According to The National Institute of Standards and Technology (NIST) Special Publication 800-145, there are three cloud service models commonly available:

• Software as a Service (SaaS)

• Platform as a Service (PaaS)

• Infrastructure as a Service (IaaS)

Figure below shows a representation of the service models, highlighting the most important stack components and the areas of responsibility between the cloud provider and the consumer, the customer that is using these services.

The SaaS model provides the highest level of abstraction and simplification. The whole “service” stack, from the infrastructure to the application level, is provided by the cloud service provider. As the customer, you directly access the service through user web interface or an application programming interface (API). On the other side, the consumer does not manage or control the underlying cloud infrastructure. Cisco Meraki leverages this model

In the PaaS model, the cloud service provider provides all the components of the platform needed to run your own applications. This includes the underlying cloud infrastructure networking and security plus additional services like databases and monitoring tools.

Finally, the IaaS model provides the computing resources, the storage and networking components (e.g., routers, firewalls, etc.) and leaves the customer to deploy their applications and services. This model gives the customer the highest level of control and flexibility but some integration work is required. The IaaS model is the one chosen for the Catalyst 9800 Wireless Controller on Cloud

The Public Cloud model chosen for the Cisco Catalyst 9800 for Cloud is the Infrastructure as a Service (IaaS) one. This means that the customer can rely on the Public Cloud vendor to provide the networking, the computing and the security infrastructure, but then the C9800 will be fully managed and controller by the customer as a virtual machine in the cloud.

There are two main reasons why customers should look at deploying C9800 in the cloud with an IaaS model:

1. Exploiting the advantages of the Public Cloud

2. Retaining the customization and control they usually have with controller onPrem

There are many advantages in adopting the Public Cloud, let’s list the one that are most significant for the C9800:

• Agility: it takes few minutes to spawn a C9800 instance in AWS; it becomes extremely easy to launch a wireless controller to test some new feature or functionality and terminate it when done.

• Scalability: there are no physical limits in the public Cloud, so you add new instance as the requirements for additional APs or clients increase

• Global footprint: this is important for latency but also for security and privacy policies. The Public Cloud providers have a global footprint so from any location you install APs you can reach a C9800-CL in the cloud in less than 50 ms. Some customers have a strict security policy dictating that user data and traffic need to stay within the region; the public cloud providers have a Data Center in every geographical region

• Cost effectiveness: reduce data center footprint and infrastructure costs. Shift from a capital expenditure (buying up front) model to an operational expenditure (pay-as-you-go) model

At the same time, the customer will have full control on the configuration of the Catalyst Wireless controller: what software image to run, what functionalities to turn on or off, what configuration tweaks to apply. On this aspect, there is no difference from deploying a wireless controller onPrem.

Using an IaaS model and deploying and manage your own instance in the cloud, it means that more work is on the customer to integrate the C9800 with the cloud infrastructure. Let’s introduce some important cloud networking concepts and then describe how to deploy C9800-CL in AWS.

I order to deploy C9800-CL in the Public Cloud you need to get familiar with some new concepts like Regions, Availability Zones, VPC, etc. The intent of this guide is to provide a quick intro and leave the user to double click on these concepts using the available AWS documentation.

When first logging in the AWS console (https://console.aws.amazon.com) you would first want to select the Region where your instance will be installed. A Region is a distributed Data Center location across the globe. Each Region is independent and separated. AWS has 15 different Regions available in all part of the world (remember the global footprint advantage?) as shown below:

The user would pick the one closest to the locations where APs will be deployed.

Within the region you have Availability Zones. These are fault-tolerant areas within a Region and they are all interconnected. When you launch an instance, you can select an Availability Zone or let AWS choose one for you. Here is a simple Region – Availability Zone visualization:

Another important concept is the Virtual Private Cloud (VPC). This represents your private network in the cloud, it’s an extension of your onPrem network to the Cloud. There is a default VPC in every region and to deploy your C9800-CL you can use the default VPC or create a custom one. Creating a custom VPC allow you to define all the networking aspects: subnets, gateways, security groups, etc. So, it gives you total flexibility.

After you have defined a VPC, you can create subnets within the VPC, define routes to and from these networks and also specify the security rules to access your instances in the VPC. Again, this is your private network in the public Cloud. To know more about VPC please refer to AWS documentation:

https://docs.aws.amazon.com/vpc/latest/userguide/getting-started-ipv4.html

In this first release (16.10), Cisco Cloud Wireless LAN Controller supports the following deployment scenario: the C9800-CL is available in AWS Virtual Private Network (VPC) connected to the customer enterprise network via a managed VPN. The VPN can be terminated either on the AWS Gateway Router or on an AWS based router of customer choice (like the Cisco CSR Cloud router).

The VPN tunnel can be established from the corporate DC and all the AP locations leverage this connection to reach the C9800-CL or each AP location (branches, for example) would have to established a VPN tunnel to the Cloud.

As explained in the next session, establishing a VPN tunnel to the AWS provided VPN gateway is extremely easy. But it comes with some limitations: it only supports 10 remote VPN connections and it only supports IPSEC tunnels.

If you want more options for VPN (IPSec, DMVPN, FlexVPN, GETVPN, EZVPN) and larger scale, the Cisco CSRv router can be used as a VPN termination alternative. More info here: https://www.cisco.com/c/en/us/td/docs/routers/csr1000/software/aws/b_csraws.html

Once the tunnel is established, the C9800-CL will get an IP address in a private subnet in the VPC and subnet would need to be routed to the onPrem networks where the AP resides. As we said, the VPC is just an extension of your onPrem network and proper routing would needs to be established. Here is a simple example:

Here the VPC subnet is 10.10.10.0/24 and it routed through the VPN-GW to reach the AP subnet (10.100.0.0/24). Some important cloud networking considerations:

• All interfaces in Public Cloud are Layer 3, there is no concept of trunk interfaces

• In Public Cloud IP allocations are done using DHCP: customer can decide which IP to allocate to the controller instance but it’s still through DHCP

• For Catalyst 9800 Cloud Wireless Controller in AWS only one interface deployment is supported: this means that the Device Management/Service interface and Wireless Management interface are same

• At FCS customer may experience longer than usual download time (30-40 mins for W2 APs) when the AP joins the FIRST time (and first time only). This is due to the reduced MTU introduced by the VPN tunnel

Since we are deploying an instance of the wireless controller in the public cloud, it makes sense to keep the client traffic local to the site where the APs are located. Also, the latency introduced by the public Internet needs to be considered when deciding the AP mode of operations.

For these reasons, the only AP deployment mode supported for C9800-CL in AWS Cloud is Flex Central Authentication and Local Switching for IPv4 and IPv6 clients, with fall back to Local Authentication if the link to the cloud controller would become not available.

The AAA server is assumed to be on premise and that’s the configuration that has been tested and hence supported.

This means that the following high-level traffic flow would take place for client full authentication:

1. EAP traffic is received by AP and sent to WLC

2. WLC talks Radius to ISE/AAA

3. ISE replies with authentication result

4. WLC sends the reply to AP

5. AP relays authentication frames to client

6. Traffic is locally switched at AP

If fast roaming is supported (802.11r for example), this exchange will happen only the first time the client authenticates to the network. Every subsequent roaming will be handled locally at the AP without the need to contact the AAA server.

If device only supports slow roam, then the flow described above will take place at each roam.

Note	Since this is a FlexConnect deployment the same WAN/Internet recommendations and requirements would apply. Please refer to the Flex Deployment guide for more details: https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/8-7/Flex_7500_DG.html#pgfId-43317

The supported high availability (HA) for C9800-CL in public cloud is the N+1 availability where user defines a Primary, secondary and optionally a Tertiary controller for APs to register to.

Since all SSIDs are configured with FlexConnect Local switching, N+1 HA guarantees no network downtime upon Primary controller failure: APs will transition to standalone mode keeping the existing client connections and then will join the Secondary Controller.

It is recommended to instantiate the Secondary controller in a separated availability zones for redundancy; this can be done by deploying it in a different subnet and assign the subnet in a different availability zone. Then you would need to configure the Primary/Secondary for the APs.

This can be done at a location level using the site tag and the join profile setting within the site tag:

Or it can be configured directly on the AP and in this case, there is an option to define the Tertiary controller as well:

The Cisco Catalyst 9800 Wireless Controller can be managed both via the integrated Web Graphical User Interface (GUI) and via the Programmatic interfaces.

The GUI has a DAY 0 interface to ease the initial setup of the box and an intuitive DAY 1 interface for all the other possible configurations. Catalyst 9800 Wireless controller has two guided configuration work flow:

• Basic: this is an intent based configuration flow where the user is abstracted from any configuration details and guided through the creation of a remote or local site in three simple steps.

• Advanced: guided workflow to configure all the relevant configuration constructs (Profiles and Tags)

Out of the box the C9800-CL supports a NETCONF interface to allow the customer to manage via standard. YANG data models define the data that is available for configuration and streaming telemetry. For more information about Programmability for the Catalyst 9800 series, please refer to the related deployment guide.

Launching a Cisco Catalyst 9800 Amazon Machine Image (AMI) occurs directly from the AWS Marketplace. Cisco Catalyst 9800 will be deployed on an Amazon EC2 instance in an Amazon VPC instance.

For the first release of the Cisco Catalyst 9800 Wireless Controller on cloud, Cisco will support the following Instance types:

• C5.xlarge: 4 vCPUs, 8 GB RAM, 8GB Disk with 1 vNIC

The allocated resources will allow the instance to scale to 1,000 APs and 10,000 clients.

The Cisco Catalyst 9800 Wireless Controller for AWS is purchased and launched as an Amazon Machine Image (AMI) on AWS Marketplace using the Bring Your Own License (BYOL) AMI model. After you deploy the C9800-CL in AWS you would have to purchase the DNA subscription licenses for APs using the Smart Licensing model.

For a more detailed overview on Cisco Licensing, go to cisco.com/go/licensingguide.

When you launch a Cisco Catalyst 9800 from AWS marketplace, you cannot select encrypted Elastic Block Storage (EBS). However, you can follow the procedure to create an AMI with Encrypted Elastic Block Storage. This process is summarized below:

• Create a Cisco Catalyst 9800 instance from the AWS marketplace

• Take a snapshot of this Cisco Catalyst 9800 instance

• Create a private AMI based on the snapshot

• Copy the private AMI to a new AMI and select "Encrypt target EBS snapshots"

At FCS, the customer has three different ways to spin up a C9800-CL in the AWS public Cloud:

• Launching a C9800-CL instance from AWS Marketplace using a CloudFormation Template

• Launching a C9800-CL instance from AWS Marketplace using the AMI

• Launching a C9800-CL instance from the AWS console

The process varies from a more manual procedure, where he customer has control of each configuration parameter (via AWS console), to a completely guided flow (using the CloudFormation template); this gives the customers the possibility to choose the best option that fits their requirements.

As described earlier, at FCS, Cisco only supports Managed VPN as the deployment mode for the new controller in the cloud: this means that a VPN tunnel has to be stabled between the on-premise location/s with APs and the customer VPC in the AWS cloud.

So, let’s first describe the required steps to create this VPN tunnel before we illustrate the procedures to launch a Catalyst 9800 Wireless Controller in the AWS public Cloud.

A VPC should have already been created, or the default VPC can be used. For more info on how to setup a VPC please read here: https://docs.aws.amazon.com/vpc/latest/userguide/getting-started-ipv4.html

1. A Managed VPN connection is created from the corporate network to the VPC

2. A VPC is created with the desired subnet for the C9800 Wireless Management interface

3. The C9800 CloudFormation template. The customer will not need to deal with the CloudFormation template as this is automatically integrated in the launching procedure; if desired, the customer can download and view the CloudFormation template file from the AWS Market Place page of the product.

4. Amazon Machine Instance ID (AMI-ID) for the desired 9800 software release; the AMI will be available in AWS market place.

5. If you don’t have one already, create a key pair by going to EC2 dashboard > Network & Security > Key pairs and click on “Create Key Pair”

   

1. A Managed VPN connection is created from the corporate network to the VPC

2. A VPC is created with the desired subnet for the C9800 Wireless Management interface

3. The C9800 CloudFormation template. The customer will not need to deal with the CloudFormation template as this is automatically integrated in the launching procedure; if desired, the customer can download and view the CloudFormation template file from the AWS Market Place page of the product.

4. Amazon Machine Instance ID (AMI-ID) for the desired 9800 software release; the AMI will be available in AWS market place.

5. If you don’t have one already, create a key pair by going to EC2 dashboard > Network & Security > Key pairs and click on “Create Key Pair”

   

1. A Managed VPN connection is created from the corporate network to the VPC

2. A VPC is created with the desired subnet for the C9800 Wireless Management interface

3. The C9800 CloudFormation template. The customer will not need to deal with the CloudFormation template as this is automatically integrated in the launching procedure; if desired, the customer can download and view the CloudFormation template file from the AWS Market Place page of the product.

4. Amazon Machine Instance ID (AMI-ID) for the desired 9800 software release; the AMI will be available in AWS market place.

5. If you don’t have one already, create a key pair by going to EC2 dashboard > Network & Security > Key pairs and click on “Create Key Pair”

   

At this point your C9800 Wireless Controller in the cloud is ready to use. You can https://<IP of Wireless Management interface> for starting the DAY 0 GUI or ssh to the box. The IP is the private IP that was either automatically assigned by AWS or you have reserved with the CloudFormation template or on the AWS console.

To ssh you have two options:

1. a. Use the username/pwd provided during the instance creation

2. Use the .pem file to authenticate using the certificate

   • chmod 400 <file>.pem

   • issh -i “file name.pem” ec2-user@<c9800-CL IP>

Note	If you want the instance to be reachable via the public IP, make sure you have a default route in the VPC Route table as explained in the “Establishing a VPN connection using the AWS VPN router” section above. Make sure that the security group would only allow the desired protocol on the Public IP.