IWAN APIC-EM Application Cisco Intelligent WAN

Transcription

1 IWAN APIC-EM Application Cisco Intelligent WAN René og Per Cisco DK SE s Feb 23 th 2016

2 AVC MPLS Private Cloud 3G/4G-LTE Virtual Private Cloud Branch WAAS PfR Internet Public Cloud Control, Management, & Automation Transport Independent Intelligent Path Control Application Optimization Secure Connectivity Consistent operational model Simple provider migrations Scalable and modular design IPsec routing overlay design Dynamic Application best path based on policy Load balancing for full utilization of bandwidth Improved availability Application visibility with performance monitoring Application acceleration and bandwidth optimization Certified strong encryption Comprehensive threat defense Cloud Managed Security for secure direct Internet access 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 2

3 END-TO-END SOLUTIONS Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) Security Collaboration Services Orchestration IWAN Published Rest APIs Network Plug and Play PKI (Trust Manager) Cisco APIC-EM Services Discovery Topology Common Policy Engine Device Abstraction Layer (SAL) CATALYST ISR ASR WIRELESS A New Software-Driven Platform for Solutions Development

4 Typical IWAN POC LAB Greenfield for 4000 ISR Sing Router Branch LAN Branch Switch 4000 ISR IWAN Transport MPLS Data Center with ASR 1000 Okay to use 4000 ISR or CSR 1000 MPLS HUB ASR 1000 Data Center Master Controller ASR 1000 Dual Router Branch Switch Internet HUB ASR 1000 LAN Branch Switch 4000 ISR Internet IWAN APP BGP, OSPF, EIGRP Switch Internal network In the data center

5 Possible Architectures Data Center 1. For a lab or POC, MC can run in one of the DMVPN hubs 2. Single data center with a separate MC 3. Dual data center with primary and transit 1 2 SP links can be: Internet + MPLS Internet + Internet Branch 1. Dual router dual links 2. Single router dual links 3. Single router single links

6

7 Monitoring Cisco Prime Infrastructure

8 Typical End-to-End IWAN Management IWAN APP REST APIs Prime Infrastructure Plug and play Secure PKI certificate automation IWAN CVD provisioning (DMVPN, QoS, PfR, AVC) Centralized business-policy definition Definition of application categories path preference Configuration archive End-to-end assurance Detailed, network-level monitoring (CPU, Mem, Interfaces) Day-2 monitoring for PfR, L7 app visibility, QoS

9 Integration with Cisco Prime Infrastructure or Above Enter your PI credentials under global APIC-EM settings Using REST API calls, the APIC-EM will: Automatically add every IWAN app device to Cisco Prime (DMVPN hubs and branch sites) Start NeFlow export and allow Cisco Prime to collect and process NetFlow data for AVC (L7 visibility), application response time (ART), QoS stats, PfRv3 monitor Prime also keeps a configuration archive of each device Configuration compliance jobs will be run by Prime on a daily basis. Detailed compliance reports are available in Prime

10 Overall application/site health and stats

11 PI 3.0 PfR Dashboard SP SLA summary: Reachability loss jitter delay Number of threshold crossings over time PfR resolved threshold crossings/route-change events

12 Detailed Site View Link Details Link details Threshold Crossings

13 Application or category usage over time for a given link/provider

14 QoS: application at a site on a provider link

15 How to Add Additional Features to a Site Any additional features can be pushed to the router. One way is to use Cisco Prime to push any CLI template Take care when pushing new CLI commands, which may conflict with the IWAN features (like ACLs, routing, RSA keys) Any feature pushed by the IWAN App (listed in the previous slide) cannot be changed manually. This will make the IWAN App policies become unsynchronized

16

17 IWAN App Requirements APIC-EM and IWAN app: Server: 64-bit x86 vcpu: 6 (2.4GHz) RAM: 64 Gigabytes Disk space: 500 Gb Disk I/O speed: 200 Mbps Network adapter: 1x Browser: Chrome (4.3.0 or later) Data Center Two ASR 1000 routers for DMVPN hubs - one must be Internet. Two minimum interfaces: one for WAN and one for LAN, management, and ub interconnect Hubs need to be configured with the WAN, management IP address, and with SNMP credentials before stating with IWAN app One ASR 1000 master controller (in lab/poc; MC can run in the DMVPN hub) HTTPS/HTTP proxy for plug and play (no need for lab/poc) Cisco IOS Software version: Cisco IOS-XE 3.16 or above; Cisco IOS-XE is required for a dual data center Branch Sites 4000 ISR with two clouds (one must be Internet) 3 Gigabit interfaces (4321 ISR requires a switch module) The ISR must have a clean configuration, with no RSA keys Either dual router with dual link, or single router dual link. Single router with single link is supported, but without PfR