Новая эра корпоративных сетей с Cisco Catalyst 9000 и другие инновации для маршрутизации и коммутации.

Transcription

1 The image part with relationship ID rid2 was not found in the file. The image part with relationship ID rid2 was not found in the file. Новая эра корпоративных сетей с Cisco Catalyst 9000 и другие инновации для маршрутизации и коммутации. Денис Коденцев Инженер-консультант, CCIE

2 Новая эра сетей Cisco анонс 20 июня 2017 DNA Center Инновационное решение для внедрения и управления корпоративной сетью и сетевыми сервисами DNA Assurance & Analytics Анализ и проактивное обнаружение проблем Software-Defined Access Универсальная сетевая фабрика с динамической микросегментацией Enhanced Network as a Sensor Обнаружение вредоносного ПО в зашифрованном обмене (без расшифровки) Коммутаторы Catalyst 9000 Первые специально созданные в рамках DNA коммутаторы Лицензирование с поддержкой подписки Дополнительные сервисы от Cisco 2

3 Cisco Catalyst 9000

4 Семейство коммутаторов Catalyst 9K Catalyst 9400 Модульный доступ Catalyst 9300 Lead Fixed Access Cisco Catalyst 9000 инновации UADP 2.0 Cisco IOS XE Software SD-Access x86 CPU and containers Encrypted Traffic Analytics (ETA)* AES256/MACSEC256* Trustworthy systems StackWise Virtual* IEEE1588 and AVB* NBAR2 Perpetual/fast PoE Model-driven programmability Patching/GIR Streaming telemetry* Catalyst 9500 Lead Fixed Core Единое ПО, возможности, лицензирование 2017 Cisco and/or its affiliates. All rights reserved. 4

5 UADP 2.0 Инновационный программируемый ASIC Investment Protection Flexible Pipeline Universal Deployments Adaptable Tables Enhanced Scale/Buffering Multicore resource share 384K Flex Counters Shared Lookup Up to 240GE Bandwidth Up to 2X to 4X forwarding + TCAM Embedded CPUs Up to 32MB Packet Buffer Up to 64K x2 Netflow Records 2017 Cisco and/or its affiliates. All rights reserved. 5

6 Настройка конвейера обработки с помощью микрокода Punt IGR Programmed to understand FIB MCast VXLAN Lookup Table Lookup Table Flex Parser Policy VXLAN MPLS Software Features NG Protocol Ingress Programmable Pipeline NF SPAN VXLAN Lookup Table Lookup Table Lookup Table Lookup Table Lookup Table Lookup Table Lookup Table Flexible Look up Tables Lookup Table (Shared Across Cores) Lookup Table Lookup Table Lookup Table Lookup Table MPLS Sec Stage #.. Egress Programmable Pipeline Micro Code L3/L2 SPAN ACL QOS Lookup Table Lookup Table Flex Parser TCAM/ SRAM EGR Programmed to understand MPLS ASIC 2017 Cisco and/or its affiliates. All rights reserved. 6

7 Представляем Catalyst 9300 Новое решение для фиксированного доступа 2.5G at the Price of 1G 40G at the Price of 10G Only Stackable Switch with 8X 10G Uplinks Highest 2.5G/mGig Density in the Industry 1G Data 1G UPOE/POE+ mgig UPOE 24 Ports 48 Ports Catalyst 9K Leadership UADP 2.0 Open IOS-XE SD-Access X86 CPU & Containers Encrypted Traffic Analytics (ETA)* 256 bit MACSEC* Trustworthy Systems StackWise Virtual* IEEE1588 & AVB* NBAR2 Modular Fans Modular Uplinks Modular Power Supplies Perpetual/Fast PoE Model Driven Programmability Patching/GIR 8x10G 2x40G 4x mgig 4x1G 350W 715W 1100 W Streaming Telemetry* *not available at FCS 7

8 Представляем Catalyst 9400 Новое решение для модульного доступа Industry s Highest PoE Scale Redundancy is now Table-stake Catalyst 9K Leadership 9Tbps System b/w UADP 2.0 Open IOS-XE SD-Access X86 CPU & Containers Encrypted Traffic Analytics* 256 bit MACSEC* Trustworthy Systems StackWise Virtual* IEEE1588 & AVB* NBAR2 4-Slot* 7-Slot 10-Slot Supervisor Sup-1: 80G/Slot Access Optimized Sup-1XL*: 120G/Slot Core Optimized Access Linecards 24xmGig + 24xUPOE* 48xUPoE 48xPoE+* 48xData Core Linecards 24x 10G SFP+* 48x1G SFP* 24x1G SFP* Power Supply 3200W AC 3200W DC* 2400W AC* Perpetual PoE* Model Driven Programmability Patching/GIR Streaming Telemetry* *not available at FCS

9 Catalyst инновации и преимущества N+1/N+N Modular Power Supply Extending Cat 4500E Leadership in Modular Access 4X Throughput Ergonomic handles for efficient weight distribution 3X Client Scale 2X Wireless Scale Mix AC & DC Power Supplies 4X Power scale Efficient Platinum Rated Power Supplies 3X Buffering Up to 480Gbps/Slot 10X Bandwidth Rear accessible Fan Tray for flexible cable management UPOE Simultaneously on all ports Native 25/10G & 40G Uplinks 4X Memory & Flash Lower Power Better Acoustics DualServiceable Fan Tray Up to 1TB SATA Storage Higher MTBF MPLS VPN Fits non-standard racks (16 ) While preserving. Side-to-side air flow Intel x86 CPU, 4 Core 2.4GHz Re-architected power distribution for 10% higher energy efficiency HA Architecture Investment Protection Story

10 Архитектура C9400 Centralized Architecture Supervisor Forwarding Features Embedded CPUs Open IOS-XE Control Plane Container HA communication Passive BackPlane Upto 480G BW per slot Line Card STUB ASIC Line Card STUB ASIC Line Card STUB ASIC 2017 Cisco and/or its affiliates. All rights reserved. 10

11 Catalyst 9400 новый уровень надежности Only Campus Access platform in the industry to support ISSU N+N Power Supply Redundancy Safeguard against power circuit failure N+1 Power supply redundancy Safeguard against power supply failure Transparent line card design Minimal on-board components for very high MTBF Unique uplink redundancy Uplinks of failed supervisor continue to remain active Dual Supervisors with sub 50ms ISSU* & NSF/SSO Redundant Fans N+1 Fan redundancy within Fan-tray; Up to 2 minutes of fan-less operation for servicing fan-tray

12 Catalyst 9400 SUP1XL, SFP LCs Nov `17 Sup1XL Up to 120G Per Slot Mar `18 C9400-LC-48S 48 Port SFP Line rate on all ports Mar `18 C9400-LC-24S 24 Port SFP Line rate on all ports C9400-LC-24XS 24-Port SFP/SFP+ Distribution Template with Sup1XL* Fiber to the desktop Nov `17 Collapsed Access Distribution Note: 120G per slot on 7 Slot C9400-SUP1XL Up to 120G per slot Full Portfolio readiness in 7 and 10 Slot chassis for 4K Migration SDA Border Template*

13 Catalyst 9400 mgig & PoE+ Shipping Nov `17 48x 10/100/1000 Data 48x 10/100/1000 UPoE 24x mgig + 24x 1G 24x 1G + 24x mgig UPoE PoE+ for price neutral transition Mar ` ports of mgig 48x 10/100/1000 PoE+ Highest mgig Port Density in the Industry

14 Представляем Catalyst 9500 новое решение для фиксированного ядра 3X Throughput 3X Bandwidth 5X Buffering IOS 16.x SD-Access, MPLS AVB, WRED,NAT, PAT, NBAR2 Stackwise Virtual 40 x 10G High scale control plane with 2.4GHz x86 CPU with 16 GB DDR4 Memory Internal Storage : 16GB External Storage :1xUSB 2.0 (front), 1xUSB 3.0 (back) Up to 2x 950W AC/DC PSU 5 x Fan Trays Non-blocking ports with 5.3MB (shared) packet buffer per port Built-In RFID Up to 24 ports of QSFP 5X CPU Speed 4X Memory & Flash 4X Port Speed 12 x 40G 24 x 40G 2.4X 10G Port Density 8 x 10G 2 x 40G The only 40G Optimized Enterprise Class Switch Line rate on all ports 2017 Cisco and/or its affiliates. All rights reserved. 14

15 Новые возможности по управлению Catalyst 9K Inventory Management Efficiency with Built-in RFID Ease of Serviceability with Blue Beacons on each component Icons Mobil e Lapto p Ergonomic Design with Industry standard Icons Wireless Console Access with Bluetooth

16 Программные инновации Catalyst 9K и не только

17 Надежного периметра уже недостаточно attachment Perimeter Security ineffective 4 DDoS Attack / Data Exfiltration Phishing Social Media Link Site with Malware Malware on Personal device 1 Initial Compromise 2 3 Malware Propagation Botnet creation / Privilege Escalation 17

18 Encrypted Traffic Analytics Эксклюзивная поддержка на Catalyst 9K Специализированная телеметрия Netflow Data: SrcIP, DstIP, SrcPort, DstPort, Proto, #Bytes, #Packets Intraflow Data: Sequence of Packet Lengths & Times (SPLT), Byte Distribution, TLS Metadata: Extensions, Ciphersuites, SNI, Certificate Strings, Основная задача Вторичная задача Malware in Encrypted Traffic Cryptographic Audits

19 Как мы анализируем зашифрованный трафик? Initial data packet Make the most of the unencrypted fields Sequence of packet lengths and times Identify the content type through the size and timing of packets Threat intelligence map Who s who of the Internet s dark side Data exfiltration Self-Signed certificate C2 message Broad behavioral information about the servers on the Internet.

20 Развитие решения Cisco «Сеть как Сенсор» Обнаружение вредоносного ПО в зашифрованном трафике Автоматическая изоляция угрозы Коммутатор Catalyst 9K NetFlow с расширенной телеметрией на скорости порта ISE (Identity Services Engine) Stealthwatch Машинное обучение Обнаружение вредоносов в шифрованном трафике Encrypted Traffic Analytics 99 % точность обнаружения угроз* 0.01 % ложных срабатываний* Cognitive Analytics *Source : Identifying Encrypted Malware Traffic with Contextual Flow Data, Oct 2016

21 Поддержка ETA ETA is NetFlow records are collected and exported at the Access/Fabric Edge Catalyst 9300 Sends ETA Data to Flow Collectors B B C For Wired clients ETA is applied directly to interfaces For SD-Wireless ETA is deployed on VLANs which correspond to Wireless IP Pools Campus / Branch Wired Deployments SD Access Wired and Wireless Deployments 21

22 Application Hosting Mar `18 Fast multi-core x86 processor Linux-based OS up to 16BG RAM Storage expansions (USB, SSD) Cloud Connect Applications Customer Specific Edge Applications Network Functions, Analytics and Telemetry Applications Open Programmability (Python scripts, Puppet Master)

23 Сервисные контейнеры в Cisco IOS-XE IOSd Control Plane Cisco Apps (WAAS, Snort) Linux OS KVM/LXC Приложения сторонних разработчиков Virtual Ethernet Platform-Specific Data Plane Internal Services Blade (UCS E-Series) External Services Blade (UCS) Cisco Connect Cisco and/or its affiliates. All rights reserved. 23

24 Stackwise Virtual - развитие технологии VSS Core Distributed Forwarding Architecture Centralized Control & Management Plane Catalyst 9500 Catalyst 9500 Single Virtual System Stackwise Virtual Multi Chassis Etherchannel 2017 Cisco and/or its affiliates. All rights reserved

25 StackWise Virtual Полная совместимость с SD-Access StackWise Virtual technology is integrated platform in DNA architecture Catalyst 9500 series StackWise Virtual can be Edge Node (EN) or in Border Node (BN) in Fabric enabled network StackWise Virtual helps building simplified underlay IP infrastructure SDA support available starts from initial software release B B SV SV SV SV E E E SV SV SV

26 Catalyst 9K - MPLS Source CE CE PE CE PE MPLS Backbone M MPLS Backbone PE M MDT PE L3VPN L3VPN L3 VPN PE CE Receiver Multicast VPN Multicast VPN - DraftRosen PE Receiver CE PE P PE IPV6 CE IPv4 MPLS Enabled IPv6 VPN 6PE/6VPE PE L2 CE P PE EOMPLS VPLS L2VPN EOMPLS/ VPLS IPV6 CE L2 CE MPLS Features L3VPN MP-BGP Multicast VPN Draft-Rosen L2VPN EOMPLS VPLS IPv6 VPN 6PE 6VPE Polaris UADP Standards-based 26

27 L2VPN EOMPLS / VPLS где поддерживается? EOMPLS VPLS Layer Platform Version FCS 3850/3650( All Models) July 17 Access/Distribution/ Core 9300 ( All models ) July ( All models ) July 17

28 Wide Area Bonjour Mar`18 Policy Management on DNA-Center User Devices Service Discovery Agent on Cat 9k WAN Bonjour Devices (Apple TV, Printers) Traditional Bonjour Single Gateway solution, cannot scale across enterprises No access control Limited Management capabilities Wide Area Bonjour Enables Discovery and service distribution across WAN Group-Based Policies for access control Simplified Controller Based Management

29 Catalyst 9K: унификация функционала и лицензирования Current-Gen - three-tier packaging IP Services Full L3 and Core Differentiators IP Base Routed Access and Access Differentiators C9K - Simplified two-tier packaging DNA Advantage Software Defined Access, Assurance and ETA Solution Package Network Advantage Full L3 with flexible Segmentation and Network Resiliency Lan Base L2 Features and Competitive Parity DNA Essentials Simplified Network Operations Solution Package Network Essentials Competitive Parity with Full L2 and Routed Access DNA subscriptions required (min 3-year term) at time of Cat 9K order

30 Catalyst 9K: сравнение Advantage и Essentials * Future Advantage Essentials 3,5,7 Year Terms DNA Advantage (Inclusive of DNA Essentials) Software-defined Access Policy-based Automation and Assurance, SD-Wireless Telemetry & Visibility ERSPAN, AVC, NBAR2 Security & IoT Encrypted Traffic Analytics, mdns GW, NAT/PAT Assurance & Analytics Network insights from analytics and machine learning, clients and applications covering on-boarding, connectivity and performance Element Management Patch Management SD- Access Ready 3,5,7 Year Terms DNA Essentials Cisco Differentiators Containers, Python, EEM, ANI, Full NetFlow, Wireshark Basic Monitoring Capabilities EasyQOS Monitoring*, Client and Device 360, PSIRT Compliance* Basic Automation Plug and Play, Patch Management *, EasyQOS Configuration* Element Management Image Management, Topology and Discovery Network Advantage (Inclusive of Network Essentials) Network Essentials Perpetual Enhanced Security Controls MACSEC-256 IoT & Mobility CoAP Full Routing Functionality BGP, HSRP, OSPF, ISIS, HSRP,GLBP Flexible Network Segmentation VRF, VXLAN, LISP, Trustsec, Wireless Client and Guest, MPLS L3VPN High Availability & Resiliency NSF, GIR, Stackwise Virtual, ISSU Optimize Bandwidth Utilization with Multicast MSDP, mvpn, AutoRP, PIM-BIDIR Perpetual Essential Switch Capabilities Layer 2, Routed Access, PIM Stub, PVLAN, VRRP, PBR, CDP, QoS, FHS, 802.1x, Macsec-128, CoPP, Trustsec SXP, IP SLA Responder, SSO Telemetry & Visibility Sampled NetFlow, SPAN, RSPAN DevOps Integration Programmability with Open Models and Netconf/Restconf, PnP Agent, ZTP Inclusive of Switch and DNA Center Capabilities

31 Routed Access доступен везде! 2960L 2960X 3650/3850/4500E 3650/3850/4500E C9K Lan Lite Lan Base Lan Base IP Base Network Essentials includes Routed Access includes Routed Access includes Routed Access includes Routed Access & VRF includes Routed Access Default-route Static RIP RIP EIGRP Stub OSPF(200 routes) PBR PIM Stub Multicast (up to 200 routes) RIP EIGRP Stub OSPF (1000 routes) PBR PIM Stub Multicast (up to 1000 routes) 3 Virtual Networks for SD-Access RIP EIGRP Stub OSPF (1000 routes) PBR PIM Stub Multicast (up to 1000 routes) IOS 15.2(6)E IOS 15.2(6)E IOS XE 16.6/3.10E IOS XE 16.6/3.10E IOS XE 16.5

32 Инновации в области маршрутизации

33 Маршрутизаторы для филиала: ISR4000 ВЫСОКАЯ И ПРЕДСКАЗУЕМАЯ ПРОИЗВОДИТЕЛЬНОСТЬ 4 Разделение data, control, services plane 4 Предсказуемая производительность ГИБКОСТЬ И УПРАВЛЯЕМОСТЬ 4 Автоматизация с APIC-EM 4 Возможность программного апгрейда производительности 4 Интеграция сервисов 4 NFV ФУНКЦИОНАЛ IWAN 4 IOS Firewall, VPN, IPSec, PfRV3, NBAR2, AVC, AppNav, VRF, MPLS ISR4451 ISR4431 ISR4351 ISR4331 ISR4321 ISR Gbps 500Mbps/1Gbps 200/400Mbps 100/300Mbps 50/100Mbps 35/70Mbps 2017 Cisco and/or its affiliates. All rights reserved. 33

34 Маршрутизаторы для агрегации: ASR1000 МОЩНЫЕ, КОМПАКТНЫЕ МАРШРУТИЗАТОРЫ 4 Производительность 2.5G G+ со включенными сервисами 4 Криптоподсистема 2G... 60G+ 4 Гибкость I/O: SPAs и Ethernet LCs ВЫСОКАЯ ОТКАЗОУСТОЙЧИВОСТЬ 4 Отдельные control и data planes 4 Резервирование аппаратуры и ПО 4 In-service software upgrades ФУНКЦИОНАЛ IWAN 4 IOS Firewall, VPN, IPSec, PfRV3, NBAR2, AVC, AppNav, VRF, MPLS ASR1001-X 2.5G с апгрейдом до 5G, 10G, 20G До 8G крипто ASR1002-X 5G с апгрейдом до 10G, 20G, 36G До 4G крипто ASR1006-X Модульный, до 200G Резервирование RP/ESP До 60G крипто ASR1001-HX 40G с апгрейдом до 60G 8G или 16G крипто ASR1002-HX 44G с апгрейдом до 100G 8, 16, 25G крипто New New New 2017 Cisco and/or its affiliates. All rights reserved. 34

35 ISR новая «Boost» лицензия All ISR4000, IOS FCS Nov 2017 Enforced License PAK is needed 60 day Boost Eval available. Once installed Unshackle the performance Container services not supported on 4331 & 4351 with Boost license Boost license is repurposing cores on 4331 & 4351

36 ISR 4000 Boost лицензия Что можно ожидать в плане производительности? IP Routing ( CEF ) Performance license Boost license % CPU 4 35% CPU % CPU 4 62% CPU % CPU 2 45% CPU % CPU 2 53% CPU % CPU 2 68% CPU % CPU % CPU UP results on uncapped platforms IOS 16.4

37 Представляем Cisco ISR 1100

38 Cisco ISR 1100 cамый маленький маршрутизатор на базе IOS XE FCS Starting Nov (depending on SKU) Regions covered: US, Canada, EU, Japan and Australia G.fast / Super-vectoring (35b) orderable in Jan Series product offering not affected by ISR 1100 SD-WAN Umbrella Security Mobility Express LTE Advanced Programmability

39 Licensing Packaging Model Default License: IP Base Technology Package: APP, SEC Feature parity with the ISR 4000 HSEC Performance (IPSec) APP SEC IP Base

40 Cisco Enterprise NFV Сетевая виртуализация для удаленного офиса

41 Представляем Cisco Enterprise NFV Cisco Enterprise Service Automation (ESA) + APIC-EM + PI Virtual Router (ISRv) Virtual Firewall (ASAv) Virtual WAN Optimization (vwaas) Virtual Wireless LAN Controller (vwlc) Third-Party VNFs Network Functions Virtualization Infrastructure Software (NFVIS) Cisco 4000 Series ISR + UCS E-Series Enterprise Network Compute System (ENCS) Cisco UCS C-Series 2017 Cisco and/or its affiliates. All rights reserved. 41

42 Виртуальные функции для Вашей сети 1 Выберите функции сети 2 Выберите платформу 3 Оркестрация и автоматизация q vrouter q vfirewall q vwan Optimization q ISR/UCS E-Series q UCS C-Series q X86 Server APIC-EM с Enterprise Service Automation IT Agility q vwlan Controller q 3 rd party services 2017 Cisco and/or its affiliates. All rights reserved. 42

43 Серия ENCS 5400 Интегрированный блок питания GB DRAM 6, 8, или 12-Core Intel Xeon-D Выделенный Board Management Controller Опциональный аппаратный RAID контроллер Интегрированный M.2 Storage Аппаратная оптимизация передачи трафика между виртуальными машинами Интегрированный 8- портовый коммутатор с опцией POE USB 3.0 Storage 2 порта Gigabit Ethernet ports с SFP Слот Network Interface Module для LTE & WAN 2 HDD или SSD RAID 0 & Cisco and/or its affiliates. All rights reserved. 43

44 ENCS 5100 AMD 3.4GHz ISRv 250 Mbps (NAT, QoS, ZBFW) Size: 1 RU 13 x & 32 GB DRAM 4-Core CPU ISRv + 1 VNF M.2 Storage GB Integrated Power Supply Console & MGMT 4 GE ports with 2 SFPs 2 x USB 3.0 Storage

45 Новый ENCS 5104 уже доступен для заказа! ENCS Core ENCS Core ENCS Core ENCS Core ISRv + 5 cores PoE ISRv + 9 cores PoE ISRv + 2 cores ISRv + 3 cores LAN Ports NIM LTE, DSL, T1 HDD, SSD RAID, HW Crypto

46 Представляем Cisco SD-WAN (Viptela)

47 Зачем SD-WAN заказчикам? Simplify WAN/Branch management Reduce WAN and operating costs Optimize application experience 47

48 Cisco SD-WAN общая архитектура Multitenant, Cloud Delivered and Cloud Operated REST API GUI vmanage vsmart Controllers Cloud Data Center Secure SD-WAN Fabric Analytics Private/Hosted/Managed Cloud Internet MPLS Data Center Secure Control Plane 4G/LTE vedge Router Small Office Home Office Branch Campus

49 Централизованное управление (Cloud&On-Prem) Single Pane Of Glass Rich Analytics & Monitoring Power Tools CLI Linux Shell REST NETCONF Syslog SNMP Flow Export

50 Zero Touch Provisioning (ZTP) Zero Touch Provisioning Server Control and Policy Elements Full Registration and Configuration Assumption: DHCP on Transport Side (WAN) DNS to resolve ztp.viptela.com* 4 * Factory default config vedge Delivered as-a-service

51 Контроль состояния каналов vedge Routers continuously perform path liveliness and quality measurements vmanage App Aware Routing Policy App A path must have: Latency < 150ms Loss < 2% Jitter < 10ms Device QoS (shaping, policing, queuing, marking) vedge Router Path 2 Internet MPLS 4G LTE vedge Router Path1: 10ms, 0% loss, 5ms jitter Path2: 200ms, 3% loss, 10ms jitter Path3: 140ms, 1% loss, 10ms jitter Optimal Application Throughput

52 Управление SD-WAN на основе политик Policy Augmented Dynamic Routing 1 vmanage GUI Policy Orchestration Control Policy: Routing and Services App-Route Policy: App-Aware SLA-based Routing Data Policy: Extensive Policy-based Routing and Services Combine and Apply per Site 2 vsmart controller Policy Enforcement/Advertisement Execute Control Policy Advertise AAR/Data Policies to Sites 3 vedge WAN router Execute AAR and Data Policy as received Dynamic Routing and Policies Combine to dictate behavior Access Layer Branch/DC

53 Портфолио Viptela - vedge IOT / Small Footprint SOHO SMB (100 M) Branch (1 G) Head-End Aggregation (10 G) Higher Capacity Aggregation (20 G+) NFV, vcpe (N x cores) IaaS & Cloud Interconnect (Nx cores) ARM

54 Окончание цикла продаж ISR G2

55 В качестве напоминания End-of-sale 2900 & 3900 series on Dec 9, 2017 Plan to End-of-sale 1900 series in December, 2018

56 Подводя итог

57 Спасибо! Вопросы? Денис Коденцев, Cisco