Cisco DNA Service for Bonjour

Transcription

1

2 BRKCRS-2120 Cisco DNA Service for Bonjour Rahul Kachalia Sr. Technical Leader

3 Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after the session 1. Find this session in the Cisco Live Mobile App 2. Click Join the Discussion 3. Install Spark or go directly to the space 4. Enter messages/questions in the space cs.co/ciscolivebot#brkcrs Cisco and/or its affiliates. All rights reserved. Cisco Public

4 Agenda Requirements and Challenges Cisco DNA Service for Bonjour Solution Cisco DNA Center Wide Area Bonjour App Network Design and Implementation Local Area Bonjour Domain Wide Area Bonjour Domain Conclusion

5 Enterprise-Class Zero-Conf Solution Cross-Verticals common IT Requirements HealthCare Airport Education Enterprise Hospitality Retail IT Requirements Network Service Secure Policy Location Wired & Wireless Service without boundaries High scale solution No performance compromise IT controlled service Policy-Based service distribution BYOD Service Management Role and Network Policy Based Location Proximity Service Wired and Wireless Mobility 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

6 Bonjour Services Use Cases Various Use Case for IT and Users Smart FAN File Sharing Smar t HVA C Smart Light Policy-Based ZeroConf Services management for Enterprise networks. Common Bonjour Services distribution from end-user devices. IT Managed Bonjour end points and new IoT devices providing end-to-end ZeroConf solution Content Music Sharing Screen Sharing Print Sharing Enterprise Print Digital Signage Mobile Printing P2P File Share BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 6

7 Challenges Performance Scale Technology Solution Boundary Scale Residential-class Technology Fragmented Gateway Solutions Single Device solution Limited scale and performance Single network segment discovery Integration in Enterprise networks Local System Bonjour Solution Not end-to-end solution Unable to scale beyond single system Limited network discovery boundary Centralized architecture impact performance Sub-optimal mobility with scale Traditional solution deficits Enterprise Networks requirements

8 Cisco DNA Service for Bonjour Solution Controller Local Area SDG Wide Area SDG Local Area SDG IP Cisco WLC Agent Agent Agent Local Area SDG Multi-Domain Local Area SDG Agent Wide Area SDG Controller Seamless Integration Two-tier Bonjour Domains Policy-Based end-to-end Services NB APIs for multi-domain SDG * SDG Agent and Endpoint communication Zero-touch Discovery and Distribution Distributed Service and cache management SDG Controller and Agent communication Secured and reliable service management Centralized service distribution across IP network Transparent User Experience Flexible for any network design Seamless WLAN integration * = Roadmap

9 Requirements and Challenges Cisco DNA Service for Bonjour Solution Agenda Cisco DNA Service for Bonjour Solution Cisco DNA - Wide Area Bonjour App Technical Design and Implementation Local Area Bonjour Domain Wide Area Bonjour Domain

10 DNA Center Wide Area Bonjour App BETA 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

11 Wide Area Bonjour App Dashboard Overview 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

12 Wide Area Bonjour App Dashboard Overview Dashlet Key Performance Indicator Network-wide State and Scale Global Domain Policy Statistics Wide Area Bonjour Query Stats Real-time Service Analysis Historical Statistics Report Top Talkers Top 5 Networks and Services Consolidated Services Information Simplified Chart views 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

13 Root Domain Structure ABC-Corp ABC-Corp.com Single Root Domain per DNA Center. User defined Root Domain name, i.e. ABC-Corp.com Wide Area Bonjour Domain and Bonjour Service domain.local are independent. Domain names do not need to match or changes any value in actual Bonjour Service announcements BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 13

14 Root Domain Structure Bldg-1 FL-1 Bldg-1 FL-2 FL-4 FL-3 ABC-Corp.com FL-1 FL-2 Bldg-2 FL-1 FL-2 Wide Area Bonjour Sub-Domain is an logical entity containing Bonjour Service Filters or next-level Sub-Domain for more hierarchy. The Service Filters or Policies can be created at any level of Sub-Domain. The Sub-Domain can re-presented as a Site, Building in a Site, Floors, User WorkGroup etc. BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 14

15 Multi-Tier Sub-Domain Example Bldg-1 LAN - EAST FL-4 Bldg-1 FL-1 LAN - WEST FL-3 FL-2 FL-1 FL1-WIFI-to-LAN Additional hierarchy can be added if needed, i.e. divide Floor based on location or names to build constrained policy-based service discovery. Depending on network design the service discovery can be restricted view on each sub-domains and policies defined. For example, the Bonjour Service Distribution plan per Sub-Domain can be based on network design : o LAN : o Wired Source to Wired Receiver in same LAN zone (EAST or WEST) o Wired Source to Wireless Receiver on across Floor-1 o WLAN : o Wireless Source to Wired Receiver on Floor-1 (both LAN zones) BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 15

16 Sub-Domain Navigation Navigation Flexible selection option to navigate domains Select Root domain for global structure view Select individual sub-domain for granular view Three expanded views information to browse 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

17 360 0 View SDG Agents SDG Agent SDG Agent listing Per-Subdomain Total Service Instance count per SDG Agent Quick verification of connection state Sort based on connection state Three expanded views information to browse 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

18 360 0 View Service Filters Service Filters Service Filter listing Per-Subdomain Create Edit Delete existing Service Filters Total Service Instance count per Filter Quick view of Service Type and State 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

19 Building Service Policy for Source and Query Agent Steps Policy Configuration 1 Enter Policy Name 2 3 Select Service-Type Click Add to select Source and Query SDG Agent 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

20 Building Service Policy for Source and Query Agent 3 Steps Source SDG Agent Configuration 1 Select Source Select Source SDG Agent from list Select required interfaces where source endpoints connected Click Done Repeat to add more Source 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

21 Building Service Policy for Source and Query Agent 3 Steps Query SDG Agent Configuration 1 Select Query Select Query SDG Agent from list Select required interfaces where query endpoints connected Click Done Repeat to add more Query 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

22 Building Service Policy for Source and Query Agent Wide Area Bonjour provides flexible and scalable service policy architecture for global service distribution Each Service policy considers Bonjour Service-Type as root-point. Enables policy-based Bonjour Service discovery from Source Agent (Source) and distribution to other Query SDG-Agent (Receiver) across the network. The Source Agent cannot be Query Agent and vice-a-versa in same Service Policy. Create separate policy for such requirement Cisco and/or its affiliates. All rights reserved. Cisco Public

23 SDG Agent Management Monitor SDG Agent Detailed view for each SDG Agent SDG Agent to Sub-Domain mapping Statistics, Roles and Device Reachability Bonjour services resynchronization 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

24 Wide Area Bonjour Service Monitoring Monitor SDG Agent Detailed view for each Service Instances Source location and advertising Agent details Complete Source endpoint details Global service distribution state 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

25 Wide Area Bonjour Service Monitoring Monitor Troubleshoot Summary troubleshooting log support Controller and Agent bi-directional messages Timestamps, Log message and details 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

26 Wide Area Bonjour App Administration Administration Global MD5 security for Bonjour Control Session Centralized Keepalive Timer management Inactive Service Instant Purge Timer Settings 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

27 Wide Area Bonjour Service-Type Database Administration Service Pre-defined Services ready-to-use Custom Services support for new types Regex format, add. at end of each Pointers, i.e. _airplay._tcp.local Cisco and/or its affiliates. All rights reserved. Cisco Public

28 Requirements and Challenges Cisco DNA Service for Bonjour Solution Agenda Cisco DNA Service for Bonjour Solution Cisco DNA - Wide Area Bonjour App Technical Design and Implementation Local Area Bonjour Domain Wide Area Bonjour Domain

29 Local Area Bonjour Domain Overview LAN WLAN SDG SDG Cisco WLC mdns mdns RFC 6762 Multicast DNS compliant service gateway system Multicast DNS flood-n-learn boundary point Retain end-to-end Zeroconf end-user experience Services Gateway at Layer 3 network boundary Single Gateway system IP and Services Endpoint services gateway to discover and distribute services beyond single VLAN BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 29

30 Local Area Bonjour Domain Key Function LAN WLAN SDG SDG Cisco WLC mdns mdns Policy Cache Timer Proxy First-Hop policy-enforcement point for LAN and WLAN networks. Policy-Based Bonjour services discovery and distribution Granular and bi-directional policy control. Local Bonjour cache database. Each SDG Agent switch stores local Bonjour cache database. Distributed and scalable architecture for large scale environments. Distributed service time management providing better scale. Bonjour source end point maintenance to keep network updated. Scalable architecture to maintain and auto-refresh service entries. Policy-Based Bonjour service distribution. Asymmetric proxy model support based on deployment scenarios Granular service classification support. BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 30

31 Local Area SDG Role-Based Policy Per User-Group Inter User-Group Shared Services HR HR HR IT Engg R&D Engg R&D Engg R&D Unique Policy Per-User group. Each Group may contain different services rule. Bi-Directional Service Policy with variables. Common or Unique Policy Per-User group. Asymmetric Policy between User-groups Bi-Directional or Uni-directional service discovery and distribution for each services. Hybrid Bonjour Policy configuration support Bi-Directional or Asymmetric Policy between User-groups Shared services to user-defined groups. BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 31

32 Local Area SDG Policy Enforcement Single Broadcast Domain No Policy Enforcement Segmented Broadcast Domain SDG Policy Enforcement Cisco DNA Center Cisco DNA Center Cisco Identity Service Engine SDG SDG VLAN-A VLAN-B VLAN-A VLAN-B VLAN-A VLAN-A Multicast DNS frames can be considered as another form of Broadcast. All hosts in a common Broadcast Domain receives and process transmitted frame. The SDG policy remains in effective in a single flat Layer 2 network domain. As best practices smaller broadcast domains are recommended for several technical, operational and security reason. The Local Area SDG Policy is effective and enforced between two separate VLANs (Wired or Wireless). The network can be segmented based on static or dynamic assignment thru AAA based on User Group, Device, Location policies. BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 32

33 Local Area Bonjour Domain Configuration Policy Step 1 Create Step 2 Classify Step 3 Apply John Foo Interface Location Service Name Type Bonjour Rules with Service-List Common or Unique per User-Groups High scale support per SDG switch Granular and Flexible classification mechanics Five unique Bonjour Classification rules One or more classification per rule Apply on L3 Interfaces SVI connecting endpoints Bi-directional policy enforcements See Notes for details BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 33

34 Local Area SDG Policy Ingress Configuration Examples LAN and WLAN SDG Ingress Policy SDG SDG SDG Source-Only Receiver-Only Source + Receiver INGRESS POLICY SOURCE-ONLY service-list mdns SOURCE-ONLY permit 1 match message-type announcement service-type _airplay._tcp.local! service-list mdns SOURCE-ONLY permit 2 match message-type announcement service-type _raop._tcp.local! service-list mdns SOURCE-ONLY permit 3 match message-type announcement service-type _ipp._tcp.local! interface Vlan A description Bonjour Source Network service-routing mdns-sd service-policy SOURCE-ONLY IN INGRESS POLICY RECEIVER-ONLY service-list mdns RECEIVER-ONLY permit 1 match message-type query service-type _airplay._tcp.local! service-list mdns RECEIVER-ONLY permit 2 match message-type query service-type _raop._tcp.local! service-list mdns RECEIVER-ONLY permit 3 match message-type query service-type _ipp._tcp.local! interface Vlan B description Bonjour Receiver Network service-routing mdns-sd service-policy RECEIVER-ONLY IN INGRESS POLICY SOURCE + RECEIVER-ONLY service-list mdns SRC+RCV permit 1 match message-type any service-type _airplay._tcp.local! service-list mdns SRC+RCV permit 2 match message-type any service-type _raop._tcp.local! service-list mdns SRC+RCV permit 3 match message-type any service-type _ipp._tcp.local! interface Vlan C description Bonjour Src + Rcv Network service-routing mdns-sd service-policy SRC+RCV IN Use-Case : IT Managed Bonjour Network Connected Bonjour endpoints can only announce services No Receivers in this network Use-Case : End-Users network segment Connected Bonjour endpoints can only receive services from Shared network Not permitted to announce from personal endpoints Use-Case : Hybrid Bonjour services network segment Connected Bonjour endpoints can announce and receive services in the network Local discovery and distribution within same network BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 34

35 Local Area SDG Policy Egress Configuration Examples LAN and WLAN SDG Egress Policy SDG SDG SDG Source-Only Source-Only Receiver-Only Source-Only Source + Receiver EGRESS POLICY SOURCE-ONLY! Disable Local Proxy function.! No Egress Service-Policy required for network with Source-Only Bonjour End points Use-Case : No Egress filter required if no Receivers Disables Local Proxy function on specific network Helps improving performance EGRESS POLICY RECEIVER-ONLY service-list mdns RECEIVER-ONLY permit 1 match message-type announcement service-type _airplay._tcp.local! service-list mdns RECEIVER-ONLY permit 2 match message-type announcement service-type _raop._tcp.local! service-list mdns RECEIVER-ONLY permit 3 match message-type announcement service-type _ipp._tcp.local! interface Vlan B description Bonjour Receiver Network service-routing mdns-sd service-policy RECEIVER-ONLY OUT Use-Case : Enables local-proxy function from local cache SDG provides Bonjour response between local area networks EGRESS POLICY SOURCE + RECEIVER-ONLY service-list mdns SRC+RCV permit 1 match message-type any service-type _airplay._tcp.local! service-list mdns SRC+RCV permit 2 match message-type any service-type _raop._tcp.local! service-list mdns SRC+RCV permit 3 match message-type any service-type _ipp._tcp.local! interface Vlan C description Bonjour Src + Rcv Network service-routing mdns-sd service-policy SRC+RCV OUT Use-Case : Hybrid Bonjour services network segment SDG provides Bonjour response between local area networks Local discovery and distribution within same network BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 35

36 Cisco WLC Multicast Local Area SDG Cisco WLC IP X Wireless AP Multicast Bonjour Gateway Agent Multicast Controller Cisco AP By default Cisco Wireless LAN Controller do not permit Layer 2 or Layer 3 Multicast frames from WLAN to LAN networks. Wireless AP Multicast required. No multicast required in LAN or WLAN Client networks required. Verify all AP have successfully joined WLC Multicast group to pass-thru mdns frames between SDG and Wireless Bonjour endpoints. The Cisco WLC Bonjour Gateway must remain disabled at Global/WLAN level BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 36

37 Cisco WLC Multicast Cisco WLC L2 L3 IP L3 Local Flex WLC IP Gateway Agent Multicast AP IP Gateway Agent Cisco AP ip multicast-routing ip multicast-routing!! interface Vlan <id>! description WLC Mgmt VLAN ip pim sparse-mode interface Vlan <id>! description AP Mgmt VLAN ip pim sparse-mode L2 L3!!! Allow Multicast Group in ACL if implemented! Allow Multicast Group in ACL if implemented BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 37

38 Cisco WLC Link Local Bridging Cisco WLC AP-Group-1 AP-Group-2 Cisco WLC Link Local Bridging feature solves Bonjour challenges for user soft-roaming between AP Groups. Administrator must globally enable Link Local Bridging capability to support this feature. The Cisco WLC link local bridging optimizes handling of Bonjour data communication in the network L2 Soft-Roam Associated AP : AP-1 Interface : AP-GRP-1 IP Address : /24 X Associated AP : AP-11 Interface : AP-GRP-2 IP Address : /24 BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 38

39 Cisco FlexConnect Bonjour Solution IP Cisco WLC SDG Dist Access FlexConnect AP FlexConnect AP SDG LAN and WLAN Client IP Gateway interface Vlan <id>! description FlexConnect Client VLAN service-routing mdns-sd service-policy <name> < IN OUT >! interface Vlan <id>! description LAN Client VLAN service-routing mdns-sd service-policy <name> < IN OUT >! Cisco IOS SDG supports Bonjour services for FlexConnect Wireless Clients. Cisco WLC must be configure AP Multicast. No other configuration on Cisco WLC or L2 Access switch required. Bonjour service policy enforcement at SDG switch becomes effective between LAN and WLAN interfaces BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 39

40 Local Area Bonjour Cache Database Cache SDG SDG#show mdns cache mdns CACHE ================================================================================================================================================================================================ [<NAME>] [<TYPE>] [<CLASS>] [<TTL>/Remaining] [Accessed] [If-name] [Mac Address] [<RR Record Data>] MAC-Pro._device-info._tcp.local TXT IN 4500/ Vl f20a.3e9a (16)'model=MacPro1,1' MAC-Pro.local AAAA IN 120/112 7 Vl f20a.3e9a 2001:10:101:146:217:F2FF:FE0A:3E9A MAC-Pro.local A IN 120/112 7 Vl f20a.3e9a _cups._sub._ipp._tcp.local PTR IN 4500/ Vl f20a.3e9a MAC-Pro._ipp._tcp.local _ipp._tcp.local PTR IN 4500/ Vl f20a.3e9a MAC-Pro._ipp._tcp.local MAC-Pro._ipp._tcp.local TXT IN 4500/ Vl f20a.3e9a (479)'txtvers=1''qtotal=1''rp=printers/iCeps_rtp9r-01-f1402-c''ty=HP Co MAC-Pro._ipp._tcp.local SRV IN 120/51 3 Vl f20a.3e9a MAC-Pro Cisco IOS SDG switch discovers Bonjour Service-Announcements from source end points and caches in its local database. The software database runs on system memory. The mdns cache provides structured and detail view for services discovered from local Layer 2 LAN or WLAN networks. The cache database can be in multiple break down formats including message-type, mac-address, Service-Instance name etc. BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 40

41 Local Area Bonjour Cache Management Service Entry Count Control Service Processing Rate Control SDG(config)#service-routing mdns-sd SDG(config-mdns)#cache-memory-max [ ] Cache SDG(config)#service-routing mdns-sd SDG(config-mdns)#rate-limit in [ ] SDG#show mdns-sd statistics all inc cache mdns cache memory in use : 72984(bytes) mdns cache can grow upto : (bytes) SDG SDG#show mdns-sd statistics all inc rate Average Input rate (pps) : 0, 0, 0 Average Output rate (pps) : 1, 1, 1 mdns packets rate limited : 0 Cisco IOS SDG Agent caches the Bonjour entries in memory. Memory allocation limited 10 to 100%. Default 10%. Recommend Default setting. Max 5KB per Service Entry can meet most network environment. Cisco IOS SDG Agent process Bonjour messages in software. System-Wide rate-limiter function for all Bonjour message types Two-tier Control-Plane Policer: o Software : Default. 60 PPS, range o Hardware : Non-Default. Enable if performance impacted in large scale environment. BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 41

42 Local Area Bonjour Active Query Management DB Timer Active Query Active Query Service Policy SDG Query Response Source service-list mdns-sd ACTIVE-QUERY query service-type _airplay._tcp.local service-type _raop._tcp.local! interface Vlan <id> service-routing mdns-sd service-policy-query ACTIVE-QUERY [ sec ]! During initialization Bonjour Source endpoints announce service and Time-to-Live (TTL) for each records. The SDG switch maintains entries until TTL value and removed once expired impacting user-experience. With Active Query Service Policy, the SDG switch act as Bonjour Receiver. Periodically queries based on services defined in policy. Active-Query value range between seconds. Recommended at 90 sec to refresh cache before short-lived record expires BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 42

43 IOS Monitoring Local SDG Cache ALL Bonjour Entries show mdns cache mdns CACHE ================================================================================================================================= [<NAME>] [<TYPE>][<CLASS>] [<TTL>/Remaining] [Accessed] [If-name] [Mac Address] [<RR Record Data>] _airplay._tcp.local PTR IN 4500/ Vl18 6c94.f8f1.21b5 RTP-ATV-2._airplay._tcp.local _raop._tcp.local PTR IN 4500/ Vl18 6c94.f8f1.21b5 6C94F8F121B5@RTP-ATV-2._raop._tcp.local _appletv-v2._tcp.local PTR IN 4500/ Vl18 6c94.f8f1.21b5 770B8D1A01694D59._appletv-v2._tcp.local RTP-ATV-2._device-info._tcp.local TXT IN 4500/ Vl18 6c94.f8f1.21b5 (13)'model=J33iAP' RTP-ATV-2._airplay._tcp.local SRV IN 120/55 1 Vl18 6c94.f8f1.21b5 RTP-ATV-2.local 6C94F8F121B5@RTP-ATV-2._raop._tcp.local SRV IN 120/55 1 Vl18 6c94.f8f1.21b5 RTP-ATV-2.local 770B8D1A01694D59._appletv-v2._tcp.local SRV IN 120/55 1 Vl18 6c94.f8f1.21b5 RTP-ATV-2.local RTP-ATV-2.local A IN 120/55 1 Vl18 6c94.f8f1.21b RTP-ATV-2.local AAAA IN 120/55 1 Vl18 6c94.f8f1.21b5 2001:10:101:18:145C:D3B5:8521:7F80 Name : Displays Bonjour service announced based on User defined name, i.e. Conf-Room-ATV.local Type : Displays all Bonjour services based on Record type, i.e. A (IPv4 Address), AAAA (IPv6 Address), PTR, SRV and TXT if-name : Displays all Bonjour cache entries learned from local VLAN interface, i.e. Data VLAN 201 Mac Address : Displays all Bonjour services announced by specific end point based on its known MAC address Grouped Bonjour Entries show mdns cache interface vlan <id> show mdns cache mac <H.H.H> show mdns cache name <Record Name> show mdns cache type < A AAAA PTR SRV > Clear Bonjour Entries clear mdns cache clear mdns cache interface vlan <id> clear mdns cache mac <H.H.H> BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 43

44 LAN SDG Network Design Alternatives Multilayer Network Design Alternatives Routed Access Network Design Alternatives Design 1 SDG Design 2 Design 1 SDG Design 2 SDG SDG Distribution Distribution L3-Access L3-Access Access Access Local Area SDG Access Access Local Area SDG Local Area SDG Ext-Access Ext-Access Local Area SDG Multiple network design alternatives to implement Bonjour gateway for Enterprise Campus and Branch LAN networks. IP Gateway = Bonjour Gateway in most deployment scenarios. Seamless integration possible in Multilayer network design with dedicated SDG Switch : o Distribution Switch Continue to be IPv4 / IPv6 gateway system for end points behind Layer 2 Access switches. The Distribution system can be Standalone, VSS or StackWise Virtual mode. No SDG function here. o SDG Switch Dedicated SDG switch with L2 trunk to Distribution switch for all VLANs required for Bonjour gateway function. Pairs with SDG Controller App for Wide Area SDG. BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 44

45 WLAN SDG Network Design Alternatives CUWN Network Design Alternatives FlexConnect Network Design Alternatives Design 1 Design 2 Design 1 Design 2 SDG SDG SDG WLC SDG WLC Distribution Distribution Distribution Distribution WLC WLC Local Area SDG WLC WLC Local Area SDG AP AP Local Area SDG AP AP Local Area SDG SDG Gateway placement remains consistent for LAN or WLAN networks. The SDG Gateway for Wireless clients in centralized CUWN or distributed FlexConnect deployment model remains same as their IP Gateway. At the Distribution layer the dedicated SDG Switch can be inserted without impacting existing operation and service in the LAN or WLAN network. The SDG Agent in both Wireless deployment models communicates with Controller App for Wide Area SDG. BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 45

46 Requirements and Challenges Cisco DNA Service for Bonjour Solution Agenda Cisco DNA Service for Bonjour Solution Cisco DNA - Wide Area Bonjour App Technical Design and Implementation Local Area Bonjour Domain Wide Area Bonjour Domain

47 Cisco DNA Service for Bonjour Solution Controller Local Area SDG Local Area SDG SDG SDG Cisco WLC IP LAN Agent Agent WLAN Local Area Bonjour Wide Area Bonjour X X X No service-routing solution between gateways Limited services single LAN or WLAN network. Centralized services processing and management Hierarchical Service-routing architecture End-to-End policy-based services routing Distributed services processing and management BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 47

48 Cisco DNA Service for Bonjour Solution Services Rich End-to-End Network Infrastructure Network Controller Local Area SDG IP Wide Area SDG Local Area SDG HR R&D Agent Agent Engg R&D Agent HR Local Area SDG Services without Boundary LAN-to-LAN Service Integration Transparent WLAN Solution Media-independent Services Enables network-wide services No stringent latency dependent Services across LAN/WLAN/WAN Bonjour services discovery beyond single LAN Hierarchical communication structure Seamless integration on any LAN designs WLC provides pass-thru Bonjour function Seamless WLAN designs Local or Flex Mode Scalable architecture for large scale networks No network media or TTL restrictions Any-to-Any services discovery solution Retain end-to-end Zeroconf experience 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

49 Cisco DNA Service for Bonjour Solution Distributed and Scalable Architecture for Enterprise-Class Networks Scale Controller DHCP Server DNS Server IP mdns Agent Agent mdns Agent mdns Local Area Service Database Wide Area Service Database Dynamic & Distributed Restricted Flood-Boundary Scalable Architecture Optimal Network Performance Automatic service learning Policy-based distribution No MAC, DHCP, DNS configuration Keeps mdns boundary at Layer 2 No tunnels or L2 extensions to change Core Light-weight communication in Wide Area domain Each SDG Agent support high-scale Improved processing and response time Eliminate single-point of failure Ship-in-night solution Retains original network performance Low bandwidth requirement 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

50 Cisco DNA Service for Bonjour Solution End-to-End Policy-Based Services Discovery and Distribution Policy Controller Service Agent Network Policy Apple TV Agent-1 Net-1 Google ChromeCast Agent-1 Net-2 AirPrint Agent-2 Net IP Policy : Apple TV, Google ChromeCast Agent-1 Agent-2 Policy : AirPrint Role Network Local-Area Policy Wide-Area Policy HR Net-1 Engg Net-2 R&D Net-3 X X Role Network Local-Area Policy Wide-Area Policy HR Net-11 Engg Net-12 R&D Net-13 X X Structured Policy Mgmt Local Area Bonjour Policy Wide Area Export Policy Global Distribution Policy Three-tier Bonjour policy mgmt Core and Mandatory function Flexible and scalable policy support Role-Based policy association to VLAN/Subnet Bi-directional Policy at SDG Agent Per-Interface or system global policy support Single export policy to central Controller Uni-directional policy support to Controller Flexibility to export all, limited or none services Secure peering and communication Policy-based discovery & distribution Flexible policy for scale environment 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

51 Cisco DNA Service for Bonjour Solution Location-Based Services Discovery and Distribution Location Controller Granular Wired vs Wireless Service Policies Agent Controlled Role and Location Policy IP Per-Location Unique Service Discovery Per-Floor Common Discovery Policy Agent Agent Per-Building Services Boundary Multi-Domain Local Area SDG Agent Wide Area SDG Controller Seamless Integration Two-tier Bonjour Domains Policy-Based end-to-end Services NB APIs for multi-domain SDG * SDG Agent and Endpoint communication Zero-touch Discovery and Distribution Distributed Service and cache management SDG Controller and Agent communication Secured and reliable service management Centralized service distribution across IP network Transparent User Experience Flexible for any network design Seamless WLAN integration 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

52 Cisco Bonjour Control Protocol Wide Area Bonjour Service-Routing Signaling Protocol Local Area SDG Wide Area SDG Bonjour Control Protocol Multicast DNS Layer 2 Frame IP LAN WLAN Agent TCP/IP Unicast LAN WAN Controller Cisco Bonjour Control Protocol Packet Structure L2 DIP SIP TCP BCP Payload Unicast Controller Agent Controller Agent 9991 Message Variable Information Cisco Bonjour Control Protocol (BCP) is stateful, reliable and light-weight control protocol between SDG Controller and Agent Catalyst switches Cisco BCP protocol is 66 byte header and operates on TCP for reliable connection on LAN and WAN network environments The Cisco BCP Protocol supports advanced messages to synchronize the Bonjour cache, BCP Connection up to date end-to-end BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 52

53 BCP Reliable Source Connection Local Area SDG Wide Area SDG mdns Loopback IP Wide Area Bonjour App LAN WLAN Agent LAN WAN Controller SDG(config)# interface Loopback 0 SDG(config-if)# ip address ! SDG(config)#service-export mdns-sd controller DNAC-BONJOUR-CONTROLLER SDG(config-mdns-sd-se)# controller-address SDG(config-mdns-sd-se)# controller-source-interface Loopback0 SDG(config-mdns-sd-se)# controller-port 9991 The BCP connection can be formed over any Layer 3 interface. Cisco recommends to use reliable interface, i.e. Loopback. The TCP port number 9991 is used for BCP protocol. Alternate can be used, but must match between Controller and Agent. BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 53

54 Cisco Bonjour Control Protocol AutoConf Wide Area SDG REQUEST RESPONSE IP Agent LAN WAN Controller Wide Area Bonjour App First message negotiation after TCP socket successfully established with Controller App SDG Agent sends Bonjour AutoConf REQUEST message to SDG Controller SDG Controller may respond with the following back to SDG Agent : o o o KEEPALIVE Mandatory parameter automatically programs SDG Agent with Keepalive timer to apply on each SDG Agent. Range sec HOLD TIMER Mandatory and automatic parameter based on Keepalive timer. Keepalive Time x 4 = Hold Timer. This parameter is not tunable. MD5 PASSPHRASE Optional. If MD5 was configured in Wide Area Bonjour App then AutoConf RESPONSE notifies each SDG Agent to use the password. BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 54

55 Wide Area Bonjour Controller Verification Enhanced State and Statistics Monitoring Capabilities Wide Area SDG Bonjour Control Session IP Agent LAN WAN Controller Connection Name Controller IP and TCP ports Connection State SDG#show mdns controller detail Controller : DNAC-BONJOUR-CONTROLLER IP : , Dest Port : 9991, Src Port : 20676, State : UP Source Interface : Loopback 0, MD5 Enabled, Synchronized Hello Timer 15 sec, Dead Timer 60 sec, Next Hello 00:00:01 Uptime 00:00:28 (09:49:36 EST Jan ) <snip> AutoConf Status Session Timer Management Session Uptime Details BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 55

56 Policy-Based BCP Session Management Controller Policy 1 Source Agent : Network : Any Receiver Agent : Network : Any Implicit Deny Local Area SDG LAN Agent Loopback IP Wide Area SDG Loopback Agent Local Area SDG WLAN Loopback Agent Local Area SDG Cisco Wide Area Bonjour solution follows Client/Server application model. SDG Agent function as Client. SDG Controller as Server. The Wide Area Bonjour App Policy have Implicit Deny, i.e. Firewall. The BCP Connection, Service Cache and Service Query is filtered from un-defined SDG Agents and Networks. BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 56

57 Wide Area Bonjour Multi-Tier Policy Controller Local Area SDG 3 Local Area SDG 2 IP Agent Agent Wide Area SDG 1 Local Area SDG Agent Policy Enforced on SDG Agent in Layer 2 Network Domain. Bi-Directional. 2 Wide Area SDG Agent Policy Enforced on SDG Agent for export control to Controller. Uni-Directional Egress. 3 Wide Area Controller Policy Enforced on Controller for global discovery and distribution. Bi-Directional. BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 57

58 Wide Area Bonjour Export Policy Management Controller Local Area SDG Local Area SDG Announce Agent ADVERTISE IP ADVERTISE Agent Announce Wide Area SDG SDG(config)# service-list mdns-sd DNAC-BONJOUR-EXPORT-POLICY permit 1 SDG(config-mdns-sd-sl)#! <Empty = Any>! SDG(config)#service-export mdns-sd controller DNAC-BONJOUR-CONTROLLER SDG(config-mdns-sd-se)# controller-service-policy DNAC-BONJOUR-EXPORT-POLICY OUT Mandatory configuration. Define local Bonjour service export rule to be discovered in Wide Area Bonjour domain. Define remote Bonjour service lookup rule to be browse and use from Wide Area Bonjour domain for local endpoints. SDG#show mdns controller detail Controller : DNAC-BONJOUR-CONTROLLER IP : , Dest Port : 9991, Src Port : 20676, State : UP <snip> Service Announcement : Filter : DNAC-BONJOUR-EXPORT-POLICY <snip> BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 58

59 Wide Area Bonjour Policy Architecture Controller Local Area SDG Wide Area SDG Local Area SDG Service-Type (Source) /24 LAN Agent Wide Area Policy Agent /24 WLAN Service-Type (Receiver) Source Tuple Receiver Tuple Service-Type SDG IP Address Network Address Service-Type SDG IP Address Network Address The security level on Controller to handle Bonjour Service Service learning and Query handling process is same as BCP connection. The Service Filter policy is mandatory required and must match full Tuple. Unique Tuple must match to process Bonjour Service Announcement and Service Query message to discover and distribute services globally. BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 59

60 Wide Area Bonjour Service Name De-Duplication Without Suffix Instance Controller With Suffix Instance John s imac SDG-Agent-1 John s imac-fl1-lan SDG-Agent-1 John s imac SDG-Agent-2 John s imac-fl1-wlan SDG-Agent-2 IP Agent-1 Agent-2 Agent-1(config)# interface Vlan <id> Agent-1(config-if)#service-routing mdns-sd Agent-1(config-if-mdns-sd)# service-inst-suffix FL1- LAN John s imac Agent-2(config)# interface Vlan <id> Agent-2(config-if)#service-routing mdns-sd Agent-2(config-if-mdns-sd)# service-inst-suffix FL1-WLAN Dual-Homed Bonjour Source endpoints advertises services over all available Interfaces. Central Controller receives common Instance information from redundant SDG Agents resulting duplicate name in Wide Area Bonjour domain Service Instance Suffix appends user-defined string to advertised name. Controller receives and distributes unique name in Wide Area Bonjour domain BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 60

61 HSRP Aware Wide Area Bonjour Domain Controller Agent-1 : Active Agent-2 : Standby John s imac SDG-Agent-1 IP-1 MAC-1 Mary s imac SDG-Agent-1 IP-2 MAC-2 IP Agent-1 : Standby Agent-2 : Active John s imac SDG-Agent-2 IP-1 MAC-1 Mary s imac SDG-Agent-2 IP-2 MAC-2 Agent-1 Agent-2 Standby Active Bonjour Cache Standby Active Bonjour Cache Wide Area Bonjour is tightly integrated with HSRP at LAN or WLAN Distribution block. Default configuration. HSRP-Active switch operates as active Bonjour gateway in Local and Wide Area Bonjour domain. HSRP-Standby switch operates as standby Bonjour gateway in Local Area Bonjour domain. It builds BCP connection with Controller, but do not process any mdns messages on Standby Interfaces until transitions to Active state. HSRP state-transition between two Agents switches remains transparent to central Controller BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 61

62 Wide Area Bonjour Service Flow Process Controller Local Area SDG RESPONSE Local Area SDG ANNOUNCE Source Data Agent ADVERTISE IP REQUEST Data Agent QUERY RESPONSE Receiver LAN Wide Area SDG LAN WAN WLAN Bonjour Control session communication between SDG Agent and Controller takes unicast routing path and policy. Bonjour Unicast data communication between Source and Receiver endpoints remains transparent from Controller. The Bonjour data communication between Source and Receivers follows network forwarding and access-control policies of each SDG Agent. BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 62

63 Wide Area Bonjour Controller Configuration 3-Steps Simple Configuration Process 1 Globally enable Service Discovery Gateway feature service-routing mdns-sd Command-Line Description Globally enable SDG feature before enabling any configuration ingress-client query-suppression enable Enable Ingress Query Suppression for better scale and performance 2 Configure Service List Filter for APIC-EM Controller Command-Line service-list mdns-sd DNAC-CONTROLLER-SDG-POLICY permit 1 Description Configure empty Service-List with permit keyword. This equals to permit all. This policy-map assumes all local Bonjour cache should be browseable from remote networks. 3 Configure Service Export configuration to APIC-EM Controller Command-Line service-export mdns-sd controller DNAC-CLUSTER-1 controller-address <DNAC_VIRTUAL_IP> controller-port 9991 controller-service-policy DNAC-CONTROLLER-SDG-POLICY out controller-source-interface Loopback0 Description Configure DNAC Controller settings and export policy for local cache Apply DNAC Virtual IP to establish secure communication from SDG Agent Switch Bonjour Control Protocol operates over TCP Port Default on DNAC side. Apply Service list to DNAC controller configuration permitting to export all dynamically discovered cache Define the source interface to use for establishing Bonjour Control session from SDG Agent to the Controller BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 63

64 IOS Monitoring Wide Area SDG ALL Bonjour Entries show mdns controller details Controller : DNAC-BONJOUR-CONTROLLER IP : , Dest Port : 9991, Src Port : 19994, State : UP Source Interface : Vlan4093, MD5 Enabled, Synchronized Hello Timer 15 sec, Dead Timer 60 sec, Next Hello 00:00:08 Uptime 1d05h (13:58:00 EST Jan ) Service Announcement : Filter : DNAC-BONJOUR-EXPORT-POLICY Count 50, Delay Timer 30 sec, Pending 0, Pending(TTL0) 0 Total Export Count 797, Next Export in 00:00:03 Service Query : Query Suppression Enabled Query Count 50, Query Delay Timer 15 sec, Pending 0 Total Query Count 954, Next Query in 00:00:03 Wide Area Bonjour Controller CLIs show mdns controller export-summary show mdns controller statistics show mdns controller summary Clear Bonjour Entries clear mdns controller session clear mdns controller statistics BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 64

65 Wide Area Bonjour SNMP Management Network-wide SDG Agent monitoring from Central NMS Two Tier SNMP MIB data collections from NMS Local and Wide Area Bonjour Domains Local Area Bonjour SNMP information : o Bonjour Cache statistics o Global or Per-Interface level mdns Traffic Statistics o IPv4 vs IPv6 Statistics o More Wide Area Bonjour SNMP information : o Controller Session Status o Export Policy and Session Timer Information o Wide Area Bonjour Count and Traffic Statistics o More CISCO-SDG-MDNS-MIBS OID : BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 65

66 Cisco Bonjour Solution Support Matrix DNA-C 1.2 Wide Area Bonjour App Catalyst Catalyst (1)SY Catalyst E Catalyst Cisco ISR AireOS 8.X Apple ios Any Apple macos Any Apple tvos Any Google Android Any Any mdns compliant BETA Mar 18 FCS Jul 18 BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 66

67 Key Takeaway Complete end-to-end Bonjour solution for Enterprise-class networks Seamless integration without forklift changes. Transparent operation to end points It is designed to provide uncompromised scale and performance solution Intuitive App to centrally manage Wide Area Bonjour domain and services Flexible and granular Bonjour policy enforcement at the network edge 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

68 Reference cisco.com/go/bonjour BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 68

69 Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after the session 1. Find this session in the Cisco Live Mobile App 2. Click Join the Discussion 3. Install Spark or go directly to the space 4. Enter messages/questions in the space cs.co/ciscolivebot#brkcrs-2120

70 Please complete your Online Session Evaluations after each session Complete 4 Session Evaluations & the Overall Conference Evaluation (available from Thursday) to receive your Cisco Live T-shirt All surveys can be completed via the Cisco Live Mobile App or the Communication Stations Complete Your Online Session Evaluation Don t forget: Cisco Live sessions will be available for viewing on-demand after the event at Cisco and/or its affiliates. All rights reserved. Cisco Public

71 Continue Your Education Demos in the Cisco campus Walk-in Self-Paced Labs Tech Circle Meet the Engineer 1:1 meetings Related sessions BRKCRS Cisco and/or its affiliates. All rights reserved. Cisco Public 71

72 Thank you

73