Inside Cisco IT: Zero Touch Deployment Using Cisco Prime Infrastructure

Transcription

1

2 Inside Cisco IT: Zero Touch Deployment Using Cisco Prime Infrastructure Stephen Hoover - Member of Technical Staff David Iacobacci - Member of Technical Staff Mary Kadomoto - Director BRKCOC-2001

3 Agenda Introduction The Zero Touch Deployment process Cisco IT Deployment Strategy IT Extensions Lessons Learned Demo Conclusion

4 What is Zero Touch Deployment? Capability to securely automate the following activities associated with a device: Provisioning Deployment Upgrades Rack, Stack, Cable Provision Deploy Upgrade Operate

5 Reasons to pursue ZTD Save money : Cut incident rates due to inconsistent configurations Reduce skills level necessary to deploy production network devices Shorten time to deploy

6 Inside Cisco IT Network of 100,000+ devices Prime Infrastructure as part of Cisco IT network management strategy 6 instances across the globe Close collaboration with PI BU (CVG) EFTs Enhancement requests Cisco IT extensions

7 Existing Cisco ZTD Solutions Autoinstall IOS device obtains configuration via DHCP and TFTP during boot-up sequence Smart Install Switches Configuration Engine Large number of devices with similar configurations, pushed via cns protocol Tcl Scripts

8 Cisco IT ZTD experience with CVO CVO - Cisco Virtual Office Teleworker Solution SDP: Secure Device Provisioning Registrar (IOS with templates) Configuration Engine: push configurations and images to routers Cisco Security Manager: Repository for templates and policies Encrypted Tunnel Internet Corporate Network

9 The Zero Touch Deployment process

10 Components to implement ZTD using PI Prime Infrastructure v2.2 Plug and Play Gateway v2.2 Target router or switch Cisco Plug and Play Application (ios/windows based) or DHCP/TFTP servers

11 Deployment of PI and PnP GW Option to collapse PnP GW and PI server - PI and the PnP GW could be installed and operated on the same host Target Device PnP GW Prime Infrastructure

12 Maintain PnP GW independent of PI server By maintaining PI and the PnP GW on independent devices, PI could remain in the DC while the PnP GW could be installed in the DMZ for access across the Internet Target Device PnP GW Prime Infrastructure

13 PI Based ZTD Overview Three phases, referred to as Days are used to deploy a configuration : Day0: Basic IP connectivity, CNS configuration, basic routing, Day1: Common configuration (AAA, routing protocols, ) Day2: Device specific configuration (interfaces configuration, VLANs, )

14 PI Based ZTD Overview Cisco IT Deployment PnP Gateway Target Device Internal network Prime Infrastructure Step 0: Provision target device Create day0 (bootstrap) and day1 configurations Create Plug and Play profile that consists of day0, day1 and image

15 PI Based ZTD Overview Cisco IT Deployment PnP Gateway Target Device Internal network Prime Infrastructure Step 0: Provision target device Step 1: Install device Rack, stack and cable

16 PI Based ZTD Overview Cisco IT Deployment PnP Gateway Target Device Internal network Prime Infrastructure Step 0: Provision target device Step 1: Install device Step 2: Apply day0 (bootstrap) configuration to device Plug and Play application

17 PI Based ZTD Overview Cisco IT Deployment PnP Gateway Target Device Internal network Prime Infrastructure Step 0: Provision target device Step 1: Install device Step 3: Device requests configuration via cns Step 2: Apply day0 (bootstrap) configuration to device

18 PI Based ZTD Overview Cisco IT Deployment PnP Gateway Target Device Internal network Prime Infrastructure Step 0: Provision target device Step 1: Install device Step 2: Apply day0 (bootstrap) configuration to device Step 3: Device requests configuration via cns Step 4: Day1 configuration & image provided

19 PI Based ZTD Overview Cisco IT Deployment PnP Gateway Target Device Internal network Prime Infrastructure Step 0: Provision target device Step 1: Install device Step 2: Apply day0 (bootstrap) configuration to device Step 3: Device requests configuration via cns Step 4: Day1 configuration & image provided Step 5: Day2 configuration provisioned and applied to device

20 Device Provisioning: Plug and Play Profiles Defines features and configurations for new deployments. Easy to reuse Required for communication with PI Organizes provisioning components by Device type Deployment Scenario (topology)

21 High Level Overview Plug and Play Profile Day0 Day1 IOS Image AAA ACLs Global Templates

22 Device Provisioning User Input (Variables) Plug and Play Profile

23 Day0 template considerations Day0 template is one-size-fits-all Apache VTL for flexible scripting logic Users populate variables during pre-provisioning to generate the device specific Day0 configuration Configuration built for the Day0 template Hostname Management interface IP address/mask IP routing PnP GW certificate (if using CNS over HTTPS) CNS commands

24 Day0 (bootstrap) template

25 Bootstrap template variables

26 Day0 template form view

27 Day1 template

28 Plug and Play profile

29 Device provisioning profile

30 Device provisioning profiles

31 PnP App provisioning profile download

32 PnP App provisioning profile deployment

33 Verifying successful deployment

34 Day2 Finalizing the device configuration Device specific configurations: Interfaces QoS TrustSec ION (Internet Only Network Guest) CNS negation Deployed remotely to devices managed by PI Runs as configuration job in PI console Communicates over SSH with target device

35 Day2 - Finishing the ZTD deployments User Input (Variables) Day2 Composite Template

36 Cisco IT Deployment Strategy

37 Focus first on the Remote Office Why? Opportunity to reduce deployment resources and travel costs Devices such as desktop switches (4510) share similar configuration with Campus Target next generation of network devices and RO topologies Small Medium Large

38 Remote Office HW Target State Function Current Hardware Next Generation Hardware WAN GW >= OC3/155 Mbps - ASR 1K < OC3/155 Mbps - ISR G2 3945, 2951, 891 > GE - ASR 1K <= GE - ISR 4451-X LAN GW 6500/Sup720 > 40 ports /Sup2T <= 40 ports X LAN SW Modular Chassis /Sup7E Fixed/Stackable X Modular Chassis /Sup8E Fixed/Stackable WLC Appliance 5508 Integrated into LAN SW WAAS Appliance 8541,7571, 694 Virtualized on 4451-X & UCS APs LAB GW 3945, 2951 ISR 4451-X Console Server 2901 ISR 4451-X

39 Small Office (1 24 users) Equipment installed in noise damping portable rack Wiring closet not required ISR 4451-X WAN - 4 GE ports Voice - SRST, TDM voice module ISR-WAAS w/app-nav-xe Catalyst 3850 Up to 48 GE/PoE+ ports Built-in WLC 3700 Series APs Target of 15 users per AP WAN Wired LAN Wireless LAN LAB GW ac

40 Medium Office ( users) ASR1004 WAN > GE Cat 4510/Sup8 Up to 384 GE/UPoE Built-in WLC 3700 Series APs Target of 15 users per AP ISR 4451-X WAN Voice Catalyst 3850 Up to 48 GE /PoE+ Built-in WLC WAN Wired LAN Wireless LAN ac ac WAAS Console Srv LAB GW Voice GW

41 Large Office (300+ users) ASR1004 WAN > GE Catalyst 6500/2T Up to 2TB capacity VSS Catalyst 4510/8E Up to 384 GE/UPoE Built-in WLC 3700 Series APs Target of 15 users per AP ISR 4451-X WAN Voice Catalyst 4500-X 800G switching capacity VSS Catalyst 3850 Up to 48 GE/PoE+ Built-in WLC WAN Core Wired LAN Wireless LAN 3700 Series APs ac ac WAAS Console Srv LAB GW Voice GW

42 IT Extensions: Configuration Lifecycle Management

43 Configuration Lifecycle Management Cisco IT Prime Infrastructure extensions CLM is a centralized configuration solution Content control Revision control (interfacing PI with SVN) Change tracking and approval (interfacing PI with Cisco Process Orchestrator) Optimization of configuration creation Reusable blocks of sub-configurations (templates) Object-oriented configuration structure (recursive composite templates) CLM generates standard PI templates that can be used by devices (manual push, ZTD, )

44 Configuration Lifecycle Management New Device New Service Configuration Update Development Config Prime Infrastructure API s Production Golden Config Cisco Process Orchestrator Approval System Subversion Version Control

45 Opportunity to simplify documentation A cookbook is a Word document created per Place In the Network (PIN), detailing how to deploy new or existing networks Generic PIN Configuration (cutsheets) is embedded in the cookbook A cutsheet comprise over half of the 2,000 page Remote Office cookbook Cutsheets require most frequent updates Compared to rest of cookbook Cutsheets are labor intensive, require review/updates to multiple sections

46 Lessons Learned

47 Lessons learned Simplify the network Many standards are difficult to automate! Plan hierarchical template structure Repeatable content for composite templates Simplify and minimize variables Work with users to: Create intuitive labels Organize variables for easier data input Focus on manipulating data in programmatic manner CIDR for subnet mask conversion Poll DB variables for Day2 template

48 Demo

49 Complete Your Online Session Evaluation Give us your feedback to be entered into a Daily Survey Drawing. A daily winner will receive a $750 Amazon gift card. Complete your session surveys though the Cisco Live mobile app or your computer on Cisco Live Connect. Don t forget: Cisco Live sessions will be available for viewing on-demand after the event at CiscoLive.com/Online

50 Continue Your Education Demos in the Cisco campus Walk-in Self-Paced Labs Table Topics Meet the Engineer 1:1 meetings Related sessions

51

52 Thank you

53

54 Internet of Things (IoT) Cisco Education Offerings Course Description Cisco Certification NEW! CCNA Industrial An associate level instructor led training course designed to prepare you for the CCNA Industrial certification CCNA Industrial Managing Industrial Networks with Cisco Networking Technologies (IMINS) Control Systems Fundamentals for Industrial Networking (ICINS) Networking Fundamentals for Industrial Control Systems (INICS) This curriculum addresses foundational skills needed to manage and administer networked industrial control systems. It provides plant administrators, control system engineers and traditional network engineers with an understanding of the networking technologies needed in today's connected plants and enterprises For IT and Network Engineers, covers basic concepts in Industrial Control systems including an introduction to automation industry verticals, automation environment and an overview of industrial control networks For Industrial Engineers and Control System Technicians, covers basic IP and networking concepts, and introductory overview of Automation industry Protocols. Cisco Industrial Networking Specialist For more details, please visit: Questions? Visit the Booth or contact

55 Network Programmability Cisco Education Offerings Course Description Cisco Certification Integrating Business Applications with Network Programmability (NIPBA); Integrating Business Applications with Network Programmability for Cisco ACI (NPIBAACI) Developing with Cisco Network Programmability (NPDEV); Developing with Cisco Network Programmability for Cisco ACI (NPDEVACI) Designing with Cisco Network Programmability (NPDES); Designing with Cisco Network Programmability for Cisco ACI (NPDESACI) Implementing Cisco Network Programmability (NPENG); Implementing Cisco Network Programmability for Cisco ACI (NPENGACI) Learn networking concepts, and how to deploy and troubleshoot programmable network architectures with these self-paced courses. Learn how to build applications for network environments and effectively bridge the gap between IT professionals and software developers. Learn how to expand your skill set from traditional IT infrastructure to application integration through programmability. Learn how to implement and troubleshoot open IT infrastructure technologies. Cisco Business Application Engineer Specialist Certification Cisco Network Programmability Developer Specialist Certification Cisco Network Programmability Design Specialist Certification Cisco Network Programmability Engineer Specialist Certification For more details, please visit: Questions? Visit the Booth or contact

56 Cloud Cisco Education Offerings Course Description Cisco Certification Designing the FlexPod Solution (FPDESIGN); Implementing and Administering the FlexPod Solution (FPIMPADM) UCS Director (UCSDF) Learn how to design, implement and administer FlexPod solutions Learn how to manage physical and virtual infrastructure using orchestration and automation functions of UCS Director. FlexPod Design Specialist; FlexPod Implementation & Administration Specialist Cisco Prime Service Catalog Learn how to deliver data center, workplace, and application services in an on-demand, automated, and repeatable method. Cisco Intercloud Fabric Learn how to implement end-to-end hybrid clouds with Intercloud Fabric for Business and Intercloud Fabric for Providers. Cisco Intelligent Automation for Cloud Learn how to implement and manage cloud deployments with Cisco Intelligent Automation for Cloud For more details, please visit: Questions? Visit the Booth or contact