Smart Switch

• CPU—Central Processing Unit (CPU)—Controls and manages the switch; handles general control-plane tasks such as operating system processes, managing the device, routing protocols, logging, and system coordination.

• NPU—Network Processing Unit (NPU)—High-speed packet-forwarding engine; optimized for network traffic processing such as switching, routing, filtering, and traffic handling.

• DPU—Data Processing Unit (DPU)—Specialized programmable data processing engine; hosts services such as security, telemetry more efficiently.

• Modes—Two modes that the Smart Switch operates in, network and DPU security mode. The default mode is network mode. To use the DPU security mode, you need to enable feature service acceleration.

• Hypershield—A controller application designed to protect modern datacenters. Hypershield is a distributed security architecture that provides hardware-accelerated security policy enforcement using DPU technology. Hypershield centrally manages and distributes policies across all enforcement points, ensuring consistent security across the entire network.

  The N9300 Smart switch serves as a Network-Based Enforcer for implementing and managing security policies across the network. You can view the N9300 Smart switch in Hypershield under Network-based enforcers in Hypershield. For more information, refer to the Cisco Hypershield User Documentation.

• Hypershield Agent—A containerized agent that receives Security configurations and policies from Hypershield and pushes them to the DPU complex that in-turn configures security rules on DPUs. The Hypershield Agent constructs flow logs and exports them.

• Network Security Operations administrator role—A specialized role (netsecops-admin) available only on the N9300 Smart Switches that has the privileges to execute the commands within the DPU and the Hypershield agent container. For more information, refer to User Accounts and RBAC for Smart Switches.

• DPU security mode—The N9300 Smart Switch DPU security mode differs from the Security Firewall product as well as the network security features in N9000 Series Switches. The Smart Switch, when used in DPU security mode, provides a distributed, stateful Layer-4 segmentation and DPU security enforcement directly within the switch using embedded Data Processing Units (DPUs).

  To use the DPU security mode, you need to enable feature service acceleration. When the DPU is in a powered-on state, the switch works in both network and DPU security modes. When the DPU is in a powered-off state, the switch works in a network-only mode.

From the NX-OS command line interface you can:

• manage the traffic redirection to the DPU

• configure network policies, and

• observe network analytics, and topology.

From the Hypershield, you can:

• manage and monitor security policies

• orchestrate the usage of security policies, and

• observe security policies and ensure security compliance.

• Cisco N9324C-SE1U NX-OS-Mode Switch Hardware Installation Guide

• Cisco N9348Y2C6D-SE1U NX-OS Mode Switch Hardware Installation Guide

• For Optics support on the N9300 Series Smart Switches, refer to Cisco Optics-to-Device Compatibility Matrix

• N9300 Series Smart Switch Data Sheet

• For network mode support features documentation, refer to Cisco Nexus 9000 Series Switches

• For details about Hypershield, refer to Cisco Hypershield User Documentation, Cisco Hypershield Reference Documentation, and Cisco Hypershield Release Notes.