This section describes the device roles and the supported network topologies for LAN automation.

Seed device

The seed device is a predeployed system in the network and is the initial point through which LAN automation discovers and onboards new switches downstream. The seed device can be automated through technologies such as Plug and Play (PnP) and zero-touch provisioning or configured manually. Device discovery happens only on the primary seed device interfaces.

The figure illustrates the network boundaries of the seed device from the Catalyst Center connection in the IP core to the underlay network that LAN automation will discover. The peer seed (Seed-2) can also be automated through LAN automation. However, only one seed device is required.

PnP agent

The PnP agent is a Cisco Catalyst switch with factory default settings. The switch uses the built-in day-0 mechanism to communicate with Catalyst Center and support the integrated PnP server function. Catalyst Center dynamically builds the PnP profile and configuration sets that enable complete day-0 automation.

The figure shows the PnP agent physical connection to the seed device.

Automation boundary

In general, we recommend building structured and hierarchical network designs in enterprise networks to provide scalability and redundancy at every network tier. While the three-tier architecture is proven in large-scale enterprise campus networks, the network design varies based on the overall network size and physical connections. As part of the initial planning, the network admin must determine the physical topology to automate with Cisco LAN automation.

LAN automation in Catalyst Center supports a maximum of two hops from the initial automation boundary point device. To build the underlay network up to the access layer, the network admin must start the automation boundary from the core or distribution layer. Any additional network devices beyond two hops might be discovered but cannot be automated.

LAN automation initiates only on directly connected neighbors.

These two scenarios illustrate the LAN automation process in a three-tier network:

• Scenario 1: You have a three-tier network and you want to LAN automate distribution- and access-layer switches. Because distribution-layer switches (which are directly connected to the seed) participate in LAN automation, both distribution- and access-layer switches will be discovered and LAN automated.

• Scenario 2: You have a three-tier network and you want to LAN automate distribution- and access-layer switches. You already LAN automated the distribution layer. Later, you add access-layer switches to your network and you want to LAN automate these switches. Because the distribution switches are already LAN automated and links converted to Layer 3, Tier 1 switches cannot be used as the seed. You must choose distribution as the seed in this scenario.

Multistep LAN automation for large topologies: First pass

Large topologies are brought up by performing LAN automation multiple times. During the first pass, core devices are chosen as seed devices to bring up the distribution switches as new devices.

Note	N is 50 devices or fewer at a time. All switches in the group can be booted in parallel or in a staggered fashion.

Multistep LAN automation for large topologies: Second pass with first group

During the second pass, two of the distribution switches act as seed devices to bring up the edge devices as new devices. All new devices in this session must connect directly to the two distribution switches that act as seed devices. Repeat this process for the remaining set of distribution switches, two at a time.

1. Repeat the second pass for each set of distribution to bring up the access/edge switches (where N is 50 devices or fewer at a time).

2. Connect uplinks from edges to the primary and peer distribution switches only.

3. Power down IOT/extended devices during the LAN automation session.

4. Distribution switches can be connected to other distribution switches.

5. There can be two tiers of devices below the seeds.

6. Always connect new devices to the primary seed device. Connection to the peer seed device is optional.

Multistep LAN Automation for large topologies: Second pass with second group

Edge devices in one group cannot be connected to edge devices in another group. Newly discovered PnP devices in the LAN automation session cannot be connected to existing nonseed inventory devices.

Note	In Catalyst Center 2.3.5 and later, you can establish links between the devices after LAN automation stops using the Add Link feature. For more information, see Create a link between interfaces.

Constraints

• LAN automation does not automate the onboarding of a StackWise Virtual (SVL) switch through PnP. SVL switch can only be used as a seed device.

• LAN automation does not support stack renumbering.

• For platform support, see Supported switches for each role at different layers.

The figure shows supported device families for the seed and PnP agent at different layers.

LAN automation product support matrix

Use the Catalyst Center Design feature to create the required sites, buildings, and floors. Consider how the primary seed and peer seed will be connected to the new devices—for example, will they all belong to the same site or follow a hierarchy? Also consider how to share IP pools across different sites, buildings, and floors. One option is to have a pool specific to a site. Another option is to share a common LAN pool for all sites in the hierarchy. If the devices are onboarded across multiple LAN automation sessions, ensure that the required IP pools are available across the sites within the hierarchy.

Note	You cannot change the site after provisioning the devices. For this reason, we recommend that you complete LAN automation before you provision devices.

To create IP pools for LAN automation, begin with creating a global pool in Catalyst Center, followed by a site-specific LAN IP pool, which LAN automation allocates internally.

LAN IP pool allocation

1. One part of the IP pool is reserved for a temporary DHCP server. The size of this pool depends on the size of the parent LAN pool. For example, if the parent pool is 192.168.10.0/24, a /26 subpool is allocated for the DHCP server. If the pool size is larger than /24, the DHCP pool size is increased up to a maximum of /23 subpool (512 IP addresses). Therefore, a /24 pool reserves 64, a /23 pool reserves 128, a /22 pool reserves 256, and larger pools reserve 512 IP addresses for the DHCP server. To start LAN automation, the pool size must be atleast /25, which reserves a /27 pool or 32 IP addresses for the DHCP pool. This IP pool is reserved temporarily for the duration of the LAN automation discovery session. After the LAN automation discovery session completes, the DHCP pool is released, and the IPs are returned to the LAN pool. Because the DHCP pool is usually the largest contiguous segment of IPs required, the pool should have at least one such segment available. If the pool is too fragmented, it cannot allocate the DHCP pool and the LAN automation session ends with an IP pool allocation error.

2. Another part of the IP pool is reserved internally with a subpool size of /27. This subpool is for allocating single IPs for Loopback0 and Loopback60000 always. Also, two consecutive IPs for point-to-point L3 links are allocated from this subpool if no separate overlapping IP pool is provided. This internally reserved subpool is used throughout the LAN automation sessions for providing IPs as long as it has IPs available. If exhausted, a new /27 subpool is created for allocating IPs. These subpools are released only when all the allocated IPs are released as part of the devices being deleted from Catalyst Center. Otherwise, the subpools remain throughout the process and are not allowed to be removed. Due to this internal subpool allocation logic, the IP pool usage in IPAM counts the subpools instead of the actual IPs allocated to the devices.

3. If a shared or link overlapping IP pool is provided for the point-to-point Layer 3 links, then the subpool of size /27 is reserved internally from the shared pool instead of the main IP pool. The subpools are automatically deleted when all the allocated IPs from the pool are released.

Single and shared IP pool

When a dedicated (single) IP pool is used to build the underlay networks, each of the devices discovered via LAN automation gets a unique /31 per interface for point-to-point connection, and a unique /32 for Loopback0 and the underlay multicast.

A link overlapping IP pool or shared IP pool is used to optimize the IPv4 addressing in the underlay network by allowing overlapping /31 IP addresses for a multisite deployment. Hosts in different sites can get duplicate IP addresses on the /31 links. The /31s in the underlay are not advertised outside of the fabric site and hence there is no need for them to be unique. However, the /32 loopback needs to be unique to every device, and should be advertised to the global routing table to identify the device in the entire network.

IP pool roles

The LAN IP pool can have these two valid roles:

• Link Overlapping IP Pool: This pool role is optional for a LAN automation session. If provided, the allocation of IP addresses is only on the point-to-point Layer 3 links.

• Main IP Pool (Principal IP Address Pool in Catalyst Center Release 2.3.5 and later): This pool role is mandatory for every LAN automation session. This is the pool that is used for all management-related IP addressing such as loopbacks, multicast, and DHCP. If the Link Overlapping IP Pool is not provided, then the Main IP Pool is the default fallback pool for the Layer 3 links IP addressing.

IP address allocation in Catalyst Center Release 2.3.7.x and later

In Catalyst Center Release 2.3.7.x and later, IP address allocation from LAN pool is based on IP address range instead of subnet allocation. This approach helps in minimizing the issue of IP address loss during subnet creation and in effective management of the IP addresses. Instead of creating a subnet, IP address range is blocked for both DHCP pool allocation and IP address assignment for point-to-point links, loopback, and multicast. The LAN automation workflow supports assignment of IP address pools with /27, /28, and /29 subnet masks.

IP pool usage example

Imagine you want to LAN automate 10 devices using the same pool, where each device has one link to the primary seed and another link to the secondary.

Consider a 192.168.199.0/24 pool. When LAN automation starts, a /26 pool is reserved for the DHCP addresses. In this example, 192.168.199.1 to 192.168.199.63 are reserved and assigned to VLAN 1 for the 10 devices.

Next, a /27 pool is reserved for loopback addresses. If there is no shared IP pool, then this pool is used for point-to-point links as well. Because there are 10 devices with two links each, a total of 2*10*2 = 40 IP addresses are reserved for point-to-point links, and 10 loopback addresses are reserved.

In total, 60 IP addresses are reserved for the 10 devices: 10 for each VLAN 1, 10 for each loopback, and 40 for the point-to-point links between devices and seeds.

After LAN automation stops, the VLAN 1 IP addresses are released back to the pool, and 90 addresses are allocated for the LAN automation session.

Guidelines for IP pool allocation

• The same IP pool can be used for multiple discovery sessions. For example, you can run one discovery session and discover the first set of devices. After discovery completes, you can provide the same IP pool for a subsequent LAN automation session. Similarly, you can choose one LAN pool for one discovery session and another LAN pool for a second discovery session.

  Note	When the seed device for LAN automation session is in a different site than the discovered device site, then the same shared IP pool cannot be used with the same seed and different discovered device site. This is to avoid the allocation of duplicate IP to the same seed device.

• Every time you start LAN automation, it checks for 64 available IP addresses in the IP pool. If you decide to run LAN automation multiple times with the same pool, use at least a /24 pool. If you plan to LAN automate only once for the IP pool, a /25 pool suffices.

• Avoid using an address pool that is already utilized elsewhere in the network, such as an address pool that belongs to the loopback or to other addresses configured on the device.

To start LAN automation, a site-specific CLI and SNMPv2 read or SNMPv3 configuration is required. Use the Catalyst Center Design feature to configure the site-specific CLI and SNMP configurations. Save the site configuration used for LAN automation. When you configure credentials globally, they become visible at the site level. You must click the radio button for the specific site and then save the configuration to make it available for LAN automation.

Note	SNMPv2 write credentials are not required. If they are configured, they will not be pushed to the device during LAN automation.

Follow these guidelines when configuring the seed devices:

• Ensure that the system MTU (maximum transmission unit) value is at least 9100.

• Turn on IP routing on the seed devices.

• Set up routing between the seed service and Catalyst Center so that Catalyst Center has IP reachability to the LAN IP pool subnet.

• We recommend that you use the default interfaces connected to PnP agents. If the peer seed device has IP interfaces configured on the interfaces connected to PnP agents, those links are not configured. If you want to configure the peer device interfaces connected to PnP agents, use the default interfaces and perform an inventory synchronization on the peer seed device. LAN automation works only when the ports are Layer 2. The ports on the Cisco Catalyst 6000 Series Switches are Layer 3 by default. Convert the ports to Layer 2 before starting LAN automation.

• Configure device credentials and SNMP credentials on the seed devices.

• If the seed devices have Layer 3 interfaces configured, ensure that there are no conflicts with any of the IP pools provided in Catalyst Center. Check the IP addresses which are configured manually.

• Ensure that the seed devices don't have any other interfaces connected to another DHCP server running in VLAN 1.

• LAN automation configures loopback on the seed devices if they are not configured.

• If you change configuration on the seed devices before running LAN automation, synchronize the seed devices with the Catalyst Center inventory.

• Assign the seed devices to a site. (It is not necessary to provision the seed devices for LAN automation.)

Additional recommended configurations on seed devices

Ensure that the device that you want to LAN automate is running the Advantage license level. Otherwise, you cannot execute certain commands.

Note	Catalyst Center 2.3.5 and later support automatic license upgrade for C9000 and C3850 series switches.

New PnP agents have factory defaults and are ready to start LAN automation.

If you are reusing existing network devices, follow these steps:

1. Ensure that PnP agents have the required license to execute LISP, IS-IS routing, and CTS-related CLI commands. Use the show license command to view the current license level. If required, upgrade the license.

2. Ensure that PnP agents do not have stale certificates or keys from the previous runs.

3. Use these commands to restore the switch configurations to factory default:

   • For Cisco IOS XE 16.11 and earlier, use:

     [CLI config mode]
     
         no pnp profile pnp-zero-touch
         no crypto pki certificate pool
         Also remove any other crypto certs shown by "show run | inc crypto"
         crypto key zeroize
         config-register 0x2102 or 0x0102 (if not already)
         do write
         end

     [CLI exec mode]
     
         delete /force nvram:*.cer
         delete /force stby-nvram:*.cer (if a stack)
         delete /force flash:pnp-reset-config.cfg
         write erase 
         reload (enter no if asked to save)

   • For Cisco IOS XE 16.12.x or later, use:

     [CLI exec mode]
     
     pnpa service reset no-prompt
     
     

Stop LAN automation to finish discovering required devices and to prevent inadvertent discovery of additional devices.

When LAN automation stops, these actions occur:

• The remainder of the configuration is pushed to network devices, which includes converting the point-to-point links from Layer 2 to Layer 3.

• The configuration for VLAN 1 is removed, and the IP addresses for VLAN 1 are returned to the LAN automation pool.

• The device is onboarded in Catalyst Center and assigned to the site.

Stop LAN automation process

1. In the LAN Automation Status window, click Stop.

   

2. After the LAN automation stop process starts, the LAN Automation Status changes to STOP in Progress.

3. The network orchestration service issues a synchronization operation (RESYNC) for seed and PnP devices to retrieve the state of all links. After the initial RESYNC completes, the service pushes the Layer 3 configuration on all Layer 2 links. It then reissues RESYNC to resynchronize the cluster's link state.

   The Layer 3 link configuration is pushed when network orchestration stops. Each interface pair receives its configuration.

   For example, here is a sample configuration:

   interface GigabitEthernet1/0/13
    description Fabric Physical Link
    no switchport
    dampening
    ip address 192.168.2.97 255.255.255.252
    ip router isis
    logging event link-status
    load-interval 30
    bfd interval 500 min_rx 50 multiplier 3
    no bfd echo
    isis network point-to-point
   

4. After all the point-to-point links between the seeds and discovered devices, including links between peer seed and discovered devices, are configured, the devices are added to the site and synced to Catalyst Center.

5. The LAN automation process completes and the LAN Automation Status changes to Completed.

6. Check the LAN automation logs to verify the status.

   

This section shows how to add an existing switch that was already present in Catalyst Center.

If the switch was previously LAN-automated, either as part of another stack or as a standalone device, or was discovered by PnP, remove the switch physically before adding it. Next, remove its entry from the inventory, and from the PnP application or database

Remove the switch from inventory

Remove the switch from PnP