Cisco and Molex Digital Building Solution Implementation Guide
Bias-Free Language
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
- Updated:
- October 19, 2017
Chapter: Cisco and Molex Digital Building Solution Implementation Guide Document
Cisco and Molex Digital Building Solution
Implementation Guide
The Cisco® Systems and Molex® end-to-end Digital Building Solution is a network-based connected lighting system that uses the Cisco Universal Power over Ethernet (UPOE) switching products and Molex Coresync products to provide indoor lighting services in the enterprise network.
The Cisco and Molex Digital Building Solution Cisco Reference Design (CRD) consists of a Design Guide, which provides overall guidance on the solution design, and this Implementation Guide.
This document provides implementation details for the Cisco and Molex Digital Building Solution initial installation, migrating the lighting initial setup to a production campus network topology and on-going lighting system management and maintenance.
This Cisco and Molex Digital Building Solution Implementation Guide provides the implementation details for the system topologies as discussed in the “System Architecture” section of the Cisco and Molex Digital Building Solution Design Guide.
Note: The Cisco and Molex Digital Building Solution Design Guide, which is referred to frequently in this document, will be simply referred to as “Design Guide” going forward.
The scope of this document is limited to implementation of lighting network for initial installation, migrating the lighting setup to an enterprise campus network topology as described in the “System Architecture” section of the Design Guide.
Note: Detailed configuration steps for implementing Molex Lighting system are covered in the Molex Coresync Manager User Guide that is referenced in this document, wherever applicable.
The detailed implementation of Cisco Campus Network architecture is beyond the scope of this document. For more details on Campus LAN Network architecture, refer to the Design Zone for Campus Wired and Wireless LAN, which can be found at the following URL:
■
http://www.cisco.com/c/en/us/solutions/design-zone/networking-design-guides/campus-wired-wireless.html#~validate
The audience of this guide comprises, but is not limited to, system architects, network/compute design engineers, systems engineers, field consultants, Cisco Advanced Services specialists, and customers who are deploying the Cisco and Molex Digital Building Solution.
Readers should be familiar with IPv4 networking concepts and protocols, Networking Layer 4 through Layer 7 services and Cisco Catalyst Series Switches, Cisco Unified Computing System (UCS), and VMware hypervisors.
This section provides the high-level implementation flow for deploying the Cisco and Molex Digital Building Solution on a campus network topology that is described in the design guide. It is suggested to follow this implementation flow when deploying the solution on system topologies with campus network core and aggregation as described in the “System Architecture” section of the Design Guide.
Figure 1 Cisco and Molex Digital Building System Implementation Workflow
System Overview
This section, which provides an overview of the Cisco and Molex Digital Building Solution implementation, includes the following major topics:
System Topology
Different network topologies exist in which the Digital Building Solution can be deployed based on the customer's requirements when the installation will be done.
For more details on deployment topologies, refer to the “System Architecture” section of the Design Guide.
Figure 1 above show the physical network topology for a lighting network integration with a Campus Network, where wiring closet access switches (Cisco Catalyst 3850 standalone and Cisco Catalyst 3850 stack) connect to the campus network aggregation/distribution switch (Cisco Catalyst 4500-X). In this deployment, the aggregation switch aggregates lighting wiring closet switches and provides IP addressing to light fixtures using Dynamic Host Configuration Protocol (DHCP). The aggregation switch in the campus network collapsed core/distribution layer connects to the data center via a firewall. The firewall allows only management traffic from the lighting network to flow to the data center.
Figure 2 shows the Cisco Catalyst 3850 switch as an example data center switch for the server farm's network access. However, any data center switch that is recommended or implemented in the campus data center design can be leveraged to configure network access to servers.
Note: The campus network topology shown in Figure 2 is one of the deployment models of campus network architectures (that is, the Collapsed Core Network topology) considered for the system test bed. The detailed implementation of the campus network for enterprise network services is beyond the scope of this document. For detailed implementation and best practices for deploying the campus network, refer to the Cisco Campus Network Design Guide at the following URL:
■ http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Campus/HA_campus_DG/hacampusdg.html
Figure 2 Cisco and Molex Digital Building Solution on a Campus Network Topology with Cisco Catalyst 3850 Switches and Stack in Wiring Closet
System Components
The components validated within this system consist of a mix of Cisco products (see Table 1) and Molex products (see Table 2).
Terminal Access Controller Access Control System+ (TACACS+) authentication and authorization server for network devices |
||
LED POE light with integrated occupancy and Ambient Light sensors |
||
Molex Gateway Firmware |
||
Molex Sensor Board Firmware |
||
Molex Tablet Software - ZoneID |
||
Molex Tablet Software - EUT |
||
Table 3 is the list of third party infrastructure components used in the system.
System Networking
The network-powered lighting system should deploy on a separate logical network (VLAN). It is suggested to use one VLAN or a network segment (subnet) for 500 light fixtures to reduce the size of the broadcast domains in the network. Therefore, an additional VLAN should be created for deploying more than 500 light fixtures. Each VLAN requires the Molex MoDiag application to set the Molex Coresync Manager IP address with which light fixtures can communicate.
This section summarizes the logical network (VLAN) configuration for the Cisco and Molex Digital Building Solution network. In Table 4, which is an example list of VLANs implemented for this solution, the subnet mask “255.255.252.0” is used for 500 light fixtures per VLAN as recommended in the Design Guide.
Note: The VLANs shown in Table 4 are only examples that are used in this Cisco and Molex Digital Building Solution. VLAN numbering will vary based on your actual deployment.
Initial Installation of Lighting Network
The Cisco and Molex Digital Building Solution uses UPOE switches for the deployment scenarios discussed in the Cisco and Molex Digital Building Design Guide. This chapter, which covers implementation details for the initial installation (Day 0), includes the following major topics:
■Initial Installation with Cisco Catalyst 3850 UPOE Switch
■Light Fixture Initial Installation
During the initial installation, the electrician will install the light fixture on a wiring closet switches (Cisco Catalyst 3850) with the default factory configuration to verify the light fixture's operation.
Initial Installation with Cisco Catalyst 3850 UPOE Switch
This section covers the network topology and configuration required on the Cisco Catalyst 3850 switch for the initial installation of light fixtures.
Network Topology
During the initial installation, light fixtures are connected to the wiring closet Cisco Catalyst 3850 UPOE access switch or to the switch stack, as shown in the network topology in Figure 3.
Figure 3 Cisco and Molex Digital Building Solution Initial Setup on Wiring Closet Cisco Catalyst 3850 Switch
Configuring Cisco Catalyst 3850 UPOE Switch for Initial Installation
Molex Light Fixtures Installation
A technician using an UPOE switch generally performs the initial installation of Molex light fixtures at the installation site.
When the light fixtures are connected to a Cisco Catalyst 3850 UPOE switch port, the light fixtures turn on with low brightness; this verifies the light fixtures' hardware operation.
Initial Network Setup
An IT network engineer or the commissioning engineer generally perform the initial installation of the lighting network.
Prerequisites for Initial Installation
Perform the following prerequisite step for initial lighting network setup:
The Cisco Catalyst 3850 switch supports Perpetual and Fast PoE features (described in Lighting Migration to Campus Network Architecture) on the 16.9.1 switch IOS software release. Therefore, it is suggested to upgrade the switch IOS image to version 16.9.1 before beginning lighting network installation.
1. Enable Link Layer Discovery Protocol (LLDP) on the switch global configuration as shown below. LLDP is required to be enabled on the switch for the Molex light fixtures' power negotiation and operation.
2. Enable 2-event classification on all the light ports:
3. Configure Switched Virtual Interface (SVI) for default VLAN 1:
Light Fixture Initial Installation
This section covers IP addressing using the DHCP server and initial commissioning of light fixtures using Molex MoDiag.
Configuring DHCP Server for Light Fixture IP Addressing
Commissioning the Molex light fixtures for the initial installation verifies the light fixture operation and control using the Molex MoDiag and Coresync Manager application. The light fixture requires IP addresses to be assigned in the network to perform setup for initial provisioning.
During the initial installation, the DHCP server IP addressing pool for light fixtures and wall dimmers is configured on the Cisco Catalyst 3850 access switch on the wiring closet to assign IP addresses to Molex endpoints.
Table 5 is an example DHCP pool range for Molex light fixtures.
Configure the DHCP server on the Cisco Catalyst 3850 access switch. For example:
Configuring MoDiag for Light Fixture Provisioning
Perform the steps described in this section for installing and configuring the Molex Coresync Manager.
Installing Molex MoDiag
Refer to the Installation Procedure in the Molex Coresync Manager Installation Guide for installing Molex MoDiag.
Provisioning Light Fixtures
Refer to the Molex Coresync Commissioning Guide and Molex Coresync Manager User Guide for detailed instructions on initial provisioning of the light fixtures.
Verifying and Upgrading Light fixture Firmware
The light fixture's firmware version can be verified on the MoDiag application after the MoDiag connects to the light fixture.
Refer to the Molex Coresync Commissioning Guide for upgrading firmware on Molex endpoints. Also, verify the firmware version after the successful upgrade by following the instructions provided in the MoDiag User Guide.
Lighting Migration to Campus Network Architecture
This chapter covers the implementation details for migrating a lighting deployment installed as an “initial install” to a converged campus network architecture. Lighting migration to campus network topology is also discussed in more detail in the “System Architecture” section of the Design Guide.
Implementation of networking Layer 2 and Layer 3, and security features required for network powered lighting with campus network deployment is discussed in following major topics:
■Campus Network Core/Aggregation Switch Cisco Catalyst 4500-X
■Wiring Closet Access Switch (Cisco Catalyst 3850)
■Wiring Closet Access Switch Stack (Cisco Catalyst 3850 Stack)
■Implementing Data Center Applications for Lighting
Network Topology
During migration, the access switches in the wiring closet (Cisco Catalyst 3850 standalone or stack) connect to a production campus network core/aggregation switch with separate logical networks for Molex light fixtures, as shown in Figure 4 and Figure 5.
Figure 4 Cisco and Molex DBS on Campus Network Architecture with Cisco Catalyst 3850 Access Switch
Figure 5 Cisco and Molex DBS Large Scale Deployment on Campus Network Architecture with Cisco Catalyst 3850 Switch Stack
Campus Network Core/Aggregation Switch Cisco Catalyst 4500-X
The lighting network UPOE access switches (Cisco Catalyst 3850 standalone or stack) are connected to campus network aggregation switches when migrating from an initial lighting setup to a converged campus network/large scale deployment. The detailed implementation of the campus network architecture is beyond the scope of this document.
Cisco Catalyst 4500-X switches deployed in a pair, which provides campus network core, aggregation services, and Layer 3 routing functionalities for the lighting endpoints in the access layer. The implementation of the Cisco Catalyst 4500-X switch in a large scale network powered lighting architecture with security features, as described in the “System Design” section of the Design Guide, is covered in this section.
Configuring Virtual Switching System
The system topology in Figure 4 above shows one of the implementations of the campus network aggregation as a collapsed core/distribution model for this Cisco and Molex Digital Building Solution. The aggregation Cisco Catalyst 4500-X switches implement Virtual Switching System (VSS) to provide network redundancy at the aggregation layer.
A VSS combines a pair of Cisco Catalyst 4500-X series switches into a single network element. The VSS manages the redundant links, which externally act as a single port channel. The VSS also simplifies network configuration and operation by reducing the number of Layer 3 routing neighbors and by providing a loop-free Layer 2 topology.
Note: The lighting network converges to a production campus network where VSS may not be required to be implemented at the network aggregation level. In this case, VSS configuration steps are not required to be performed.
For the detailed implementation of VSS on the Cisco Catalyst 4500-X switch, refer to the Catalyst 4500 Series Switch Software Configuration Guide, IOS XE 3.9.xE and IOS 15.2(5)Ex at the following URL:
■ http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/XE3-9-0E/15-25E/configuration/guide/xe-390-configuration/vss.html
Configuring Network Layer 2 and Layer 3
This section defines the implementation of VLANs and Layer 3 logical interfaces on the Cisco Catalyst 4500-X switch.
1. Configure VLANs, which must be created along with ports assignment on the Cisco Catalyst 4500-X switch:
2. Create Layer 3 SVI for the lighting VLANs. The example configuration below shows SVIs for the lighting VLANs and network management VLAN on the Cisco Catalyst 4500-X switch:
Note: When migrating the lighting initial setup to a converged campus network, remove the SVIs of lighting VLANs that you may have created on wiring closet access switches. SVIs for lighting VLANs are configured at core/aggregation switches that provide Layer 3 services to the lighting network.
3. Create port channel interfaces on the Cisco Catalyst 4500-X to the wiring closet switches (Cisco Catalyst 3850 standalone and stack), and ASA firewall in the network as shown below:
4. Enable EtherChannel on the appropriate physical switch ports connected to the Cisco Catalyst 3850 standalone, stack, and ASA. The following configuration shows the port channel assignment to switch physical ports:
Physical links to the Cisco Catalyst 3850 switch stack in wiring closet:
Physical links to the Cisco Catalyst 3850 switch in wiring closet:
Physical links to the ASA 5585 Firewall switch:
5. The following commands add static default routes to the ASA:
6. Enable rapid per-vlan spanning tree:
Configuring DHCP Server for Light Fixture IP Addressing
When migrating the lighting initial setup to a converged campus network, the DHCP server IP addressing pool for light fixtures and wall dimmers is configured on the Cisco Catalyst 4500-X aggregation switch to assign IP addresses to Molex endpoints, as shown in Figure 4.
Note: Make sure to remove the DHCP server configuration on the wiring closet access or director switches (Cisco Catalyst 3850) that was performed on the initial lighting setup.
Table 6 shows an example DHCP pool range for Molex endpoints.
Perform the following step to configure the DHCP server pool on the Cisco Catalyst 4500-X aggregation switch for lighting network:
Configure DHCP pools for light fixture on the Cisco Catalyst 4500-X:
Configuring Security Features
Security features in the lighting network are important to protect light fixtures from network attacks like IP address from untrusted DHCP servers, Address Resolution Protocol (ARP) attacks, Denial of Service (DoS) attacks, and broadcast storms. If proper security configurations are not implemented on switches, the light fixtures and the whole network become more susceptible to such attacks. Therefore, features such as DHCP snooping, Port security, ARP inspection, and ARP rate limiting will enable security on the switch and its ports to keep the network safe.
This section defines the recommended Layer 2 security features to be enabled within the campus network on the Cisco Catalyst 4500-X. For a detailed description of the Layer 2 security features, refer to the Cisco Catalyst 4500-X Configuration Guide at the following URL:
■ http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/XE3-9-0E/15-25E/configuration/guide/xe-390-configuration/vss.html
IP DHCP Snooping (Optional)
IP DHCP snooping is needed on the Cisco Catalyst 4500-X switch only if a separate centralized DHCP server exists that is connected to the Cisco Catalyst 4500-X. In that case, the Cisco Catalyst 4500-X also needs to be configured as a DHCP relay agent.
DHCP snooping is a security feature that acts like a firewall between untrusted hosts and trusted DHCP servers. The DHCP snooping feature determines whether traffic sources are trusted or untrusted. An untrusted source may initiate traffic attacks or other hostile actions. To prevent such attacks, the DHCP snooping feature filters messages and rate-limits traffic from untrusted sources.
When light fixtures are powered on, they request an IP address from a DHCP server. IP DHCP snooping ensures that only DHCP packets received on trusted ports that are sent by the server are forwarded to the lights.
Perform the following steps on the Cisco Catalyst 4500-X switch to configure IP DHCP snooping.
Note: The DHCP snooping table does not match the IP Source Guard table and the light fixtures don't receive the IP address properly. Therefore, the DHCP snooping feature will not work as expected in this CRD release.
1. Configure the required port as DHCP snooping trusted port:
2. Enable IP DHCP snooping globally for the per-port command to take effect:
IP Source Guard
IP Source Guard is a security feature that restricts IP traffic on untrusted Layer 2 ports by filtering traffic based on the DHCP snooping binding database or manually configured IP source bindings. This feature helps prevent IP spoofing attacks when a host tries to spoof and use the IP address of another host.
Only the IP-to-MAC bindings learnt on the Cisco Catalyst 4500-X on trusted ports will be allowed to send or receive traffic. All the packets received on trusted ports with a different binding to a particular MAC will be dropped.
Note: The DHCP snooping table does not match the IP source guard table and the light fixtures don't receive the IP address properly. Therefore, the IP Source Guard feature will not work as expected in this CRD release.
Perform the following step on the Cisco Catalyst 4500-X switch to configure IP Source Guard:
Configure the IP Source Guard on the downlink port channel interfaces to the Cisco Catalyst 3850 stack and standalone switches that have trusted IP-to-MAC bindings:
ARP Inspection (Optional)
Since it is highly unlikely that attackers will connect to the free ports of the Cisco Catalyst 4500-X, configuring Dynamic ARP Inspection (DAI) on the Cisco Catalyst 4500-X is optional.
DAI is a security feature that validates ARP packets in a network. DAI intercepts, logs, and discards ARP packets with invalid IP-to-MAC address bindings. This capability protects the network from some man-in-the-middle attacks.
Lights or any other devices connected on untrusted ports of the Cisco Catalyst 4500-X will be automatically put in an error disabled state so that the device won't be able to get access to the network.
Perform the following steps on the Cisco Catalyst 4500-X switch to configure ARP Inspection:
1. Configure the required port channels as an ARP Inspection-trusted port, as shown in this example configuration:
2. Enable Global ARP Inspection for the required VLANs so that the per-port command takes effect:
Storm Control
A traffic storm occurs when packets flood the LAN, creating excessive traffic and degrading network performance. You can use the traffic Storm Control feature to prevent disruptions on Layer 2 ports by a broadcast, multicast, or unicast traffic storm on physical interfaces.
A broadcast or unicast storm is usually capable of creating a loss of access to the light fixtures and Storm Control Manager (SCM) depending on the port bandwidth consumed by the storm. Therefore, keeping Storm Control limits the propagation of such packets to the light fixtures and maintains proper access to the light fixtures for the SCM.
Perform the following configuration on the Cisco Catalyst 4500-X switch to configure Storm Control:
Configure the Storm Control for broadcast or unicast traffic according to the maximum and minimum allowable threshold percentage of line rates:
Disabling Telnet
Since Telnet is not secure, it should be disabled for accessing the device. The following commands disable Telnet and enable only Secure Shell (SSH) access to the Cisco Catalyst 4500-X switch:
Configuring Network Management (SNMP)
Simple Network Management Protocol (SNMP) is used in the lighting network to manage and monitor the switches in the lighting network.
SNMP traps are configured to send light fixtures ports up/down status alerts to a network management server (Cisco Prime Infrastructure 3.0) that helps monitor light fixture's port status.
Configuring Switch Network Management
The SNMPv3 protocol configuration is used on the Cisco Catalyst 4500-X switch for network management. Perform the following steps to configure SNMP v3:
Figure 6 Network Management SNMP Configuration Flow
5. Verify that the SNMP user, group and view have been created using the following CLI:
Wiring Closet Access Switch (Cisco Catalyst 3850)
This section covers wiring closet access switch Cisco Catalyst 3850 stack, Layer 2, Layer 3 networking, security configuration, and network management configurations.
Removing the Initial Installation Configuration
When migrating the initial lighting setup on the Cisco Catalyst 3850 switch on the wiring closet to a campus network, follow the steps below to configure the Cisco Catalyst 3850 switch:
1. Remove the DHCP pool from the switch by issuing a no command:
2. Remove the IP address for VLAN 1:
Configuring Network Layer 2 and Layer 3
This section defines the implementation of VLANs and logical SVI for management traffic on the Cisco Catalyst 3850 switch. The LLDP and 2-event must have been already enabled in the initial installation.
1. Configure VLANs, which must be created along with ports assignment on the Cisco Catalyst 3850 switch stack. The following is an example VLAN configuration:
2. Configure switch ports connecting to light fixtures/wireless gateway on appropriate lighting VLAN in access mode:
3. Provide shutdown and no shutdown CLI commands on the switch ports where light fixtures and Coresync gateways are connected. This enables lights fixtures to initiate DHCP requests to obtain IP addresses on the newly configured VLANs.
Note: The shutdown and no shutdown on the interfaces will cause momentary disruption on light fixtures. Light fixtures then illuminate and will become fully operational for controls once the new IP addresses are assigned after the light fixtures are re-commissioned using Molex applications.
4. Create Layer 3 SVI for the management VLAN and default gateway as required. The following is an example configuration of management VLAN SVI on the Cisco Catalyst 3850 switch stack:
5. Create port channel uplink interfaces on Cisco the Catalyst 3850 to campus network aggregation switch (Cisco Catalyst 4500-X), as shown in Figure 2.
6. Enable PortChannel on the appropriate physical switch ports connected to the Cisco Catalyst 4500-X switch. The following configuration shows the port channel assignment to switch physical ports:
Physical links to Cisco Catalyst 4500-X active and standby VSS switches:
7. Enable per-vlan spanning tree.
Configuring MAB and filter-spec (OPTIONAL)
Note: MAB and MAB Policy configuration is required only if we implement MUD visibility using ISE in this solution.
The Manufacturer Usage Description (MUD) URL is used to address the threats to network device in a light network to which the light communicates. The MUD-URL is sent from the light’s firmware that is used to authenticate the lights. This section describes the commands that should be configured for the MUD-URL to be displayed on the switch.
The following configurations should be added on both the Cisco Catalyst 3850 switch stack and the standalone light fixture access ports. These configurations are mandatory for the visibility of the MUD-URL on the switch and on ISE.
Here access sessions are configured in order to give authentication to a port. Access session host mode allows the host to gain access to a controlled port and access session port control sets the authorization for the port.
The MAB policy is defined as follows. Here the control class specifies the MAB authentication as default and is used here to authenticate a session.
MAB is configured as the highest priority (10).
Configuring POE Features
All the light fixtures receive power via the UPOE ports of the Cisco Catalyst 3850 switch. The switch allocates powers based on the type of connected light fixtures. Perpetual POE feature can help sustain the POE under specific circumstances where the switch may undergo a power failure or a soft reload.
The following configurations are not mandatory during migration. Perpetual POE and Fast POE features only have to be configured on those Cisco Catalyst 3850 switch access ports on which certain light fixtures need to illuminate even during a reload or if you want to them to turn on quickly after power restoration on the switch.
Perpetual POE
Perpetual POE is a POE enhancement feature on the Cisco Catalyst 3850 switch that helps enable light fixtures connected ports to continue to receive power during a soft reload of the switch.
Perform the following configuration on the Cisco Catalyst 3850 stack switch for light fixture access ports to configure Perpetual POE:
Configure the required edge port with the poe-ha command, which enables Perpetual POE on that port:
Fast POE
The Fast POE feature on Cisco Catalyst 3850 switch ports helps enable Molex light fixtures to illuminate with low brightness within 10 seconds (~15W of power given via cable two pair by switch hardware) after restoring the power on a switch/stack of switches when a power interruption caused the switch to go down. Once the switch is restored to normal state, the lights are allocated the requested power.
Perform the following configuration on the Cisco Catalyst 3850 stack switch for light fixture access ports to configure Perpetual POE:
Configure the required edge port with the poe-ha command, which enables Fast POE on that port:
Note: Perpetual poe-ha cli is needed to enable Fast POE in this release. Once the Fast POE issue is resolved, this can be updated.
Configuring Security Features
The Cisco Catalyst 3850 switch stack integrated security features can provide threat defense capabilities for mitigating man-in-the-middle attacks and protect the critical network infrastructure. This section details the switch configurations necessary for basic Layer 2 security features to be enabled as specified in the Design Guide.
For more security configuration, refer to the Consolidated Platform Configuration Guide, Cisco IOS 16.9.x and Later (Catalyst 3850 Switches) at the following URL:
■ http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/37e/consolidated_guide/b_37e_consolidated_3850_cg.html
IP DHCP Snooping
Perform the following steps on the Cisco Catalyst 3850 stack switch to configure IP DHCP snooping:
1. Configure the required port channel connected to the Cisco Catalyst 4500-X as DHCP snooping trusted port:
2. Enable IP DHCP snooping globally for the per-port command to take effect:
Note: The DHCP snooping table does not match the IP Source Guard table and, therefore, light fixtures don't receive the IP address properly from the DHCP server. This issue has been resolved in the latest CCO image release.
IP Source Guard
Perform the following steps on the Cisco Catalyst 3850 stack switch to configure IP Source Guard:
1. Configure the IP Source Guard on the port channels which have trusted IP-to-MAC bindings:
2. Configure the same on the light fixture access ports:
Note: The DHCP snooping table does not match the IP Source Guard table and the light fixtures don’t receive the IP address from DHCP server when IP Source Guard is enabled. Therefore, the IP Source Guard feature does not work as expected in this CRD release.
ARP Inspection
Perform the following steps on the Cisco Catalyst 3850 stack switch to configure ARP Inspection:
1. Configure the required port as an ARP inspection-trusted port:
On light fixture access ports:
2. Enable ARP inspection globally for the required VLANs so that the per-port command takes effect:
ARP Rate Limiting
Perform the following step on the Cisco Catalyst 3850 stack switch to configure ARP Rate Limiting:
Configure ARP Rate Limiting according to the maximum allowable packet rate on light fixture access ports. For example:
Port Security
You can use Port Security with dynamically learnt and static MAC addresses to restrict a port's ingress traffic by limiting the MAC addresses that are allowed to send traffic into the port. When you assign secure MAC addresses to a secure port, the port does not forward ingress traffic that has source addresses outside the group of defined addresses. If you limit the number of secure MAC addresses to one and assign a single secure MAC address, the device attached to that port has the full bandwidth of the port.
With port security, the MAC address of light fixtures that are learnt on any secured port will be the only MAC address permitted on that port. If any other device is connected on that port, then it will throw a security violation alert. So if one light's MAC address is already learnt via sticky mode on a particular port, then after connecting a new light, that sticky mapping command needs to be removed first so that the new light's MAC address can be learnt. If The Auto Smartport feature is enabled, then this issue will automatically be taken care of by Auto Smartport.
Perform the following step on the Cisco Catalyst 3850 stack switch to configure port security:
Configure the port security on the light fixture access ports in sticky mode with a maximum allowable number of MAC address of “1.” Keep the violation as “Restrict.” For example:
Storm Control
Perform the following step on the Cisco Catalyst 3850 stack switch to configure Storm Control:
Configure Storm Control for broadcast or unicast traffic according to the maximum and minimum allowable threshold percentage of line rates on light fixture access ports as follows:
PortFast and BPDU Guard
PortFast Bridge Protocol Data Unit (BPDU) Guard prevents loops by moving a non-trunking port into an errdisable state when a BPDU is received on that port. When you enable BPDU Guard on the switch, spanning tree shuts down PortFast-configured interfaces that receive BPDUs instead of putting them into the spanning tree blocking state.
The ports connected to lights don't have to do a BPDU check for spanning tree and. therefore. those ports can be configured for PortFast BPDU Guard.
Perform the following step on the Cisco Catalyst 3850 stack switch to configure PortFast and BPDU Guard:
Enable Portfast on the light fixture access ports since no BPDUs are expected on that port and then enable BPDU Guard:
Port Access Lists
Port Access Lists (PACLs) filter incoming traffic on Layer 2 interfaces using Layer 3 information, Layer 4 header information, or non-IP Layer 2 information. The PACL feature uses standard or extended IP ACLs or named MAC-extended ACLs that you want to apply to the port.
The ports on which lights are connected should be able to filter packets based on specific Layer 4 port numbers so that unwanted traffic doesn't reach the light. In this scenario, PACLs specifically filter the port numbers that the Coresync Manager uses to communicate with light fixtures.
Perform the following steps on the Cisco Catalyst 3850 stack switch to configure PACL:
1. Configure IP access list to permit the incoming traffic only for Layer 4 port numbers specific to communication between lights and SCM:
2. Apply this IP access list for the ingress traffic on the light fixture access ports. For example,
Disabling Telnet
Telnet should be disabled for accessing the device as it is not secure. The following commands disable Telnet and enable only SSH access to the Cisco Catalyst 3850 switch:
Configuring Auto Smartport (Recommended)
Rather than manually enabling all the commands separately, the access port configurations shown in the previous sections can be configured much more simply with the Auto Smartport feature. This also saves a great deal of time when several lights are connected on the switch.
Auto Smartport enables configuring the access ports connected to end hosts such as light fixtures. By configuring an Auto Smartport macro for a particular type of host device, the moment a port comes up with that type of host device, a macro that instantly puts a set of preconfigured commands on that access port is triggered. For the light fixtures, the macro will enable the basic configuration needed by the light ports (such as port security, ARP inspection, DHCP snooping, and access VLAN). As soon as the port goes down for any reason, the same config commands will be removed from the port, which saves the time otherwise needed to manually remove commands from different ports.
If Auto Smartport causes any issues, then it can be disabled in the global mode of the switch and each of the access port commands can be entered manually to troubleshoot the issue.
For detailed functionality of the Auto Smartport feature, refer to the Auto Smartports Configuration Guide, Cisco IOS XE Release 3SE (Catalyst 3850 Switches), which can be found at the following URL:
■ http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3-2_0_se/autosmartports/configuration_guide/iosaspcg/configure.html
1. The macro needed for the light port config can be configured as shown below:
2. Auto Smartport can be enabled globally using the following command:
Configuring Network Management (SNMP)
Simple Network Management Protocol (SNMP) is used for collecting information from network devices in order to manage the network.
Refer to Configuring Switch Network Management for configuring network management on Cisco Catalyst 3850 standalone.
Wiring Closet Access Switch Stack (Cisco Catalyst 3850 Stack)
This section covers wiring closet access switch Cisco Catalyst 3850 stack, Layer 2, Layer 3 networking, security configuration, and network management configurations.
Cisco Catalyst 3850 Stack Configuration
A switch stack can have up to nine stacking-capable switches connected through their StackWise-480 ports. The stack members work together as a unified system. Layer 2 and Layer 3 protocols present the entire switch stack as a single entity to the network.
The switches in the stack are assigned roles as active, stand-by, and member. However, all switches in the stack are operational. A switch stack always assigns one switch in active role and one in standby role. If the active switch becomes unavailable, the standby switch assumes the role of the active switch and continues to keep the stack operational. The active switch controls the operation of the switch stack and is the single point of stack-wide management.
In this system implementation, a stack of four Cisco Catalyst 3850 UPOE (24 UPOE ports per switch) switches are configured in the network topology according to the system requirement. Since each of those switches have 24 UPOE ports, light fixtures connected to any of them can be configured via the active switch of the stack.
A higher priority value for a stack member increases the probability of it being elected active switch and retaining its stack member number. The priority value can be 1 to 15. The default priority value is 1. You can display the stack member priority value by using the show switch EXEC command.
Note: We recommend assigning the highest priority value to the switch that you prefer to be the active switch. This ensures that the switch is re-elected as the active switch if a re-election occurs.
■To install a Cisco Catalyst Switch Data Stack and Stack Manager, refer to the Catalyst 3850 Switch Hardware Installation Guide at the following URL:
– https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/16-9/configuration_guide/stck_mgr_ha/b_169_stck_mgr_ha_3850.html
■To configure a switch stack, refer to the Stack Manager and High Availability Configuration Guide, Cisco IOS XE Release 3SE (Catalyst 3850 Switches) at the following URL:
– https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/16-9/configuration_guide/stck_mgr_ha/b_169_stck_mgr_ha_3850/managing_switch_stacks.html
When migrating lighting initial setup on the Cisco Catalyst 3850 switch on the wiring closet, perform the following steps to configure the Cisco Catalyst 3850 switch stack:
1. Make sure that the four switches that are going to be part of the stack all have the same boot configuration. Use the show boot command to verify their boot parameters:
2. The boot variable for all the switches should be the same image file as shown above. To configure that, use the following show command:
3. Once all the switches boot up with the same image and license, connect them in ring form to bring up the stack. Provision each of the switches from the master as shown below:
4. The switch that is needed to be “active” after a stack reload/reboot should be configured with a higher stack priority value of 15. The priority of switch can be configured in the Enable mode as shown below:
Network Layer 2 and Layer 3 Configuration
This section defines the implementation of VLANs and logical SVI for management traffic on the Cisco Catalyst 3850 switch stack.
1. Enable LLDP on the switch stack as follows:
2. Enable 2-event classification on all light fixture ports:
3. Configure VLANs, which must be created along with ports assignment on the Cisco Catalyst 3850 switch stack. The following is an example VLAN configuration:
4. Configure switch ports connecting to light fixtures/wall dimmers on the appropriate lighting VLAN in access mode:
5. Create Layer 3 SVI for the VLANs and default gateway as required. The following configuration is an example configuration of management VLAN SVI on the Cisco Catalyst 3850 switch stack:
6. Create port channel uplink interfaces on the Cisco Catalyst 3850 stack to the campus network aggregation switch (Cisco Catalyst 4500-X), as shown in Figure 2.
7. Enable port channel on the appropriate physical switch ports connected to the Cisco Catalyst 4500-X switch. The following configuration shows the port channel assignment to switch physical ports:
8. Enable the per-vlan spanning tree.
POE Feature Configuration
All light fixtures receive power via the UPOE ports of the Cisco Catalyst 3850 switch. Based on the type of light fixtures connected to the switch, the switch allocates powers to them. The Perpetual POE feature can help sustain the POE under circumstances where the switch undergoes a power failure or a soft reload.
The following configurations are not mandatory during initial installation. They only have to be configured on those access ports of Cisco Catalyst 3850 switch on which certain light fixtures need to illuminate even during a reload or you want to them to turn on quickly after power restoration on the switch.
Perpetual POE
Perpetual POE is a POE enhancement feature on Cisco Catalyst 3850 switch, which helps enable light fixtures connected on certain ports to continue to receive power during a soft reload of the switch. Perform the following configuration on the Cisco Catalyst 3850 stack switch for light fixture access ports to configure Perpetual POE:
Configure the required edge port with the poe-ha command which enables perpetual POE on that port:
Fast POE
The Fast POE feature on Cisco Catalyst 3850 switch ports helps enable Molex light fixtures to illuminate with low brightness within 10 seconds (~15W of power given via cable two pair by switch hardware) after restoring the power on switch/stack of switches, when power interruption caused the switch to go down.
Configure the required edge port with the poe-ha command, which enables Fast POE on that port:
Note: Perpetual poe-cli is needed to configure Fast POE in this release. Once the Fast POE issue is resolved, this will be updated. The light fixtures are initially at low brightness within 20 seconds after power restore but then turn to full brightness after the UPOE switch is fully up and operational (approximately 6-8 minutes).
Configuring Security Features
The Cisco Catalyst 3850 switch stack integrated security features can provide threat defense capabilities for mitigating man-in-the-middle attacks and protect the critical network infrastructure. This section details the switch configurations necessary for basic Layer 2 security features to be enabled as specified in the Design Guide.
For more security configurations, refer to the Consolidated Platform Configuration Guide, Cisco IOS XE 3.7E and Later (Catalyst 3850 Switches) at the following URL:
■ http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/37e/consolidated_guide/b_37e_consolidated_3850_cg.html
IP DHCP Snooping
Perform the following steps on the Cisco Catalyst 3850 stack switch to configure IP DHCP snooping:
1. Configure the required port as DHCP snooping trusted port:
2. Enable IP DHCP snooping globally for the per-port command to take effect:
IP Source Guard
Perform the following step on the Cisco Catalyst 3850 stack switch to configure IP Source Guard:
Configure the IP source guard on the ports which have trusted IP to MAC bindings:
On light fixture access ports:
ARP Inspection
Perform the following steps on the Cisco Catalyst 3850 stack switch to configure ARP Inspection:
1. Configure the required port as ARP inspection trusted port:
On light fixture access ports:
2. Enable ARP Inspection globally for the required VLANs so that the per-port command takes effect:
ARP Rate Limiting
Perform the following step on the Cisco Catalyst 3850 stack switch to configure ARP Rate Limiting:
Configure ARP Rate Limiting according to the maximum allowable packet rate on light fixture access ports. For example:
Port Security
You can use Port Security with dynamically learned and static MAC addresses to restrict a port's ingress traffic by limiting the MAC addresses that are allowed to send traffic into the port. When you assign secure MAC addresses to a secure port, the port does not forward ingress traffic that has source addresses outside the group of defined addresses. If you limit the number of secure MAC addresses to 1 and assign a single secure MAC address, the device attached to that port has the full bandwidth of the port.
With port security, the MAC address of light fixtures that are learnt on any secured port will be the only MAC address permitted on that port. If any other device is connected on that port, it will throw a security violation alert.
Perform the following step on the Cisco Catalyst 3850 stack switch to configure Port Security:
Configure the Port Security on light fixture access ports in sticky mode with the maxi-mum allowable number of MAC address as 1. Keep the violation as restrict. For example,
Storm Control
Perform the following step on the Cisco Catalyst 3850 stack switch to configure Storm Control:
Configure the Storm Control for broadcast or unicast traffic according to the maximum and minimum allowable threshold percentage of line rates on light fixture access ports as follows:
PortFast and BPDU Guard
PortFast BPDU Guard prevents loops by moving a non-trunking port into an errdisable state when a BPDU is received on that port. When you enable BPDU Guard on the switch, spanning tree shuts down PortFast-configured interfaces that receive BPDUs instead of putting them into the spanning tree blocking state.
The ports connected to lights don't have to do BPDU check for spanning tree and, therefore, those ports can be configured for PortFast BPDU Guard.
Perform the following step on the Cisco Catalyst 3850 stack switch to configure PortFast and BPDU Guard:
Enable Portfast on the light fixture access ports as no BPDUs are expected on that port and then enable BPDU Guard:
Port Access Lists
PACLs filter incoming traffic on Layer 2 interfaces using Layer 3 information, Layer 4 header information, or non-IP Layer 2 information. The PACL feature uses standard or extended IP ACLs or named MAC-extended ACLs that you want to apply to the port.
The ports on which lights are connected should be able to filter packets based on specific Layer 4 port numbers so that unwanted traffic doesn't reach the light. PACLs, in this scenario, filters specifically the port numbers that MA uses to communicate with lights.
Perform the following steps on the Cisco Catalyst 3850 stack switch to configure PACL:
1. Configure IP access list to permit the incoming traffic only for Layer 4 port numbers specific to communication between the lights and SCM:
2. Apply this IP access list for the ingress traffic on the light fixture access ports. For example,
Disabling Telnet
Telnet should be disabled for accessing the device as it is not secure. The following commands disable Telnet and enable only Secure Shell (SSH) access to the Cisco Catalyst 3850 switch.
Configuring Auto Smartport (Optional)
Auto Smartport enables configuring the access ports connected to end hosts such as light fixtures. By configuring an Auto Smartport macro for a particular type of host device, the moment a port comes up with that type of host device, a macro that instantly puts a set of pre-configured commands on that access port is triggered. For the light fixtures, the macro will enable the basic configuration needed by the light ports (such as port security, ARP inspection, DHCP snooping, and access VLAN). As soon as the port goes down for any reason, the same config commands will be removed from the port, which saves the time otherwise needed to manually remove commands from different ports.
1. The macro needed for the light port config can be configured as shown below:
2. Auto Smartport can be enabled globally using the following command.
Configuring Network Management (SNMP)
SNMP is used for collecting information from network devices in order to manage the network.
Refer to Configuring Switch Network Management for configuring network management on the Cisco Catalyst 3850 stack.
Provisioning Light Fixtures
This section describes how to commission the light fixtures using MoDiag and the Coresync Manager when migrating the light fixtures from initial installation to the existing converged campus network.
During migration phase, the light fixtures are assigned IP addresses from the DHCP pool configured on the Cisco Catalyst 4500-X aggregation switch in the light fixtures’ VLANs. The MoDiag application is required to set the Coresync Manager IP address for light fixtures communication with Coresync Manager. Refer to the Molex MoDiag User Guide for detailed steps to setting up the IP address.
A new Coresync Manager Design tool project is required to be created based on the new IP addresses of light fixtures which are required to be commissioned in the campus network. Refer to the Molex Coresync Manager User Guide for detailed steps for this procedure.
Implementing Data Center Applications for Lighting
This section covers the implementation of data center application/services in a campus network required for Cisco and Molex Digital Building Solution deployment, as shown in Figure 2. It includes the following major topics:
■Configuring Firewall (Cisco ASA 5585-X)
■Configuring Unified Computing System
■Configuring Network Device Authentication (ISE)
■Configuring Network Management (Cisco Prime Infrastructure)
Configuring Firewall (Cisco ASA 5585-X)
In the Cisco and Molex Digital Building Solution, when migrating a lighting initial setup with campus network, ASA in the campus network data center edge is recommended as the firewall and protects the applications in the data center. Traffic coming into data center from the network, along with traffic from lighting network, should pass through the ASA firewall.
The ASA is configured to operate in routed mode. Several tasks are required to complete ASA configuration. The workflow is shown in Figure 7.
Figure 7 Firewall Configuration Flow Diagram
Configuring Port Channel to Network
Configure the port channel on the ASA towards the data center and towards the campus network aggregation switch (Cisco Catalyst 4500-X), as per the topology in Figure 2. The port channels can be created by performing the following steps:
1. ASA is configured with a port channel having two member links to 4500. The port channel includes the two Ten Gig interfaces available on the ASA 5585-X. No name or security-level is assigned to the port channel.
2. VLAN subinterfaces provide access to different components in the network, such as the data center and management network. Subinterfaces based on VLANs are configured on the port channel. The VLAN and subinterface configuration for campus network access is as follows:
3. ASA is configured with a port channel having two member links to the Cisco Catalyst 3850 data center switch. The port channel includes the two Gig interfaces available on the ASA 5585X. No name or security-level is assigned.to the port channel.
4. VLAN subinterfaces provide access to different components in the network, such as the data center and management network. Subinterfaces based on VLANs are configured on the port channel. The VLAN and subinterface configuration for data center network access is as follows:
Configuring ASA Interfaces
The interfaces are configured with names, security levels, and IP addresses. Table 7 summarizes the interface configuration used along with the corresponding zones:
The firewall security level can be configured between 0 and 100; 0 is the least secure zone and 100 is the most secure.
Configuring Access Control Lists
By default, ASA denies all traffic moving from a lower security level to a higher security level. Access Control Lists (ACLs) are configured to enable required traffic between interfaces. The Access Control Entries (ACEs) are as follows:
ACE to allow traffic from the campus network to data center:
Apply the ACL on the outside interface (towards the corporate network):
Configuring Unified Computing System
Configuring Virtualization Infrastructure
This section describes how to deploy a Cisco UCS C240 M3 server to provide the virtualized infrastructure required to deploy virtual machines (VMs), for example, Cisco Prime and Cisco ISE. Where applicable, refer to the following Cisco and VMware documentation for details:
■Cisco UCS C240 M3 Server Installation and Service Guide at the following URL:
– http://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/c/hw/C240/install/C240.html
■ Cisco UCS C-Series Servers Integrated Management Controller GUI Configuration Guide, Release 2.0 at the following URL:
– http://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/c/sw/gui/config/guide/2-0/b_Cisco_UCS_C-series_GUI_Configuration_Guide_201.html
■vSphere Installation and Setup Guide at the following URL:
– https://pubs.vmware.com/vsphere-55/index.jsp#com.vmware.vsphere.install.doc/GUID-A71D7F56-6F47-43AB-9C4E-BAA89310F295.html
Note: The Cisco Unified Computing System (UCS) C-Series server platform discussed in this section is used for applications, such as Network Time Protocol (NTP), Cisco Prime Infrastructure, and ISE, through server virtualization. However, any UCS server series or desktop server can be chosen for deployment based on the application's hardware requirements matching the server hardware resources.
Figure 8 Flow Diagram for Virtualization Configuration
ESXi Installation and Configuration
To install and configure ESXi on a UCS C240 server, refer to the “Installing & Setting Up ESXi” section in the vSphere Installation and Setup Guide.
Refer to the detailed vCenter server installation steps in the “Installing vCenter Server” section of the vSphere Installation and Setup Guide.
Note: We recommend immediately completing all licensing through the vCenter management application during the ESXi installation process.
ESXi Networking
This section covers the ESXi networking configuration for UCS C-Series server platform for the data center applications such as Cisco Prime Infrastructure, Cisco ISE, and the NTP server, as shown in Figure 2.
Note: The data center networking switches and configurations may vary based on the Enterprise IT network data center deployment. Where applicable, follow the deployment procedures used on the enterprise data center deployment and enable networking according to the production campus network.
To configure VMs’ ESXi networking on the UCS ESXi host, refer to Setting Up Networking with vSphere Standard Switches at the following URL:
■ https://pubs.vmware.com/vsphere-55/index.jsp#com.vmware.vsphere.networking.doc/GUID-E198C88A-F82C-4FF3-96C9-E3DF0056AD0C.html
Configuring Network Device Authentication (ISE)
This section covers how to deploy Cisco ISE 2.0 on the UCS server platform in the data center for network devices authentication (TACACS+) and security.
Installation of Cisco Identity Services Engine
The prerequisites and the necessary information to install ISE can be found at the following URL:
■ https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/install_guide/b_ise_InstallationGuide24/b_ise_InstallationGuide24_chapter_00.html
The above book describes different deployment scenarios with ISE. One should choose deployment scenario according to the use case needs.
Configuring Cisco Identity Services Engine (Optional)
Note: The deployment of ISE and AAA configurations in this solution is optional. However, it is recommended to use ISE for devices authentication and enhanced network security.
ISE 2.0 is used for providing device authentication and authorization in the network via TACACS+. ISE is deployed in a VM and assigned an IP address in the VLAN 70 residing behind the firewall. The firewall ports need to be opened for TACACS+ communication from the management VLAN 50 to ISE.
Figure 9 AAA Configuration Flow
Perform the following steps on each switch in the network (for example, Cisco Catalyst 4500-X and Cisco Catalyst 3850 stacks and Cisco Catalyst 4506-E switches in the deployment, as shown in Figure 2) to configure Authentication, Authorization, and Accounting (AAA).
The steps described in this section should also be part of switch configuration files(s) if you are using the Smart Install feature to configure the switches as described in Initial Installation of Lighting Network.
1. On the switches, configure ISE as the TACACS+ server. ISE is the name of the RADIUS defined. Any user-defined name can be used. The RADIUS server "ISE" defined is added to the aaa group-server.
2. Create a local user with full privilege for fallback with the username command as shown here:
3. Configure login authentication, exec and console authorization using the following commands, which show the different authentication groups that could be created:
4. Use method ABC on VTY authentication and authorization. From the above step, the different authentication groups that have been created should be attached to the respective login type.
Perform the following steps on the ISE server for enabling RADIUS-based device authentication and authorization:
1. Log in to ISE. Figure 10 shows the ISE summary after successful login.
Figure 10 ISE Login Success Page
2. Add the 3850 standalone switch or the stack as a network device to ISE. To add the network device, from Administration > Network Resources, click Network Devices as shown in Figure 11.
Figure 11 Choose Network Devices in ISE
3. On choosing Network Devices, the page should display a list of the devices (if any) that were added.
Figure 12 Network Devices in ISE
4. To add network device to the list, click Add, and then enter the device name and the correct IP address. The IP address of the network device should be reachable from ISE.
Figure 13 Adding a Network Device in ISE
5. After adding a network device, choose the RADIUS authentication settings and enter the pre-shared key that is common to the network device. This pre-shared key should be same as the key added in the AAA configuration of the network device.
Figure 14 RADIUS Authentication Settings
6. To create an identity (user), go to Administration > Identity Management > Identities > Users. Add the Name and the login password. These credentials will be used to log in to the network device from ISE.
Figure 15 Adding a New User in Identity Management
Figure 16 Creating a New User in Identity Management
This completes the ISE 2.0 RADIUS configuration for network devices authentication and authorization.
7. After performing the above steps, the endpoints can be seen in Context Visibility > Endpoints.
8. On clicking one of the end points, choose the Attributes tab and then scroll to the bottom of the tab to see the MUD-URL. This is shown in Figure 18.
Configuring Network Management (Cisco Prime Infrastructure)
Cisco Prime Infrastructure is a network management system used to monitor and manage the devices in the network. Prime Infrastructure is also used as a syslog server.
Installation of Cisco Prime Infrastructure
1. Download the Prime Infrastructure 3.0 Open Virtualization Application (OVA) file from the Cisco website at the following URL:
https://software.cisco.com/download/release.html?mdfid=286285348&flowid=&softwareid=284272932&release=3.0.0&relind=AVAILABLE&rellifecycle=&reltype=latest
2. Launch your VMware vSphere Client and connect to the ESXi host or vCenter server.
3. Click File > Deploy OVF Template.
4. Choose the OVA file downloaded in Step 1 in the Select window.
5. Click Next and then respond as per the prompt.
For detailed installation instructions, refer to the “Installing Cisco Prime Infrastructure” section in the Cisco Prime Infrastructure 3.0 Quick Start Guide at the following URL:
■ http://www.cisco.com/c/en/us/td/docs/net_mgmt/prime/infrastructure/3-0/quickstart/guide/cpi_qsg.html
Configuring Cisco Prime Infrastructure for Lighting
For more details, refer to the “Adding Devices to Prime Infrastructure” section in the Cisco Prime Infrastructure 3.0 User Guide at the following URL:
■ http://www.cisco.com/c/en/us/td/docs/net_mgmt/prime/infrastructure/3-0/user/guide/pi_ug.html
The following are the high level steps to add the device to the Cisco Prime Infrastructure:
1. Launch PI User Interface using a web browser using PI IP address.
2. Log in to the GUI with the username and password.
3. In the main menu, click Inventory > Network Devices > Add Device.
Configuring Molex Coresync Manager Services
Installation of Molex Coresync Manager
Refer to the Molex Coresync Manager Installation Guide for setting up and installing the Coresync Manager in the data center.
Commissioning Light Fixtures using Molex Design Tool
Refer to the Molex Coresync Manager User Guide for the detailed procedure to commission the light fixtures in the network. The following high level steps summarize the commissioning procedure.
1. Launch the Design Tool and enter the Project details.
2. Add the Fixture Start Address and Sensor Start Address details.
3. From the Fixture tab, double-click the map to add a light fixture.
4. Edit the IP Address on the right window, if required, and then choose CoAP v1.1 from the drop-down menu.
5. From the Sensor tab, double-click the map to add a sensor.
6. From the right panel, choose the type of sensor you want to add.
7. Verify the IP Address and choose the protocol as CoAP v1.1.
8. From the Zone tab, create a zone by dragging the mouse creating a rectangular area covering the fixture and the sensors.
9. Click the desired zone on the right to make the rectangular selection into your desired zone type.
10. Navigate to File > Upload Project.
11. Once the dialog window says Project Upload Successful, click OK.
This completes the addition of light fixtures and sensors to the design tool project.
Lighting Control and Maintenance
This section covers the implementation of lighting control and management use cases using Molex Coresync Manager, Facility Manager, wireless wall switch, and Smart Tablet.
The steps described in this section provides a high-level summary of steps, to implement light fixtures control and management of zones during commissioning. Refer to the latest documentation provided by Molex for provisioning and managing light fixtures.
Light Fixture Control using Molex Facility Manager
Connecting to the Controller using Facility Manager
The light fixtures can be switched ON/OFF or dimmed UP/DOWN using the Molex Facility Manager.
Refer to the Molex Coresync Manager User Guide for the procedure to connect to the Coresync controller.
On/Off/Dimming Control using Wireless Wall Switch
Alternatively, the light fixtures can also be controlled via the wireless wall switch. The wall switch controls all the light fixtures of a zone to which it is added. Perform the following steps to control the light fixtures using the Wall Switch:
1. Pair the Wireless wall switch with the Wireless Switch using the MoDiag tool. Refer to the Molex Coresync Commissioning Guide for detailed steps to pair the wireless switch and gateway.
2. On the Design Tool, add the sensor with its correct IP address and choose the ON/OFF sensor in the sensor role from the right panel.
3. Enter the 6 digits of the Hex ID in the Daisy Chain ID section.
4. Set the polling rate to Zero.
5. Configure it in the zone that you wish to control.
7. Press the button on the Wireless Switch to switch the lights ON/OFF. Verify that light fixtures switch ON/OFF accordingly.
Configuring Occupancy Sensing
Refer to the Molex Coresync Manager User Guide and Molex Coresync Commissioning Guide for the steps to configure the Occupancy Sensing feature.
Configuring Ambient Lighting Sensing
Ambient Lighting Sensing is used to adjust the intensity of the light fixture according to the surrounding light from other light sources as well as from a day light. This helps in saving power.
Refer to the Molex Coresync Manager User Guide and Molex Coresync Commissioning Guide for the steps to configure the Ambient Lighting Sensing feature.
Light Scene Selection using Facility Manager
The Light Scenes can be changed in order to bring a unique experience for each collaboration. Once the Project has been created and uploaded using the Coresync design tool, the required Light Scene can be selected using the Facility Manager.
For the Light Scene selection procedure, refer to the Molex Coresync Manager User Guide.
Light Fixture Control using Coresync Smart Tablet
Molex Coresync Smart Tablet is a tool used to control a single commissioned zone available through the Coresync Smart Controller on the same network.
For more details on the Coresync Smart Tablet, refer to the Molex Coresync Manager User Guide.
For wireless network access, make sure to enable all required configuration on wireless access point as per the Campus network wireless access best practices described in the Design Zone for Campus Wired and Wireless LAN.
Installing Applications
The Smart Tablet consists of two components: the Zone ID Application for zone commissioning and the End User Tool for controlling the zone. The Smart Tablet is designed to control only one zone.
Refer to the Molex Coresync Manager User Guide for installing and configuring the Smart Tablet for light fixture controls.
Commissioning a Zone using ZoneID
The commissioning of the zone is done using the ZoneID application. Refer to the Molex Coresync Manager User Guide for the zone commissioning procedure using Smart Tablet.
Light Fixtures Ongoing Maintenance
Replacing Light Fixtures
When a light fixtures malfunctions, it must be replaced. Since the MAC address of the new light fixture is different from the light fixture that needs to be replaced, the DHCP IP address assignment for this newly replaced light fixture will be different from the old light fixture in the same network subnet.
This requires the recommissioning of the lights fixture in the Molex Coresync Manger design tool and projects. Therefore, follow through the commissioning procedure as suggested by Molex for replacing the light fixture. The following provides a summary of steps to be performed.
Modify Light Fixture in Design Tool
The new light fixture has to be added to the Project replacing the old light fixture. This can be done in the Design Tool.
1. In the Design Tool, go the target old fixture to be replaced and change the IP address of the fixture to that of the new fixture.
2. Similarly, change the IP address for the sensors added of this fixture.
3. From File > Upload Project, select the target networks and devices.
4. Verify that the new light fixture has successfully replaced the old light fixture by controlling it from the Facility Manager Zone.
Appendix A: Caveats
This appendix covers the list of open issues in the system and workarounds for open issues.
Appendix B: References
This appendix, which lists the documentation used in this implementation guide, includes the following major topics:
Cisco Documentation
■Design Zone for Campus Wired and Wireless LAN at the following URL:
– http://www.cisco.com/c/en/us/solutions/design-zone/networking-design-guides/campus-wired-wireless.html#~validate
■Cisco Catalyst 3850 Switch Data Sheet at the following URL:
– http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-3850-series-switches/data_sheet_c78-720918.html
■Catalyst 4500 Series Switch Software Configuration Guide, IOS XE 3.9.xE and IOS 15.2(5)Ex at the following URL:
– http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/XE3-9-0E/15-25E/configuration/guide/xe-390-configuration/vss.html
■Catalyst 3850 Hardware Installation Guide at the following URL:
– http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/hardware/installation/guide/b_c3850_hig/b_c3850_hig_chapter_010.html
■Stack Manager and High Availability Configuration Guide, Cisco IOS XE Release 3SE (Catalyst 3850 Switches) at the following URL:
– http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3se/ha_stack_manager/configuration_guide/b_hastck_3se_3850_cg/b_hastck_3se_3850_cg_chapter_010.html
■Consolidated Platform Configuration Guide, Cisco IOS 16.9.X and Later (Catalyst 3850 Switches) at the following URL:
– http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/37e/consolidated_guide/b_37e_consolidated_3850_cg.html
■Cisco UCS C240 M3 Server Installation and Service Guide at the following URL:
– http://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/c/hw/C240/install/C240.html
■Cisco UCS C-Series Servers Integrated Management Controller GUI Configuration Guide, Release 2.0 at the following URL:
– http://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/c/sw/gui/config/guide/2-0/b_Cisco_UCS_C-series_GUI_Configuration_Guide_201.html
■Cisco Prime Infrastructure (PI) Installation and Configuration Guide at the following URL:
– http://www.cisco.com/c/en/us/td/docs/net_mgmt/prime/infrastructure/3-0/quickstart/guide/cpi_qsg.html#pgfId-63672
■Cisco Identity Services Engine (ISE) Installation and Configuration Guide at the following URL:
– http://www.cisco.com/c/en/us/td/docs/security/ise/2-0/installation_guide/b_ise_InstallationGuide20/Installing_ISE_on_a_VMware_Virtual_Machine.html
■Cisco Prime Infrastructure 3.0 Quick Start Guide at the following URL:
– http://www.cisco.com/c/en/us/td/docs/net_mgmt/prime/infrastructure/3-0/quickstart/guide/cpi_qsg.html
■Cisco Prime Infrastructure 3.0 User Guide at the following URL:
– http://www.cisco.com/c/en/us/td/docs/net_mgmt/prime/infrastructure/3-0/user/guide/pi_ug.html
Molex Documentation
■Coresync Installation and Commissioning Overview Application Note
Feedback