So after defined access is a combination of building out a fabric but also
adding an SDN
element, especially an SDN controller.
What we want to do is we want to solve problems that go beyond the Layer 2 and
Layer 3 issues
as we just set.
And so when we talk about a fabric, this is great for solving the Layer 2 and
Layer 3
conundrum.
It allows us to achieve the best of both worlds.
It's a wonderful approach that enables us to deliver something that traditional WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's a wonderful approach that enables us to deliver something that traditional
networks
have never been able to deliver.
But it doesn't solve all the other issues.
The SDN controller and what we're going to find with SDA is actually a pair of
controllers.
But this operational layer is what's going to give us the ability to wrap our
arms around
better management.
So all of those issues on the right side of the chalkboard and the last video
that we
said we've got all kinds of issues with managing a large environment and it's
going to allow
us to manage the security issues that we talked about as well. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
us to manage the security issues that we talked about as well.
This is why SDA combines the fabric with the SDN world because we're trying to
solve
more problems than just the bits and bytes that are flowing around our network.
So let's gain a quick reminder of what exactly a fabric looks like.
We know in a traditional network we are going to build this around a 3-tier
architecture.
And this 3-tier model is going to extend our core connectivity.
So here's our network core down to a distribution layer. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So here's our network core down to a distribution layer.
So this distribution layer is the dividing line between the Layer 3 world and
the Layer
2 world if we're building Layer 2 out to the edge.
So we could also extend Layer 3 out here.
This would be that Layer 2 versus Layer 3 debate.
And from here we're going to connect down to individual access closets.
And we have to decide how exactly we want to connect to the access closet.
So we could do the triangle approach like I've drawn here on the left. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we could do the triangle approach like I've drawn here on the left.
And then I'm going to connect more switches down here and then loop through
them.
And this is going to give us some pros and cons relative to the other option
which is
to do this square methodology which allows us to connect through all of the
switches this
way.
And just depending on outages and situations of which links go down, which
switches might
go down, either one of these topologies is going to have benefits and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
go down, either one of these topologies is going to have benefits and
disadvantages in
those types of situations.
And so we can build this out in either way and ideally recall that we benefit
greatly
if we replace this with a chassis switch or a stack of switches.
And especially if we deploy VSS or these days, what Cisco calls stack wise
virtual, either
one of these technologies here at the distribution layer will greatly reduce
spanning trees influence
on this topology.
And yet spanning tree is going to have to continue to run in one form or the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And yet spanning tree is going to have to continue to run in one form or the
other.
So there are things that we can do in this traditional 3-tier model.
And the invention of these various technologies along the way or along the last
couple of
decades have really helped us out with our access layer designs.
And we're also going to have to decide between layer 2 and layer 3.
What I've drawn here is assuming a layer 2 environment.
If we draw a layer 3 network out, we're likely going to go with the topology
here on the
left, which allows me to do layer 3 out to this head end node and then a sort WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
left, which allows me to do layer 3 out to this head end node and then a sort
of many
layer 2 network that's inside of the network closet.
Now we compare this or maybe contrast it with the idea of a fabric.
And so with a fabric, we're going to take our many different access layer
switches or
ultimately our access closets, especially the head ends.
And we're going to connect these into a layer 3 network.
And we're going to build tunnels across the top of them. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we're going to build tunnels across the top of them.
So from a physical perspective, we still have our distribution switches in here
.
We're still connecting out to all of these different access closets.
But from a layer 2 perspective, we're going to build tunnels among our
different access
layer closets.
And these tunnels are going to allow us to carry layer 2 traffic.
This is going to use a protocol known as VXLAN in order to do this. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This is going to use a protocol known as VXLAN in order to do this.
And this allows a subnet to be stretched.
We'll draw it like this all the way over here.
So this layer 2, let's call it VLAN 10, can be stretched between these two
access layer
closets with devices at both closets being on the same subnet, being in the
same VLAN.
And yet they are layer 3 segmented because this underlay is layer 3.
The reason why this works is because we see the VXLAN tunnel extends layer 2 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The reason why this works is because we see the VXLAN tunnel extends layer 2
connectivity
between the access layer closets.
So this fabric concept is going to solve the layer 2 and layer 3 conundrum for
us.
We're going to build this network on layer 3.
It's going to look a lot like a layer 3 access closet design at the beginning.
Yet we're going to extend layer 2 via the XLAN.
And so this completely eliminates spanning tree protocol, which is wonderful. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so this completely eliminates spanning tree protocol, which is wonderful.
We don't have that problem anymore.
It also maximizes our flexibility because now we can have devices in the same
subnet and
two different access closets even though they are layer 3 segmented.
Scaling is no issue whatsoever.
We have wonderful scaling here because of the underlying layer 3 architecture.
And so this is why we basically have all of the pros of layer 2 and layer 3. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so this is why we basically have all of the pros of layer 2 and layer 3.
And we have none of the cons of either one of those, neither of the downsides.
Now we could argue that complexity is there.
Maybe one factor there.
We have said layer 3 is a little more complex to manage because we have
additional protocols
that we have to worry about.
And we could make that argument that, hey, this is a lot that we have to manage
.
But deploying a fabric on its own is very different than deploying it with an
SDN controller. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
SDN controller.
And so hopefully the claim at least is that this will actually be a lot simpler
to manage
than even the layer 3 side of things on the traditional or in the traditional
network.
And so the SDN controller is going to help us with that.
So now let's explore what the SDN controller is going to help us do and that's
going to
start with a conversation around management.
Management of our network.
Again, it goes past the just switching of layer 2 frames and deciding about WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Again, it goes past the just switching of layer 2 frames and deciding about
layer 2 and
layer 3 architectures.
And it's helping us with the sheer number of access layer switches.
That continues to be one of the biggest problems and one of the biggest
challenges for large
organizations, especially when we think about college campuses and many
locations and many
access closets.
And this can become very challenging as far as some of the management items
that we had
talked about earlier. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
talked about earlier.
Well, with an SDN controller, we are typically going to have a single
management pane.
Now pane is spelled P-A-N-E, not a pain like it hurts us.
But a single management pane, meaning something that we log into.
Usually, this is going to be a graphical user interface.
And sometimes we're still going to get some amount of CLI tools, although the
CLI is
minimized.
It's not the same thing as a traditional network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's not the same thing as a traditional network.
As far as how much CLI we're going to use, we're largely going to rely on the
graphical
user interface.
That said, because of programmability elements, we can also take advantage of R
EST APIs and
deploy configuration scripts that way.
So if we like how we do things with the CLI, it's probably worth learning the
APIs a little
bit because that's effectively the new CLI.
I can write a script.
Now in, let's say Python, and it was in JSON in there, rather than using Cisco WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now in, let's say Python, and it was in JSON in there, rather than using Cisco
CLI.
And that Python script can run and take advantage of the REST APIs and do
things in a much
cleaner fashion as far as deploying to a lot of switches.
This allows us to deploy global configurations.
So we're talking about earlier, we said quality of service can be a challenge
to give us end
to end policy enforcement.
Well now we have it.
Even if we have multiple types of hardware in our environment, the fact that we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Even if we have multiple types of hardware in our environment, the fact that we
have a
controller-based management approach allows the controller to deal with the n
itty gritty
of QOS even across different hardware platforms.
It also allows us to manage the images.
So our image management can now lock in on particular software versions to say
that we
want to make sure we're running this software version on all of our switches.
And now we can make sure that that's happening much more seamlessly using that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And now we can make sure that that's happening much more seamlessly using that
single pane
of management.
Now all of this can lead to a conversation around network assurance, which we
're calling
the last video, we were talking about how we wanted to be more proactive in
identifying
issues that are coming, in identifying issues that are here, and in terms of
troubleshooting,
being faster with troubleshooting.
And because we have an aggregated amount of data, we can run analytics. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And because we have an aggregated amount of data, we can run analytics.
And by running analytics against the data that we've been collecting across
this entire infrastructure,
we have the ability to also deliver that assurance, being a proactive approach
to resolving issues
and troubleshooting things as they come up.
Now lastly, all of this is also going to lead us to a much better security
model.
We're looking at security.
We don't have to worry as much about ACL management.
The joke is always how often do we go and remove ACLs or how often do we remove WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The joke is always how often do we go and remove ACLs or how often do we remove
ACL entries,
the access control entries, the lines that make up an ACL.
We don't like to do that.
Nobody likes to remove ACLs and generally speaking any amount of configuration
that's in place.
And so this is going to be managed now by our controller so that all of our
access control
lists are in sync with our current active policy.
This is also going to allow us to perform access control at a much more
granular level.
So now our access control can be based on the user and no longer the VLAN or WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So now our access control can be based on the user and no longer the VLAN or
the subnet.
And that can again lead us back to saying that this host and this host cannot
communicate
with one another even though they're on the same subnet and they're not going
to go through
a SVI to route to one another.
And lastly, this means that we have a much more dynamic policy.
We mentioned that's a very static policy.
I could deploy security mechanisms and security configurations to maybe this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I could deploy security mechanisms and security configurations to maybe this
port on this switch,
but what if this user migrates to a different machine or what if this machine
migrates to
a different switch?
Either way, we're talking about a much more dynamic security mechanism because
we can
identify that the user is now over here on a different switch port and we can
apply
the exact same policy, whether it's the same PC or a different PC.
It doesn't matter.
It's in a different location.
It's user driven. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's user driven.
And so we can manage our access control in a much more dynamic way.
So this is a set of all of the advantages that we are trying to achieve by
combining these
two technologies by saying that we're going to deploy a fabric now to our
network edge.
And we're going to take advantage of SDN elements and specifically SDN
controllers in order
to bring the rest of the problems hopefully to resolution.