Cvd Software Defined Access Deployment Guide 2018apr x111b

CISCO VALIDATED DESIGN

Software-Defined Access Deployment Guide April 2018 Solution 1.1

Table of Contents

Table of Contents Software-Defined Access Introduction............................................................................................. 1 Deployment Details.......................................................................................................................... 4 Installing Controllers for SD-Access Network...................................................................................................................5 Install Identity Services Engine Nodes............................................................................................................................ 15 Integrate Identity Services Engines with DNA Center..................................................................................................... 22 Install SD-Access Wireless LAN Controllers.................................................................................................................. 25 Deploying SD-Access.................................................................................................................................................... 30 Using DNA Center for Network Discovery and Initial Design.......................................................................................... 30 Using DNA Center for SD-Access Network Provisioning............................................................................................... 44 Creating Segmentation and Policy in the SD-Access Network...................................................................................... 52 Using DNA Center to Provision an SD-Access Overlay Network.................................................................................... 55 Integrating Wireless Into SD-Access.............................................................................................................................. 65

Appendix A: Product List................................................................................................................ 72 Glossary......................................................................................................................................... 75

Cisco Validated Design

Software-Defined Access Introduction

Software-Defined Access Introduction Cisco® Software-Defined Access (SD-Access) is an application package that runs on the Cisco Digital Network Architecture Center (DNA Center) controller for deg, provisioning, applying policy, and facilitating the creation of an intelligent campus wired and wireless network with assurance. Fabric technology for the campus, an integral part of SD-Access, introduces programmable overlays enabling easy-to-deploy network virtualization across the wired and wireless campus. In addition to network virtualization, fabric technology for campus provides software-defined segmentation and policy enforcement based on identity and group hip. Softwaredefined segmentation is seamlessly integrated using Cisco TrustSec technology, providing micro-segmentation through the use of scalable groups within a virtual network. Using DNA Center to automate the creation of virtual networks provides reduction in operational expenses, coupled with the advantage of reduced risk with integrated security and improved network performance provided by the assurance and analytics capabilities. This guide describes an implementation for deploying an SD-Access network using DNA Center, integrated into an existing enterprise network. The virtual networks that SD-Access builds (overlay networks) run on a physical network (underlay network), creating alternative topologies for connecting devices in the campus LAN. Similarly, overlay networks are commonly used to provide Layer 2 and Layer 3 logical networks with virtual machine mobility in data center fabrics (examples: Cisco ACI, VXLAN, and Cisco Fabriath). Overlay networks are also used in wide-area networks to provide secure tunneling from remote sites (examples: MPLS, DMVPN, and GRE). This guide helps you understand important elements of automating SD-Access configurations and the integration into existing networks. As described in the Software-Defined Access Design Guide, the underlay network is defined by the physical switches and routers that are part of the campus fabric. All network elements of the underlay must establish IP connectivity via the use of a routing protocol, just as when building a traditional campus network. Instead of using arbitrary network topologies and protocols, this implementation uses a well-designed Layer 3 foundation inclusive of the campus edge switches (also known as a routed access design), ensuring performance, scalability, and high availability of the network. In the campus fabric, end- subnets are not part of the underlay network, even though the underlay infrastructure equipment s the end- physical connectivity. You use the underlay as the ing infrastructure when creating one or more overlay networks, which run across a set of the underlay network devices. The data plane traffic and control plane signaling is contained within each virtualized network, maintaining isolation among the networks in addition to isolation from the underlay network. The SD-Access fabric implements virtualization by encapsulating traffic over IP packets that are sourced and terminated at the boundaries of the fabric, extending all the way to APs for wireless clients. Because IP-based connectivity within each Layer 3 overlay is an abstraction from the physical connectivity, multiple IP networks can be a part of each virtual network. In multi-tenant style deployments where you relinquish control of the addressing for each tenant’s Layer 3 overlay, you likely have to allow for some non-unique IP address space appearing in more than one overlay. You can the overlapping IP address space requirement by preserving the traffic separation beyond the fabric border using typical virtualization techniques—including adding devices to remediate addressing conflicts (typically using network address translation) and provisioning to enable communication with permitted common external IP services such as DNS and the Internet.


page 1

Software-Defined Access Introduction Figure 1 Layer 3 overlay—connectivity logically routed

Border Nodes

Layer 3 Overlay

Physical Fabric Topology

7104F

Edge Nodes

In addition to network virtualization, the campus fabric integrates Cisco TrustSec technology to enable softwaredefined segmentation and policy enforcement based on identity and group hip. In this deployment, security policy management uses Cisco Identity Services Engine (ISE). Scalable group tags (SGTs), also known as security group tags, are integrated into the campus fabric headers. For group policies that extend outside of the campus, you configure the propagation of the SGT information from the fabric border node outside of the campus by either transporting the tags to TrustSec-aware devices using SGT exchange protocol (SXP) or by directly mapping SGTs to Cisco Meta Data (CMD) using inline tagging capabilities implemented for connections to the border.

Implementation Overview Although there are certainly a wide variety of alternative deployment options to the topologies, protocols, and designs shown in this implementation, organizations are encouraged to start implementations with these configurations and then customize them to fit their needs. Within this guide, the deployment of the underlay network is a Layer 3 routed access topology using the IS-IS routing protocol with fast network convergence properties available using equal-cost multipath (ECMP) routing. Underlay topologies for the fabric should not use the classic Layer 2 access design components, such as Ether-


page 2

Software-Defined Access Introduction channel, in a fabric implementation for SD-Access Solution 1.1. The overlay networks deployed are IP-only and connect with the rest of the enterprise network at the fabric border nodes as a function enabled on the campus core devices. Network virtualization extending outside of the fabric is preserved using VRF-lite, a virtualization technology commonly used to enable multiple separated Layer 3 routing and forwarding functions within a device. Outside of the fabric, you enable any required connectivity among VRFs and to services (typically residing within either the global routing table or a dedicated VRF) using classic virtualization techniques, which preserve the separation while allowing communication on an as-needed basis. When you consider integrating the campus fabric into an existing enterprise network, there are two key network design considerations, and each drives unique requirements for the integration: • Virtualized network—If the network is already virtualized, the VRFs at the campus fabric border extend into that virtualization technique of choice by using VRF-lite as a handoff into the existing virtualized infrastructure, whether it is MPLS, Multi-VRF, or some other technique. • Non-virtualized network—If the existing network is not virtualized, the recommended, validated interconnection between the fabric border and the non-virtualized network uses an intermediate device (fusion router) to enable route exchange between the domains and enabling shared services across all the virtual networks. Dual fusion routers are deployed for increased availability and use BGP as an exterior gateway protocol to the fabric border, which easily accommodates loop avoidance. In the deployment described, the campus core layer hosts the border functionality. An alternative border for smaller networks using a collapsed core/distribution using stackable switches is also described. Using the core as the border offers the overlay benefits across the entire campus LAN at the common campus exit point. The location where traffic exits the fabric as the default path is the external border. There are alternative choices for the external border, such as extending the border further into the enterprise, perhaps by extending the fabric all the way to the Internet edge. For trial deployments, the entire fabric could consist of a pair of distribution switches (or a collapsed core/distribution at a smaller site) performing the fabric external border role along with associated access switches at the fabric edge. When implementing this, recognize that the fabric benefits are limited to the devices covered by the extent of the border-to-edge fabric domains. If there is a requirement to have another location in the fabric as an alternative exit point for a specific set of nondefault traffic (perhaps a WAN location, for example), additional border devices are used to the requirement. The scope of border deployment guidance in this version of the deployment guide is for the more common external border configurations. The enterprise network integrated with the described campus fabric deployment is non-virtualized and runs EIGRP as a routing protocol. IP prefixes from the campus, including shared services, must be available to both the fabric underlay and the overlay networks while maintaining isolation among overlay networks. To maintain the isolation, VRF-Lite extends from the fabric border nodes to a set of fusion routers. The fusion routers implement VRF route leaking using a BGP route target import and export configuration and perform mutual redistribution with EIGRP in the enterprise network and with BGP to the campus fabric. A route-map configuration for dynamic tagging and filtering of redistributed routes provides a simple and dynamic way to prevent routing loops while accommodating multiple redistribution points in the high availability design. If you didn’t get this guide from Cisco Design Zone, you can check for the latest version of this guide. You can find the Software-Defined Access Design Guide, -to-Data Center Access Control Using TrustSec Deployment Guide, and related design guides, deployment guides, and white papers in the Design Zone at the following page: https://www.cisco.com/go/designzone


page 3

Deployment Details

Deployment Details How to Read Commands This guide uses the following conventions for commands that you enter at the command-line interface (CLI).

Commands at a CLI or script prompt: Router# enable

Commands to enter at a CLI prompt: configure terminal

Long commands that line wrap are underlined. Enter them as one command: police rate 10000 pps burst 10000 packets conform-action

Commands that specify a value for a variable: ntp server 10.10.48.17 Commands with variables that you must define: class-map [highest class name]

Noteworthy parts of system output (or of device configuration files) are highlighted: interface Vlan64 ip address 10.5.204.5 255.255.255.0

When deploying SD-Access, there are a number of significant deployment decisions to consider prior to starting: • Are you ready to deploy a Layer 3 (routed) access layer? This deployment assumes a Layer 3 access for the network. Although any topology and routing protocol could be used in the underlay, the implementation of a well-designed Layer 3 foundation all the way to the campus edge is required to ensure for performance, scalability, and high availability of the network. To achieve this goal for underlay deployments not manually created, DNA Center LAN automation deploys new networks using an IS-IS routed access design. Though there are many alternatives, the selection offers operational advantages such as neighbor establishment without IP protocol dependencies, peering capability using loopback addresses, and agnostic treatment of IPv4, IPv6 and non-IP traffic. • Subnet planning is an integral consideration if you are planning a migration from a Layer 2 to a routed access layer. All the same, SD-Access introduces the flexibility to remove traditional routed access layer restrictions associating client subnets to the closest Layer 3 gateway and allows subnets to stretch through the SDAccess fabric to a specific function, such as connectivity for computers, unified communications, or Wireless LAN access points. • Do you plan to deploy the underlay manually in a custom configuration as an extension to the enterprise-wide routing protocol already used, or do you intend to use a dedicated interior gateway protocol (IGP) for the fabric underlay? This deployment shows a separate IGP using IS-IS for the underlay, which has a well-defined scope that is useful in automating new deployments. • Are there requirements to deploy multiple Layer 3 overlay networks (such as for multitenant use cases described in the Introduction section), or does a single Layer 3 overlay with multiple stretched subnets meet the requirements? The deployment accommodates both types of deployments by ing one or multiple VRFs extended outside the fabric domain. Nevertheless, consider that multiple overlays require additional planning for integration of common services into the multi-VRF environment. In both scenarios, you need to plan for and document all overlay subnets and VRFs for the host pools and be prepared to integrate them into your DH services.


page 4

Deployment Details • Have you identified the appropriate locations for the edge, border, and control plane roles in your network? Do you have the proper platforms in place to those fabric roles? Full discussion of these platforms and roles is covered in the associated Software-Defined Access Design Guide. It is important to understand that, unlike in a trial deployment, a production deployment will present operational challenges if you deploy the border in one location and later decide the border needs to relocate to another, so careful consideration of the future fabric coverage scope is important. In the validated deployment described, the most common scenarios with ed platforms are shown, and Appendix A: Product List lists the equipment specifically validated for roles in this deployment.

INSTALLING CONTROLLERS FOR SD-ACCESS NETWORK The Cisco SD-Access Solution 1.1 described in this guide uses a single DNA Center controller hardware appliance, prepared for inclusion as part of a cluster in the future. For this solution, DNA Center integrates with two ISE nodes configured for redundancy and dedicated to the SD-Access deployment, as detailed in the installation. To SD-Access Wireless, the solution includes two Wireless LAN Controllers (WLCs) for controller redundancy. Before you begin, you must identify the following: • IP addressing and network connectivity for all controllers being deployed — DNA Center must have Internet access for system updates from the Cisco cloud repository • A network-reachable Network Time Protocol (NTP) server — used during DNA Center installation to ensure reliable digital certificate operation for securing connections • Certificate server information, if you choose not to use self-signed digital certificates for a single node — For three-node cluster configurations, certificates generated by a certificate authority are required

Procedure 1

Install DNA Center

The DNA Center appliance has 10Gbps SFP+ Modular LAN on Motherboard (MLOM) interfaces and integrated copper interfaces available for network connectivity. Use the following table to assist with IP address assignment and connections. Validation is shown using a virtual IP (VIP) configured on a standalone DNA Center appliance, making it easier to migrate to a three-appliance cluster in the future. You do not need to physically connect the intra-cluster communications port for a standalone configuration. For provisioning and assurance communication efficiency, DNA Center should be installed in close network proximity to the greatest number of devices being managed.


page 5

Deployment Details Table 1 DNA Center server LAN Ethernet interface assignments (left to right from rear) PORT 2 MLOM SFP+ 10Gb

PORT 1 MLOM SFP+ 10Gb

M Integrated RJ45

1 Integrated RJ45

2 Integrated RJ45

enp10s0

enp9s0

—

enp1s0f0

enp1s0f1

Intra-cluster communications

Enterprise network infrastructure

CIMC out-ofband server appliance management

Optional dedicated management network for web access

Optional isolated enterprise network

Example Cluster VIP Address

—

10.4.49.25 255.255.255.0

—

—

—

Example Interface Address

192.168.127.1 255.255.255.248

10.4.49.26 255.255.255.0

10.204.49.25 255.255.255.0

Unused in this example

Unused in this example

Wizard Name

Use

Tech Tip To avoid the need to maintain a list of static routes on an additional interface, you can connect DNA Center to your network using a single network interface configured with a default gateway. For deployments requiring multiple interfaces separating istrative access and network infrastructure provisioning, static route changes after installation may require reconfiguration. If reconfiguration is required, follow the procedure to reconfigure the appliance using the wizard in the Cisco Digital Network Architecture Center Appliance Installation Guide.

Reserve an arbitrary private IP space at least 20 bits of netmask in size which is not used elsewhere in the network. The /20 address space is divided and used in a later setup step for services communication among the processes running in a DNA Center instance, and is needed for deploying both a single-server configuration and a three-server configuration. The DNA Center appliance also must have Internet connectivity either directly or via a web proxy to obtain software updates from the Cisco cloud repository. Internet access requirements and optional proxy server setup requirements are detailed in the Cisco Digital Network Architecture Center Appliance Installation Guide. Step 1: Connect the DNA Center server to a Layer 2 access switch port in your network, by: • Using the 10Gb port labeled PORT 1 on the MLOM card (also named enp9s0 in the wizard) • Using the Cisco Integrated Management Console (CIMC) port (labeled M on the embedded Ethernet ports) • Optionally using any other ports required for the installation, such as the dedicated web management port, an isolated enterprise network port, or cluster configuration port.


page 6

Deployment Details The following example steps are described in detail with all options within the Installation Guide for the appliance software version. Use the guide to configure CIMC on the appliance during first boot, along with the credentials required for CIMC access. The Installation Guide describes the complete set of options, including ing a host to another host to create a cluster and configuring the left port (labeled PORT 2 on the MLOM card, and named enp10s0 in the wizard) for intra-cluster communications. The example that follows configures a standalone host or the first host in a cluster deployment, without a network proxy. Step 2: Boot the DNA Center hardware appliance. A welcome message appears. Welcome to the Maglev Configuration Wizard! Step 3: Press ENTER to accept the default choice Start a DNA-C Cluster. Step 4: Continue by accepting the wizard default choices, while supplying information for the following steps within the wizard (wizard steps are in order, but not sequential): • In wizard STEP #4, selection for NETWORK ADAPTER #1 (enp10s0): This interface is used for clustering—configure clustering to easily allow for the future capability, even if you don’t need clustering initially. Fill in the information for the Host IP Address and Netmask (a /29 size network covers a three-member cluster), use the spacebar to select Cluster Link, do not fill in any other fields, and then select next >> to continue. Host IP Address: 192.168.127.1

Netmask:

255.255.255.248

Default Gateway IP Address: [blank]

DNS Servers: [blank]

Static Routes: [blank]

Cluster Link

[use spacebar to select]

Configure IPv6 address [blank]

• In wizard STEP #4, selection for OPTIONAL - NETWORK ADAPTER #2 (enp1s0f0): This interface can be used as a dedicated management interface for istrative web access to DNA Center—if you are using this option (which requires static route configuration), fill in the information; otherwise leave all selections blank, and then select next >> to continue. • In wizard STEP #4, selection for OPTIONAL - NETWORK ADAPTER #3 (enp1s0f1): This is available for use with an isolated network with a static route—unless you require this connectivity, leave all selections blank, and select next >> to continue.


page 7

Deployment Details • In wizard STEP #4, selection for OPTIONAL - NETWORK ADAPTER #4 (enp9s0): Use this interface for communications with your network infrastructure - supply at least the Host IP Address, Netmask, Default Gateway IP address, and DNS Servers, optionally supply Static Routes, and then select next >> to continue. Host IP Address: 10.4.49.26

Netmask:

255.255.255.0

Default Gateway IP Address: 10.4.49.1

DNS Servers:

10.4.49.10

Static Routes:

[blank for single interface installation]

Cluster Link [blank]

Configure IPv6 address [blank]

The wizard displays an informational message. The wizard will need to shutdown the controller in order to validate… Step 5: Select proceed >> to continue with the network validation. The installation validates gateway reachability. Please wait while we validate and configure host networking... Step 6: After the wizard network validation completes, continue entering initial configuration values. For a standalone appliance, you create a cluster configuration to facilitate future migration. To add appliances into a cluster configuration, refer to the Installation Guide. • In wizard STEP #11 , MAGLEV CLUSTER DETAILS: Cluster Virtual IP address 10.4.49.25

• In wizard STEP #13 , SETTINGS: Linux : *

[linux ]

Re-enter Linux : * [linux ]

Generation Seed: [skip this entry]


page 8

Deployment Details Auto Generated : [skip this entry]

phrase: *

[DNAC ]

Re-enter phrase: * [DNAC ]

Step 7: In wizard STEP #14, NTP SEVER SETTINGS, you must supply at least one active NTP Server. NTP Servers: *

10.4.0.1 10.4.0.2

Step 8: Select next >>. The installation validates connectivity to the NTP servers. Step 9: In wizard STEP #16 , MAGLEV ADVANCED SETTINGS, you assign unique IP networks that are not part of the enterprise network, which are used by DNA Center to manage its own API services and cluster services. The minimum recommended size for each is a network with a 21-bit netmask to accommodate the large numbers of different services with unique IP addresses that communicate among one another. Services Subnet: *

192.168.240.0/21

Cluster Services Subnet: * 192.168.248.0/21

Select next >>. The wizard displays an informational message. The wizard is now ready to apply the configuration on the controller. Step 10: Ignore any additional warning messages about existing disk partitions. Select proceed >> to apply the configuration and complete the installation. You should not interact with the system until the installation is complete. A number of status messages scroll by during the installation, the platform boots the installed image, and configures the base processes for the first time, which can take multiple hours. When installation and configuration is complete, a message is displayed. Welcome to the Maglev Appliance (tty1) Step 11: with the maglev from the console, or alternatively from an SSH session on port 2222 to the host IP address as assigned during the installation. maglev-master-1 : maglev

: [ assigned during installation]


page 9

Deployment Details Step 12: processes are deployed. $ maglev package status

For the validated version, all packages are DEPLOYED initially, except for any NOT_DEPLOYED packages listed including the following, which vary depending on your installation version: application-policy sd-access sensor-automation You install other required components in later steps. Step 13: Connect to the DNA Center Web UI by directing a web browser to the Cluster Virtual IP address you supplied in the first step of the installation (example: https://10.4.49.25/). Step 14: At the name line enter , at the line enter the DNA Center that you assigned using the Maglev Configuration Wizard, and then click .

Step 15: At the prompt, choose a new or skip to the next step. Step 16: At the Welcome to DNA Center prompt, provide a cisco.com ID and . The ID is used to software s and receive system communications. If you skip this step because you do not have an ID or plan to add one later (using Settings (gear) > System Settings > Settings > Cisco Credentials), features such as SWIM, Telemetry, and Licensing will be unable to function properly. Step 17: In the previous step, if you did not enter an ID with Smart access with privileges for managing Cisco software licenses for your organization, a Smart prompt displays. Enter a cisco.com ID associated with a Smart or click Skip.


page 10

Deployment Details Step 18: If you have an Infoblox or Bluecat IPAM server, enter the details at the IP Address Manager prompt, and click Next. Otherwise, click Skip. Step 19: At the and Conditions display, click Next, and then at the Ready to go! display, click Go.

Step 20: At the main DNA Center dashboard, click the settings (gear) icon, and then click About DNA Center.


page 11

Deployment Details Tech Tip The validation uses a standalone DNA Center with both virtual and physical IP addresses and selfsigned certificates and requires a certificate chain generated with version 1.1.3 or later before any upgrades. Without having an appropriate certificate chain, you will not be able to successfully integrate with other systems, such as ISE. For this situation, an appropriate certificate chain can be manually generated, or is automatically generated when the startup DNA Center image can be replaced with 1.1.3 or later.

Step 21: Check that the Version is at least 1.1.3. If your version is earlier than 1.1.3, then you should to reimage your DNA Center appliance to version 1.1.3 or later before continuing.

Step 22: At the main DNA Center dashboard, click Add applications.

The Application Management - Packages & Updates screen displays, which you use to add additional functionality to the controller, including SD-Access.


page 12

Deployment Details Tech Tip For the validated version of DNA Center and SD-Access listed in Appendix A: Product List, a system update from the Internet is required in advance of any other package s and updates. Check the release notes for your target software version for the appropriate procedures and dependencies. DNA Center release notes are found on cisco.com here: https://www.cisco.com/c/en/us//cloud-systems-management/dna-center/products-releasenotes-list.html DNA Center software newer than that used for this validation may also additional platform images, which can be found by searching cisco.com for SD-Access Hardware and Software Compatibility Matrix.

Step 23: Click the settings (gear) icon, click System Settings, and then navigate to App Management > System Updates. The Application Management – System Updates screen is displayed. DNA Center automatically connects to the Cisco cloud repository to find the latest updates. You can use the Refresh button to reveal any updates that are found. Step 24: Under the Available Update column in the row showing System, click Install.

A of the new system update begins, which can take many minutes. Then the installation automatically starts, which can take more than an hour. Use the Refresh button to check status until the updated Installed Version is displayed with a Running status. The System package within the System Updates section is the only package you or update during the initial system update. After the installation of the system is complete, you then and install the application packages and updates. Tech Tip Illustrations are installation examples. Software versions used for validation are listed in Appendix A: Product List.


page 13

Deployment Details Step 25: Click the settings (gear) icon, click System Settings, navigate to App Management > Packages & Updates, at the top of the list select all packages by selecting the box next to Package, click the Actions pulldown menu, and then select .

Step 26: At the popup, select OK to confirm the operation. The screen updates, showing all packages being ed. Before proceeding to the next step, refresh the screen until there are no longer any packages showing a status of ing. The can take many minutes to complete. Step 27: After the new versions of the packages are ed, you install them to address any package dependencies before ing and installing the latest version of the SD-Access package. Select all packages with a Status that is Running and where there is a newer ed Version available, at the top click the Actions pulldown menu, select Update, and then click OK.

The package updates begin. Use the browser refresh button to see updated status for each package. The update process can take over an hour to complete. Tech Tip Packages must be updated in a specific order to appropriately address package interdependencies and should only be updated after the system updates have completed. Allow DNA Center to handle dependencies by selecting and updating all installed packages at once, otherwise refer to the Installation Guide for the correct package update sequence. The Installation Guide also explains how to use the Maglev CLI to force a retry for any stalled .


page 14

Deployment Details The Actions menu is unavailable until package tasks are complete. Wait until packages no longer show a Status of Pending Update, Preparing Update, or Updating before proceeding. Step 28: Within the package listings, find the row Automation - SD Access, select the check box next to it, and select any other remaining packages with a default Status of Not Installed that you wish to install. Step 29: At the top click the Actions pulldown menu, select Install, and then click OK.

An installation message appears, and the screen refreshes with the changed installation status. While the packages are installing, which takes some time, you may work in parallel on the next process for installing the Identity Services Engine Nodes.

PROCESS

After the Automation - SD Access package is in Running status, along with any other updated packages, the functionality is available to use and integration with the installed ISE nodes can proceed.

Install Identity Services Engine Nodes 1. Install ISE server images 2. Configure roles for ISE nodes 3. ISE node 2 and configure roles

The SDA Solution 1.1 described in this guide uses two ISE nodes in a high-availability standalone configuration dedicated to the SD-Access network and integrated into DNA Center management. The first ISE node has the primary Policy istration Node (PAN) persona configuration and the secondary monitoring and troubleshooting (MnT) persona configuration. The second ISE node has the secondary PAN persona configuration and the primary MnT persona configuration. Both nodes include Policy Services Node (PSN) persona configurations. You also enable pxGrid and External RESTful Services (ERS) on the ISE nodes.


page 15

Deployment Details Table 2 ISE node configurations ISE Node 1

ISE Node 2

Primary PAN

Secondary PAN

Secondary MnT

Primary MnT

PSN

PSN

pxGrid

pxGrid

ERS Services

ERS Services

Tech Tip There is a minimum ISE software version requirement for compatibility with DNA Center. To be able to integrate with an existing ISE installation, you must first ensure that the existing ISE is running at least the minimum ed version. An ISE integration option not included in this validation is to stand up a new ISE instance as a proxy to earlier versions of ISE. The versions of ISE and DNA Center validated in HA standalone mode for this guide are listed in Appendix A: Product List. You may find newer recommended images by searching cisco.com for SDAccess Hardware and Software Compatibility Matrix.

Procedure 1

Install ISE server images

Step 1: On both ISE nodes, boot and install the ISE image. Step 2: On the console of the first ISE node, at the prompt, type setup, and then press Enter. ********************************************** Please type ‘setup’ to configure the appliance ********************************************** localhost : setup

Step 3: Enter the platform configuration parameters. Press ‘Ctrl-C’ to abort setup Enter hostname[]: m29-ise1

Enter IP address []: 10.4.49.30

Enter IP netmask[]: 255.255.255.0

Enter IP default gateway[]: 10.4.49.1

Enter default DNS domain[]: ciscodna.net

Enter Primary nameserver[]: 10.4.49.10


page 16

Deployment Details Add secondary nameserver? Y/N [N]: N

Enter NTP server[time.nist.gov]: 10.4.0.1 Add another NTP server? Y/N [N]: Y

Enter NTP server[time.nist.gov]: 10.4.0.2 Add another NTP server? Y/N [N]: N Enter system timezone[UTC]: UTC Enable SSH service? Y/N [N]: Y Enter name[]:

Enter : [ ]

Enter again: [ ] Copying first CLI to be first ISE GUI … Bringing up network interface... Pinging the gateway... Pinging the primary nameserver... Do not use ‘Ctrl-C’ from this point on... Installing Applications... === Initial Setup for Application: ISE === Additional installation messages appear, and then the server reboots. Rebooting... Step 4: Repeat steps 2 and 3 on the second ISE node, using the appropriate parameters for it. The systems reboot automatically and display the Cisco ISE prompt. localhost :

Procedure 2

Configure roles for ISE nodes

Step 1: On the first ISE node, using a web browser and the configured name and , and then accept any informational messages. https://m29-ise1.ciscodna.net/


page 17

Deployment Details Step 2: Navigate to istration > System > Deployment, and then click OK to the informational message.

Step 3: Click on the ISE node hostname, and then under Role, click Make Primary.

Step 4: Select pxGrid, and then click Save.

Procedure 3

ISE node 2 and configure roles

Integrate the additional ISE node by using the same ISE istration session started on the first node.


page 18

Deployment Details Step 1: Navigate again to istration > System > Deployment to refresh the view, and then under the Deployment Nodes section, click .

A screen displays allowing registration of the second ISE node into the deployment. Step 2: Enter the ISE fully-qualified domain name Host FQDN (m29-ise2.ciscodna.net), Name (), and ([ ]), and then click Next. Step 3: If you are using self-signed certificates, click Import Certificate and Proceed. If you are not using selfsigned certificates, follow the instructions for importing certificates and canceling this registration, and then return to the previous step.


page 19

Deployment Details Step 4: On the ISE Node - Step 2: Configure Node screen, under Monitoring, change the role to PRIMARY, at the bottom check pxGrid, and then click Submit.

The node configuration is saved. Step 5: Click OK to the notification that the data is to be synchronized to the node and the application server on the second node will restart. The synchronization and restart of the second node can take more than ten minutes to complete. You can use the refresh button on the screen to observe when the node returns from In Progress to a Connected state to proceed to the next step.

Step 6: Check cisco.com for ISE release notes, any patch required for your installation, and install the patch by navigating in ISE to istration > System > Maintenance > Patch Management, click Install, click Browse, browse for the patch image, and then click Install. The patch installs node-by-node to the cluster, and each cluster node reboots.


page 20

Deployment Details Step 7: After the ISE web interface is active again, check progress of the patch installation by navigating to istration > System > Maintenance > Patch Management, select the patch, and then select Show Node Status. Use the Refresh button to update status until all nodes are in Installed status, and then proceed to the next step.

Step 8: Navigate to istration > System > Settings, on the left pane navigate to ERS Settings, under ERS Setting for Primary istration Node select Enable ERS for Read/Write, accept any dialog box that appears, under ERS Setting for All Other Nodes select Enable ERS for Read, and then click Save. Accept any additional dialog box that appears.


page 21

Deployment Details

PROCESS

The ERS settings are updated, and ISE is ready to be integrated with DNA Center.

Integrate Identity Services Engines with DNA Center 1. Configure DNA Center authentication and policy servers

Integrate ISE with DNA Center by defining ISE as an authentication and policy server to DNA Center and permitting pxGrid connectivity from DNA Center into ISE. Integration enables information sharing between the two platforms, including device information and group information, and allows DNA Center to define policies to be rendered into the network infrastructure by ISE. Tech Tip Validation shows DNA Center integrated with ISE servers. Although it is possible to avoid the integration of ISE, policy configuration such as using scalable group tags and group-based policies will not be possible and there will be a loss of automation, resulting in the requirement to manually assign edge ports to VNs, which is not a part of the validation shown.


page 22

Deployment Details

Procedure 1

Configure DNA Center authentication and policy servers

Step 1: to the DNA Center web interface, at the top-right corner select the gear icon, and then navigate to System Settings.

Step 2: Navigate to Settings > Authentication and Policy Servers, and then click on the + Add button. Tech Tip The next step for integrating an ISE installation is the same whether you use a high-availability standalone ISE deployment, as validated, or a distributed ISE deployment. The shared secret chosen needs to be consistent with the shared secret used across the devices in the network for communicating with the AAA server. The name and are used for DNA Center to communicate with ISE.


page 23

Deployment Details Step 3: In the Add AAA/ISE SERVER display, enter the ISE node 1 (primary PAN) Server IP Address (example: 10.4.49.30) and Shared Secret, toggle the Cisco ISE selector, enter the ISE name (example: ), enter the ISE , enter the ISE fully-qualified domain name for FQDN (verified with a DNS lookup at submission—using cut-and-paste from a browsing session to ISE is recommended), enter Subscriber Name (example: dnac), leave the SSH Key blank, and then click Apply.

During communication establishment, status from DNA Center displays INPROGRESS. Use the Refresh button until communication establishes with ISE and the server displays ACTIVE status. If communication is not established, an error message displays with information reported from ISE regarding the problem to be addressed before continuing. You can also see the communication status by navigating from the gear icon to System Settings > System 360. Under External Network Services, the Cisco ISE server shows in Available status. With communications established, DNA Center requests a pxGrid session with ISE. Step 4: to ISE, and then navigate to istration > pxGrid Services. The client named dnac is now showing Pending in the Status column.


page 24

Deployment Details Step 5: Check the box next to dnac, above the list click Approve, and then click Yes to confirm.

A success message displays, and the Pending status changes to Online (XMPP). You can additionally that the integration is active by expanding the view for the client and observing two subscribers, Core and TrustSecMetaData.

PROCESS

If ISE is integrated with DNA Center after scalable groups are already created in ISE, any existing ISE groups are visible when logging into DNA Center and navigating to Policy > Registry > Scalable Groups, in addition to the default groups available. Existing ISE policies are not migrated to DNA Center.

Install SD-Access Wireless LAN Controllers 1. Configure the WLC Cisco AireOS platforms using the startup wizard 2. Configure the time zone

For this deployment, dedicate the WLCs to SD-Access wireless connectivity using native integration. The WLCs use link aggregation to connect to a redundant Layer 2 shared services distribution outside of the SD-Access fabric, as described in the Campus LAN and Wireless LAN Design Guide. This guide is used to configure a pair of Cisco WLCs with HA SSO resiliency, and all of the network connectivity should be in place before starting the configuration procedure. Tech Tip The SD-Access 1.1 solution s transport of only IP frames in the Layer 2 overlays that are used for WLAN, without Layer 2 flooding of broadcast and unknown multicast traffic. Without broadcasts from the fabric edge, ARP functions by using the fabric control plane for MAC-to-IP address table lookups. For transport of non-IP frames and Layer 2 flooding, see the release notes for your software version in order to updated .


page 25

Deployment Details Tech Tip When using WLAN with the software releases listed in Appendix A: Product List and Catalyst 6800 Series fabric border devices, use separate control plane devices which the required Layer 2 WLAN control plane. See release notes for any changes to WLAN Layer 2 control plane on the Catalyst 6800 Series.

Procedure 1

Configure the WLC Cisco AireOS platforms using the startup wizard

Perform the initial configuration using the CLI Startup Wizard. After powering up the WLC, you should see the following on the WLC console. If not, enter - (dash) and enter repeatedly until the startup wizard displays the first question. Welcome to the Cisco Wizard Configuration Tool Use the ‘-‘ character to backup Step 1: Terminate the autoinstall process. Would you like to terminate autoinstall? [yes]: YES Step 2: Enter a system name. System Name [Cisco_7e:8e:43] (31 characters max): SDA-WLC-1 Step 3: Enter an name and . Tech Tip Use at least three of the following character classes in the : lowercase letters, uppercase letters, digits, and special characters.

Enter istrative Name (24 characters max):

Enter istrative (24 characters max): [] Re-enter istrative

: []

Step 4: Use DH for the service port interface address. Service Interface IP address Configuration [static] [DH]: DH Step 5: Enable Link Aggregation (LAG). Enable Link Aggregation (LAG) [yes][NO]: YES


page 26

Deployment Details Step 6: Enter the management interface IP address, mask, and default router. The IP address for the secondary controller of an HA SSO pair is only used temporarily until the secondary WLC s the configuration from the primary and becomes a member of the HA controller pair. Management Interface IP Address: 10.4.174.26 Management Interface Netmask: 255.255.255.0

Management interface Default Router: 10.4.174.1 Step 7: Configure the Management Interface VLAN Identifier. Management Interface VLAN Identifier (0 = untagged): 164 Step 8: Configure the Management Interface Port Number. Management Interface Port Num [1 to 5]: 1 Step 9: Enter the DH server for clients. (Example: 10.4.48.10) Management Interface DH Server IP Address: 10.4.48.10 Step 10: Enable HA SSO. Enable HA (Dedicated Redundancy Port is used by Default)[yes][NO]: YES

If you are configuring the primary controller in an HA controller pair, use the following values. Configure HA Unit [PRIMARY][secondary]: PRIMARY Redundancy Management IP Address: 10.4.174.126

Peer Redundancy Management IP Address: 10.4.174.127

If you are configuring the secondary controller in an HA controller pair, use the following values. Configure HA Unit [PRIMARY][secondary]: SECONDARY Redundancy Management IP Address: 10.4.174.127

Peer Redundancy Management IP Address: 10.4.174.126

Step 11: The WLC uses the virtual interface for mobility DH relay, guest web authentication, and inter-controller communication. Enter an IP address that is not used in your organization’s network. Virtual Gateway IP Address: 192.0.2.1 Step 12: Enter a multicast address that will be used by each AP to subscribe to IP multicast flows coming from the WLC. This address will be only be used when configuring the IP multicast delivery method called multicastmulticast. Multicast IP Address: 239.1.1.1 Tech Tip The multicast address must be unique for each controller or HA pair in the network. The multicast address entered is used as the source multicast address, which the access points ed to the controller use for receiving wireless -based multicast streams.


page 27

Deployment Details Step 13: Enter a name for the default mobility and RF group. (Example: CAMPUS) Mobility/RF Group Name: SDA-CAMPUS Step 14: Enter an SSID for the data WLAN. This is used later in the deployment process. Network Name (SSID): SDA-Data Step 15: Disable DH Bridging Mode. Configure DH Bridging Mode [yes][NO]: NO Step 16: Enable DH snooping. Allow Static IP Addresses [YES][no]: NO Step 17: Do not configure the RADIUS server now. You will configure the RADIUS server later using the GUI. Configure a RADIUS Server now? [YES][no]: NO Warning! The default WLAN security policy requires a RADIUS server. Please see documentation for more details. Step 18: Enter the country code where you are deploying the WLC. Enter Country Code list (enter ‘help’ for a list of countries) [US]: US Step 19: Enable all wireless networks. Enable 802.11b network [YES][no]: YES Enable 802.11a network [YES][no]: YES Enable 802.11g network [YES][no]: YES Step 20: Enable the radio resource management (RRM) auto-RF feature. Enable Auto-RF [YES][no]: YES Step 21: Synchronize the WLC clock to your organization’s NTP server. Configure a NTP server now? [YES][no]:YES

Enter the NTP server’s IP address: 10.4.0.1

Enter a polling interval between 3600 and 604800 secs: 86400 Step 22: Do not configure IPv6. Would you like to configure IPv6 parameters[YES][no]:NO Step 23: Confirm the configuration is correct. The WLC saves the configuration and resets automatically. Configuration correct? If yes, system will save it and reset. [yes][NO]: YES Configuration saved! Resetting system with new configuration…


page 28

Deployment Details If you press enter or respond with no, the system resets without saving the configuration, and you have to complete this procedure again. The WLC resets and displays a : prompt. (Cisco Controller) Enter Name (or ‘Recover-Config’ this one-time only to reset configuration to factory defaults) : Step 24: Repeat Step 1 through Step 23 for the secondary WLC After the secondary WLC in an HA SSO pair resets, the manual configuration process for it is complete. All configuration for a WLC HA SSO pair is performed on the primary WLC and automatically replicates to the secondary.

Procedure 2

Configure the time zone

Configuring the date and time of the WLC is critical for correct certificate validation. Improper date/time may prevent access points from successfully ing with the WLC. Step 1: Use a web browser to to the Cisco WLC istration web page using the credentials created in Step 3 of Procedure 1. (Example: https://10.4.174.26) Step 2: At the top of the page, click Advanced.

Step 3: Navigate to Commands > Set Time. Step 4: In the Location list, choose the time zone that corresponds to the location of the WLC. Step 5: Click Set Time zone, and then click OK (when prompted that continuing will cancel any scheduled system resets). The controller is ready for discovery and integration into the DNA Center setup.


page 29

Deployment Details

DEPLOYING SD-ACCESS Using DNA Center for Network Discovery and Initial Design 1. Create network sites 2. Add device credentials for discovery and management

PROCESS

3. Configure underlay network device management 4. Configure underlay network links for routed access connectivity 5. Enable routing connectivity at border towards external router neighbor 6. Redistribute shared services subnets into underlay IGP 7. Enable connectivity at external fusion router towards border neighbor 8. Configure MTU on unmanaged intermediate devices 9. Discover and manage network devices 10. Manage software images for devices in inventory 11. Use software image management to update device software

Using DNA Center, you create a network hierarchy of sites that can contain additional sites or buildings and floors within sites. Devices map into buildings for configuration.

Procedure 1

Create network sites

Step 1: to DNA Center. At the home App Launcher page, under Design, select Add site locations on the network.


page 30

Deployment Details Step 2: Click Add Site to start a network design using the tool.

Step 3: Repeat as required to add sites and buildings, creating a hierarchy that makes sense for your organization. You add floors using the gear icon next to a created building, which are used during the wireless provisioning. If you have floor map diagrams in DXF, DWG, JPG, GIF, or PNG formats, add them to any defined floors as a useful component for wireless deployments to show AP locations and coverage. You can add hundreds of sites up to the limits listed in the Software-Defined Access Design Guide.


page 31

Deployment Details

Procedure 2

Add device credentials for discovery and management

You can discover and manage devices in an existing network to be used for an SD-Access underlay network when DNA Center has IP connectivity to the devices, and DNA Center is configured with the CLI and SNMP credentials required to manage the devices. The credentials are also used for accessing a ed seed device, such as a Catalyst 9500 Series switch, if you choose to use LAN Automation to create your initial connectivity, which uses Cisco Network Plug and Play (PnP). Add device credentials to manage scopes of the site hierarchy created in the design. These credentials enable discovery and management for the network. Step 1: Navigate to Design > Network Settings > Device Credentials, select an appropriate level of the site hierarchy in the left pane (example: Global for common credentials across the hierarchy), and acknowledge any pop-up alerts.

Step 2: At the top of the CLI Credentials section, click Add, complete the Name / Description (example: IOS Devices), name, , and Enable fields, click OK.


page 32

Deployment Details Caution If you are using ISE as your AAA server, you should avoid using as the name for device CLI credentials that can lead to name conflicts with the ISE resulting in the inability to to devices.

Step 3: At the top of the SNMP Credentials section, select an SNMP credential type to update (example: SNMPv2c Read) click Add, select the radio button in the row next to the credential to update (a single credential per row at a time), fill out the credential details, click Save. Step 4: Repeat Step 2 and Step 3 for any additional credentials required in the hierarchy. CLI Credentials and both SNMPV2C Read and SNMPV2C Write are the most common requirements. Step 5: For each of the CLI and SNMP Credentials assigned, click all radio buttons next to each assignment created, including ones where you toggle among the options (example: SNMPV2C Write), and then, at the bottom of the Device Credentials screen, click Save.

Created Common Settings successfully acknowledgement is displayed. The device credentials to be used for network discovery and management are now available in DNA Center.

Procedure 3

Configure underlay network device management

For maximum resiliency and bandwidth, use a loopback interface on each device and enable Layer 3 connectivity for DNA Center in-band discovery and management. The following steps configure point-to-point Ethernet connectivity between devices using IS-IS as the routing protocol and SSHv2 with SNMPv2c for device configuration to the device loopback interfaces.


page 33

Deployment Details Step 1: Use the device CLI to configure the hostname to make it easy to identify the device. hostname [hostname] Step 2: Configure local and . name dna privilege 15 secret [ ] enable secret [enable ] service -encryption Step 3: Configure Secure Shell (SSH) as the method for CLI management access. ip ssh version 2 line vty 0 15 local transport input ssh transport preferred none Step 4: Enable Simple Network Management Protocol (SNMP) and configure SNMPv2c with both a read-only and a read-write community string, which match the credentials input into DNA Center. snmp-server community [SNMP read-only name] ro

snmp-server community [SNMP read-write name] rw Step 5: Configure the switch to Ethernet jumbo frames. The MTU chosen allows for the extra fabric headers and compatibility with the highest common value across most switches, and the round number should be easy to when configuring and troubleshooting. system mtu 9100 Step 6: Configure the switch loopback address. interface Loopback0

ip address [Device loopback IP address] 255.255.255.255

Procedure 4

Configure underlay network links for routed access connectivity

Optional If your underlay network is already configured as a routed access network, or if you have deployed using an automated underlay network configuration, skip this procedure.


page 34

Deployment Details Step 1: Configure the switch connections within the underlay network infrastructure. Repeat this step for every link to a neighbor switch within the fabric underlay. If the device will be provisioned as a fabric border node and the connection is to be used as a handoff from the fabric to the rest of the infrastructure, use the next procedure instead. interface TenGigabitEthernet1/0/1 no switchport

ip address [Point-to-point IP address] 255.255.255.254 Step 2: Enable IP routing and enable the IS-IS routing protocol on the switch. ! ip routing is not enabled by default for many switches ip routing router isis

net 49.0001.0100.0400.0001.00 metric-style wide nsf ietf ispf level-1-2 ive-interface loopback0 log-adjacency-changes

Tech Tip A common convention in IS-IS is to embed the loopback IP address into the unique NET, or system ID. For example, a loopback IP address 10.4.32.1 (010.004.032.001) becomes 0100.0403.2001, and it is appended with .00 and prepended with the area ID (49.0001), resulting in NET 49.0001.0100.0403.2001.00.

Step 3: Enable IS-IS routing on all of the configured infrastructure interfaces in the underlay, except for the border handoff interfaces, which are configured in the next procedure. The loopback interface is enabled to share the management IP address and the physical interfaces are enabled to share routing information with the connected infrastructure. interface Loopback0 ip router isis

interface range TenGigabitEthernet1/0/1-2 , TenGigabitEthernet2/0/1-2 ip router isis


page 35

Deployment Details

Procedure 5

Enable routing connectivity at border towards external router neighbor

If your underlay network is already configured as a routed access network and integrated with the rest of your network using BGP, skip this procedure. To connect border node devices into your network, you establish connectivity across interfaces configured using VRF-lite, which uses 802.1Q VLAN tagging to separate the VRFs. Connect common network services available outside of the border nodes such as DNS, DH, and WLCs, and for DNA Center management when it is not directly connected to the SD-Access network nodes, by extending your existing enterprise network to the underlay at the border. Connectivity to DNA Center is required for additional provisioning. The external device handling routing among multiple virtual networks and a global routing instance acts as a fusion router for those networks, and the separation of connectivity is maintained by using VRFs connected using interfaces with 802.1Q tagging to the border, also known as VRF-lite. Establishing the underlay connectivity using BGP allows DNA Center to manage initial discovery and configuration using the link, and then to use the same link augmented with additional tags and BGP sessions as needed for overlay VN connectivity. Step 1: For each border node, if you are configuring a switch ing VLAN trunk interfaces such as Catalyst 9000, 3800, or 6800 Series switches, you must configure a trunk on the connected interface with a dedicated VLAN to establish underlay connectivity for route peering to the fusion router. vlan 100 interface vlan100

ip address [IP address] [netmask] no shutdown

interface FortyGigabitEthernet1/0/24 switchport switchport mode trunk

switchport trunk allowed vlan add 100 no shutdown Step 2: For each border node, if you are configuring a device such as an ASR or ISR router that s 802.1Q VLAN tagging, use an alternative subinterface configuration instead of a switch trunk interface to establish underlay connectivity to the fusion router. interface TenGigabitEthernet0/1/0 no shutdown !

interface TenGigabitEthernet0/1/0.100 encapsulation dot1Q 100

ip address [IP address] [netmask] no shutdown


page 36

Deployment Details Step 3: If you skipped the procedure to interconnect the underlay devices, connect the redundant border nodes together with at least one routed interface for underlay communication and later BGP peering. The configuration for integrating into the IS-IS protocol is shown. Repeat this step for each interface connecting border nodes. interface FortyGigabitEthernet1/0/23 no switchport

ip address [Point-to-point IP address] 255.255.255.254 ip router isis no shutdown Step 4: Enable BGP routing to the fusion router in order to connect networks external to the fabric, and activate BGP for the connecting interfaces. You use BGP to allow DNA Center management access to the underlay network devices, while allowing further provisioning for virtual networks on the interfaces and minimizing disruption to network connectivity. Repeat this step for each border node. router bgp [underlay AS number]

bgp router-id [loopback 0 IP address] bgp log-neighbor-changes

! fusion router is an eBGP neighbor

neighbor [fusion interface IP address] remote-as [external AS number]

! redundant border is an iBGP neighbor

neighbor [redundant border Lo0 address] remote-as [underlay AS number] neighbor [redundant border Lo0 address] update-source Loopback0 ! address-family ipv4

network [Lo0 IP address] mask 255.255.255.255

! underlay IP network summary in global routing table

aggregate-address [underlay IP network summary] [netmask] summary-only redistribute isis level-2

neighbor [fusion interface IP address] activate

neighbor [redundant border Lo0 address] activate maximum-paths 2

exit-address-family


page 37

Deployment Details

Procedure 6

Redistribute shared services subnets into underlay IGP

A default route in the underlay cannot be used by the APs to reach the WLC. A more specific route (such as a /24 subnet or /32 host route) to the WLC IP addresses must exist in the global routing table at each node where the APs connect to establish connectivity. Permit the more specific routes for the WLC and DH shared services needed from BGP (examples: 10.4.174.0/24 and 10.4.48.0/21) into the underlay network by redistributing the shared services route at the border into the underlay IGP routing process using this procedure. Using this process, the prefixes used match prefixes in the BGP routing table. Step 1: Connect to the each border node and add a prefix-list and route-map for subnets used for the shared services. ip prefix-list SHARED_SERVICES_NETS seq 5 permit 10.4.48.0/21

ip prefix-list SHARED_SERVICES_NETS seq 10 permit 10.4.174.0/24 route-map GLOBAL_SHARED_SERVICES_NETS permit 10

match ip address prefix-list SHARED_SERVICES_NETS

Step 2: At each border node, redistribute the prefixes into your underlay routing protocol. This example assumes ISIS. router isis

redistribute bgp [underlay AS number] route-map GLOBAL_SHARED_SERVICES_NETS metric-type external

Procedure 7

Enable connectivity at external fusion router towards border neighbor

The fusion routers connected to your SD-Access fabric border routers require CLI configuration for BGP connectivity consistent with the border routers configured in the previous procedure. Follow this procedure at each external fusion router device that is connected to your border. Step 1: On each external fusion router, create the VRF, route distinguisher, and route targets for the initial management connectivity to the border. vrf definition VRF-GLOBAL rd 100:100 ! address-family ipv4

route-target export 100:100 route-target import 100:100

exit-address-family


page 38

Deployment Details Step 2: For each connection from the external fusion router to the SD-Access fabric border, enable the interface, VLAN-tagged subinterface, and IP addressing. This example uses 802.1Q VLAN tagging on a router with subinterfaces. For switches requiring trunk port configurations, match the other side that was previously configured. interface TenGigabitEthernet0/1/7 description to Border mtu 9100 no ip address

interface TenGigabitEthernet0/1/7.100 encapsulation dot1Q 100

vrf forwarding VRF-GLOBAL

ip address [IP network] [netmask]

IP connectivity is now enabled for the VLAN (example: 100) on the 802.1Q tagged connection between the fusion router and the border node. Step 3: Create route maps to tag routes and avoid routing loops when redistributing between the IGP used within the rest of the network and BGP when connecting using multiple links. IGPs can vary—the example shown is for EIGRP, completing the routing connectivity from IS-IS to BGP to EIGRP. route-map RM-BGP-TO-EIGRP permit 10 set tag 100 !

route-map RM-EIGRP-TO-BGP deny 10 match tag 100

route-map RM-EIGRP-TO-BGP permit 20 Step 4: Enable BGP peering from redundant fusion routers to the border nodes and redistribute the IGP that is used to reach the networks beyond the fusion routers. router bgp [external AS number]

bgp router-id [loopback IP address] bgp log-neighbor-changes !

address-family ipv4 vrf VRF-GLOBAL

redistribute eigrp 100 route-map RM-EIGRP-TO-BGP

neighbor [redundant fusion IP] remote-as [external AS number] neighbor [redundant fusion IP] activate

neighbor [border IP address] remote-as [underlay AS number] neighbor [border IP address] activate maximum-paths 2

default-information originate exit-address-family


page 39

Deployment Details Step 5: Redistribute BGP into the IGP to enable reachability. IGPs can vary—the example shown is for named mode EIGRP. router eigrp LAN !

address-family ipv4 unicast vrf VRF-GLOBAL autonomous-system 100 topology base

redistribute bgp [external AS number] metric 1000000 1 255 1 9100 route-map RM-BGP-TO-EIGRP exit-af-topology

network [external IP network address] [netmask] eigrp router-id [loopback IP address] exit-address-family

Procedure 8

Configure MTU on unmanaged intermediate devices

Optional It is an advantage to have DNA Center manage all devices in a fabric domain. DNA Center already manages fabric edge nodes and border nodes; however, if you have intermediate devices within the fabric that will not be managed by DNA Center (example: hardware or software isn’t available in DNA Center), then the devices must still meet the requirements for transporting SD-Access traffic through those transit fabric intermediate nodes. The primary requirements are that they: • Are Layer 3 devices that must be actively participating in routing within the other fabric underlay domain devices. • Must be able to transport the jumbo frames that are offered by the fabric encapsulation techniques. For unmanaged fabric intermediate node devices, you must set an appropriate MTU (example: 9100) and manually configure routing with the other devices in the underlay. Configuration guidance for this situation is devicespecific and not discussed further in this guide.

Procedure 9

Discover and manage network devices

You discover and manage devices in a network to be used as the underlay for an SD-Access network when DNA Center has IP connectivity to the devices and has the CLI and SNMP credentials required to manage the devices. These steps show how to initiate discovery by supplying an IP address range or multiple ranges to use to scan for network devices, which constrains the time of discovery. Alternatively, you can supply an initial device for discovery and direct DNA Center to use Cisco Discovery Protocol (CDP) to find connected neighbors. Step 1: Navigate to the main DNA Center dashboard, and at the bottom under the Tools section, click Discovery, fill out a Discovery Name, click Range, enter a start and end IP loopback address for IP Ranges (to cover a single address, enter that address for both the start and end of the range), for Preferred Management IP, click + (plus sign), and then select Use Loopback.


page 40

Deployment Details Step 2: If you have any additional ranges, in the IP Ranges section, enter the additional range, and then click + (plus sign), the credentials to be used for the discovery, and then click Start.

The discovery details are displayed and the discovery begins. A progress bar shows the status. During the discovery you can click the device count icon at the top of the page to see devices as they are discovered.

Step 3: If there are any discovery failures, inspect the devices list, resolve the problem and restart the discovery for those devices.


page 41

Deployment Details Step 4: After the discovery process finishes successfully, navigate to the main DNA Center dashboard, and then under the Tools section click Inventory. The discovered devices are displayed. After inventory collection completes, the devices have a Managed status.

DNA Center can now access the devices, synchronize the inventory, and make configuration changes on the devices.

Procedure 10

Manage software images for devices in inventory

To achieve the full capabilities of SD-Access, the SD-Access package in DNA Center has minimum software version requirements for the devices that it provisions. The software image management capability built into DNA Center is used to upgrade any devices that are not running a recommended image version. You can find recommended images by searching cisco.com for SD-Access Hardware and Software Compatibility Matrix. The images used for validation are listed in Appendix A: Product List. Use the following steps to apply software updates of images and software maintenance updates (SMUs) to the devices, by importing the required images, marking images as golden, and applying images to devices. Step 1: Navigate to the main DNA Center dashboard, click Design, click Image Repository, click + Import Image/SMU, choose a file location, and then click Import.


page 42

Deployment Details The image import into DNA Center starts. Repeat this step for all images that you wish to deploy using DNA Center. Images to be used for device families not yet available in DNA Center will be listed under the Unassigned category. You can an import is in the image repository ready to deploy by clicking Show Tasks until the image import task is listed as green with a checkmark next to it. Step 2: After the image is successfully imported, use the Refresh button to update available device families that have the imported image available, under the Image Name column click the down arrow next to the image listed for a device family, and then click the star for Golden Image to mark the appropriate image as the preferred one for the platform. Repeat the importing and tagging images as golden until all devices are marked for an appropriate image.

Procedure 11

Use software image management to update device software

DNA Center runs a compliance check of devices in inventory compared to images marked golden. Devices out of compliance with the golden image are marked as Outdated in inventory. Update the images to the version marked golden. Inventory collection must have completed successfully and the devices must be in the Managed state before continuing. When you update device software, the software image copy and upgrade happen in a single step. Step 1: Navigate to PROVISION > Devices > Inventory, select all devices marked Outdated, select Actions, and then select Update OS Image.


page 43

Deployment Details Step 2: Inspect the list of devices to be updated. If any devices do not have the appropriate resources for an upgrade, they are flagged. Fix any problems before continuing. Figure 2 Example device with insufficient flash memory available for update

Step 3: Select all devices to update, use the default selection of Run Now, click Apply, and then at the popup warning about devices being rebooted click OK.

Images are distributed to the selected devices, and then the devices reboot to activate the new images immediately after the image distribution is complete.

PROCESS

Step 4: In Inventory, click Refresh to see overall upgrade status and click Upgrade Status to see the details for each task.

Using DNA Center for SD-Access Network Provisioning 1. Configure network services for sites 2. Reserve IP address pools for network provisioning 3. Provision devices and assign to sites to prepare for SD-Access

After devices have management connectivity with DNA Center and are running the appropriate software versions for SD-Access, use DNA Center to define network settings and provision the devices with their roles as part of an SD-Access network.


page 44

Deployment Details

Procedure 1

Configure network services for sites

Step 1: Configure AAA, DH, and DNS services as required for the sites in DNA Center. If the services use the same servers across all of your sites, you can configure them globally and the inheritance properties of the hierarchy make the global settings available to all sites. Differences for individual sites can then be applied on a site-by-site basis. This procedure shows the configuration globally. Step 2: Within DNA Center, navigate to DESIGN > Network Settings > Network, within the left pane in the site hierarchy select the appropriate level (example: Global), fill in the DH Server IP address (example 10.4.49.10), under DNS Server fill in the Domain Name (example: ciscodna.net) and server Primary IP Address (example 10.4.49.10), add any redundant or additional servers, and then click Save.


page 45

Deployment Details Step 3: Above the list of network server types, click the + Add Servers button, select the AAA check box, and then click OK.

The configuration pane is updated with AAA Server as an available configuration section, ready for configuring AAA services for both the network infrastructure device management and the client endpoints connecting to the infrastructure. For validation, the high-availability standalone ISE nodes are used with RADIUS for both the network infrastructure and the client endpoint authentication. Step 4: Select the Network checkbox, select both the ISE and RADIUS radio buttons, under Network, use the pulldown to select the prepopulated ISE server, and then use the second pulldown that appears to select the second ISE server.


page 46

Deployment Details Step 5: Select the Client/Endpoint checkbox, select both the ISE and RADIUS radio buttons, under Client/Endpoint, use the pulldown to select the prepopulated ISE server, use the second pulldown that appears to select the second ISE server, and then click Save.

Step 6: The ISE servers for AAA, the DH Server, and DNS Server for the selected level in the site hierarchy are all saved to be used during fabric provisioning.

Procedure 2

Reserve IP address pools for network provisioning

Step 1: Reserve IP addresses for your networks by manually asg them in DNA Center. The assignments can be pushed to an IP address manager (IPAM) (examples: Infoblox, Bluecat) by integrating the IPAMs through APIs. You optionally integrate with an IPAM by navigating to the System Settings > Settings > IP Address Manager and filling out the form with the specifics of your IPAM provider. Step 2: This procedure shows how to manually define the IP address pools and then assign pools to be used by the sites in your network, which you do for both manual and IPAM configurations. Step 3: You only use the global level when you create IP address pools when using the validated version of DNA Center listed in Appendix A: Product List. Subsets of the global pools can be reserved at lower levels in the site hierarchy. DH scopes configured on the DH server should the address allocations and any additional DH options required to make a device work. For example, some IP telephony vendors require specific DH options to be configured to enable their devices to function correctly, which can be checked in product documentation.


page 47

Deployment Details The global address pools in the table are added as part of the validation. Table 3 Global address pools Pool Name

Network/Mask

IP Gateway

DH Server

DNS Server

Border-Handoff

172.16.172.0/24

172.16.172.1

—

—

Access-Point

172.16.173.0/24

172.16.173.1

10.4.49.10

10.4.49.10

14-Underlay

10.4.14.0/24

10.4.14.1

10.4.49.10

10.4.49.10

14-Employee

10.101.114.0/24

10.101.114.1

10.4.49.10

10.4.49.10

14-Phone

10.101.214.0/24

10.101.214.1

10.4.49.10

10.4.49.10

14-Things

10.102.114.0/24

10.102.114.1

10.4.49.10

10.4.49.10

14-Guest

10.103.114.0/24

10.103.114.1

10.4.49.10

10.4.49.10

Step 4: Add a global pool in DNA Center that is dedicated to fabric border node connectivity provisioning. Navigate to DESIGN > Network Settings > IP Address Pools. In the site hierarchy on the left, select Global, click + Add IP Pool, fill in the IP Pool Name, IP Subnet, CIDR Prefix, and Gateway IP address, if the pool has endpoint clients assign a DH Server(s) and DNS Server(s), do not select Overlapping, and then click Save.


page 48

Deployment Details

Repeat this step for any additional global IP pools that include subnets at the site and building levels. The pools are added to the list of global pools.

Procedure 3

Provision devices and assign to sites to prepare for SD-Access

Provision the devices and assign devices to a site for integration into an SD-Access network. ISE is updated to the provisioning. Tech Tip When devices are provisioned, the devices receive a number of configurations appropriate for the assigned site, including the centralized AAA server configuration, which is preferred over local credentials. To maintain the ability to manage the devices after provisioning, the credentials you use for provisioning must be available from the centralized AAA server, either directly or as the means to an external identity source such as Active Directory.


page 49

Deployment Details Step 1: to ISE, navigate to istration > Identity Management > Identities, click +Add, enter the Name (matching what was used for DNA Center discovery), enter the associated and Re-Enter , and then at the bottom of the screen click Submit.

The network istrative is now available from ISE, in addition to the same ID stored on each device. Step 2: In DNA Center, navigate to PROVISION > Devices > Inventory, select the devices to provision into an SD-Access network, click Actions, and then click Provision.

A Provision Devices wizard screen appears. Tech Tip Devices must be of the same type (example: all switches) in order to provision them at the same time. You can group provisioning operations in multiple small batches for common site assignments as needed.


page 50

Deployment Details Step 3: Within the first wizard screen, select the site assignments for the devices, and then at the bottom of the screen click Next.

Step 4: Use Next to skip the Configuration and Advanced Configuration screens, in the Summary screen review the details for each device, and then click Deploy.

Step 5: At pop-up screen, leave the default selection of Now, and click Apply. Configuration of each device begins, and status messages appear as each device is provisioned successfully. The Device Inventory screen updates with Provision Status and Sync Status. As a result of the DNA Center pxGrid integration with ISE, the network devices also appear in ISE.


page 51

Deployment Details

PROCESS

Step 6: the ISE integration function by logging into ISE and navigating to istration > Network Resources > Network Devices. The provisioned devices appear.

Creating Segmentation and Policy in the SD-Access Network 1. Add an overlay VN to the SD-Access network 2. Create a micro-segmentation policy using SGTs

As part of the design decisions in advance of your SD-Access network deployment, you decide network segmentation strategies for the organization. Macro segmentation uses additional overlay networks in the fabric (VNs), and micro segmentation uses scalable group tags to apply policy to groups of s or device profiles. The desired outcomes of policy application using segmentation may be easily accommodated with group policies. In a university example, students and faculty machines may both be permitted to access printing resources, but student machines should not communicate directly with faculty machines, and printing devices should not communicate with other printing devices. In other cases, a higher degree of isolation is required. In a retail store example, the point-of-sale machines should never be in communication with the video surveillance network infrastructure, which in turn should never communicate with the building HVAC system. In cases where the isolation need extends from the edge of the network all the way to the core of the network for access to access centralized services, macro segmentation using VNs is the best choice. Governmental and industrial compliance requirements and an organization’s risk policies often drive the choice to use VNs. Use these procedures as examples for deploying your macro and micro segmentation policies.


page 52

Deployment Details

Procedure 1

Add an overlay VN to the SD-Access network

Step 1: From the main DNA Center dashboard, navigate to POLICY > Virtual Network, click the + (plus sign) to create a new virtual network, enter a Virtual Network Name (example: Workers), drag scalable groups from the Available Scalable Groups pool into the Groups in the Virtual Network pool (examples: Employees and Developers), and then click Save.

The VN with associated groups is defined and appears in the list of defined virtual networks. These virtual network definitions are available for provisioning fabrics. Tech Tip If you don’t see any groups, likely the pxGrid connectivity between DNA Center and ISE is not fully operational. In this case, review the integration procedures for ISE with DNA Center and be sure to approve the pxGrid connection request in ISE from DNA Center.

Repeat this step for each overlay network, either guest or non-guest, as required. You can also return to this step after the fabric is provisioned to create more overlay networks.

Procedure 2

Create a micro-segmentation policy using SGTs

Micro-segmentation policies are customized for an organization’s deployment. This simple example shows a basic policy that can be used to deny s within a VN from communicating with other employee devices and also from one another when a group called Quarantined_System is applied.


page 53

Deployment Details Step 1: From the main DNA Center dashboard, navigate to POLICY > Policy istration > Group-Based Access Control (Fabric), click + Add Policy, from the Available Scalable Groups pane drag the Quarantined_System group and drop it into both the Source and the Destination panes, drag the Employees group into the Destination pane, input a Policy Name (example: Quarantine), enter a Description, select Enable Policy, leave Enable Bi-directional unselected, click + Add Contract, select deny, click OK, and then click Save.

The policy is created and listed with a status of DEPLOYED. This policy is now available to be applied to fabrics that are created and is available in ISE.


page 54

Deployment Details Step 2: to ISE, navigate to Work Centers > TrustSec > TrustSec Policy, on the left side select Matrix, and that the policy has been updated in ISE.

PROCESS

Using DNA Center to Provision an SD-Access Overlay Network 1. Create a fabric domain and add provisioned network devices 2. Enable external BGP connectivity at neighbor (fusion) to border router 3. Assign wired clients to VN and enable connectivity 4. Enable fabric edge ports for client onboarding

Using the provisioned SD-Access underlay network devices, create a fabric overlay network using those devices.

Procedure 1

Create a fabric domain and add provisioned network devices

A fabric domain called Default LAN Fabric is automatically created by DNA Center, containing provisioned devices ready to be assigned to a fabric. Create a new campus fabric domain and assign the appropriate devices to it. Campus fabric domains are used in the SD-Access 1.1 solution, enabling client endpoints to connect to wired and wireless LAN networks.


page 55

Deployment Details Step 1: Using DNA Center, navigate to PROVISION > Fabric, click + Add, leave the default Campus selection, supply a fabric name (example: RTP6_C9K), and then click Add.

The new campus fabric domain is created. Tech Tip All devices appear across all fabric domains. The fabric is defined within a domain by asg fabric functionality to devices and requires at least one instance of each of the fabric functions: edge node, border node, and control plane. The roles may be combined (example: control plane and border node) as permitted by the SD-Access solution being deployed.

Step 2: Click the icon for the fabric domain you just created (example: RTP6_C9K). The fabric Select Devices wizard starts.


page 56

Deployment Details Step 3: If the topology diagram shown does not mimic the two-tier (distribution/access) or three-tier (core/distribution/access) topology that is deployed, correct the topology by clicking each device, on the pop-up menu select Device Role, inspect its network role, and then either change the role and click Save, or if the role is correct select Cancel. When the device roles are complete an appropriate topology is displayed. The topology can be reoriented by clicking the green arrow button.

Step 4: Hold the shift key and click all of the nodes that are fabric edge nodes, and then in the pop-up box, click Add to Fabric. Step 5: If you have a node for the fabric dedicated to the role of being a control plane node without border functionality, click it, and then in the pop-up box, click Add as (control plane). Repeat this step for a redundant dedicated control plane node without border functionality. Tech Tip If the border nodes are Nexus 7700 Series switches using the software listed in Appendix A: Product List, you use dedicated control plane nodes and connect them directly to the Nexus 7700 Series border nodes. Additionally, enable the MPLS license and configure MPLS LDP on the physical links to the control plane nodes to the control plane connectivity.

Step 6: Click a device to perform the fabric border role, in the pop-up box click either Add as Border or Add as +Border (if skipping the previous step), fill in the additional dialog for the type of border (example: Outside World (External)), supply the BGP Local AS Number (example: 65514), under Border Handoff > Layer 3 use the Select IP Pool dropdown to select the Global pool configured previously in the guide for border connectivity functionality, and then next to External Interface click + Add Interface.


page 57

Deployment Details Tech Tip If the border is the only path to exit to the rest of the network, you should choose an external border. In cases where you have a combined control plane and border node functionality and the node uses internal border functionality, additional control plane filtering may be necessary when using the validated releases shown in Appendix A: Product List.

Step 7: Select the interface for the connection to the fusion router outside of the fabric, fill in the BGP Remote AS Number for the device outside of the fabric (example: 65500), select Virtual Network and all VNs to include in the Layer 3 handoff outside the fabric, click Save, and then click Add.

If you have an additional fabric border node, repeat the previous two steps for it. Tech Tip To configure a VRF-Lite handoff interface from the border to the rest of the network requires an 802.1Q-tagged interface. If you are managing the border using in-band connectivity over the redundant links to be converted, you first make the connection over a tagged interface, as described in the processes to setup management to a border device for network discovery. When using the version of SD-Access validated in this guide, provisioning is unsuccessful if the interface already includes a non-tagged configuration.


page 58

Deployment Details Step 8: After all required roles are assigned to the nodes in the fabric, at the bottom click Save, use the default choice Now, and then click Apply. Your campus fabric domain is created.

Procedure 2

Enable external BGP connectivity at neighbor (fusion) to border router

The SD-Access application in DNA Center configures the fabric border node BGP handoff to external networks. In the SD-Access version validated, you manually configure the external network peers of the border devices with the compatible VRF-Lite and BGP peering information. For AP and other infrastructure onboarding, you use the routing information from the BGP peer for the DEFAULT_VN, highlighted in the example below.

Example subset of border node configuration pushed by DNA Center SD-Access application vrf definition DEFAULT_VN rd 1:4098 ! address-family ipv4 route-target export 1:4098 route-target import 1:4098 exit-address-family ! vrf definition Workers rd 1:4099 ! address-family ipv4 route-target export 1:4099 route-target import 1:4099 exit-address-family !


page 59

Deployment Details interface Vlan3001 description vrf interface to External router ip address 172.16.172.1 255.255.255.252 no ip redirects ip route-cache same-interface ! interface Vlan3002 description vrf interface to External router vrf forwarding Workers ip address 172.16.172.5 255.255.255.252 no ip redirects ip route-cache same-interface ! interface Vlan3003 description vrf interface to External router vrf forwarding DEFAULT_VN ip address 172.16.172.9 255.255.255.252 no ip redirects ip route-cache same-interface ! router bgp 65514 bgp router-id interface Loopback0 bgp log-neighbor-changes neighbor 10.4.2.65 remote-as 65500 neighbor 10.4.14.4 remote-as 65514 neighbor 10.4.14.4 update-source Loopback0 neighbor 172.16.172.2 remote-as 65500 neighbor 172.16.172.2 update-source Vlan3001 ! address-family ipv4 network 10.4.14.3 mask 255.255.255.255 aggregate-address 10.4.14.0 255.255.255.0 summary-only redistribute isis level-2 redistribute lisp metric 10 neighbor 10.4.2.65 activate neighbor 10.4.14.4 activate


page 60

Deployment Details neighbor 172.16.172.2 activate neighbor 172.16.172.2 weight 65535 exit-address-family ! address-family ipv4 vrf DEFAULT_VN redistribute lisp metric 10 neighbor 172.16.172.10 remote-as 65500 neighbor 172.16.172.10 update-source Vlan3003 neighbor 172.16.172.10 activate neighbor 172.16.172.10 weight 65535 exit-address-family ! address-family ipv4 vrf Workers redistribute lisp metric 10 neighbor 172.16.172.6 remote-as 65500 neighbor 172.16.172.6 update-source Vlan3002 neighbor 172.16.172.6 activate neighbor 172.16.172.6 weight 65535 exit-address-family ! The deployed configuration includes VRF, VLAN, and BGP elements similar to the ones shown in the above configuration example; however, the VLANs deployed will likely be different. Step 1: to border devices and use the CLI to observe the automated configurations created by the SDAccess DNA Center application for IP connectivity outside of the border. Some of the following commands may be helpful. show running-config brief show running-config | section vrf definition show running-config | section interface Vlan show running-config | section router bgp Tech Tip There are other important additions to the configuration, which are handled completely by the automation. If you are interested in observing additional LISP fabric control plane changes, use the following command:

show running-config | section LISP|lisp|site


page 61

Deployment Details Step 2: to the fusion devices external to the fabric that are connected to the border, using the border configuration as a guide, configure VRFs as required by virtual networks created on the border. VRFs separate communication between groups of interfaces and virtual network contexts within the fabric. vrf definition [VRF name]

rd [Route Distinguisher] address-family ipv4

route-target export [Route Target] route-target import [Route Target]

exit-address-family Repeat this step for each virtual network context, consistent with the border node configuration. Step 3: Configure each interface to the neighbor. Some devices VLAN subinterface configuration directly on trunks, and other devices require VLAN interfaces to be created and associated with a trunk. Repeat the neighbor interface configuration for each neighbor on each peer to the border. interface [Peer interface] Step 4: Configure BGP IPv4 unicast routing towards the fusion router to connectivity for each VRF associated with each VN in the fabric. router bgp [Local BGP AS] bgp router-id interface Loopback0 bgp log-neighbor-changes

neighbor [Border IP Address] remote-as [Fabric BGP AS] !repeat for any additional neighbors ! address-family ipv4

network [Loopback IP Address] mask 255.255.255.255 neighbor [Border 1 IP Address] activate neighbor [Border 2 IP Address] activate maximum-paths 2

exit-address-family Step 5: On the fusion router, for each VN, export route-targets to the global VRF and import select route-targets from the global VRF into the VN. Route leaking with import and export of route-targets s access to the shared services only as required for each VN, while maintaining route separation between VNs. Configurations can vary—more information for route leaking configurations can be found by searching cisco.com for route leaking between global and VRF routing tables.


page 62

Deployment Details

Procedure 3

Assign wired clients to VN and enable connectivity

Step 1: From the DNA Center dashboard, navigate to PROVISION > Fabric > Host Onboarding, under Select Authentication template select Closed Authentication, at the top of the section click Save, and then click Apply.

Step 2: Under Virtual Networks, select a VN to be used for wired clients (example: Workers), in the Edit Virtual Network:Workers slideout pane, select the names of IP Pools to add to the VN (example: 14-Employee), select Traffic Type of Data, change Layer 2 Extension to Off, and then click Update. Layer 2 extension is only ed with wireless in SD-Access solution 1.1.

Step 3: At the Modify Authentication Template slideout, keep the default Run Now selection, and then click Apply.


page 63

Deployment Details

Procedure 4

Enable fabric edge ports for client onboarding

Repeat this procedure for each fabric edge switch where clients are connecting. Step 1: Navigate to PROVISION > Fabric > Host Onboarding, under Select Port Assignment in the left column select a switch. Step 2: At the top of the list of switch ports on the right, select the Address Pool(VN) (example: 10_101_114_0-Workers), optionally select an appropriate group from Groups (example: Employees), optionally select a Voice Pool(VN) to use for IP telephones, and then select the Authentication (example: Closed Authentication). Tech Tip The group assignment is used to statically assign a group if the fabric edge port does not receive its assignment dynamically using an authentication server, which is useful for some types of devices used in an organization.

Step 3: Within the list of switch ports, select every wired fabric edge port to participate in the fabric VN, click Save, and then click Apply.

Devices can now connect at the fabric edge ports using the wired network overlay and authentication method created.


page 64

Deployment Details

Example port configuration pushed by DNA Center using closed authentication interface GigabitEthernet1/0/23 switchport access vlan 1032 switchport mode access switchport voice vlan 1030 load-interval 30 authentication control-direction in authentication event server dead action authorize vlan 3999 authentication event server dead action authorize voice authentication host-mode multi-auth authentication order dot1x mab authentication priority dot1x mab authentication port-control auto authentication periodic authentication timer reauthenticate server authentication timer inactivity server dynamic mab no macro auto processing dot1x pae authenticator dot1x timeout tx-period 10 spanning-tree portfast

Integrating Wireless Into SD-Access

PROCESS

1. Add the wireless controller pair into inventory 2. Create IP pools for APs 3. Design fabric enterprise wireless SSIDs 4. Design fabric guest wireless SSID. 5. Provision the WLC for SD-Access Wireless fabric integration 6. Enable onboarding of APs into the wireless fabric 7. Assign wireless clients to VN and enable connectivity

The process to install SD-Access wireless LAN controllers, described earlier, is complete and the controllers are available to integrate into the fabric using DNA Center.


page 65

Deployment Details

Procedure 1

Add the wireless controller pair into inventory

If the wireless LAN controllers are not in the DNA Center inventory, you must add them before the wireless integration. Step 1: Navigate to the main DNA Center dashboard, under the Tools section click Discovery, fill out a Discovery Name, click Range, in both the start and end IP loopback address for IP Ranges enter the IP address of the WLC HA pair, click + (plus sign) to include the range, leave the default Preferred Management IP of None, if you have unique credentials for the device click + Add Credentials and add them and Save, and then click Start. The inventory discovery for the WLC pair starts, and when it is complete the device count increments and shows Complete is displayed. Step 2: Navigate to the main DNA Center dashboard under the Tools section click Inventory, and find the added WLC. Before proceeding, use the Refresh button to update the Last Inventory Collection Status until it is in Managed status. Step 3: Go to the main DNA Center dashboard, navigate to DESIGN > Image Repository, and either import an appropriate image, mark the image golden and upgrade the WLC, or if the existing image is ed by SDAccess mark it golden.

Procedure 2

Create IP pools for APs

that a global pool in DNA Center is available for address assignment for the APs to be managed by the network. Step 1: Navigate to DESIGN > Network Settings > IP Address Pools. In the site hierarchy on the left, select Global, and inspect the list of IP address Pools for a pool dedicated to the AP infrastructure (example: AccessPoint). Step 2: If a pool for the APs does not exist, click + Add IP Pool, fill in the IP Pool Name, IP Subnet, CIDR Prefix, and Gateway IP address (examples: Access-Point, 172.16.173.0, /24, 172.16.173.1), select the DH Server and DNS Server, and then click Save.


page 66

Deployment Details

Procedure 3

Design fabric enterprise wireless SSIDs

Step 1: From the main DNA Center dashboard, navigate to DESIGN > Network Settings> Wireless, in the Enterprise Wireless section click + Add, in the Create an Enterprise Wireless Network wizard, and supply the following information: • Enter the Wireless Network Name(SSID) (example: Employee) • Under TYPE OF ENTERPRISE NETWORK, select Voice and Data and Fast Lane • For LEVEL OF SECURITY select WPA2 Enterprise • Under ADVANCED SECURITY OPTIONS select Adaptive Step 2: Click Next to continue in the wizard, and supply the following information: • Enter a Wireless Profile Name (example: RTP5-Wireless) • Under Fabric, select Yes • Under Choose a site, select the location where the SSID will broadcast (example: Global/RTP/RTP5-C9K), and include floors to include in SSID coverage (example: Global/RTP/RTP5-C9K/Main Floor) Step 3: Click Finish to continue. The DESIGN > Network Settings> Wireless screen is displayed. Repeat this procedure for additional SSIDs using the same network profile and any new location profiles to be associated with an SSID.

Procedure 4

Design fabric guest wireless SSID.

Step 1: Navigate to DESIGN > Network Settings> Wireless, in the Guest Wireless section click + Add, in the Create a Guest Wireless Network wizard, and supply the following information: • Enter the Wireless Network Name(SSID) (example: Guest) • Under LEVEL OF SECURITY select Web Auth • Under AUTHENTICATION SERVER select ISE Authentication Leave the other default selections and click Next to continue in the wizard. Step 2: In the Wireless Profiles section, select the Profile Name corresponding to the deployment location (example: RTP5-Wireless), in the slideout keep the default Fabric selection of Yes, keep the other default information, at the bottom of the click Save, and then click Next. Step 3: In the Portals screen, click + Add. The Portal Builder screen appears.


page 67

Deployment Details Step 4: Supply a Guest Portal name (example:Guest-RTP5), make any desired customizations, and then at the bottom of the screen click Save. A guest web authentication portal is generated for the site, and you return to the previous screen. Step 5: Click Finish. The wireless LAN design is created and is ready to deploy.

Procedure 5

Provision the WLC for SD-Access Wireless fabric integration

After completing the SD-Access Wireless design, push the configuration from the design to the WLC. Step 1: Navigate to PROVISION > Devices, find the WLC and select the checkbox next to it, and then at the top of the screen under the Actions pull-down, select Provision. The Provision Devices wizard opens. Step 2: Assign the site (example: Global/RTP/RTP5-C9K), click Next, at the Configuration screen under Managed AP Location select the additional floor assignments for APs managed by the WLC (example: Global/RTP/ RTP5-C9K/Main Floor), click Next, and then at the Advanced Configuration screen click Next. Step 3: At the Summary screen review the configurations, click Deploy, at the slideout keep the default selection Run Now, and then click Apply. The WLC is assigned to the site and the provisioning starts. Use the Refresh button until Provision Status shows Success before proceeding.


page 68

Deployment Details Step 4: Navigate to PROVISION > Fabric, click the fabric domain where the WLC is to be added (example: RTP6_C9K), click the WLC, in the popup box select Add to Fabric, click Save, in the slideout menu keep the default selection Run Now, and then click Apply. The WLC configurations are created to establish a secure connection to the fabric control plane.

You can that WLC controller pair is integrated into the fabric from the WLC management console by navigating to CONTROLLER > Fabric Configuration > Control Plane, which shows the fabric integration is enabled with the connection status up.

Procedure 6

Enable onboarding of APs into the wireless fabric

The APs are hosts that the fabric and are assigned into a VN named INFRA_VN. This special VN for infrastructure devices such as APs, enables management communication between the APs at the fabric edge nodes using the fabric control plane and the WLC sitting outside of the fabric as a part of global routing connectivity.


page 69

Deployment Details Step 1: Connect APs to be used for the fabric directly to an edge node within the fabric. Step 2: Navigate to PROVISION > Fabric, select the fabric, and then click Host Onboarding. Step 3: Under Select Authentication template, select No Authentication, click Save, in the slideout keep the default selection Run Now and then click Apply. The authentication template is applied to the fabric, and automatic onboarding of APs is enabled. Tech Tip DNA Center enables automatic onboarding of APs by provisioning a CDP macro at the fabric edge switches when the authentication template to be set to No Authentication. Alternatively, you use the switch port configurations in DNA Center to assign a port to the IP address pool for the APs.

Step 4: Under Virtual Networks, select INFRA_VN, click the check box next to the IP Pool Name for the APs (example: Access-Point), click Update, in the slideout keep the default selection Run Now, and then click Apply.

After the update is complete, the edge node switch ports connected to the APs are enabled with a device tracking configuration recognizing APs and permitting the APs to get network connectivity. Tech Tip A default route in the underlay cannot be used by the APs to reach the WLC. A more specific route (such as a /24 subnet or /32 host route) to the WLC IP addresses must exist in the global routing table at each node where the APs connect to establish connectivity. Redistribute the WLC route at the border into the underlay IGP routing process for efficiency. Alternatively, you can create static entries at each edge node ing APs.


page 70

Deployment Details Step 5: Navigate to the main DNA Center dashboard, under Tools select Inventory, select the WLC being added, and then at the top in the Actions pulldown, select Resync. The APs associated with the WLC are immediately added to the inventory without waiting for an inventory refresh. Step 6: Navigate to the main DNA Center dashboard, PROVISION > Devices > Inventory, select the APs being added, at the top in the Actions pulldown menu, select Provision, assign the APs to a floor (example: Global/RTP/ RTP5-C9K/Main Floor), click Next, for RF Profile select TYPICAL, click Next, at the Summary page click Deploy, and then in the slideout , click Apply and acknowledge any warnings about reboots.

Procedure 7

Assign wireless clients to VN and enable connectivity

Step 1: Navigate to PROVISION > Fabric > Host Onboarding, select a VN to be used for clients (example: Guest), in the Edit Virtual Network:Guest slideout pane, select the names of IP Pools to add to the VN (example: 14-Guest), select Traffic Type of Data, Layer-2 Extension is On, and then click Update. Tech Tip Selecting Layer-2 Extension enables the SD-Access LISP control plane to learn MAC addresses, which is required for wireless clients.

Step 2: Under the Modify Authentication Template slideout, keep the default Run Now selection, and then click Apply. Step 3: In the Wireless SSID’s section, for each SSID Name, under Address Pool, select the appropriate IP Address Pool, click Save, and then click Apply. Devices can now connect via the wireless networks.


page 71

Appendix A: Product List

Appendix A: Product List The following products and software versions were included as part of validation in this deployment guide. Additional hardware options are listed in the associated Software-Defined Access Design Guide, and updated DNA Center package files are regularly released and available within the packages and updates listings.

DNA Center

Functional Area

Product

Part Number

Software Version

Network Automation

Cisco DNA Center Appliance

DN1-HW-APL

1.1.4

DNA Center Packages All packages running on the DNA Center during validation are listed—not all packages are included as part of the testing for SD-Access validation. Package

Version

Assurance - Base

1.0.5.686

Assurance - Path Trace

2.1.8.60044

Assurance - Sensor

1.0.5.360

Automation - Application Policy

2.1.8.170027

Automation - Base

2.1.8.60044

Automation - Device Onboarding

2.1.8.60044

Automation - Image Management

2.1.8.60044

Automation - SD Access

2.1.8.60044

Automation - Sensor

2.1.8.60044

Command Runner

2.1.8.60044

N - Base

2.1.8.60044

N - Services

2.1.8.60044

Network Controller Platform

2.1.8.60044

Network Data Platform - Base Analytics

1.0.7.878

Network Data Platform - Core

1.0.7.829

Network Data Platform - Manager

1.0.7.949

System

1.0.4.807


page 72


Identity Management Functional Area

Product

Software Version

Cisco ISE Server

Cisco Identity Services Engine

2.3 Patch 1

SD-Access Fabric Border and Control Plane Functional Area

Product

Software Version

Border and Control Plane

Catalyst 9500 Series Switches

16.6.3

Border and Control Plane — Small Site

Catalyst 3850XS Series (10Gb fiber)

16.6.3

Border and Control Plane

Cisco 4000 Series Integrated Services Routers

16.6.3

Border and Control Plane — Large Scale

Cisco ASR 1000-X and 1000-HX Series Aggregation Services Routers

16.6.3

Border (wired-only control plane option)

Cisco Catalyst 6807 Series 7-slot Chassis with Supervisor Engine 6T or Supervisor Engine 2T and 6800 32-port 10GE with dual integrated DFC4

15.4.1-SY4

Border (wired-only control plane option)

Cisco Catalyst 6880-X and 6840-X Series

15.4.1-SY4

Border

Cisco Nexus 7700 Series Switches 2-Slot Chassis with Supervisor2 Enhanced Module and Nexus 7700 M3-Series 48-Port 1/10G Ethernet Module

8.2(1) + SMU 8.2.1.CSCvg39911 and 8.2.1.CSCvh87828

Control Plane

Cisco Cloud Services Router 1000V Series

16.6.3

SD-Access Fabric Edge Functional Area

Product

Software Version

Fabric Edge

Cisco Catalyst 9300 Series - Stackable

16.6.3

Fabric Edge

Cisco Catalyst 9400 Series with Supervisor Engine-1 – Modular Chassis

16.6.3

Fabric Edge

Cisco Catalyst 3850 Series - Stackable

16.6.3

Fabric Edge

Cisco Catalyst 3650 Series - Standalone with Optional Stacking

16.6.3

Fabric Edge

Cisco Catalyst 4500E Series with Supervisor 8-E – Modular Chassis

3.10.1E


page 73


SD-Access Wireless Functional Area

Product

Software Version

Wireless LAN Controller

Cisco 8540, 5520, and 3504 Series Wireless Controllers

8.5.120.0

Fabric Mode Access Points

Cisco Aironet 1800, 2800, and 3800 Series (Wave-2)

8.5.120.0


page 74

Glossary

Glossary AAA authentication, authorization, and ing ACI Cisco Application-Centric Infrastructure ACL access control list AD Active Directory AP access point ARP address resolution protocol BGP border gateway protocol BPDU bridge protocol data unit CAPWAP control and provisioning of wireless access points protocol CLI command line interface CMD Cisco Meta Data DH dynamic host configuration protocol DMVPN dynamic multipoint virtual private network DNA Cisco Digital Network Architecture DNS domain name system ECMP equal-cost multipath FHRP first-hop redundancy protocols GLBP gateway load-balancing protocol GRE generic routing encapsulation GUI graphical interface HSRP hot standby router protocol IGMP Internet Group Management Protocol IoT Internet of Things IS-IS intermediate system to intermediate system routing protocol IGP interior gateway protocol ISE Cisco Identity Services Engine LISP locator/ID separation protocol MnT Monitoring and Troubleshooting Node MPLS multiprotocol label switching MSDP multicast source discovery protocol MTU maximum transmission unit PAN Policy istration Node


page 75

Glossary PSN Policy Service Node RP rendezvous point SD-Access Software-Defined Access SGACL scalable group access control list SGT scalable group tag or security group tag SVI switched virtual interface SXP scalable group tag exchange protocol VLAN virtual local area network VN virtual network VRF virtual routing and forwarding


page 76

You can use the form to send comments and suggestions about this guide.

Americas Headquarters Cisco Systems, Inc. San Jose, CA

Asia Pacific Headquarters Cisco Systems (USA) Pte. Ltd. Singapore

Europe Headquarters Cisco Systems International BV Amsterdam, The Netherlands

Cisco has more than 200 offices worldwide. Addresses, phone numbers, and fax numbers are listed on the Cisco Website at www.cisco.com/go/offices. ALL DESIGNS, SPECIFICATIONS, STATEMENTS, INFORMATION, AND RECOMMENDATIONS (COLLECTIVELY, “DESIGNS”) IN THIS MANUAL ARE PRESENTED “AS IS,” WITH ALL FAULTS. CISCO AND ITS SUPPLIERS DISCLAIM ALL WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE. IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THE DESIGNS, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THE DESIGNS ARE SUBJECT TO CHANGE WITHOUT NOTICE. S ARE SOLELY RESPONSIBLE FOR THEIR APPLICATION OF THE DESIGNS. THE DESIGNS DO NOT CONSTITUTE THE TECHNICAL OR OTHER PROFESSIONAL ADVICE OF CISCO, ITS SUPPLIERS OR PARTNERS. S SHOULD CONSULT THEIR OWN TECHNICAL ADVISORS BEFORE IMPLEMENTING THE DESIGNS. RESULTS MAY VARY DEPENDING ON FACTORS NOT TESTED BY CISCO. Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental. © 2018 Cisco Systems, Inc. All rights reserved. Cisco and the Cisco logo are trademarks or ed trademarks of Cisco and/or its s in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)


B-000251C-1 05/18

Cvd Software Defined Access Deployment Guide 2018apr x111b

Overview 1s532p

More details 6h715l

Related Documents 2w1qw

Cvd Software Defined Access Deployment Guide 2018apr x111b

Software Defined Network (sdn) 5o5d16

Software Defined Radio 1e2m1f

Day One: Software Defined Networks 5x4b1x

Software-defined Radio Handbook - Pentek.pdf 2p2l1m

Software Defined Networks For Dummies 3r2e2r

More Documents from "Muhammad Alim" 6v2eq

Cvd Software Defined Access Deployment Guide 2018apr x111b

Yevi Ikram Karim 09320160146.docx e3m5l

Contoh Surat Undangan Syukuran Rumah Baru 424n2w

Swagelok Tubing Data 21115s

Short Notes 4l5m9