I've gone ahead and I've clicked on the link
that you can see right above this video
to launch into this site,
where we're working with the Cisco Catalyst Center
automation and assurance demo environment.
This is a public environment, sort of,
you do have to have a login.
So if you click here and it makes you log in first,
you do have to have a Cisco account to get in.
Now, it doesn't tell you much
about what the Cisco Catalyst Center solution is WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
about what the Cisco Catalyst Center solution is
or what it does.
And that's ultimately what this video is gonna talk about.
I wanna pause for a moment and tell you,
kind of warn you,
that take everything you kind of know about networking
and how you approach a network challenge
and be prepared to do the opposite
when you work with DNA Center, kind of.
Look, I'm gonna click explore here.
And what we're gonna do is I'm gonna choose
the latest version of demo.
It gives you three different versions WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
It gives you three different versions
of Catalyst Center that you can work with.
I'm gonna use the latest one,
which is version 3.1.5 at the time of this recording.
And I'm gonna click try it
and it's gonna launch into the environment itself.
I'm greeted with a login prompting me
for the Catalyst Center username and password.
You might be wondering what is the username and password?
Go back to this D cloud page right here,
go into resources and open up the demo guide.
It's like a PDF. WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
It's like a PDF.
Under the PDF do start here,
go to introduction and you'll see in the center of the page,
the credentials.
These credentials have been the same
for about five years now.
So the username is demo,
the password is all lowercase demo,
one, two, three, four, exclamation mark.
Now, the reason why this is not a very secure username
and password is that you don't have
any admin privileges here.
This is really just a read only account,
which is all you need to monitor a network. WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
which is all you need to monitor a network.
You're not changing a network
or provisioning any new devices.
So we'll type in the username and passwords.
If you see these pages that look frozen or hung,
it's actually okay.
It just takes a while to get a response.
If it sits there for forever,
feel free to give it a refresh
and it should pop up okay.
So when we talk about Catalyst Center,
there's really, it's kind of a workflow WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
there's really, it's kind of a workflow
of going from zero to a full large campus fabric
over the course of four steps.
Those steps are number one, design,
number two, policy,
number three, provision
and number four, assurance,
which is what the main topic of this set of videos is.
If you've never really worked with SD Access
or gotten a crash course on it,
you might be wondering, what is SD Access?
Why are there four workflows? WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
Why are there four workflows?
And that's what we need to talk about first.
So I'm gonna clear the screen a little bit
and we're gonna do some doodling.
Pretend you work on a large college campus.
There are dozens of buildings.
There are tens of thousands of people,
maybe hundreds of thousands of people
on your campus at all times.
Several thousand of those people are employees.
So let's say you work here in building A WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
and let's say you're some type of network engineer
or software developer.
So here you are.
You're sitting on your laptop, tablet, PC or whatever
and maybe it's docked and it plugs into a wall
and you have access to all the resources
you're used to having.
Perhaps somewhere over here is a data center
and you access a server that's racked right here, WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
boop, right there in the data center.
What is the networking that goes into making this work?
Well, immediately as a network engineer,
we think, well, we're clearly a part of some VLAN
that has routable access through the core of the network
and over to the data center
and there's some sort of ACLs in place
that allow me to access this server right here
and access the resource.
This is maybe a file share, documentation server, WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
This is maybe a file share, documentation server,
whatever the case is, you have access
because you're plugged in to this network port right here
which gives you access to this VLAN
which is allowed to route through the network
to this particular server
which maybe is on the same VLAN but probably not
but one way or another,
your VLAN can access resources on this server.
Great, what happens then if you pick up your laptop
and you walk across the entire campus WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
and you walk across the entire campus
and you go to the student union
and you sit down with your laptop
and now you connect to Wi-Fi?
Hmm, do you still have access to the server?
This is where I want you to pause right now and think.
I want you to think about this.
How would you as a network engineer solve the problem
of needing access to the server WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
of needing access to the server
when you connect to Wi-Fi in the student union?
Well, immediately your head is thinking,
hmm, well, I need to take this VLAN
or create a new VLAN and give it its own SSID
so that I connect to that SSID
which puts me on that VLAN
which then gets routed back to this data center
and right there is where the whole thing
kind of falls apart
and when I say kind of falls apart,
what I mean by that is this is not scalable WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
what I mean by that is this is not scalable
because users on a large college campus move.
They go from point A to point Z all the time
and we're talking tens or even hundreds
of thousands of people.
So as network engineers,
the way we have solved this problem in the past
up until DNA Center, now Catalyst Center,
is that we thought about how to use the network WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
is that we thought about how to use the network
to solve accessibility, to solve connectivity.
What if I told you that Catalyst Center
goes in the complete opposite direction
where to solve this user's problem,
we use networking technologies?
What if I told you instead of approaching these problems,
looking at the network first as the solution,
what if I told you we could just look at
the person themself and their username and privileges WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
the person themself and their username and privileges
and have the network adapt itself
wherever that user goes?
That's what SD access is.
SD access is now we design users and groups
and policies that say users in this group
need access to this application wherever they go. WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
need access to this application wherever they go.
And from there, the Catalyst Center servers
deploy the network in such a way
that the user can now roam throughout the campus
and maintain their same connectivity wherever they go.
How?
How is such a thing even possible?
Well, we're not gonna get too in depth into how,
but I will tell you that the Catalyst Center servers,
typically the deployment is three servers. WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
typically the deployment is three servers.
So we'll call this one, two, and three,
work in conjunction with all of our Catalyst equipment.
This is all Catalyst 9K devices or newer
and the latest Cisco wireless technologies as well,
because they're all part of this.
They all ultimately report back to these servers WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
They all ultimately report back to these servers
and these servers push policies and configurations
to all the switches, routers, and wireless devices
in the entire campus to support them.
The underlying network is a fabric
that consists of, of course, an underlay and then an overlay.
In the underlay, ISIS, it's almost always ISIS
that gets deployed absolutely everywhere. WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
that gets deployed absolutely everywhere.
On top of this, we're going to use LISP,
which is a service provider type technology usually seen,
plus VXLAN, of course, this is for tunneling
layer two traffic typically, and TrustSec.
TrustSec, this is for identifying our users
and attaching those users and their policies
ultimately to their NIC card, WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
ultimately to their NIC card,
you know, their IP address and their Mac address.
So as a user migrates through the network
from point A to point Z,
LISP is keeping track of their location.
VXLAN allows them to tunnel their traffic
all the way back to wherever devices they need
and TrustSec identifies what policies they need.
ISIS, of course, is the routing from one end to the other.
So why, again, what is the problem that this is solving? WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
So why, again, what is the problem that this is solving?
When it comes to huge amounts of people,
customizing the network for every single one of their needs
and allowing them to be able to roam freely
throughout your entire college campus
is a very challenging thing to do
if you're the one typing commands
on switches and routers and so on.
Even if you are using a software-defined
networking controller without SD-Access,
software-defined access, not software-defined networking, WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
software-defined access, not software-defined networking,
software-defined access, even without that,
it's still a daunting challenge.
Now, with SD-Access, it's not just one college campus
that we can actually manage,
we can manage a global campus.
If we have huge locations in New York, Tokyo, UK, and so on,
it can all be managed from SD-Access
and people can migrate from one facility WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
and people can migrate from one facility
all the way to the other end of the world
and maintain similar or same connectivity wherever they go.
The win for you as a network designer
is that you no longer focus on the network.
You focus on people.
You focus on getting the person into the right group
with the right permissions, and then they just get to go. WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
with the right permissions, and then they just get to go.
And SD-Access does the rest.
Now, I'm not telling you that you don't have to log
into consoles and type commands.
There's still, I mean, this is a very,
very complicated deployment.
That's why it's like save for the CCIE
and the content on it is pretty in-depth on its own.
But the point is, if this is a mindset shift
to get away from thinking about network devices
and network commands to now managing people,
roles, groups, and permissions. WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
roles, groups, and permissions.
Ultimately, I think the reason that they,
this is speculation, okay?
This is just me.
But I think that they rebranded this
from DNA Center to Catalyst Center
because this is a completely opposite way
of tackling challenges that we've done in the past.
And the term DNA Center, just the brand DNA Center,
it was just really hard to wrap my head around
that like, oh, we have to just redo everything.
When we say Catalyst Center, now I'm kind of like, WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
When we say Catalyst Center, now I'm kind of like,
well, I'm already buying Catalyst appliances.
This is just a software-defined networking controller
that manages those Catalyst appliances.
And it makes that transition to get in the door,
to talk about Catalyst Center easier.
People can go to Cisco now and be like,
hey, it's time to refresh our hardware.
Let's talk about the Cat 9K devices.
Then Cisco salespeople or whoever,
you know, their reps or whatever could go,
oh, well, since you're getting Cat 9K,
we should talk about Catalyst Center. WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
we should talk about Catalyst Center.
That makes it a lot easier of a conversation
than we can talk about DNA Center, right?
Because what comes after that is,
you should stop doing everything
the way you've been doing it
and do it in a totally different way.
And that's an even bigger conversation, isn't it?
With all that said, when I flip over here
and we're now looking at Catalyst Center,
the workflows now kind of matter.
Design is not where you design your network.
Interestingly, it's where you identify your geographies. WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
Interestingly, it's where you identify your geographies.
You will quite literally say,
we have building A located at this address
in this state, in this country.
Then we have building B located at this address
in this state, in this country.
And that makes sense because the entire point
of Catalyst Center is ultimately in policy
to define people and Catalyst Center needs to know
what building are they currently in WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
and where did they roam to?
So first we start off with geographies and buildings.
Then we go into policies,
which is really the meat and potatoes of the whole thing.
Users, groups, apps, servers, and permissions.
People need to connect to resources.
Who gets to connect to what is defined in policy.
Provision is what the name implies.
This is where you will perform
a network-wide discovery and onboarding. WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
a network-wide discovery and onboarding.
Now, this is also an in-depth procedure,
but thanks to zero-touch provisioning,
there's not a lot that you have to do
as long as you start using Cat 9K devices
with the right licenses.
DNA Center can connect to those devices.
You basically give it Telnet credentials
or SSH credentials, and if it discovers the device
and can log in, it does the rest.
Once you're done with that, you move on to Assurance. WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
Once you're done with that, you move on to Assurance.
This is where Assurance and Catalyst Center really shine.
This is where we start to see monitoring
all of this stuff, all of these people,
all of these network devices, wired and wireless,
and identify and automatically react to issues
as they occur.
It is incredibly powerful.
Now, obviously, this was a big deal in 2019 or 2020
when DNA Center was rolling out. WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
when DNA Center was rolling out.
Assurance uses machine learning to detect anomalies
and identify threats and also find issues
with your network and automatically respond
with best practices or suggestions.
Now, that's kind of expected in 2026
when I'm recording this, and it's not too surprising
that we see AI branded everywhere, right?
Because LLMs and ChatGPT have made AI mainstream,
and now it's absolutely everywhere.
It was a huge deal back then. WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
It was a huge deal back then.
Now it's kind of like the norm,
but it's still a really important part.
Assurance will learn what is normal for your network
so that it can detect anomalies,
because your network's not the same
as everybody else's network, right?
You're working at a college campus.
Is your network the exact same
as Microsoft's campus in Washington?
No.
What goes on there is not.
So this is why it's a big deal to have machine learning
on these very large and very expensive DNA center servers WEBVTT X-TIMESTAMP-MAP=MPEGTS:0,LOCAL:00:00:00.000
on these very large and very expensive DNA center servers
so that it can identify what is normal
and what is not in your environment.
So now that we understand what SD-Access is,
why it matters, why it's a mindset shift,
and where assurance fits in,
we can start using assurance in the next video.