Network deployment modes

The SDG Agent providing Bonjour gateway functions is typically an IP gateway for wired end-points that could be residing in the distribution layer in multilayer network designs, or in the access layer in routed access network designs.

The following figure shows various topologies which are explained further in the section.

Cisco DNA Service for Bonjour supports these network deployment modes:

• Multilayer LAN: In this deployment mode, the Layer 2 Access switch provides the transparent bridging function of Bonjour services to Distribution-layer systems that act as the IP gateway and SDG Agent. There is no additional configuration or new requirement to modify the existing Layer-2 trunk settings between the Access and Distribution Layer Cisco Catalyst Switches.

• Routed Access: In this deployment mode, the first-hop switch is an IP gateway boundary and therefore, it must be combined with the SDG Agent role.

The Cisco DNA Service for Bonjour also supports various Wireless LAN network designs commonly deployed in the Enterprise. The SDG Agent provides consistent Bonjour gateway functions for the wireless endpoints as in wired networks. In general, the IP gateway of the wireless clients is also a Bonjour gateway. However, the placement of the SDG Agent may vary depending on the Wireless LAN deployment mode.

Wide Area Bonjour logical components

Wide Area Bonjour uses two logical components in a network:

• SDG Agent: The Fabric Edge switch is configured as the SDG Agent, and the configuration is added only after the SD-Access is configured.

• Wide Area Bonjour Controller: The Wide Area Bonjour application in the Cisco Catalyst Center acts as the Controller.

The Wide Area Bonjour communication between the SDG Agent and the Controller takes place through the network underlay. The SDG Agent forwards the endpoint announcements or queries to the Controller through the fabric underlay. After discovering a service, a Bonjour-enabled application establishes direct unicast communication with the discovered device through the fabric overlay. This communication is subject to any configured routing and SDG policies.

Policy enforcement points

The policy enforcement occurs at the SDG Agent level and in Cisco Catalyst Center Wide Area Bonjour application. This illustration shows enforcement point and direction of all four types of Bonjour policies:

Local area Bonjour policy configuration

The Cisco IOS Bonjour policy structure is greatly simplified and scalable with the new configuration mode. The services can be enabled with intuitive user-friendly service-type instead individual mDNS PoinTeR (PTR) records types, for example select AirPlay that automatically enables video and audio service support from Apple TV or equivalent capable devices. Several common types of services in Enterprise can be enabled with built-in service-types. If built-in service type is limited, network administrator can create custom service-type and enable the service distribution in the network.

The policy configuration for the Local Area Bonjour domain is mandatory, and is a three step process. This illustration shows the step-by-step procedure to build the Local-Area Bonjour policy, and apply to enable the gateway function on selected local networks:

To configure local area bonjour policies, enable mDNS globally. For the device to receive mDNS packets on the interface, configure mDNS gateway on the interface. Create a service-list by using filter options within IT allow services into or OUT of a device or interface. After enabling mDNS gateway globally and on the interface, you can apply filters (IN-bound filtering or OUT-bound filtering) on service discovery information by using service-policy commands.

Built-in service lists

The Cisco IOS software includes built-in list of services that may consist of one more Bonjour service-type. A single service-list may contain more than one service-type entries with default rule to accept service announcement from service-provider and the service query request from receiver end-points. If selected service-type contains more than one Bonjour service-types (PTR), then a service announcement or a service query is honored when the announcement/query is for any one of these included Bonjour service-types. For example, Apple Time Capsule Data service-type consists of both_adisk and _afpovertcp built-in PTRs, however if any end-point announces or requests for only _afpovertcp service, then SDG Agent will successfully classify and process the announcement or request. The service-list contains implicit-deny for all un-defined built-in or custom services entries.

This table illustrates complete list of built-in Bonjour services that can be used to create policies in local area Bonjour.

Service Status Timer Management

The Bonjour service-provider end-points may announces one or more services in the network combining mDNS records and time-to-live (TTL) service timers for each record. The TTL value provides assurance of end-point availability and serviceability in the network. The SDG Agents ensures that IT contains up to date information in its local and updates global services in Controller based on TTL and other events in Local Area Bonjour domain. The network administrator must configure the service status timer where service-provider endpoint discovery is permitted.

Policy structure and configuration

The Wide Area Bonjour policy hierarchy and structure is identical as described in Local Area Bonjour Policy structure section. This section provides step-by-step reference configuration to build and enforce the policy to enable the successful communication with Wide Area Bonjour App in Cisco Catalyst Center.

Policy configuration components:

• Service List: Network administrators must create new controller bound egress service lists for the Wide Area Bonjour domain. In most common network deployment models, the Wide Area Bonjour service list may contain same service-types as the Local Area Bonjour to implement common services between both domains. Based on requirements, certain services can be limited to Local Area and prevent routed in Wide Area Domain, then by default only allowed service list entries are permitted and rest are dropped with implicit deny rule.

• Ingress Policy Direction: The ingress service policy for Wide Area Bonjour domain is not required and cannot be associated to the controller.

• Egress Policy Direction: The Bonjour policy structure between Local Area and Wide Area is consistent, however the enforcement point is different. Cisco recommends configuring separate Service-List and Service-Policy for Wide Area Bonjour domain as this helps building unique policy sets for each domain.

• Conditional Egress Service List: The Wide Area Bonjour egress service list configuration can be customized to conditionally route the service or query request to the Cisco Catalyst Center. With this alternative configuration setting, network administrators can route the service or query the request in Wide Area Bonjour domain from specific local source VLAN networks instead globally from the entire system.

Service timer management:

The Cisco Catalyst Center centralizes services information from large scale distributed SDG-Agents across the network. To maintain scale and performance of the controller, services routing information is transmitted and synchronized periodically by each SDG-Agent network device. To protect system and network performance, the scheduler base service information exchange allows graceful and reliable way to discover and distribute Bonjour services across Wide Area Bonjour domain.

Note

In most large-scale network environments, the default Bonjour service timers on SDG-Agents are fine-tuned and may not need any further adjustments. Cisco recommends retaining the interval timer values to default and adjust only based on any user experience issue and consider modified parameters do not introduce scale and performance impact.

Default mDNS service configurations details

Starting with Cisco IOS XE Bengaluru 17.6.1, the default mDNS service configuration is introduced. The default service configuration contains a default service policy that creates a service list with default service-types that is automatically enforced in the ingress or egress direction.

Additionally, you can define a custom policy and service list with custom-defined service types, and enforce it in the ingress or egress direction.

HSRP-Aware mDNS Service-Routing configuration

Starting from Cisco IOS XE Bengaluru 17.6.1, Hot Standby Router Protocol-aware (HSRP-aware) mDNS Service-Routing is supported between Service Peers and SDG agents in a multilayer network. During a changeover, that is when the primary SDG agent fails and the secondary SDG agent becomes the new primary, the service-routing session between the Service Peer and the SDG agent remains uninterrupted. The new primary SDG agent establishes a session with the Service Peer and cache information is resynced.

The HSRP virtual IP address of the management VLAN is enabled on the SDG agent using the standby group_number IP ip_address command. The HSRP virtual IP address needs to configured on the Service Peer as the IP address of the SDG agent.

Note	The HSRP virtual IP address must be reachable and in active state during a changeover.

This figure illustrates a wired and wireless network that supports HSRP-aware mDNS Service-Routing:

The HSRP offers these advantages:

• Automatic gateway selection.

• Rapid switchover.

• Reduces service convergence.

Service-gateway SSO operation

Starting from Cisco IOS XE Bengaluru 17.6.1, mDNS Stateful Switchover (SSO) is supported on network devices configured in Service Peer role. In SSO-enabled devices, one device is selected as an active device and the other as a standby device. The cache information learnt by the active device is synced with the standby device. When the active device fails, the standby device becomes the new active device and continues the mDNS service discovery process.

Wireless Network Configuration Requirements

To enable mDNS communication between wireless endpoints and a Cisco Catalyst switch acting as an SDG Agent, perform the following configuration steps:

1. Disable mDNS Snooping on Cisco AireOS based WLCs.

2. Enable the mDNS Gateway feature on Cisco Catalyst 9800 series WLCs.

3. Set the AP Multicast Mode to Multicast.

The following figure illustrates the prerequisite configuration for wireless networks to enable communication between SDG-Agent switches and wireless endpoints.

The configuration of local area Bonjour on a switch that acts as the SDG Agent in a wireless network involves the same set of procedures that are used to configure local area Bonjour on a switch that acts as the SDG Agent in a wired network.

The Bonjour protocol operates on service announcements and queries. Each query or advertisement is sent to the mDNS IPv4 address 224.0.0.251 and IPv6 address FF02::FB. The mDNS messages are carried over well-known industry standard UDP port 5353, over both Layer 3 transport types.

The Layer 2 address used by the Bonjour protocol is link-local multicast address and therefore it’s only forwarded to the same Layer 2 network. As multicast DNS (mDNS) is limited to a Layer 2 domain, for a client to discover a service, it has to be a part of the same Layer 2 domain. This isn’t always possible in a large-scale deployment or enterprise.

To enable mDNS communication between Wireless endpoints and Cisco Catalyst switch that acts as an SDG Agent, the intermediate WLC must transparently allow the network to transmit and receive mDNS messages.

Hence, for a Multicast DNS Mode Wireless network deployment, disable the mDNS Snooping on Cisco AireOS based WLC and enable mDNS Gateway feature on Cisco Catalyst 9800 series WLC and set the AP Multicast Mode to Multicast.

The Cisco WLC and Access Points by default prevent the forwarding of Layer 2 or Layer 3 Multicast frames between Wireless and Wired network infrastructure. The forwarding is supported with stateful capabilities enabled using AP Multicast. The network administrator must globally enable Multicast and configure a unique Multicast Group to advertise in the network. This multicast group is only required for Cisco Access Points to enable Multicast over Multicast (MCMC) capabilities across the LAN network. The Bonjour solution doesn’t require any Multicast requirements on Wireless Client VLAN; thus, it’s optional and applicable only for other Layer 3 Multicast applications.

The core network must be configured with appropriate Multicast routing to allow the Access Points to join WLC Multicast Group. The Multicast configuration must be enabled on Cisco WLC management VLAN and on the Cisco Access Points of their respective distribution layer switch.