honeypot.

• If the unknown AP is not using the same SSID as your network and is not connected to the corporate network, Cisco DNA Center verifies whether it is causing any interference. If it is, Cisco DNA Center classifies the AP as an Interferer and marks the rogue state as Potential Threat. The threshold level for classifying interferers on the network is greater than -75 dBm.

• If the unknown AP is not using the same SSID as your network, and is not connected to the corporate network, Cisco DNA Center verifies whether it is a neighbor. If it is, Cisco DNA Center classifies the AP as Neighbor and marks the rogue state as Informational. The threshold level for classifying the rogue AP as a neighbor AP is less than or equal to -75 dBm.

The Cisco Adaptive Wireless Intrusion Prevention System (aWIPS) is a wireless intrusion threat detection and mitigation app. With this fully infrastructure-integrated solution, you can continually monitor wireless traffic on both wired and wireless networks. Instead of waiting until damage or exposure has occurred, you can use this network intelligence to pinpoint attacks and proactively prevent new attacks. For more information on the Rogue Management and aWIPS apps, see the Cisco DNA Center Rogue Management and aWIPS Application Quick Start Guide.

Cisco DNA Center supports the following standard signatures, which detect the various denial of service (DoS) attacks:

• authentication flood

• association flood

• CTS Flood

• RTS Flood

• broadcast Probe

• disassociation Flood

• disassociation Broadcast

• deauthentication flood

• deauthentication broadcast

• EAPOL logoff flood

Cisco DNA Center's Stealthwatch Security Analytics (SSA) application can be used during the provisioning of Catalyst access switches to exercise ETA/NaaS use cases. Healthcare organizations must ensure that the most secure TLS libraries and cipher suites are used for communications between wired workstations throughout a medical facility and EHR systems, regardless of where the workstations and EHR systems are deployed. As access to EHR services in the cloud becomes more common (and in some cases, required), these communications need to be analyzed more closely for any signs of suspicious activity.

The intraflow metadata, or information about the events that occur inside of a flow, can be collected, stored, and analyzed within a flow monitoring framework. This data is especially valuable when traffic is encrypted because deep-packet inspection is no longer viable. This intraflow metadata, called Encrypted Traffic Analytics (ETA), is derived by using new data elements or telemetry that is independent of protocol details, such as the lengths and arrival times of packets within a flow. These data elements apply equally well to both encrypted and unencrypted flows. ETA extracts two main data elements: the initial data packet (IDP) and the sequence of packet length and time (SPLT). These elements are then communicated using a dedicated NetFlow template to Cisco Stealthwatch Enterprise.

When used in conjunction with Flexible NetFlow, a complete view of the flow's life is available, allowing you to identify malicious traffic as well as anomalous behavior and customizable policy violations in your network. When implementing ETA, in addition to cryptographic assessment, the metadata collected can be used to detect malware within the encrypted traffic without the need to decrypt the traffic when Cisco Stealthwatch is integrated with Cognitive Intelligence. When Flexible NetFlow and DNS information is combined with the ETA metadata found in the IDP, other ETA data elements (such as the sequence of packet length and times (SPLT)) provide a valuable way to identify malware through the detection of suspicious traffic. By default, only traffic (including DNS queries) that crosses the enterprise network perimeter outside of the enterprise address space (i.e. internet-bound traffic) is sent to the Cognitive Intelligence cloud for malware analysis. All traffic is monitored, and records are exported to the Cisco Stealthwatch flow collector. After processing, the flow collector sends only the metadata for this external traffic to the Cognitive Intelligence cloud in an encrypted TLS tunnel for further analysis. All other internal traffic is processed by the flow collector for conformance with the policies established in Cisco Stealthwatch, as well as for the cryptographic assessment based on ETA data. The following diagram depicts communication between a local medical server, a bedside monitor, and a nurse's workstation, as well as communications between these devices and a cloud-based EHR system. For more information about enabling SSA on access switches, see the Stealthwatch Security Analytics Service on Cisco DNA Center User Guide.

The Cisco AI Endpoint Analytics application provides next-generation endpoint visibility by pairing AI-driven analytics with network-driven deep-packet inspection. The majority of endpoints in the healthcare segment are Internet of Things (IoT)-based. This positions security as a major challenge for network administrators as they monitor these endpoints. Consider the case of a doctor plugged in to a patient’s health monitoring device, which is connected to the hospital's network. What if this device spread malware throughout the network, resulting in widespread issues? Cisco AI Endpoint Analytics comes to the rescue by minimizing the damage.

The first step in securing the endpoints is to identity the type of the devices, which is also known as endpoint profiling. Endpoint Analytics does its best to identify the maximum number of unknown endpoints in the enterprise network based on Deep Packet Inspection (DPI) and Machine Learning (ML). Endpoint profiling starts with aggregating and analyzing endpoint data from various data sources. Examples of these data sources include network devices or appliances supporting deep packet inspection and Cisco Identity Services Engine (ISE). Cisco AI Endpoint Analytics provides granular endpoint profiling details by defining the endpoint type, manufacturer, model, and operating system. The endpoints are profiled based on the combination of 400 available attributes.

The second step in securing the endpoints is to determine whether the profiled endpoint exhibits anomalous behavior, which ends up compromising network security. Trust Scores are assigned to the profiled endpoints, based on its trustworthiness in the network. The value ranges from 1 (low trust) to 10 (high trust). These Trust Scores are calculated using all of the available insights, such as endpoint authentication and compliance and endpoint anomaly detection. For more information about the the Cisco AI Endpoint Analytics application, see the Cisco DNA Center User Guide.

Cisco wireless mobility solutions aim to improve the efficiency of healthcare services. Physicians on rounds could use their wireless laptops to update patient charts, which helps other staff members stay up-to-date with the latest information. Dieticians and nurses could check for the latest orders and review test results using wireless tablets. Patients would no longer need to wait in an admission queue. The registration clerk, armed with a wireless tablet, could help a patient complete registration while they wait to be seen. Seamless mobility for a large number of clients is essential for supporting uninterrupted voice and data services. Fast roaming, such as CCKM and 802.11r/k/v, is enabled for this vertical. 802.11r, which is the IEEE standard for fast roaming, introduces a new roaming concept called Fast Transition (FT), where the initial handshake with the new AP is done even before the client roams to the target AP. The initial handshake allows the client and APs to do the Pairwise Transient Key (PTK) calculation in advance. These PTK keys are applied to the client and AP after the client sends a reassociation request or response exchange with the new target AP.

The FT key hierarchy is designed to allow clients to make fast BSS transitions between APs without requiring reauthentication at every AP. For a client to move from its current AP to a target AP using the FT protocols, the message exchanges are performed using one of the following two methods:

• Over-the-Air: The client communicates directly with the target AP using IEEE 802.11 authentication with the FT authentication algorithm.

  

• Over-the-DS: The client communicates with the target AP through the current AP. Client and target AP communication is carried in FT action frames between the client and the current AP, which are then sent through the controller.

  

As more and more interactive applications use wireless infrastructures, QoS becomes increasingly important. QoS allows network managers to establish SLAs with network users. It enables more efficient network resource sharing, expedites the handling of mission critical applications, and prioritizes time-sensitive multimedia and voice application traffic. QoS does this by:

• Reserving dedicated bandwidth for critical users and applications

• Controlling jitter and latency (required by real-time traffic)

• Managing and minimizing network congestion

• Shaping network traffic to smooth traffic flow

• Setting network traffic priorities

In a healthcare environment, QoS implementation is a policy decision and the applications used in different environments will dictate their QoS policy.

Cisco DNA Center enables the provision of the AutoQoS Fastlane during SSID creation for the prioritization of the traffic originating from Apple clients.

The following configurations are pushed to the wireless controller during WLC provisioning by Cisco DNA Center:

wireless profile policy 9840-local_Floor1_NF_5bfebcd0
 aaa-override
 accounting-list default
 autoqos mode fastlane
 cts inline-tagging
 cts role-based enforcement
 description 9840-local_Floor1_NF_5bfebcd0
 dhcp-tlv-caching
 exclusionlist timeout 180
 http-tlv-caching
 radius-profiling
 service-policy input platinum-up
 service-policy output platinum
 vlan Vlan510

Various built-in AutoQoS profiles are classified into different macros, based on the traffic characterization:

• Enterprise

• Voice

• Guest

As part of the NBAR2-based Application QoS policy on IOS-XE based wireless controllers, Cisco DNA Center provisions the Cisco Validated Design Queuing profile.

Cisco DNA Center bases its marking, queuing, and dropping treatments on IETF RFC 4594, as well as the business relevance category that you have assigned to the application. For more information, see the "Application Policies" topic in the Cisco DNA Center User Guide.

The following is a sample configuration:

9840-hca#show policy-map 9840-local_DNA-MARKING_0550e02f 
  Policy Map 9840-local_DNA-MARKING_0550e02f
    Class 9840-local_VOICE_0550e02f
      set dscp ef
    Class 9840-local_TRANS_DATA_0550e02f
      set dscp af21
    Class 9840-local_SCAVENGER_0550e02f
      set dscp cs1
    Class 9840-local_REALTIME_0550e02f
      set dscp cs4
    Class 9840-local_MM_STREAM_0550e02f
      set dscp af31
    Class 9840-local_BROADCAST_0550e02f
      set dscp cs5
    Class 9840-local_OAM_0550e02f
      set dscp cs2
    Class 9840-local_SIGNALING_0550e02f
      set dscp cs3
    Class 9840-local_MM_CONF_0550e02f
      set dscp af41
    Class 9840-local_CONTROL_0550e02f
      set dscp cs6
    Class 9840-local_BULK_DATA_0550e02f
      set dscp af11
    Class class-default
      set dscp default

Cisco DNA Center offers a wireless guest anchoring solution that does the following:

• Provisions the servicing wireless controllers as foreign controllers.

• Provisions the anchor controllers in the DMZ area (which acts as a gateway for guest users to reach the internet).

Guest traffic is tunnelled via CAPWAP all the way from the servicing APs attached to the foreign controller to the anchor controller in the DMZ.

wireless profile policy guest-camp_Global_GA_7ae528ce
 aaa-override
 accounting-list default
 description guest-camp_Global_GA_7ae528ce
 dhcp-tlv-caching
 exclusionlist timeout 180
 http-tlv-caching
 mobility anchor 90.1.1.7 priority 3
 mobility anchor 90.1.1.8 priority 3
 nac
 service-policy input silver-up
 service-policy output silver
 no shutdown
!
wlan guest-camp_Global_GA_7ae528ce 18 guest-campus2
 mac-filtering dnac-cts-guest-camp-1d1eb5df
 no security ft adaptive
 no security wpa
 no security wpa wpa2
 no security wpa wpa2 ciphers aes
 no security wpa akm dot1x
 no shutdown

Anchor Guest

wireless profile policy guest-camp_Global_GA_7ae528ce
 aaa-override
 accounting-list default
 description guest-camp_Global_GA_7ae528ce
 dhcp-tlv-caching
 exclusionlist timeout 180
 http-tlv-caching
 mobility anchor
 nac
 service-policy input silver-up
 service-policy output silver
 vlan Vlan91
 no shutdown
!
wlan guest-camp_Global_GA_7ae528ce 22 guest-campus2
 mac-filtering dnac-cts-guest-camp-1d1eb5df
 no security ft adaptive
 no security wpa
 no security wpa wpa2
 no security wpa wpa2 ciphers aes
 no security wpa akm dot1x
 no shutdown

Wired guest access allows the wired port to connect to the manufacturer's or vendor's website for equipment maintenance, software, or firmware updates. Wired guest sessions are connected to the designated wired Ethernet ports and are completed using the configured authentication method (OPEN or Webauth). Wired guest sessions are terminated at the guest anchor controller in the DMZ through the CAPWAP tunnel originating from the guest foreign controller. Wired guest access is a two-controller solution with a guest anchor and a guest foreign controller. This type of deployment isolates the wired guest traffic from enterprise user traffic.

Foreign Guest

wireless profile policy PP_PGN-VIP-Wired
guest-lan enable-session-timeout
 mobility anchor 90.1.1.8 priority 3
 no shutdown
!
guest-lan profile-name PP_PGN-VIP-Wired 1 wired-vlan 515
 no security web-auth
 no shutdown

Anchor Guest

wireless profile policy PP_PGN-VIP-Wired
guest-lan enable-session-timeout
 mobility anchor
 vlan Vlan91
 no shutdown
!
guest-lan profile-name PP_PGN-VIP-Wired 1
 no security web-auth
 no shutdown

Patient and healthcare device mobility is essential for high-quality patient care. Cisco DNA Center addresses these use cases with the CMX and Cisco Spaces integration, which tracks the mobile assets such as wifi tags, laptops, and phones.

The Cisco Spaces connector is installed on premises, which establishes an NMSP connection with the wireless controllers. Via this connection, aggregated data is relayed from the controllers and access points to Cisco Spaces. For information on setting up the Cisco Spaces connector, see the "Prerequisites" chapter in the Cisco Spaces: Connector Configuration Guide.

The Cisco Spaces connector/CMX is then mapped to the corresponding site in Cisco DNA Center's Wireless Network Settings page and provision the wireless controller to push the NMSP mapping to the Cisco Spaces connector on the WLC.

The access points are placed under the corresponding floors in the wireless maps configured in Cisco DNA Center's Network Hierarchy page. The same positioning of the access points is reflected in Cisco Spaces (in the Detect and Locate application). This application also tracks the clients associated to access points, as well as Rogue APs, Rogue Clients, and Interferers. The medical assets that have wifi asset tags attached to them can also be tracked in Cisco Spaces.

The following topology depicts the logical flow of events and illustrates how Cisco Spaces and Cisco DNA Center are in sync:

• Cisco DNA Center is registered with Cisco Spaces.

• The WLC is registered with the Cisco Spaces connector.

• The Cisco Spaces connector forwards the aggregate details of APs and endpoints in the WLAN to Cisco Spaces.

• Cisco DNA Center's wireless maps are synced with Cisco Spaces.

• Cisco Space's Detect and Locate application forwards client map locations to the wireless maps maintained by Cisco DNA Center. For more information on Cisco DNA Center's integration with Cisco Spaces, see the "Cisco DNA Center Integration" chapter in the Cisco Spaces Configuration Guide.

Healthcare networks need to be resilient enough to provide continuous service. The high availability feature (AP SSO/Client SSO) is especially important to achieve this goal. Cisco DNA Center allows you to form an RP+RMI HA setup, which involves connecting two physical wireless controllers to form an active and standby pair with a single control/data plane. At any given time, there is a single CAPWAP tunnel between an access point and the active WLC. Also, the AP database for both the active and standby WLCs are in sync. Whenever a failover occurs, the standby WLC becomes the new active WLC. And since it already has the details of the connected access point in its database, the APs never have to go down and reestablish the CAPWAP tunnel. It results in a seamless failover where the AP continues to stay up. Similarly, the wireless clients in the RUN state are synced between the active and standby WLCs. During a failover, clients do not have to reassociate and are able to maintain a continuous session.

Cisco DNA Center also provides N+1 HA functionality, offering controller redundancy of controllers across multiple geographies. Unlike the RP+RMI HA setup, AP SSO and Client SSO are not supported by N+1 setups. Whenever the primary controller fails, the APs disconnect from it and then join the secondary backup controller, which results in the restart of the CAPWAP state machine. After the primary controller resumes operation, the APs disconnect from the backup controller and rejoin the primary WLC. For more information, see the "Cisco DNA Center Configuration for N+1 High Availability" topic in the Cisco Catalyst 9800 Wireless Controller N+1 High Availability White Paper.

Cisco DNA Center offers the In-Service Software Upgrade (ISSU), which allows you to upgrade an HA-enabled wireless controller to a newer Cisco DNA Center version without disrupting data forwarding in your network. If you use the ISSU, note that you can only upgrade to a newer major version (in other words, you can't upgrade to a point or patch version).

You'll need to complete the following tasks when using an ISSU:

1. Onboard the controller's software image to flash memory.

2. Download the access point image to the relevant access point.

3. Install the controller's software image.

4. Commit your changes.

For more information about this feature, see the "Upgrade a Software Image with ISSU" topic in the Cisco DNA Center User Guide.

High availability (HA) isn't exclusive to wireless controllers. Cisco DNA Center also extends HA to access points, thanks to the rolling access point upgrade feature. When enabled, this feature provides the following benefits:

• Allows for staggered access point upgrades in an N+1 topology.

• Ensures that continuous service is available to users connected to the network while an upgrade is taking place.

• Automatically selects candidate access points using RRM-based neighbor information and the user-specified percentage for the upgrade: 5, 15 (default), or 25.

For more information about this feature, see the "About N+1 Rolling AP Upgrade" topic in the Cisco DNA Center User Guide.