Now that we have a full picture of what DNA Center does,
we've now seen some of the capabilities
and talked about what the SD-Access fabric does.
It's now time to talk about how DNA Center does it.
We're going to talk about the four workflows that
are basically how you go through the process of deploying,
operating, and optimizing your network within DNA Center.
This is going to give you a lot of context as to what
someone who works with DNA Center
is really going to be working with.
So we'll actually see it from the front end
as we explore the four workflows of DNA Center.
And then in the next Nugget, we're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then in the next Nugget, we're
going to wrap up with a secret fifth workflow, the platform.
Let's get going.
So how does DNA Center do what DNA Center does?
You see, even though this greatly simplifies how we work
with our network-- it greatly simplifies the complexity
of a large enterprise network with hundreds or thousands
of devices--
it's still complicated.
It's still got a lot of work to deploy an SD-Access fabric
and get all this monitoring done.
But luckily for us, DNA Center has built-in automation
all over the place. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
all over the place.
So as long as you follow their four workflows,
it should be able to reach out to all of these devices,
get them brought into the network
and provisioned with the correct configurations upfront.
The cooler thing about it is because of all
of these workflows and this automation capability,
we can actually take system defaulted devices, completely
fresh out of the box, still prompting,
would you like to configure this network device, yes or no?
You leave it in that system defaulted configuration
and DNA Center can still reach out to those devices WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and DNA Center can still reach out to those devices
and bring them into the network using plug and play technology.
Again, it circles back to the four workflows
to make these things happen.
So let's talk about what these workflows do.
The first workflow is design.
And this is where you start thinking about how are we
actually going to design the connectivity of our network
devices to each other?
And that's not exactly what design does.
Design is actually the actual layout of your campus.
We're talking geography here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We're talking geography here.
For instance, in my New York site, what IP address block
are we going to allocate to New York?
Where will it find its DHCP server?
Where will it find its DNS server?
And what image, what iOS version should devices in New York
even be using in the first place?
These are all things that we set up in design.
Then the next workflow is policy.
You've seen policy.
This is where we define our business intent
with virtual networks or ACLs, like, our scalable group ACLs.
Then we have the provision workflow. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Then we have the provision workflow.
And this is where the rubber meets the road.
This is where we actually perform LAN automation.
This is where we bring new devices into the network
and deploy our fabric overlay.
This is the SD-Access fabric that implements
the LISP and VXLAN overlays.
Beyond that, this is a very big talking point, especially
for the security track.
During the provisioning workflow, especially when
we're deploying the fabric overlay,
our devices will be provisioned to use something
called Cisco TrustSec. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
called Cisco TrustSec.
This is how our devices can implement our policies.
This is how our devices can learn
about what groups users are allowed to be a part of
and what they're allowed to communicate to.
This is how it knows what virtual network they should
belong to and which groups within it
they are allowed to communicate to.
Our macro and micro segmentation policies
come down to Cisco TrustSec.
And our devices, when deploying the fabric overlay,
will learn that they should communicate to Cisco ISE
in order to implement Cisco TrustSec. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
in order to implement Cisco TrustSec.
And the last workflow is the assurance workflow,
which we've also seen, which is how we can operate and optimize
our network by monitoring and troubleshooting
any events that go on.
So with that all said, let's actually
jump into the front end and take a look at these four workflows.
Let's start off from the home page
here and jump into the design workflow.
You can see here, we've got our global hierarchy.
This is where we're talking about those geographies
yet again.
Now, I'm in Louisiana.
And I've deployed a little fabric here
within the Louisiana fabric.
So you can see I can expand these down. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So you can see I can expand these down.
And my fabric is designed such that there's a Louisiana tier.
Then within that, we've got our cities.
And then within that, we've got some buildings
and the actual floors themselves.
So our first step in the design workflow
is just to set up what is the hierarchy of our topology
in the first place?
What are our buildings?
What are our locations?
What are their addresses?
Once you've defined the site hierarchy within DNA Center,
you can then start assigning the actual network settings
to each of these.
So my New Orleans site can find it's ISE server
at these IP addresses. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
at these IP addresses.
It can see things, like, where the DHCP server and the DNS
servers are.
And what should it be using for a syslog or SNMP server, NTP
services?
You get the idea.
You can even set the time zone that these locations should
be specified in.
We can specify what credentials should be assigned
to each of our network devices.
How can DNA Center access these network devices?
And how can we access these network devices?
We set this up right here.
We specify a username and password
that can be used for SSH, or SNMP, HTTP, and even NetConf. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that can be used for SSH, or SNMP, HTTP, and even NetConf.
Beyond that, we specify, we allocate IP addresses
that should be used for each of our virtual networks
within each of our sites.
We make all these reservations now in the design workflow,
even though we don't associate them to the final deployment
until the provision workflow.
So this sets up the design workflow,
where we're just laying out how our topology should
look in the first place.
The policy workflows, we've already seen,
is where we can define our micro and macro segmentation policy. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is where we can define our micro and macro segmentation policy.
With the macro segmentation policy,
we define the virtual networks and which users should be
within which virtual network.
With a micro segmentation policy,
we say within that virtual network,
what groups are allowed to communicate to each other?
But it's not just based on users.
We can still do the classical IP braced ACLs,
just like we've always seen.
So we could block traffic from one subnet to another.
We can also set application policies, which
is where we define things, like, QoS and class
of service treatments. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of service treatments.
And lastly, we can also set up any traffic copy scenarios,
where if we need to do any packet captures or wire
sharking, especially when certain events are triggered,
this is where we can set up those policies, too.
So this is where we define our business intent.
And this is largely coming from ISE.
Now, provision is where the rubber
meets the road, like I said.
This is where we define all of the devices in our inventory.
One of the coolest things about Cisco DNA Center
is we can just point it in the direction of our network WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is we can just point it in the direction of our network
devices and it can discover all of the devices in our network.
For instance, in my case, I specified this device
right here as my seed node.
I said just start with this device
and figure out the rest from there.
And it can actually use things like CDP
to detect who the neighbors are.
Then it jumps from one box to the next box
until it's discovered the entire network.
If we wanted to, we can provision the entire network.
We can bring it in from a factory defaulted state WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We can bring it in from a factory defaulted state
using LAN automation.
So we tell DNA Center what IP address ranges
it can use in order to bring all of these devices
into the network and create connectivity, create
policies, create AAA settings.
It does all of that for us from scratch.
Again, what we really have to do is just point it
in the direction, just give it a starting point
to start automating.
And it does the rest for us.
Once these devices are all brought
into the network, what we can do is we just jump over WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
into the network, what we can do is we just jump over
to the fabric section.
And this is where we actually deploy our SD-Access fabric.
Within the SD-Access fabric configuration section,
all we do is we tell DNA Center which virtual networks should
be within this site.
That way when users plug in, they can communicate to ISE
and be assigned to the correct virtual network
with the correct Cisco TrustSec segmentation policies
assigned to it.
And then lastly is the assurance workflow,
which we've already seen.
This is where we can actually see
what the health and status of not only
our network devices, but also our clients, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
our network devices, but also our clients,
such as wired and wireless health.
And we can troubleshoot any problems from there,
trying to figure out why things are and aren't working.
In fact, it looks like I've got some troubleshooting
to do on my own end here.
But also, if you have the correct licensing,
and NetFlow and telemetry is enabled,
you can also do things like deep packet inspection
to figure out what applications are our users using?
And we can assign them.
Are they business critical applications?
Or are they things like Netflix? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Or are they things like Netflix?
DNA Center can then report on the health of our applications
within the sites themselves.
So we can see things, like, oh my gosh,
Office 365 is a business critical application.
And users in this particular building
are having problems with just Office 365.
We can actually investigate granular items
like that in almost real time because DNA Center enables
us to take control over these situations, in total visibility
into what's going on with our network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
into what's going on with our network.
So that introduces what the four workflows are
and how we actually design and build an SD-Access fabric.
I hope this has been informative for you.
And I'd like to thank you for viewing.