Cisco's DNA Center is a new software-defined networking
solution that's primarily targeted at large enterprises.
Think about college campuses and things like that.
The goal, like most software-defined networking
solutions, is to simplify how we deploy,
operate, and optimize a network infrastructure.
So in this particular Nugget, what
we're going to talk about is what does DNA Center really do?
What is the return on investment?
What's the value that it brings?
And we're also going to introduce the core concepts WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we're also going to introduce the core concepts
of the SD-Access fabric.
In the next Nugget, we'll dig a little bit deeper
into the SD-Access fabric and talk about how it
applies to our security roles.
Let's get going.
So I know, this diagram looks pretty familiar.
You're going, wait, no, we're here
to talk about DNA Center, not Firepower.
Just hang on, hang on.
This is the same diagram from the previous skill
where we were talking about APIs and software-defined
networking.
Guess what?
The principles of software-defined networking,
they apply to DNA Center just the way
they do with Firepower Management Center. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
they do with Firepower Management Center.
So before I bring up the DNA Center diagram,
just recall for a second what we're trying to do here.
We, the end user, are logging into one single pane of glass
and deploying changes to the network
from this little management portal here.
And those changes will get pushed down
to all the different devices.
And they communicate programmatically using APIs.
But also recall that we had directions for APIs.
There were east and westbound APIs. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
There were east and westbound APIs.
There was the north and southbound APIs.
And those things really, really matter
when we're talking about DNA Center
because DNA Center is a total comprehensive solution
for large enterprises.
Now it's time to change diagrams.
DNA Center approaches the challenges
of the large enterprise with a different or more creative
way of thinking things now.
What we're really talking about when we talk about DNA Center
is intent-based networking.
And this is very similar to the things WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And this is very similar to the things
that we've talked about in the past.
What we're trying to do here is we tell
DNA Center what is our intent.
What do we intend for the network to do?
What is a basic behavior?
Like users in group A--
I'm just going to put group A here--
should never be able to talk to users in group B.
So this communication is not allowable.
Just think about that fundamentally for a second.
Someone in group A can never talk to group
B. That's all we really have to specify in DNA Center WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
B. That's all we really have to specify in DNA Center
because when we express our intent into DNA Center,
it handles pushing that business intent down
to the individual devices.
It handles things like the ACLs and the policies and the login
information.
That's the point of DNA Center.
And that's the point of intent-based networking.
But it gets a lot more complicated than that.
And that's what we're going to set up
throughout the next particular set of Nuggets.
The key things that you should know right now about DNA Center WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The key things that you should know right now about DNA Center
is how it approaches handling the enterprise network.
So what we're going to do is we're
going to start with this bottom tier
first, the intent-based infrastructure.
We see we've got a little picture of wireless access
point symbols.
We see we've got some switch symbols.
We see we've got some router symbols.
And then this is like a generic anything else.
They call these extended nodes.
But these could be things, like, firewalls or even servers.
What we're really talking about with intent-based
infrastructure, we're really saying
that these devices have the capabilities to deploy WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that these devices have the capabilities to deploy
our business intent.
And these devices all run usually some form of IOS XE.
At the time of this recording, they
prefer you to be on something like IOS XE 16.9 or 16.12.
Really, at the end of the day, what we're talking about here
is the Catalyst 9K series of devices.
The Catalyst 9K series of devices
have hardware components that help
us deploy this intent, which is the ways WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
us deploy this intent, which is the ways
that it can enforce this policy.
In fact, for many Catalyst 9K devices,
when you purchase Catalyst 9K devices,
it is required that you purchase some form of DNA
Center licensing with it.
So it all begins with the devices themselves.
They have to be able to implement DNA Center's policies
and implementations.
And really what we're saying is they
have to implement our business intent.
Then we have the systems themselves.
Well, this is, of course, a DNA Center appliance.
The DNA Center appliance is a standalone appliance. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The DNA Center appliance is a standalone appliance.
This is a server built on Cisco UCS hardware.
And this is what we, the end users, log into.
This is where, just like Firepower Management Center,
where we interact with the network.
We interact with it on the Cisco DNA Center appliance.
Now, of course, there is the ability
to make these appliances redundant.
You do have to have a minimum of three of them
in order to make them redundant.
You can't have two devices.
But the key here is that we, the end user, the administrator, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But the key here is that we, the end user, the administrator,
the network architect, will log into DNA Center from the DNA
Center appliance and tell it what our business intent is.
We'll be able to design our network.
We'll be able to monitor our network, provision
and onboard new devices.
And all of that is done from the DNA Center front end.
But notice here, this little s is "systems," not "system."
We've only talked about the DNA Center appliance.
And this is where we're going to build into what
DNA Center really does.
The big surprise is coming at the end.
Other systems that we will rely on in order for DNA Center WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Other systems that we will rely on in order for DNA Center
to work is Cisco's Identity Services Engine product,
or Cisco ISE.
Cisco ISE, in many ways, is like Active Directory,
where it is a repository of users and passwords
and permissions and privileges.
But beyond that, it's also a place
where we can store network device information.
So what DNA Center does is it integrates very tightly
with Cisco ISE.
It really can't operate without it.
And thanks to Cisco ISE's capabilities, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And thanks to Cisco ISE's capabilities,
we now have a way to keep track of what
nodes are in our inventory and are
allowed to be in our network.
But beyond that, we also have a way
of keeping track of what people are accessing our network,
what groups do they belong to?
But more importantly, we were talking about devices.
So we can now keep track of which
devices are these users using?
Are they bringing their own iPhone?
Are they sitting down at a desktop computer?
When they plug into the network and they type in their username WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
When they plug into the network and they type in their username
and password, Cisco ISE can capture this authentication
and associate them with their devices.
Beyond that, it can talk to DNA Center
and say, this user just authenticated.
What business intent would you like
for me to carry out with them?
What resources should they be allowed
to access in the first place?
That's why DNA Center talks so closely with ISE
and vice versa.
But taking it a step further, there's
more systems that we can integrate with,
like IPAM solutions.
This would be like Infoblox or BlueCat. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This would be like Infoblox or BlueCat.
So with all of these new network devices coming
into a large enterprise and all of these users
that are now accessing the network,
we need a way to cleanly organize
which IP addresses can be assigned
to which regions of our environment, like,
sites or geographic locations.
Or what types of devices should we
allocate for iPhones and iPads?
This is where the IPAM solution comes in.
And DNA Center communicates closely with that.
You can see now how the three interact with each other.
A user may authenticate using a certain type of device WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
A user may authenticate using a certain type of device
or in a certain location.
DNA Center can communicate to IPAM
about what kind of addressing and services do they need.
And all of that information is carried out that way.
But then on top of that sits the platforms.
And this is where we're really talking about APIs.
This is how DNA Center communicates
to IPAM or ISE or, more importantly, other devices
that we're trying to interact with.
This could be things like our own applications
that we're custom building or other systems and services
that we need to interact with, like, NetFlow or Syslog WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that we need to interact with, like, NetFlow or Syslog
Collector.
This is where we start talking about the northbound versus
southbound versus eastbound versus westbound API.
Now, the big thing that DNA Center really, really brings
to the table, one of the most incredible things,
is DNA Center Assurance.
Once you have your entire network
stood up with your business intent,
with all of your policies and people
are now onboarded into the network,
how do we keep track of such a large enterprise?
Again, think about a large college campus environment
where there's dozens upon dozens of buildings WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
where there's dozens upon dozens of buildings
and tens of thousands of users.
And each of them has four or five devices
that they're using.
So there could be hundreds of thousands of devices.
By the time we find out that there's a problem,
it may be too late.
It may be days past.
DNA Center Assurance is one of the most incredible things
about it because all of these people, all of these devices,
all of these network nodes and everything, they all stream
data back to DNA Center.
This is that telemetry that we were talking about again.
They're constantly sending data back WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
They're constantly sending data back
to DNA Center, which is storing it in a gigantic database.
But then it gets crazier and cooler.
DNA Center learns about your network.
It uses machine learning and artificial intelligence
to determine what's normal and what's expected
within your environment.
And it can detect when anomalies or problems occur,
and proactively monitor and troubleshoot and alert you
when these problems occur.
But beyond that, because it's storing this data WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But beyond that, because it's storing this data
in a database, it can keep a historical record
of your entire network.
So maybe you go to bed one night.
And when you wake up the next morning,
12 hours later, you find out that a problem has occurred.
You can now look historically at your assurance data
and figure out what happened 12 hours ago.
And look, I appreciate a good whiteboard as much
as the next guy.
But what we really should do is we should actually take a look.
We should peek into DNA Cente for a moment.
I actually happen to have a DNA Center appliance
within my own little lab here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
within my own little lab here.
And I'm glad that we can show it off now and actually
show you a little bit about what DNA Center looks like
and how does it behave.
We actually have dedicated training content to DNA Center.
It's called implementing an SD-Access fabric
within DNA Center.
What does that SD-Access fabric thing even mean?
That's what the next Nugget is all about.
But let me clear the screen here and bring up my web browser.
Look, this is DNA Center.
Let me get logged in.
And here we go.
Now I am online in DNA Center.
And quickly, I can see my assurance snapshots. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And quickly, I can see my assurance snapshots.
We have all sorts of issues that it's already
raising to me right now.
I have four P1 issues-- this is priority one--
and one P2 issue.
This was a way that I can log in and immediately see what's
going on within my environment.
I also see that I have several network devices that
are not in a very good state.
I have a 57% health score on my network devices.
So by jumping over to the Assurance section real quick,
this is where we can start digging
in to what's really going on within my entire SD-Access
fabric. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
fabric.
It looks like my distribution layer
and some access switches are showing down.
All of this is stuff that now I'm
being alerted to that I can start to begin to troubleshoot.
But like I said, we can jump through time
and see what's going on here.
So I can look at things like what happened in the last three
hours, what happened in the last 24 hours, what's happened
in the last seven days.
And I can drill down into all of these items.
But it doesn't stop there.
We also have things like client health.
So when a user gets logged into the network for the first time,
we can actually see what their individual health status is. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we can actually see what their individual health status is.
By far, one of the coolest things you can do
is if someone were to call in to our help desk
and tell us, hey, so-and-so is having problems in the network,
we can actually click on the Search button here
and just search for their name, like, Bob Smith.
And when their name pops up, we can actually
click on their name and see what their historical experience has
been for the last seven days and which
devices are they working with.
You see, this is how it's all integrating with IPAM and ISE.
Now we have a total snapshot into our entire environment, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now we have a total snapshot into our entire environment,
not just talking about network devices anymore.
We're now able to look into applications.
We're now able to look into users' experiences.
This is a total enterprise environment.
And again, think about how this could
benefit the very large enterprise, like, hospitals
or college campuses.
But it gets way cooler than that when
we start talking about how intent is deployed
with the SD-Access fabric.
And that's what the next Nugget's all about.
In the meantime, this has been setting up WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
In the meantime, this has been setting up
what DNA Center does.
I hope this has been informative for you.
And I'd like to thank you for viewing.