Več kot SDN - SDA arhitektura v uporabniških omrežjih

Transcription

1 Več kot SDN - SDA arhitektura v uporabniških omrežjih Aleksander Kocelj SE Cisco

2 Agenda - Introduction to Software Defined Access - Brief description on SDA - Cisco SDA Assurance - DEMO 2

3 New Requirements for the Digital Age Insights & Actions Automation & Assurance Security & Compliance Innovate FASTER REDUCE Cost & Complexity LOWER Risk Cisco Digital 11. April Network 2018 Cisco Connect Architecture Bled, Slovenija (DNA) BRKCRS-2810 Source: 2016 Cisco Study

4 Cisco s Intent-based Networking Learning DNA Center The Network. Intuitive. Policy Automation Analytics Powered by Intent. Informed by Context. Intent Context Network Infrastructure Switching Routers Wireless Security 4

5 Software Defined Access Networking at the speed of Software! Policy DNA Center Automation Analytics Identity-Based Policy & Segmentation Decoupled security policy from VLAN and IP Address B B C Outside Automated Network Fabric Single Fabric for Wired & Wireless with workflow Automation SDA Extension IoT Network User Mobility Policy stays with user Employee Network Insights & Telemetry Analytics and Insights into User and Application behavior

6 What is SD-Access? Campus Fabric + DNA Center (Automation & Assurance) ISE APIC-EM NCP 1.X DNA Center NDP PI SD-Access GUI approach provides automation & assurance of all Fabric configuration, management and group-based policy DNA Center integrates multiple systems, to orchestrate your LAN, Wireless LAN and WAN access B B Campus Fabric Campus Fabric C CLI or API approach to build a LISP + VXLAN + CTS Fabric overlay for your enterprise Campus networks CLI provides backwards compatibility but management is box-by-box. API provides device automation via NETCONF/YANG Separated management systems 6

7 SD-Access Fabric Roles & Terminology Identity Services Fabric Border Nodes Intermediate Nodes (Underlay) Fabric Edge Nodes ISE B NCP B Campus Fabric NDP C DNA Center Analytics Engine Fabric Wireless Controller Control-Plane Nodes DNA Center Enterprise SDN Controller provides GUI management and abstraction via Apps that share context Identity Services NAC & ID Systems (e.g. ISE) for dynamic Endpoint to Group mapping and Policy definition Analytics Engine Data Collectors (e.g. NDP) analyze Endpoint to App flows and monitor fabric status Control-Plane Nodes Map System that manages Endpoint to Device relationships Fabric Border Nodes A Fabric device (e.g. Core) that connects External L3 network(s) to the SDA Fabric Fabric Edge Nodes A Fabric device (e.g. Access or Distribution) that connects Wired Endpoints to the SDA Fabric Fabric Wireless Controller A Fabric device (WLC) that connects APs and Wireless Endpoints to the SDA Fabric 7

8 SD-Access Fabric Virtual Network A Closer Look Virtual Network maintains a separate Routing & Switching table for each instance Control-Plane uses Instance ID to maintain separate VRF topologies ( Default VRF is Instance ID 4098 ) Known Networks Unknown Networks Nodes add VNID to the Fabric encapsulation Endpoint ID prefixes (Host Pools) are routed and advertised within a Virtual Network VN A VN B VN C Uses standard vrf definition configuration, along with RD & RT for remote advertisement (Border Node) 8

9 SD-Access Fabric Scalable Groups A Closer Look Scalable Group is a logical policy object to group Users and/or Devices Nodes use Scalable Groups to ID and assign a unique Scalable Group Tag (SGT) to Endpoints Known Networks Unknown Networks Nodes add SGT to the Fabric encapsulation SGTs are used to manage address-independent Group-Based Policies SG 2 SG 1 SG 3 SG 5 SG 4 SG 6 SG 8 SG 7 SG 9 Edge or Border Nodes use SGT to enforce local Scalable Group ACLs (SGACLs) 9

10 SD-Access Fabric Anycast Gateway A Closer Look Anycast GW provides a single L3 Default Gateway for IP capable endpoints Similar principle and behavior as HSRP / VRRP with a shared Virtual IP and MAC address Known Networks Unknown Networks The same Switch Virtual Interface (SVI) is present on EVERY Edge, with the same Virtual IP and MAC Control-Plane with Fabric Dynamic EID mapping creates a Host (Endpoint) to Edge relationship When a Host moves from Edge 1 to Edge 2, it does not need to change it s Default Gateway GW GW GW 10

11 Group Assignment Two ways to assign SGT Dynamic Classification Static Classification L3 Interface (SVI) to SGT L2 Port to SGT Campus Access Distribution Core DC Core DC Access MAB Enterprise Backbone WLC Firewall Hypervisor SW VLAN to SGT Subnet to SGT VM (Port Profile) to SGT 11

12 See and Act on Threats (Now For Encrypted Traffic) Automated policy enforcement for segmentation through SD-Access Catalyst 9K Switch NetFlow with enhanced telemetry at line rate ISE (Identity Services Engine) Stealthwatch Machine learning Spot malware in encrypted traffic Encrypted Traffic Analytics 99 % Analyze metadata Threat without Detection decrypting traffic flows Accuracy* Global-to-local knowledge correlation 0.01 % Automate policy and segmentation across False Positives* the entire network Cognitive Analytics *Source : Identifying Encrypted Malware Traffic with Contextual Flow Data, Oct 2016

13 SD-Access DNA Center Appliance DNA Center Platform DN1-HW-APL DNAC 1.1 Scale: Per Node 5,000 Nodes (1K Devices + 4K APs) 25,000 Clients (Concurrent Hosts) Fully Integrated Automation & Assurance Centralized Deployment - Cloud Tethered Built-In Telemetry Collectors (FNF, SNMP, Syslog, etc) Built-In Contextual Connectors (ISE/PxGrid, IPAM, etc) Multi-Node High Availability (3 Node, Automation) RBAC, Backup & Restore, Scheduler, APIs 1RU Server (Small form factor) UCS 220 M4: 64-bit x86 vcpu: 44 core (2.2GHz) RAM: 256GB DDR4 Control Disks: 2 x 480GB SSD RAID1 System Disks: 6 x 1.9TB SSD M-RAID Network: 2 x 10GE SFP+ Power: 2 x 770W AC PSU Single Appliance for 11. April DNAC 2018 Cisco Connect (Automation Bled, Slovenija + Assurance)

14 SD-Access DNA Center Service Components SNS 9500 Series ISE Appliance API Cisco DNA Center 1.1 API DN1-HW-APL DNA Center Appliance Design Policy Provision Assurance API Cisco ISE 2.3 Identity Services Engine API NCP 1.1 Network Control Platform API NDP 1.1 Network Data Platform NETCONF SNMP SSH AAA RADIUS EAPoL Campus Fabric HTTPS NetFlow Syslogs Cisco Switches Cisco Routers Cisco Wireless 14

15 SD-Access Campus Fabric + DNA Center (Automation & Assurance) Campus Fabric SD Access SmartCLI Macros Simple User Inputs Customized Workflows Box-by-Box Management Programmable APIs NETCONF / YANG Automated Workflows Box-by-Box Management DNA Center GUI Cross-App REST APIs Automated Workflows Centralized Management 15

16 DNA Assurance is part of DNA Center DNA Center consists of automation and assurance Automation Analytics Design Provision Policy Assurance Planning, installation and migration Proactive and predictive network, client and application assurance 16

17 Today s tools are limited and do not address network needs Too Many Tools Reactive Systems Limited Insights Fragmented visibility Closed interfaces / Silo d views Devices queried multiple times Different protocols/mechanisms Always playing catch up Not designed for analytics Inconsistent API architecture Specialized knowledge required Limited data that is not actionable My report vs your report No view of state changes Lacking context or feedback loop Rigid Closed/Proprietary Lack of Intelligence 17

18 Why SD-Access Assurance? Need to Troubleshoot user red connectivity to a DHCP server 18

19 What types of Collection mechanism are used? Telemetry Data Type: Users, User Group Data Source: AD, Cisco ISE Mechanism: Pull (API) Data Type: Policy Data Source: Cisco ISE Mechanism: Subscription through PxGrid Data Type: IP Address Management, Namespaces Data Source: Infoblox, DHCP, DNS Mechanism: Pull (API) Data Type: Topology, Inventory, Configuration, Capabilities Data Source: Automation Contextual Telemetry Sources Data Type: Flow, Applications Data Source: Network Device Mechanism: Push Data Type: SNMP Data Source: Network Device Mechanism: Pull Data Type: Wireless Signaling, Roaming data Data Source: WLC/AP Mechanism: Streaming Data Type: Syslogs, Traps Data Source: Network Device Mechanism: Push Network Telemetry Sources A singular framework for ingestion 19

20 Power of Analytics and Automation working in sync DNA Center Automation Telemetry, alerts, violations Network inventory, topology, and configuration Assurance and Analytics Network and telemetry configuration Streaming telemetry & network data 20

21 DEMO 21

22 Benefits of Cisco SD-Access Shift IT Time to Business Focus 67 % 80 % Improve Issue Network Provisioning Time Savings Reduced Security Breach Impact Resolution 48 % 61 % Reduced Operating Expense

23