APIC-EM - Typepad

APIC-EMAdam Radford – Distinguished Systems Engineer

Agenda Introduction Inventory/Topology Path Trace Plug and Play IWAN EasyQoS

APIC-EM Controller ArchitectureScalablePlatformHighlyAvailableElastic serviceinfrastructure andauto scaleservice modelMaximum uptimefor mission-criticalapplications andseamless upgrade Single TouchPointNorthboundRESTful APIsFast and easyinstallationRBAC-enabled

APIC-EM - Platform ArchitectureAPIC-EMApplicationsNetwork PnPIWANPath TraceNetwork InventoryAdvanced Topology VisualiserAPIC-EMApplicationsAPIC-EM ControllerNorthbound REST APIs gyServicesData AccessServicePolicy AnalysisNetwork PnPElastic Service ervicesAddressesScale Outand HARequirements

Manual to Systemic Policy DeploymentManual PolicyConventional ModelDeploymentController Led PolicyDeploymentThe WhatThe What“Security Policy forBranches A-N”AdminDrivenThe How“Change ACLs inthe followingelements”“Security Policy forBranches A-N”AdminDrivenThe How“Change ACLs inthe followingflements”SystemDriven

Inventory/Topology

Controller Application - Network Discovery Quick, easy, and efficient networkdiscovery functionality Flexible discovery options Based on CDP and IP address range Ability to start, stop, and delete the scan at anytime Auto-discovery of newly added network devices Ability to initiate a discovery job through the UI ornorthbound REST APIs

Controller Application - Network Discovery

Network Discovery - Input Parameters Seed IP address for CDPbased network discoveryIP address range for discovery scope Click on the Add icon to provide multipleIP address ranges

Controller Applications - Device InventorySingle Source of Truth Real‐time network device inventory and assetservice management Includes all network devices with an abstraction for theentire network: Full knowledge of networkAwareness of the overall operational healthof the physical network Detailed inventory information for easier consumption bycontroller services and applications Allows applications to be device-agnostic Inventory service runs in the background to maintain anaccurate database

Controller Applications - Device Inventory

Device Inventory - Hardware Layout Detailed device inventory information

Device Inventory - Tagging Layout Sophisticated and automated devicesare given a role assignment based onintelligent matching against pre-settemplates and attributesGeo-site (location) and custom tags for completeflexibility in grouping and classification of devicesbased on business logic (for example, lines ofbusiness, service mix, etc.)

Controller Applications - Host Inventory Real‐time network host and endpoint inventory(PCs, wireless devices, IP phones, printers, etc.) Detailed information about each host and endpoint: Network attachment point for the host to the network device Host name, IP, and MAC address information Host inventory service runs in the background to maintain theaccuracy of the database: Information collected through CDP, LLDP, andP device-tracking database lookup SNMP traps are used to update the host inventory database(wireless host only for Release 1.0)

Controller Applications - Host Inventory Detailed host informationNetwork attachment point for host

Scale Numbers – General AvailabilityNetworkDevices:2000AccessPoints:2000 EndHosts:20,000Note: These scale numbers are for the APIC-EM platform and the base applications.Some other APIC-EM applications might have different scale numbers.

Path Trace Application:Controller basedTroubleshooting

APIC-EM Path Trace ApplicationAccelerate Trouble-Ticket ProcessingUserTrouble TicketITPath TraceNETWORKBENEFITSSDNSimple WorkflowEasy visual discovery of trouble spots in thecommunication path based on 5-tuple OpEx for ticket processing decreased by 98%from 1.6 hours to 1 minute

Path Trace App: 5-Tuple Input ThroughUser Interface Required InformationOptional InformationSRC and DEST IP address[End host or L3 interface]SRC and DEST L4 port numbers;L4 protocol (TCP or UDP)Note: Layer 4 port and protocol information is optional but highly recommended for accurate path calculation

Path Trace App: Enhanced ApplicationFlow VisibilityCAPWAP TunnelVisualisation Accuracy Note(in a percentage)Ingress/EgressInterfaceLink SourceInformation

Path Trace App: Detailed Device InformationDevice InformationDescriptionDevice IP addressIP address of the network device or end hostTypeType of network device or end hostLink information sourceFor all the links along the application flow path trace, the link information source is displayed. Some examples for this particular field include: Routing protocols (OSPF, BGP etc.) - The link is based on the routing protocol table ECMP - The link is based upon a Cisco Express Forwarding load-balancing decision NetFlow - The link is based upon NetFlow cache records collected on the device Static - The link is based on a static routing table Wired and wireless - The end host is a wired or wireless endpoint connected to the network device Switched - The link is based on Layer 2 VLAN forwarding information Traceroute - The link is based on information collected by the trace route appTunnelsRelevant tunnel information is present along the application flow path trace. For APIC-EM Release 1.0, only CAPWAP and mobility tunnelsare supported.Note: The Path Trace UI provides a visual graphic of the CAPWAP tunnel along the path traceIngress interfaceIngress interface of the device for the application flow path trace (physical or virtual)Egress interfaceEgress interface of the device for the application flow path trace (physical or virtual)Accuracy noteIf there is uncertainty about the path trace on a segment between devices, a note about the accuracy of the computed path on this segment will bedisplayed as a percentage. Click on the note to view suggestions of corrective actions to take to improve the path trace accuracy. The accuracynote is not displayed unless the APIC-EM is certain about the path.Example: If the APIC-EM is unable to obtain the exact egress interface for an ECMP scenario with two paths, the accuracy value would becalculated as 50%.

Path Trace App: Topology View

Path Trace App: Enhanced ApplicationFlow Visibility Reverse Path LookupYou have the ability to visualise the bi-directional path in a single view

Path Trace App: Path Trace Flow DiagramInfo kupCloudCloudECMPDecisionInfo Source:Poll NetworkDeviceECMPDecisionInfo Source:Poll ayLookupInfo Source:APIC-EMNIBInfo Source:APIC-EMNIB HSRPCampusInfo Source:Poll NetworkDeviceInfo Source:APIC-EMNIBL2LookupInfo Source:APIC-EMNIBBranch

Network Plug and Play:Controller basedDeployment

Network PnP with the Cisco APIC-EM AutomatesDevice ects and SitesRemoteInstaller Policies Match rules Configurations,images IP addressing Mount andcable devices Power onAPIC EMPnPAgentSmartInstallProxyPnPAgentPnP AgentPnP AgentUnskilledInstallerGUI-BasedPnP ServerConsistent for Devicesand Pin (Campus,Branch)The networkadmin remotelymonitors theinstallation statuswhile in progressBooting devicescall home to thePnP server,and requestinstructionsSmart Install ClientHighlySecureEnd to EndGreenfieldand Brownfield

Network Plug and Play - ComponentsPnP Helper AppDelivers bootstrap statusand troubleshooting checksPnP ProtocolRuns betweenAgent and ServerOpen schemaPnP ServerCentral server - APIC-EMPnP AgentRuns on Cisco switches, routers,and wireless access pointsAutomates the deployment processManages sites, devices,images, licensesProvides northbound REST APIs

OptionCisco APIC EM: PnP ServerWorkflow-Based and REST API Pre-provisioning Ad-hoc and unclaimed devicesDevice Repositoryand DatabaseEnterprise Applications and Orchestration LayerPnP REST APINetwork PnPApplication UIPythonAutomation Framework(i.e. Python script,configuration generator)IWANAppTopologyDiscoveryREST APIAPIC-EM APIPnPServiceAPIC-EM ControllerCLI, PnP ProtocolCustomer’s ExistingAutomation FrameworkCisco DevicesCatalyst , ISR, ASR, Access Points

PnP Server Discovery OptionsSwitches (Catalyst )12Routers (ISR, ASR)Wireless Access PointsDHCPDHCP with options 60 and 43ServerPnP string: 5A1D;B2;K4;I172.19.45.222;J80DNSServerDNS lookuppnpserver.localdomain ---- 172.19.45.222 (PnP Server)Cloud re-direction - roadmap elper re-directs to 172.19.45.22(PnP Server)4USB-based bootstrapping5Manual - using the Cisco Installer AppiPhone, iPad, Android, (roadmap - Windows mobile and PC)

APIC-EM PnP Login Screen

Step 3. Add devicesWorkflow on the APIC-EMIf any external TFTP server is used for configurationsand images, for a given site information must beentered here. This is not recommended.Name of deviceDevice typeSerial Numberof deviceSelect the image from an availablelist already loaded intothe APIC-EMDrag and drop the deviceconfiguration here as a txt file orselect from uploaded configurations

OptionNetwork PnP: Installer AppRedparkRJ45 toApple 8pinRJ45 toApple 30pin Get ConsoleAppleAndroidAirconsole 2.0Bluetooth Adapter* Tested with Network-PnP Solution

Installer App - WorkflowPnP Server - Sites and DevicesRemote Installer Mount andcable devices Power onAPIC-EMPnP-ServerHTTPProxyWi-Fi, 3G, 4G WAN link up VPN up (Internet)!interface GigabitEthernet0/0description To Corp Networkip address 171.71.223.88 255.255.254.0no shutdown!! PnP Server Configpnp profile pnp-wantransport https ipv4 172.19.45.222 port 443iPad to console cable, BluetoothDeliver bootstrapCustom WAN Configuration

PnP Deployment for Campus - Self-SignedCertificate MethodDHCP ServerDevice RunningPnP AgentDMZLANAPIC PnPServerDHCP RequestDHCP responsewith options 43and 60 forserver locationDCPnP Server usesself-signed SSLcertificate12PnP Agent initiates HTTP communication withthe server and sends the device UDIHTTP PnP work request with device serial number (UDI)3PnP Agent installs the local trust pointfor the server SSL certificate4PnP Server receives UDI andsends server SSL certificateover HTTP6PnP Server receives device UDIand sends the full configurationand Cisco IOS Software imageover the HTTPS channelHTTPS PnP work request with device serial number (UDI)PnP Agent initiates HTTPS communicationwith the server and sends the device UDI5

NG Plug-N-Play – Supported PlatformsPlatformAccessSwitchesPnP Agent Support on ProductsIOS-XERecommendedReleaseCisco Catalyst 4500E Switches (Sup8-E, 7-E/7L-E, 6-E/6L-E)Cisco Catalyst 3850, 3650 Series SwitchesCisco Catalyst 4500-X, 4900 Series SwitchesCisco Catalyst 3750-X, 3560-X Series SwitchesCisco Catalyst 2960-C, 3560-C Series Compact SwitchesCisco Catalyst 2960-S/SF, 2960-X/XR Series SwitchesIOS-XE 3.6.3EIOS 15.2.2E3Cisco Catalyst 3850XU/XS Series SwitchesCisco Catalyst 2960-CX, 3560-CX Series Compact SwitchesIOS-XE 3.7.2EIOS 15.2.3E2Core SwitchesCisco Catalyst 6500 Series Switches: Sup2T/Sup720Cisco Catalyst 6880-X, 6807-XL Series SwitchesAccess RoutersCisco 4300/4400 Integrated Services RouterCisco ASR 1000 Series Aggregation Services Routers, Cisco CSR 1000vCisco Cloud Services Router 1000V SeriesCisco 800, 1900, 2900, 3900 Series Integrated Services Routers (ISR G2)IOSIOS 15.2(2)SY1 (Mar2016)IOS-XE 3.16.S (ED)IOS 15.5.3M (ED)Industrial Ethernet SwitchesCisco Industrial Ethernet 2000, 3000 Series SwitchesIOS 15.2.2E3Indoor Access PointsGen2 802.11n AP 1600, 2600,, 3600, 702-W/I802.11ac Wave1 - 1700, 2700, 3700,Wave 2 802.11ac & Outdoor AP support (Roadmap)WLC Supported : AireOS and IOS-XENov2015

iWAN Application:Controller based Policy

Evolution to Policy AutomationPolicy-basedAutomation: Dynamic Business intent tonetwork intent Executed byAPIC-EM apps Prescriptive Business e-basedConfiguration: Static Focused onconfiguration Executed by Prime Infrastructure Customisable Expert-ledFeatureFeatureIncreasing Policy Coverage Through More Apps and ServicesSteady State: Cisco leadsmarket adoptionso that a largemajority ofenterprises adoptpolicy-basedautomation A small set oflarger enterprisesor MSPs willcontinue to usecustomisablefeatureconfiguration