Cisco Switch Tech Update

Transcription

1 Cisco Switch Tech Update Catalyst April 2017 Rene Andersen Cisco SE DK

2 Cisco Catalyst portefolio overview TRADITIONAL ACCESS CONVERGED ACCESS Catalyst 2960-L Catalyst 2960-X/XR Catalyst 3650 Catalyst 3850 Catalyst 4500E Sup 8 Catalyst 6800/6500 Double everything Greenest Switch Ever Wired/Wireless Convergence For Entry Level Stackable Switch Wired/Wireless Convergence for High End Stackable Switch Wired/Wireless Convergence for Chassis Based Switch New Catalyst platforms for campus Industry Leading Campus Backbone Platform

3 Catalyst G: 48 Port UADP ASIC 640GB Line-Rate 48 x SFP+ Fixed 4 x QSFP Fixed Front-to-Back and Back-to-Front Fan options New 750W AC Power Supplies 1+1 Power Supply Redundancy UADP ASIC Converged Access Line-Rate Virtual stacking 1+1 Power Redundancy Front-to-Back & Back-to-Front Fans and Power Supplies *No StackWise or StackPower on 48p SKU

4 Cisco Stackwise Virtual Phase 1 - Aggregation SW-1 VSL SW-2 o o Distributed stacking is supported in

5 Catalyst G SFP+ 12 Port and 24 Port WS-C XS C3850-NM- 4x10G WS-C XS C3850-NM- 4x10G C3850-NM- 2x40G C3850- NM- 8x10G UADP ASIC Converged Access` StackWise-480 StackPower 1+1 Power Redundancy Line-Rate

6 Some Important Features Released in MPLS Application Visibility and Control Programmability COAP POE Innovations Enterprise Media Networks - AVB WCM Sub package upgrade MACSEC 256 ERSPAN

7 Scale / Features Catalyst Fixed Backbone Portfolio FY17 1G SFP 10G SFP+ Catalyst 6880-X Catalyst G Fiber Fixed 1G Aggregation Stackable 12p and 24p SKU 10G Network Module Catalyst G Fiber Fixed 10 G Aggregation 12p, 24p and 48p SKUs Stackable(12p/24p) 10G/40G Network Module Catalyst 4500-X Fixed 10G Aggregation 16p and 32p Base Units 8 port 10G network Module Front-to-Back and Back-to-Front Fans and Power Supplies Catalyst 6840-X Best-in-Class Core Feature-set Up to 40 1G/10G Ports 40G Uplinks Full MPLS Instant Access Best-in-Class Core Feature-set Up to 80 1G/10G Ports, 20 40G ports Full MPLS Instant Access 1G 1RU Aggregation 1/10G 1RU Aggregation 1/10G 1RU Aggregation 1/10G 2RU Core 1/10G 5RU Core

8 Secure Segmentation with TrustSec APIC-EM Campus Fabric Catalyst 6500 Campus Core Modular Transition One Management with Prime Infrastructure IT Simplicity with Auto Conf, Interface Template and EEM Full MPLS for campus 1 2 FY17-18 One Policy with Identity Services Engine Unique Rich Campus Services High Availability with VSS, SSO and Quad Sup SSO Hardware Investments 8P x 40G QSFP Module IOS 15.5(1)SY Network as a Sensor & Enforcer Catalyst 6800 Nexus 7700 Position for the following requirements: Optimized for 1G/10G and low density 40G Full Campus Fabric support Proven Catalyst 6K Class of feature set Single O/S requirement in the Campus Offers: C6807-XL-S6T-BUN / C G- BUN Caveats: No 100G support Position for the following requirements: High-density 10/40/100-Gbps connectivity Full Cisco SDA Capability Closest in features (MPLS), buffers, tables to C6K Offers: N7706-EN-B22S2E/ N7710-EN-B23S2E Caveats: NexOS in Campus

9 Catalyst 6800 Family The Next Generation Campus Backbone Portfolio is here! Architectural Solution Leverage aggressive services and bundle pricing to beat competition. Nonstop Innovation Strong hardware and software roadmap with a lot more to come

10 Catalyst 6K IOS SY Software Map Q4 CY2014 Shipping Q2/Q3 CY2015 Shipping Q2/Q3 CY16 Shipping Q1 CY17+ Shipping IOS 15.2(1)SY IOS 15.2(1)SY1 (Q2) IOS 15.3(1)SY IOS 15.4(1)SY1 C G Linecards (8x/16x/32x) C6800 1G linecards (48x) WS-C3560CX-12PD IA Scale: 2K ports, 42 FEX ID, 5- stack IA 2.0: AutoConf, IBNS 2.0: Service/ Interface Templates, Critical ACL/ MAB, Concurrent/ Differentiated Auth OSPFv3 GR/ NSSA/ Area Filter BGP GR/ Local AS Netflow for COPP Netflow full MPLS support IPv6 support for Trustsec LISP ASM mdns SDG 2.0 IPv6 FHS VRF Aware DHCP Relay (v4/v6) VRF Aware DNS MPLS LDP local label filtering WS-C3560CX-8XPD-S mgig Compact as IA Client IA Scale: 1500 ports (Sup2T) Easy FEX/ Auto FEX NEAT for IA (Compact Switches) Switch / Priority Renumber for IA Custom Port QoS for IA OSPF Fast Re-Route (FRR/LFA) ISIS Fast Re-Route (FRR/LFA) HSRP BFD IOS 15.2(2)SY (Q3) C6840-X Switches IA Scale:1500 ports for C6840-X APIC-EM Support Multicast Flow based MoFRR Sup 6T Reverse Breakout Cable 4x10G 40G QSFP (Sup6T) IOS 15.3(1)SY1 Sup6T on 6500-E series chassis Sup 6T + IA ports,160 FEX IDs IOS 15.4(1)SY Campus Fabric with 6807 w/sup6t 4x10G -> 40G QSFP (Sup2T) FIPS Certification Cisco SSL Security features (Korea Homologation) CSDL ASLR CSDL PSB Campus Fabric on 6840/6880 LISP/VXLAN

11 Visibility News

12 NaaS on 2960 X/XR C1 for Full Netflow/NAAS Full Ingress NetFlow on 2960X/XR Shipping Feb17 Switch supports 8k flows / ASIC On Prem / Virtual appliance Flow records StealthWatch console Flow collector User traffic flows NetFlow collection done in hardware with Minimum impact to CPU NetFlow version 9 and version 5 export User traffic flows 2960X / 2960XR Full NetFlow supported on stacked and standalone 2960X/XR

13 Base NaaS on Catalyst 2960-X/XR NEW!! StealthWatch Cisco Unique Solution for Network Security Reduce Threat Attack Surface with Network Sensing Improved Protection for Customers and Employees Implementing NaaS brings over 200% ROI 1 Full NetFlow DNS-AS 50+ Apps C1-based License Only (New) 25 FPS/Switch License Physical 2 or Virtual Appliance C1FPCAT29003/4K9 Cisco ONE Foundation Perpetual Catalyst /48 Port Cisco ONE Foundation 1.100/1.900$ Forrester Report for StealthWatch 1 2 Purchase Separately

14 Full NaaS on Catalyst 3650/3850 Stealthwatch NEW!! Cisco Unique Solution for Network Security Reduce Threat Attack Surface with Network Sensing Improved Protection for Customers and Employees Implementing NaaS brings over 200% ROI 1 Full NetFlow NBAR Apps ERSPAN ETTA 2 50 FPS/Switch License Physical 1 or Virtual Appliance Packetwatch 1 Forrester Report for StealthWatch 1 C1 Foundation License See Software Packaging 1 Purchase separately 2 Available 1HC17

15 Challenges L7 Yesterday s Applications Today s Applications L6 HTTP 80 L5 L4 AVC FTP POP3 20/ L3 Netflow IMAP 143 L2 HTTPS 443 L1 SMTP 25

16 Know, Monitor & Control Your Applications Granular Detection, Advanced Monitoring & Business Logic Based Policies Know Your Applications Monitor Your Applications Control Your Applications Granular App Detection Encrypted Application Fault Isolation, Troubleshooting Performance Assessment Prioritized Applications Bandwidth Management 2016 Cisco and/or its affiliates. All rights reserved

17 Why do you need AVC at Access?

18 Application Recognition Techniques DNS-AS Pre Defined Apps Metadata on DNS Server Lightweight & authoritative Identify most Applications Detects ENCRYPTED apps Custom Apps IOS XE 3.9.0E (Cat4K) and IOS E1 (Cat2K) NBAR2 (Performance Optimized) 1500 Apps Initial packets copied to CPU Good for most app except evasive app like bittorrent Available in IOS XE 16.3 (3650/3850) NBAR2 DPI 1500 Apps Fine Grain DPI Mostly on Routers,.

19 DNS-AS Operation 1) Client requests a DNS Lookup 2) Access Switch examines the DNS request 3) Internal DNS Server returns a DNS response (A-Record) 4) Access Switch requests application metadata information by generating its own DNS query 5) Internal DNS Server returns application metadata (A-Record + TXT Record) DNS Server 6) Access Switch maintains a Binding Table of application metadata DNS Lookup: DNS Lookup + TXT Record Request: mail.timco.com mail.timco.com TXT Record: DNS A-Record: mail.timco.com is mail.timco.com App ID = 378 App Class: BULK-DATA Business Relevance: YES Internal Network App Server IP Address PTR App-ID App-Class Business- Relevance mail.timco.com 378 Bulk Data YES 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 19

20 Network Based Application Recognition Advanced Classification Techniques Native IPv4/ IPv6 Classificatio n Advanced Field Extraction Can be used with MQC (Modular QoS CLI) to control the traffic patterns in the network Supported devices: Catalyst 3850/3650, ISR-G2 (86x, 88x, 89x, 19xx, 29xx, 39xx), 44xx, ASR1k, CSR1kV, WLC (2508, 8500, 7500, 55xx) PP Signatures NBAR Custom Signature Builder Protocol Pack allows adding more applications without upgrading or reloading IOS Use heuristic algorithms to recognize encrypted traffic And Recognizes ~1500 Apps ~140 Encrypted Apps

21 Enabling and Monitoring AVC CLI - License : IP Base switch# show ip nbar protocol-discovery top-n CLI switch# show run int g1/0/23 Building configuration... interface GigabitEthernet1/0/23 switchport access vlan 193 ip nbar protocol-discovery end GigabitEthernet1/0/23 Input Output Protocol Packet Count Packet Count Byte Count Byte Count 5min Bit Rate (bps) 5min Bit Rate (bps) 5min Max Bit Rate (bps) 5min Max Bit Rate youtube bing Cisco and/or its affiliates. All rights reserved

22 Enabling AVC Services WebUI interface

23 AVC Monitoring WebUI - Easy and Simple Visibility

24 Campus Application Map CAT 2K Shipping! Polaris 16.2 NBAR2 Dynamic PPs NBAR2 Custom Apps AVC Polaris 16.3.x AVC with FNF Ph1 Programmability Stackwise virtual 48XS Shipping! Polaris 16.5/16.6 Python On-box Stackwise Virtual 12/24XS DNS-AS Shipping! Nova Programmability Campus Fabric MKA MACSec Shipping! CAT3650/385 0 Release 15.2(5b)E DNS-AS Full NetFlow Shipping! CAT 4K

25 Cisco Catalyst 2960-L Series Switches

26 More Use Cases Powering Small Networks with Quietness and Simplicity Often used in: Bank branches Hotel buildings School buildings Retail stores Office buildings Common ask: Low-priced GE model Simple management Low energy consumption Low-budget PoE X and web authentication Small form factor Out-of-wiring-closet design Basic Layer 2, QoS, and IPv6 Enterprise-grade quality and support

27 Business Continuity Addressing Business Transformation New Unified Access Cisco Catalyst Switching Solution New Entry-Level Cisco Catalyst C2960-L Lan Lite Resilient L2 and Converged L3 Services Converged L2 Services C2960-XR IP Lite C2960-X LAN Base Green Intelligent Services Comprehensive Security Ease of Operations and Simplicity Mission-Critical Performance Scale and Resilience Business Agility

28 Introducing Cisco Catalyst 2960-L Series Entry-Level Cisco Catalyst GE Switches Enterprise-class CLI, web GUI, mobile app (FCS+1) Cisco IOS Software Cisco Catalyst brand ELLW Fanless operation High MTBF Cisco lifecycle management Bluetoothready EEE downlinks IOS LAN Lite image Type-A USB for storage and Bluetooth dongle 800 MHz CPU Persistent PoE (FCS+1) 4 Egress queues per port Up to 370W PoE+ 2 MB per ASIC Operational temperature -5 to 55 C Shallow depth Up to 11.5 Cisco EnergyWise management 2 x 1G or 4 x 1G Versatile Form Factor Noiseless Cisco TAC Support Energy Efficiency Simplified Management

29 Catalyst 2K Product Positioning Catalyst 2960P (10 SKUs) Catalyst 2960L (8 SKUs) Catalyst 2960X/XR (23 SKUs) Catalyst FE LAN Base/LAN Lite No Stacking No PoE+ 1G Uplinks only Migrate FE (2960P, 2960C) Entry-level Catalyst GE IOS: 2960Plus + More No Stacking PoE+ 1G Uplinks only Better Global Share Fighter IOS; 2960L More LAN-Base & IP-Lite NaaS: Netflow & DNS- AS Openflow v1.3 80Gbps Stacking PoE+ 2*10G Uplinks

30 Comparing Cisco Catalyst 2960 Families 2960-P 2960-L 2960-X/XR 1G Downlinks 10G Uplinks Full PoE PoE+ Stacking Virtual Stacking (Clustering) Advanced L2/L3 * Entry-Level DNA Noiseless Operation Power Redundancy * Netflow Lite, IPv6 first-hop security, etc.

31 Cisco Catalyst 2960-L Portfolio Product ID GE Downlinks SFP Uplinks PoE Power Depth (cm) Fanless WS-C2960L-8TS-LL ,5 Yes WS-C2960L-8PS-LL W 24 Yes WS-C2960L-16TS-LL ,5 Yes WS-C2960L-16PS-LL W 24 Yes WS-C2960L-24TS-LL Yes WS-C2960L-24PS-LL W 26,5 Yes WS-C2960L-48TS-LL Yes WS-C2960L-48PS-LL W 29,2 No

32 Simple Management: Web UI

33 Building IoT

34 Cisco Digital Building Blueprint - A Converged Ecosystem Building Applications (Light & temperature control, video surveillance) Digital Network Architecture (Switching, Routing, Security) Security Automation Insights Building Endpoints (Sensors, IoT Devices, Luminaires, VAV, Badging, HVAC) Automation Policy based Configuration, onboarding & management with APIC-EM Security Device Profiling, authentication and segmentation of IoT devices with NaaS Analytics A platform for Real-Time Analytics across enterprise and IoT networks Introducing Network Innovation for Digital Buildings

35 Introducing the Catalyst Digital Building Series Switch Extends DNA to the building edge and creates the foundation for next generation Smart Buildings Compact, Rugged Design Power Efficient (~4W standby) Ceiling and Rack Mountable Cisco UPOE and PoE+ options Low Voltage Compliance High Temperature Rating (50 deg C) Simple Easy Installation & management Secure Automated policy & segmentation Savings Energy efficiency & control Optimized and purpose-built for Low Voltage Building Deployments

36 Enhanced PoE Capabilities on the Digital Building Switches Enable Scale An Expanding Ecosystem of PoE Devices Perpetual UPOE Ethernet Cable Digital Building Applications Digital Building Switch Wall Switch Commercial LED PoE Fixtures Dense Sensor Network (Light, Motion, CO2/CO, etc.) IP Video Surveillance Camera Building Mgmt (Connected HVAC) Full UPOE Perpetual UPOE Fast UPOE 2-Event Classification Increased PoE Budget: 480W of UPOE (8 x 60W) Fanless, silent reliable operation with increased MTBF and system life (10 yrs) Provides non-stop UPOE power Switch can continue to provide power during configuration and reboot Restores power to powered device within 5 secs of power resumption Simplified power negotiation without LLDP Physical layer negotiation < 1s based on class/type

37 CDB Switches Enable Efficient Cabling and Cost Effective Installation Single Cable (Terminating at Wiring Closet) Smart Installs Fire, Safety IP Camera LED Lights Variable Air Valve Badge Reader / Access Sensors Flexible Mounting (Ceiling, rack, cabinet) Physical Stacking (multiple stacked mounts) Flexible Powering (IEC, Direct Wired) Flexible Orientation (Upright, face-down, side) Simplify Installations with Cable Consolidation

38 Cisco Day 0 Mobile App Makes Installation hassle-free Install LV Power Switch Run Cables Install Luminaire No Uplinks Smart Installs Create Project Connect to LV power source Update image (optional) Apply profile (optional) Validate devices Mobile App Plenum Space LV Power Source Take snapshot Generate/send project report PoE Luminaire

39 Cisco Configuration Professional for Cisco Catalyst (Cisco CPC) Switch Management Simplified Smart Installs Set Up and Configure 4-step wizard for day 0 Monitoring System health and port status dashboard Troubleshooting and Maintenance Alerts and notification Switch, VLAN, and port config Client and endpoint visibility on wired and wireless LAN Cisco IOS Software image upgrade Localized for English, Japanese, Chinese, and Korean

40 APIC-EM 1.X Update

41 N-PnP Cloud Redirection Service Device SR# Device SR# Supply-Chain Customer DB Smart Account DB PnP Cloud Redirection Service CISCO Customer Order CUSTOMER Cisco Commerce Workspace Where s my PnP Server? APIC-EM IP APIC-EM Registers IP Address w/ Cloud PnP Protocol Customer Or Partner PnP-Agent PnP-Agent Download Image & Config APIC EM Server

42 CCW Ordering of PnP Device (NETWORK-PNP-LIC) NETWORK-PNP-LIC (option item) requires a Smart Account Smart Account requirement message provided to customer Note that there is also a minimum IOS requirement NETWORK-PNP-LIC is structured to the BOM as a zero dollar Option Item

43 CCW Ordering of PnP Device (Smart Account Assignment) Smart Account can be assigned at the order or line level Customer can also request a Smart Account directly from order

44 Cisco Plug and Play Connect (PnP Connect) General Availability We are pleased to announce the general availability of Cisco Plug and Play Connect (PnP Connect) Release 1.0. Cisco PnP Connect, a cloud based service, is a component of the Cisco Network Plug and Play solution and provides automated discovery of an on-premise APIC-EM controller. Additionally, PnP Connect enables configuration provisioning of devices directly through the cloud, without APIC-EM (beta feature

45

46

47

48

49 What s New in 1.4 APIC-EM EasyQOS App App EasyQoS EasyQoS EasyQoS EasyQoS EasyQoS EasyQoS Dynamic QoS Dynamic QoS Features Custom BW Allocation per Traffic Class Policy Scheduler Sub-Interface (WAN) support Classification based on latest NBAR2 PP(#27) Support for 2960CX/C UX Improvements Support for App Name in Flow API Performance Improvement

50 Custom BW Allocation per BW Class Custom BW Profile

51 Custom BW Allocation per BW Class Ability to select BW profile per policy scope

52 EasyQOS Policy Scheduler Ability to schedule policy provisioning

53 EasyQOS UX Improvements Improved UX for per Wireless SSID policy scope

54 What s New in 1.4 APIC-EM Inventory/Discovery/Topology Shipped: 02/21 App Topology Topology Discovery & Inventory Discovery & Inventory Discovery & Inventory Discovery & Inventory Discovery & Inventory Discovery & Inventory Features Disaggregation and Layout Improvements Toggle button to turn off host visibility Generic TTY Read only API (Command Runner Utility) Resync Inventory on demand Edit Credentials per device Per Device polling timer Auto Configuration of IPDT Incremental Back off Polling Interval for 3850 and similar switches

55 Topology Visualizer Ability to toggle Hosts Host Toggle Switch

56 Topology Visualizer Ability to toggle Hosts

57 Device Inventory Ability to Resync Inventory on demand Ability to re-sync inventory on a per device level

58 Device Inventory Per Device Polling Timer Ability to modify per-device Polling Timer

59 Device Inventory Auto Configuration of IP Device Tracking Auto-Configure IP Device Tracking on discovered switches

60 APIC-EM Command Runner App

61 APIC-EM 1.x Platform Command Runner App

62 APIC-EM 1.x Platform Command Runner App

63 APIC-EM 1.x Platform Command Runner App

64 APIC-EM 1.x Platform Command Runner App

65 APIC-EM 1.x Platform Command Runner App

66 APIC-EM Integrity and Verification App

67 APIC-EM 1.x Platform Integrity and Verification

68 APIC-EM 1.x Platform Integrity and Verification

69 APIC-EM 1.x Platform Integrity and Verification

70 APIC-EM CAA Life Cycle Management

71 APIC-EM 1.x Platform CAA- Life Cycle Management Personalized Advisor Info on: End-of-life & End-of-support dates Security Advisories (PSIRTs) based on PID and OS

72 APIC-EM 1.x Platform CAA- Life Cycle Management

73 APIC-EM 1.x Platform CAA- Life Cycle Management Hardware EoL HW End of Sale/End of Support Information

74 APIC-EM 1.x Platform CAA- Life Cycle Management - PSIRTs Security Vulnerability Information

75 APIC-EM Bonjour App

76 APIC-EM 1.x Platform SD-Bonjour Problem: Bonjour Protocol has initially been designed for limited number of Consumer Devices in a single Layer 2 Domain how to provide Enterprise Scale across multiple L3 Boundaries? Solution: Leverage Software-Defined Bonjour Service-Discovery Gateway-Controller App on APIC-EM Bonjour provides Service Discovery in single Layer 2 Domain Service Discovery Gateways (SDG) provide granular control and service across L2 Domains APIC-EM SDG Controller provides central control for Enterprise wide SDG-Agents (v1.3.3 max 200 SDG Agents, Service Instances)

77