2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

Transcription

1 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

2 PSODCN-1030 Intent Based Systems Deliver Automation Dave Malik Cisco Fellow and Chief Architect Advanced 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

3 Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after the session 1. Find this session in the Cisco Live Mobile App 2. Click Join the Discussion 3. Install Spark or go directly to the space 4. Enter messages/questions in the space cs.co/ciscolivebot#psodcn Cisco and/or its affiliates. All rights reserved. Cisco Public

4 Agenda Introduction Define Intent Base Systems Enterprise Network Software Defined Access Data Center - ACI Automation Frameworks with Multi-Vendor Use cases Conclusion 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

5 What is Intent? Intent I have scheduled a telemedicine session at 10:00AM I am rolling out a new IoT app for factory equipment monitoring I am opening a new branch to serve customers better I need the lawn cut Execution Create a HD video connection; prioritize with E2E QoS; validate performance; keep the communication safe; tear down connection after call. Create a new segment for all factory devices to connect to the IoT App; isolate from other traffic; apply SLA; validate SLA; optimize. Provision and configure the branch network; set up secure access for staff and customers; apply network services; validate application performance. Take mower out of shed; fill gas and oil; pull starter cord; push onto lawn; clean mower; return to shed. The Administrator defines the WHAT and the Automation system figures out the HOW Cisco and/or its affiliates. All rights reserved. Cisco Public

6 Automation in Key to Increasing Agility and Reducing OPEX PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 6

7 Software and Data-driven Networking Turning data into information to drive intent Workflow and Intent Applications Network Intelligence, Guidance Application Software New Businesses SaaS + Integration Operations BI Services Orchestration Analytics Infrastructure Software Management Orchestration Analytics, Controllers Programmability Network Statistics, States, Objects and Events Embedded Software Route, Switch, Appliance IOS, XR, NXOS, others PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 7

8 Automation: Solution Tenets Evolving the Traditional Uses Enabling Transformation Real Time Improve fidelity and accuracy, and access of the information presented to the operator Analytics Enabled A focus on data used to derive actionable insights driven for network visibility and optimization Scalable Network scale has grown existing applications need to adapt in concert and be simple to deploy Workflow Driven Ops Automate the repetitive and reduce the time it takes to deploy, improving agility Open An extensible platform that can be customized for the need, supporting multivendor environments Model Generated Config Intent and model driven methodology to define the network offline, reduce human error PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 8

9 Goal: Intent based Network Operations Lifecycle Plan & Design (Establish the Intent) Optimize (Optimize the Intent) AUTOMATION & ANALYTICS Validate & Implement (Deploy the Intent) Operate (Monitor the Intent) Automation & Analytics Platform PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 9

10 Enterprise Networking 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

11 Unprecedented Demands on the Network Scale Complexity Security PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 11

12 L E A R N I N G This calls for a shift to Intent-based I N T E N T CONTEXT Networking S E C U R I T Y 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

13 Segmentation What if We could dynamically create separated, secure guest access? PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 13

14 Segmentation What if! We could prevent lateral movement of ransomware? PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 14

15 Customer Experience What if The network could automatically provision end-toend QoS? PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 15

16 Network Infrastructure What if The network could intuitively stay upto-date on the most current software levels? PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 16

17 DNA Center Policy Automation Analytics Fabric WLC B B C Fabric Border Fabric Control Plane Fabric Intermediate Node Fabric Edge Extension Node Fabric AP IoT Network Employee Network PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 17

18 Secure Segmentation and Onboarding: Software Defined Access IT Simplicity Users Group 1 Group 2 Employee Virtual Network No VLAN, ACLs or IP Address management required Single network fabric Devices Group 3 Group 4 Define one consistent policy Apps Drag policy to apply IoT Virtual Network Group 5 Group 6 Guest Virtual Network Security Simplified Micro-Segmentation Policy enforcement Completely Automated Policy follows Identity Minimize Lateral Threat Movement 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

19 Enable Segmentation and Access Control 2 Custom Deny Default Permit 1 Virtual Networks First level Segmentation that ensures zero Communication between Building systems and Users Group 3 Group 4 Group 5 IoT Virtual Network Default Deny 1 Group 1 Group 2 Employee Virtual Network 2 Groups Second level Segmentation within a Virtual Network that ensures role based access control between Two Groups Routers Switches Wireless AP WLC 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

20 Data Center 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

21 The Critical Infrastructure Hierarchy of Needs Ease of Use Agility Multi-Cloud Performance Security On-Premise Data Center Availability PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 21

22 Data Center Automation Strategy Install Provision (Auto) Scale Maintain Automating the complete application Lifecycle PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 22

23 Automating the Intent Lifecycle Learn APP Protect Adapt PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 23

24 Translate Application Requirements To Network Configuration APPLICATION LANGUAGE NETWORK LANGUAGE Application Tier Policy and Dependencies Security Requirements Service Level Agreement Application Performance Compliance Geo Dependencies? APIC VLAN IP Address Subnets Firewalls Quality of Service Load Balancer Access Lists PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 24

25 ACI Policy Model Enabling Intent Driven Automation Across Physical and Any Virtualization or Cloud Technology Application Profile ACI Policy WEB ACI Policy APP ACI Policy DB Logical Network Provisioning of Stateless Hardware Open vswitch OpFlex Agent VMware DVS Cisco AVS MSFT vswitch Open vswitch OpFlex Agent Bare Metal VM 1 VM 2 VM 1 VM 1 VM 2 VM 1 VM 1 VM 2 VM 1 Docker1 Docker2 Docker1 Docker2 PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 25

26 Automating Infrastructure Enterprise Data Center Core Open, programmable interfaces Distribution Embedded automation LAN Compute SAN Storage Unified management w/aci User applications Mission critical Business critical PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 26

27 Automating Operations Private Cloud Edge Spine Policy-based networking Leaf Compute Troubleshooting and remediation Storage User applications Object storage Web applications Cloud native PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 27

28 Automating Scale Within and Across Clouds Private and Public Multi-Cloud Cisco CloudCenter Workload modeling and deployment Intersight Self-managing applications Self-service user portals PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 28

29 Cisco ACI and Kubernetes Integration ACI and Containers Unified networking: Containers, VMs, and bare-metal Integration of Kubernetes: Network policies and ACI policies OpFlex Node OVS OpFlex Node OVS Visibility: Live statistics in APIC per container and health metrics PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 29

30 ! UCS 2204XP CHS A UCS 2204XP FAN 1 FAN 5 FAN 2 FAN 6 FAN 3 FAN 7 FAN 4 FAN 8! CISCO UCS 6248UP ID STAT UCS 2204XP CHS A UCS 2204XP 1/10 GIGABIT ETHERNET 1/2/4/8G FIBRE CHANNEL UCS E16UP FAN 1 FAN 5 FAN 2 FAN 6 FAN 3 FAN 7 FAN 4 FAN 8! UCS 2204XP CHS A56 CISCO UCS 6248UP ID STAT UCS 2204XP 1/10 GIGABIT ETHERNET 1/2/4/8G FIBRE CHANNEL UCS E16UP FAN 1 FAN 5 FAN 2 FAN 6 FAN 3 FAN 7 FAN 4 FAN 8! UCS 2204XP CHS A UCS 2204XP FAN 1 FAN 5 FAN 2 FAN 6 FAN 3 FAN 7 FAN 4 FAN 8 Data Center Abstraction Layers Abstract Management & Orchestration Cisco CloudCenter Policy Intent Model Application Network Profiles Application Profile Service Profiles Storage Profiles Controller Automation End-Point Concrete Common language / translation Infrastructure Fabric Network Compute Storage Common/Trusted interface and behaviors Abstractions PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 30

31 Ex.: Cisco HyperFlex on Cisco UCS with Cisco ACI PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 31

32 5. Pervasive analytics 6. Pervasive security Capturing Intent 4. Use public Cloud Managed IaaS SaaS 4c. Instrumented for Developers and DevOps 4b. Extend Common Policy Model 4a. Common Application Blueprints 3. Build private Cloud and PaaS Private 2. Open and automated 1. Modernize infrastructure Network Compute Storage Converged HyperConverged PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 32

33 Pervasive Tetration Analytics Tetration Pervasive and Cisco Security Security Putting It All Together Multi-Cloud Managed Service Public Instrumented for Developers AppD and DevOps SaaS Extend Common ACI Policy Model Common CloudCenter Application Blueprints On-prem/Co-lo Private Policy Driven, Open and Automated Modernize Data Center Policy Nexus UCS HyperFlex Intent-Based Data Center PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 33

34 Intent Based Data Center Day-2 capabilities VISIBILITY SECURITY Cisco ACI PERFORMANCE Cisco Workload Optimization Manager PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 34

35 Tetration Anywhere Pervasive Visibility and Policy Across Multi-Cloud & Available in the Cloud On-Site Cluster Tetration Tetration In-Cloud Cluster Coming Soon PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 35

36 ACI + Tetration Rendering Policy to Any Endpoint Policy Network Policy Enforcement ACI Fabric Tetration Host Security Enforcement PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 36

37 Automate Enforcement of Policy in Any Environment Cisco Tetration Analytics Google 1. Generates unique policy per workload 2. Pushes policy to all workloads 3. Workload securely enforces policy 4. Continuously recomputes policy from identity and classification changes Azure Compliance monitoring Amazon Enforcement Public cloud Bare metal Virtual Cisco ACI TM Traditional network PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 37

38 Automate Policy Related Notifications Alerts every minute for enforcement Policy compliance event notifications Count of policy alerts until whitelisted Alerts when IP tables or firewall is flushed or disabled by user Message publish Northbound consumers Alerts when enforcement sensor is disabled Publishes policy differences between versions Cisco Tetration Analytics Kafka Kafka broker Northbound consumers PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 38

39 Intent Based Automated Application Deployment Deploy Data Center Model Private Cloud Manage One Integrated Platform Day 2 Actions Public Cloud New and Existing Applications PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 40

40 Making Security Stack Aware of ACI Groups What s new? SGT-aware StealthWatch Integration of TrustSec and ACI policy groups allows us to make security applications aware of Groups from the DC SGTs aware proxies SGT-aware Firewall APIC-DC StealthWatch/Firepower/Web Security Appliance/3 rd party receive SGT information based on the DC groups (EPG) from ACI Voice Non- Compliant Employee Supplier BYOD ACI Info shared using Security Group Tags ACI Group Info www Web Prod App Dev App PCI App Database PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 41

41 Accelerating the Journey with Cisco Services Advisory Implementation Optimization Managed Technical Training PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 42

42 Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after the session 1. Find this session in the Cisco Live Mobile App 2. Click Join the Discussion 3. Install Spark or go directly to the space 4. Enter messages/questions in the space cs.co/ciscolivebot#psodcn Cisco and/or its affiliates. All rights reserved. Cisco Public

43 Please complete your Online Session Evaluations after each session Complete 4 Session Evaluations & the Overall Conference Evaluation (available from Thursday) to receive your Cisco Live T-shirt All surveys can be completed via the Cisco Live Mobile App or the Communication Stations Complete Your Online Session Evaluation Don t forget: Cisco Live sessions will be available for viewing on-demand after the event at Cisco and/or its affiliates. All rights reserved. Cisco Public

44 Continue Your Education Demos in the Cisco campus Walk-in Self-Paced Labs Tech Circle Meet the Engineer 1:1 meetings Related sessions PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 45

45 Additional Resources SD-Access: Enterprise Networking Made Fast and Flexible PSODCN Cisco and/or its affiliates. All rights reserved. Cisco Public 46

46 Thank you 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

47 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public