DNA-C Assurance. Ib Hansen: Maj 2018

Transcription

1 DNA-C Assurance Ib Hansen: Maj 2018

2 Agenda Hvorfor Assurance Nyt i Assurance 1.2 AP4800 Sensor Intelligent Packet Capture

3 Hvorfor Assurance?

4 Why SD-Access Assurance? Need to Troubleshoot user red connectivity to a DHCP server 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 4

5 CLI is the most common troubleshooting tool. It s just a very bad troubleshooting tool Ø show ip dhcp snooping binding Ø show ip vrf interfaces inc 1021 Ø show sh lisp vrf Campus i IID Ø show lisp instance-id 4099 ipv4 map-cache Ø show ip cef vrf Campus internal Ø traceroute Ø ping Ø show cdp nei g1/0/ Cisco and/or its affiliates. All rights reserved. Cisco Public 5

6 Ø ping Success rate is 0 percent (0/5) Ø show ip route Ø show cdp nei g1/0/23 Ø show run int g1/0/ Cisco and/or its affiliates. All rights reserved. Cisco Public 6

7 interface GigabitEthernet1/0/23 description border_cp g1/0/15 no switchport ip address ip router isis ip access-group test out Extended IP access list test 10 deny ip host host Cisco and/or its affiliates. All rights reserved. Cisco Public 7

8 Today s Tools Too Limited and Do Not Address Network Needs Too Many Tools Reactive Systems Limited Insights Fragmented visibility Closed interfaces / Silo d views Devices queried multiple times Different protocols/mechanisms Always playing catch up Not designed for analytics Inconsistent API architecture Specialized knowledge required Limited data that is not actionable My report vs your report No view of state changes Lacking context or feedback loop Rigid Closed/Proprietary Lack of Intelligence 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

9 Why SD-Access Assurance? Quick Isolation of Network Issues SD-Access Assurance Reason # Cisco and/or its affiliates. All rights reserved. Cisco Public

10 Why SD-Access Assurance? Root Cause issue in a Few Clicks SD-Access Assurance Reason # Cisco and/or its affiliates. All rights reserved. Cisco Public

11 Why SD-Access Assurance? Network Troubleshooting Tool Pathtrace 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

12 Why SD-Access Assurance? End-to-End Visibility SD-Access Assurance Reason # Cisco and/or its affiliates. All rights reserved. Cisco Public

13 SD-Access Fabric Assurance Use Cases Network Infrastructure Applications Clients Services Control Plane Data Plane Policy Plane Client Onboarding Device Broad Edge to Control Plane Border to Control Plane CP performance Routing protocols Deep Border and Edge connectivity Border node health Edge node health Device to Services (DHCP, DNS, AAA) ISE connectivity Border node policy Edge node policy Client / Device DHCP Client Authentication Client Authorization CPU, Memory TCAM Tables Modules Temperature Power (POE) 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

14 SD-Access DNA Center Provision Fabric Proactive Monitoring 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

15 Fabric Assurance Monitor Fabric Connectivity C IPSLA tests are run in the network fabric to verify connectivity between Control Plane, Fabric Border, and Fabric Edge nodes. B B IPSLA analyzes basic IP service levels for common IP services, to reduce downtime and lower operational costs Includes path trace capability as part of troubleshooting steps E E E IPSLA traffic Automated via DNAC ip sla 1 icmp-echo source-ip threshold 3 ip sla schedule 1 life forever start-time now 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

16 Fabric Device 360 Click on the Fabric tab to see how Fabric metrics are going 1. Select Both options 2. Reachability tests are being performed in the Fabric underlay. This is the test results Cisco and/or its affiliates. All rights reserved. Cisco Public

17 Fabric Assurance Monitor Fabric Connectivity IPSLA tests are run in the network fabric to verify connectivity between Fabric Border and external services B B Monitor external services from fabric in the underlay and overlay network (IPAM, AAA, DHCP,DNS) Includes path trace capability as part of troubleshooting steps E E E IPSLA traffic Example ip sla 3 icmp-echo source-ip vrf Campus threshold 3 ip sla schedule 3 life forever start-time now 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

18 Fabric Assurance Monitor Fabric State Proactive Fabric nodes query Control Plane to resolve host locations, if they don t have an entry in their local database After receiving a map-reply, each fabric node stores those entries in its cache database Fabric Assurance tracks the number of requests and state of active cache entries to provide proactive trending analysis C B B E E E Example FE1# show ip lisp map-cache instance-id 4098 LISP IPv4 Mapping Cache for EID-table vrf Campus (IID 4098), 5 entries /32, uptime: 00:05:16, expires: 23:57:59, via map-reply, complete Locator Uptime State Pri/Wgt :04:23 up 10/ / Cisco and/or its affiliates. All rights reserved. Cisco Public

19 Health Scores Site Health Score Client Health Score function ( Client Health Score, Device Health Score ) function ( Onboarding Score, Connectivity Score ) Device Health Score Application Health Score function ( System Health Score, Control Plane Score, Data Plane Score ) function ( Traffic Class, Latency, Packet Loss) 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

20 Wired Client Health Monitor Fabric Connectivity Summary: Is the client connected and is the link connection good? Connected Throughput issues Link Error Wired Client Health Key Services DNS reachable Onboarding Port Up/down Yes/No Authenticated, IP Yes/No 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

21 Fabric Assurance How Do We Calculate Fabric Network Health Scores? C Collect relevant Key Performance Indicators (KPIs) to determine Device Health For example: Resources (CPU, DRAM, etc), Link state and errors, Protocol state and errors, Reachability to Control Plane, etc B B Fabric Device Health has 3 Categories: E E E Control Plane Data Plane System Health Fabric Device Score is the Lowest of all Scores Example 3850-SJC System Health Data Plane Control Plane Cisco and/or its affiliates. All rights reserved. Cisco Public

22 Fabric Assurance How Do We Calculate Fabric Network Health Scores? C Fabric Health score is picked from min of each Category Score B B Category Score is number of healthy devices in that category to the total number of devices Fabric Health has 4 Categories: Fabric Edge E E E Fabric Border Fabric Control Plane Fabric Wireless Fabric Domain Score is the Lowest of all four Category Scores Example Fabric Network Health 6 Fabric Wireless Fabric Edge Fabric Border Fabric Control Plane Cisco and/or its affiliates. All rights reserved. Cisco Public

23 DNA Center Assurance From Network Data to Business Insights Network Telemetry Contextual Data Complex Event Processing Correlated Insights Guided Remediation AAA Telnet OID Syslog SNMP Traceroute Router IPSLA IPAM CMX Netflow Wireless DNS MIB AppD DHCP CLI Ping Complex correlation Steam Processing Metadata extraction Clients Application Baseline Network Everything as a Sensor 150+ Actionable Insights Client Applications Wireless Switching Routing 23

24 Key Use Cases Client Onboarding Sensor based Proactive SLA Monitoring Streamlined Troubleshooting Ensure Better App Experience ü Analyze 240+ Onboarding Events from WLC with Event Viewer ü Automate 15+ Onboarding and Application Tests ü Real-time deep dive with Path Trace and Intelligent Capture ü Monitor Business Critical Apps through qualitative insights ü Roaming Analysis with Client Location and RSSI Heatmap ü 1800s HW Sensor ü AP as a Sensor ü Radio as a Sensor ü Guided Remediation for 150+ correlated Insights ü Get visibility into NBAR2 Apps and Custom Apps ü Onboarding Analytics across the Enterprise ü Sensor Dashboard for Performance Summary ü Contextual Analysis of past problem with Time Travel ü Troubleshoot App experience issues with per App 360 views and performance metrics

25 Use Case 1: Client On-boarding is taking a long time Time to Resolution DNA Center Traditional User Reports Problem Check Credentials Replicate Issue Radio Channel Analysis Time to resolve Issue in minutes Success Metrics Proactively find slow onboarding before users report. Reduce the time taken to resolve the issues Reduce troubleshooting time with advanced tools.

26 Use Case 2: Client is having a poor wireless experience Time to Resolution DNA Center Traditional Time to resolve Issue in minutes User Reports Problem Radio Channel Analysis Replicate Issue Site Visit DNA Center Time Travel Aironet Network Sensor Success Metrics ios client insights provides immediate information. Save time replicating issues with time travel feature. Reduce troubleshooting OPEX by solving remotely

27 DNA-C Wireless Assurance Cisco Live Barcelona

28 Overall Health Page 28

29 Overall Health Page Hierarchical Site View 29

30 Client Health 30

31 Client

32 Client 360 Issue Detail 32

33 Client 360 Issue Detail 33

34 Client 360 Onboarding Steps 34

35

36 Wi-Fi analytics

37 Cisco Apple Wireless Features Journey AireOS 8.3, 8.3 MR1 ios Phase 1 Roaming Optimizations QoS Optimizations MacOS Optimizations Analytics Optimizations Adaptive r: Fast Transition is enabled automatically for ios 10 clients Auto k/v: 11k/v are enabled by default and optimized to provide best next AP Fastlane: businessrelevant applications prioritized Fastlane on Mac OS and later. Upstream QoS prioritization available on ios and Mac OS 11k neighbor map: ios 11 client sends a list of neighbor APs upon joining the cell Disconnection reason: ios 11 client tells us why it disconnects Identity: the ios client tells us who it is (model, ios version) AireOS 8.3 Mac OS Phase 2 AireOS 8.5+ ios 11.0+

38 Advanced Client Insights Apple ios Analytics 1 2 Device Profile Wi-Fi Analytics 3 Assurance Client shares these details 1. Model e.g. iphone 7 2. OS Details e.g. ios 11 Client shares these details 1. BSSID 2. RSSI 3. Channel # Client shares these details Error code for why did it previously disconnected Support per device-group Policies and Analytics Insights into the clients view of the network Provide clarity into the reliability of connectivity

39 Advanced Client Insights Apple ios Analytics Detailed Client device profile information device model, OS details Insights into the clients view of the network Neighboring Access Points Provide clarity into the reliability of connectivity client disassociation details Capability unique to Cisco Wireless Networks only!!

40 Client view vs AP view Step 1 Step 2 When choosing an AP, client scans (sends probe requests, receives probe responses from each AP) Client then evaluates the answer (which AP is best) The client chooses an AP But the infrastructure does not know why this AP was chosen, because the infrastructure does not know how the client saw the network Association

41 Why is this a problem? Because without that view, the infrastructure cannot help this (or other) client find the best AP Association

42 How do Apple and Cisco solve this issue? Right after association, the ios 11 device sends a k beacon report: Association I scanned 200 milliseconds ago and saw: BSSID SSID Channe l Signal Protocol bb:bb:cc:dd:ee:ff Blizzard dbm ac cc:bb:cc:dd:ee:ff Blizzard dbm n dd:bb:cc:dd:ee:ff Blizzard dbm ac

43 How does the client see the Network How does the client see the network? The infrastructure does not know why this AP was chosen, because the infrastructure does not know how the client saw the network Why is this a problem? Because without that view, the infrastructure cannot help this (or other) client find the best AP How do Cisco and Apple solve this? Right after successful key-exchange during association, the ios 11 device sends to its AP an k beacon report ( Unsolicited mode ) This is how I see the network BSSID Channel Signal bb:bb:cc:dd:ee:ff dbm cc:bb:cc:dd:ee:ff dbm dd:bb:cc:dd:ee:ff dbm

44 Client goes away When a client roams or disconnects, it sends a de-association message And it adds a proprietary reason code, we have a dozen various reasons Am out of here

45 Why did the Client go away? Do we know why client disassociated? When a client roams or disconnects, it sends a disassociation message. The AP does not always know why bad signal? Something else? Reasons for disassociation How can we use this Reason Code? Help clients in the same location if there is an RF issue Collect data to understand patterns Why is this a problem? Without knowing why a client is gone, we cannot help other clients in the same location (is this location okay? Is there a better AP there? Is there incompatibility in config at this location? Reasons for disassociation DHCP Failed EAP Timed out 802.1x Failed Device Idle Captive Portal security Failed Decryption Failed WiFi Interface Disabled User-Triggered Disassoc Peer-Triggered Disassoc Beacon Loss Why I disassociated last Reason Code Why I disassociated last Reason Code DHCP Failed EAP Timed out 802.1x Failed Device Idle Captive Portal security Failed Decryption Failed Interface Disabled User-Triggered Disassociation

46 Knowing your Client After association, the ios 11 client also provides important information Association I am ios 11.0, iphone 7 plus

47 How does the Network see the device How does the network see the device? Usually as an ipad or iphone with DHCP and HTTP Device profiling When is this not enough? When we need to analyze device model and OS specific behaviors in the network How do Cisco and Apple solve this? After association, the ios 11 client also tells us about itself. We can the correlate platform, OS to behavior at different points of time and space Where can I see this on WLC? Client summary and client detail page This is who I am? I am ios 11.0, iphone 7

48 For the first time ever, know how your iphone or ipad sees the wireless network Neighboring AP s Client Details Previous Disconnect Disassociation reason The Client s view of APs

49 Client 360 ios Analytics 49

50 Access Point AP 4800

51 Cisco Aironet Portfolio Adding a New Tier The best infrastructure leads to the best outcomes Good - Enterprise class Better Ideal for small to medium-sized deployments 1815 Series 1830/1850 Series Indoor/high-powered Indoor Wall plate/teleworker 2x2:2 SS 80 MHz 867 Mbps performance Tx beamforming Integrated BLE1 Max transmit power (dbm) per local regulations2 3 GE local ports, including 1 PoE out3 Local ports 802.1X ready3 USB 2.04 Mission critical 2800 Series 3x3:2 SS 80 MHz/4x4:3 SS 80 MHz 867 Mbps or 1.7 Gbps performance 1 or 2 GE ports uplink Internal or external antenna (1850) Tx beamforming USB 2.0 Best in class 4x4:3 SS 160 MHz 5 Gbps performance 2.4 and 5 GHz or dual 5 GHz 2 GE ports uplink Cisco CleanAir and ClientLink Internal or external antenna Smart antenna connector USB 2.0 High density 3800 Series 4x4:3 SS 160 MHz 5 Gbps performance 2.4 and 5 GHz or dual 5 GHz 2 GE ports uplink or 1 GE + 1 Multigigabit (5G) Cisco CleanAir and ClientLink StadiumVision Internal or external antenna Smart antenna connector USB 2.0 Modularity for investment protection Future availability 2 Available for high-powered only 3 4 embedded radios (3 Wi-Fi and 1 BLE) 4x4:3 SS 160 MHz 5 Gbps performance 2.4 and 5 GHz or dual 5 GHz 2 GE ports uplink or 1 GE + 1 Multigigabit (5G) Embedded Hyperlocation Real-time analytics and packet capture Cisco CleanAir and ClientLink Internal antenna USB 2.0 Integrated4 Available BLE for teleworker only Available for wall plate and teleworker only

52 Best in Class Wave-2 AP or Best in Class Location Based Services AP? Customers had to choose which technology to deploy or perhaps deploy an overlay? < OR > True Client Location Accuracy AP-2800 or AP-3800 Wave ac Wave 2: High-Performance 5Gbps. 2.4, 5GHz or Dual 5GHz. 4x4:3SS 160MHz. MU-MIMO 2 GE or 1 GE + 1 mgig (5G) Flexible Radio Architecture Dual 5 GHz DNA Sensor, Spectrum Intelligence and more AP-3600 or AP-3700 With Hyperlocation module Analytics, Asset tracking, Proximity Marketing Navigation and Wayfinding true blue dot experience 1 to 3 meter location accuracy (Wi-Fi Clients) BLE Beacon Five centrally managed Beacons FastLocate Frequent location updates (Wi-Fi Clients) Spectrum Intelligent Monitoring Radio and more

53 Next-Generation Wave ac Access Point New Industry leading 4x4 MIMO:3 spatial streams (SS) Wave ac access points Tri-radio, ac Wave 2, 160 MHz Built-in BLE Radio Combined Data Rate of 5.2Gbps 2 x 5 GHz: 4x4: 3SS supporting SU-MIMO / MU-MIMO Cisco Aironet 4800 Flexible Radio Assignment: 2.4GHz, Dual-5GHz, Wireless Security Monitoring, and DNA-C Assurance 1 x 2.4GHz/5GHz for DNA Analytics, Wireless Security monitoring, and Hyperlocation Gigabit Ethernet and multi-gigabit Ethernet (1G, 2.5G, 5G) Built-in Hyperlocation Antenna Array 16-elements <3m Accuracy (median) HDX Technology USB 2.0 Analytics-enabled, DNA Ready Redefining Analytics and Location

54 Combining Proven Technologies Hyperlocation + AP-3800i + Additional Analytics Radio = AP-4800 AP-4800 Integrated Solution Hyperlocation Components AP-3800 Dual 5GHz Monitor/Sensor Proven Hyperlocation Technology in one AP & 1 cable Drop Cisco 16 element Antenna Array 1-3m Accuracy Improved Capability acW2 WiFi & BLE AoA Time Based solutions + All the core features of the AP-3800 Hyperlocation Module 40% smaller Hyperlocation AP36/ x12 AP-4800 Hyperlocation + Analytics 9.9x8.7 Hyperlocation Components Antenna components Inside AP-4800 Dual 5GHz XOR + another analytics Hyperlocation XOR radio

55 Wireless Sensor

56 Aironet Active Sensors Cisco s network sensors allow you to see the actual performance of services from a users point of view. Use a powerful network testing solution endpoint to put yourself anywhere in your network. IT

57 Sensor Anywhere drives to a powerful & comprehensive DNA Assurance Proactively assessing performance & client-network trouble avoidance Test your network anywhere at any time at real-world client level Ecosystem pervasiveness Aironet 1800S Active Sensor Flexible Radio as Sensor (2800/3800) Dual 5 GHz Flexible Radios Software defined radios automatically adjust to dual 5GHz Purpose-built Hardware for Analytics Flexible radios can to provide simultaneous in-line monitoring to DNA for analytics and insights while serving clients Ne w v 2x2 with 2 spatial streams v Multiple powering options PoE Power USB Type C power Direct AC Power Plug v Integrated BLE* v Ultra compact form factor

58 Active Sensors test and provide client perspective to ensure Wireless Service readiness Onboarding Tests Network Services Association Authentication & Key Exchange IP Addressing DHCP EAP-TLS WebAuth capture and redirect DNS RADIUS First Hop Router/Default gateway Intranet Host External Host App Connectivity App Performance* POP3, IMAP, Outlook Web Access File Transfer: FTP Web: HTTP Packet Loss Jitter Latency Speedtest *Roadmapped

59 Wireless Provisioning Config: Step1 Create Wireless Provisioning SSID for AP1800S When using the 1800s sensor (without the Ethernet module) the sensor would be provisioned over the WLAN Once 1800S provisioning is enabled, WLC creates Hidden SSID and Local EAP with EAP-TLS to authenticate AP1800S This will allow the sensor to connect AP wirelessly, and find the DNAC IP over Wireless using DHCP Option 43 or through DNS.

60 Backhaul SSID Configuration Assign one of WLC SSID as Sensor SSID. This will be used by a sensor to connect DNAC and communicate over the air. Sensor SSID will be used to push sensor-test config, receive test results to the DNAC Ensure that the SSID name and security matches an existing WLAN

61 Provision AP1800S Sensor to DNAC: Step1 Create Wireless Provisioning SSID for AP1800S 1. Create Sensor Settings for WSA Channel 2. Create Sensor SSID

62 Provision AP1800S Sensor to DNAC: Step2 Assign Sensor Provision profile to Sensors 1 1. Go to [Provision] Menu then 2. go to [Unclaimed Devices], newly discovered AP1800S will be appeared as UNCLAIMED Status 3. Select newly discovered AP1800 and click [Sensor Provision] 2 3

63 Provision AP1800S Sensor to DNAC: Step3 Assign Sensor Provision profile to Sensors Assign Site Assign Sensor SSID

64 Provision AP1800S Sensor to DNAC: Step4 Place Sensor to actual sensor location Place Sensor to installed location

65 Schedule Sensor Testing: Step1 Create Sensor-Driven Test 1. Create Sensor-Driven Test 2. Add Test Schedule, SSID selection

66 Schedule Sensor Testing: Step2 Select tests and Assign Sensor 3. Select Tests Select Sensors that will run test Target AP will be automatically decided by sensor based on RSSI 4. Select Test Sensor Sensor can take only one test config at a time. Don t re-use same same for 2 testing System Auto Suggest Sensor

67 Sensor Test Failure generates global Issue when more than 2 sensor test failed per floor

68 Thank you.