Cisco Digital Network Architecture Center Installation Guide, Release 1.2

Transcription

1 Cisco Digital Network Architecture Center Installation Guide, Release 1.2 First Published: Last Modified: Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA USA Tel: NETS (6387) Fax:

2 THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS. THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY. The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of the UNIX operating system. All rights reserved. Copyright 1981, Regents of the University of California. NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED AS IS" WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE. IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental. Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: go trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1721R) Cisco Systems, Inc. All rights reserved.

3 CONTENTS CHAPTER 1 Review the Appliance Features 1 Feature Summary 1 Front and Rear Panels 2 Physical Specifications 8 Environmental Specifications 9 Power Specifications 10 CHAPTER 2 Plan the Deployment 11 Planning Workflow 11 About DNA Center and Software-Defined Access 12 Required Interface Cable Connections 12 Required IP Addresses and Subnets 15 Required Internet URLs and FQDNs 18 Provide Secure Access to the Internet 19 Required Network Ports 20 Required SD-Access Ports and Protocols 22 Required Configuration Information 28 Required First-Time Setup Information 30 CHAPTER 3 Install the Appliance 31 Appliance Installation Workflow 31 Unpack and Inspect the Appliance 32 Review the Installation Warnings and Guidelines 33 Review the Rack Requirements 34 Connect and Power On the Appliance 34 Check the LEDs 35 iii

4 Contents CHAPTER 4 Configure the Appliance 39 Appliance Configuration Workflow 39 Enable Browser Access to CIMC 40 Execute Pre-Flight Checks 45 Configure the Master Node 51 Configure Add-On Nodes 64 CHAPTER 5 Complete First-Time Setup 77 First-Time Setup Workflow 77 Log In for the First Time 78 Integrate Cisco ISE With DNA Center 82 Configure Authentication and Policy Servers 84 Configure SNMP Properties 86 CHAPTER 6 Troubleshoot the Deployment 87 Troubleshooting Tasks 87 Log Out of Cisco DNA Center 87 Reconfigure the Appliance Using the Configuration Wizard 88 Power-Cycle the Appliance 89 iv

5 CHAPTER 1 Review the Appliance Features Feature Summary Feature Summary, on page 1 Front and Rear Panels, on page 2 Physical Specifications, on page 8 Environmental Specifications, on page 9 Power Specifications, on page 10 Cisco supplies DNA Center in the form of a rack-mountable appliance. The Cisco part number is DN1-HW-APL. The appliance consists of a Cisco UCS C220 M4 chassis, with the addition of a Virtual Interface Card (VIC) 1227 in the mlom slot. The DNA Center software image is pre-installed on the appliance, but must be configured for use. The following table summarizes the appliance features. Table 1: Cisco DNA Center Appliance Series Features Feature Chassis Processors Memory Storage Disk Management (RAID) Description One rack-unit (1RU) chassis. Up to two Intel Xeon CPU E GHz v4 series processor family CPUs. 24 slots for registered DIMMs (RDIMMs) or load-reduced DIMMs (LRDIMMs) (12 each CPU). Eight 2.5-inch Small Form Factor (SFF) solid state drives (SSDs). Three pre-configured RAID settings: RAID 1 on slots 1 and 2, RAID 1 on slots 3 and 4, and RAID 10 on slots 5, 6, 7, and 8. These settings are not user-configurable. 1

6 Front and Rear Panels Review the Appliance Features Feature Network and Management I/O Description Supported connectors: Two 10Gbps Ethernet ports on the Cisco UCS Virtual Interface Card (VIC) 1227 One 1Gbps Ethernet dedicated management port Two 1Gbps BASE-T Ethernet LAN ports One RS-232 serial port (RJ-45 connector) One 15-pin VGA2 connector Two USB3 3.0 connectors One front-panel KVM connector that is used with the KVM cable, which provides two USB 2.0, one VGA, and one serial (DB-9) connector. Power Cooling Video Dual AC power supplies, 770 W AC each. Do not mix power supply types or watt ratings in the server. Redundant as 1+1. Six hot-swappable fan modules for front-to-rear cooling. VGA video resolution up to 1920 x 1200, 16 bpp at 60 Hz, and up to 256 MB of video memory. Front and Rear Panels The following figures and tables describe the front and rear panels of the Cisco DNA Center appliance. Click this link for a short video describing the appliance front and rear panels and how the appliance NICs are cabled. 2

7 Review the Appliance Features Front and Rear Panels Figure 1: DNA Center Appliance Front Panel Component 1 Description Eight 2.5-inch SDD drives. Each installed drive bay has a fault LED and an activity LED. When the drive fault LED is: Off The drive is operating properly. Amber The drive has failed. Amber, blinking The drive is rebuilding. When the drive activity LED is: Off There is no drive in the sled (no access, no fault). Green The drive is ready. Green, blinking The drive is reading or writing data Drive bays 1 and 2 support SAS/SATA and NVMe PCIe solid state drives (SSDs). Fault and activity LEDs and their states are the same for these drives as for the installed 2.5-inch SDD drives. Pull-out asset tag Operations sub-panel buttons and LEDs. LED states for these buttons and the conditions they indicate are described in the following entries. 3

8 Front and Rear Panels Review the Appliance Features Component 5 Description Power button/power status LED. When the LED is: Off There is no AC power to the appliance. Amber The appliance is in standby power mode. Power is supplied only to the CIMC and some motherboard functions. Green The appliance is in main power mode. Power is supplied to all server components. 6 Unit identification button and LED. When the LED is: Blue Unit identification is active. Off Unit identification is inactive. 7 System status LED. When the LED is: Green The appliance is running in a normal operating condition. Green, blinking The appliance is performing system initialization and memory checks. Amber, steady The appliance is in a degraded operational state, which may be due to one or more of the following causes: Power supply redundancy is lost. CPUs are mismatched. At least one CPU is faulty. At least one DIMM is faulty. At least one drive in a RAID configuration failed. Amber, blinking The appliance is in a critical fault state, which may be due to one or more of the following: Boot failed. Fatal CPU and/or bus error was detected. Server is in an over-temperature condition. 8 Fan status LED. When the LED is: Green All fan modules are operating properly. Amber, steady One fan module has failed. Amber, blinking Critical fault, two or more fan modules have failed. 4

9 Review the Appliance Features Front and Rear Panels Component 9 Description Temperature status LED. When the LED is: Green The appliance is operating at normal temperature. Amber, steady One or more temperature sensors have exceeded a warning threshold. Amber, blinking One or more temperature sensors have exceeded a critical threshold 10 Power supply status LED. When the LED is: Green: All power supplies are operating normally. Amber, steady: One or more power supplies are in a degraded operational state. Amber, blinking: One or more power supplies are in a critical fault state. 11 Network link activity LED. When the LED is: Green, blinking: One or more Ethernet LOM ports are link-active, with activity. Green: One or more Ethernet LOM ports are link-active, but there is no activity. Off: The Ethernet link is idle. 12 KVM connector. Used with a KVM cable that provides two USB 2.0, one VGA, and one serial connector. Figure 2: DNA Center Appliance Rear Panel Component Description Grounding-lug hole (for DC power supplies) PCIe riser 1/slot 1 PCIe riser 2/slot 2 5

10 Front and Rear Panels Review the Appliance Features Component 4 Description Power supplies (up to two, redundant as 1+1). Each power supply has a power supply fault LED and an AC power LED. When the fault LED is: Off The power supply is operating normally. Amber, blinking An event warning threshold has been reached, but the power supply continues to operate. Amber, solid A critical fault threshold has been reached, causing the power supply to shut down (for example, a fan failure or an over-temperature condition). When the AC Power LED is: Green, solid AC power is OK, DC output is OK. Green, blinking AC power is OK, DC output is not enabled. Off There is no AC power to the power supply. For more details, see Power Specifications, on page Gbps Cluster Port (Port 2, enp10s0, Network Adapter 3): This is the second 10Gbps port on the Cisco Virtual Interface Card (VIC) 1227 in the appliance mlom slot. It is identified as Port 2 on the rear panel, and as enp10s0 and Network Adapter 3 in the Maglev Configuration Wizard. Connect this port to a switch with connections to the other nodes in the DNA Center cluster. This port has a link status ("ACT") LED and a link speed ("LINK") LED. When the link status LED is: Green, blinking Traffic is present on the active link. Green Link is active but there is no traffic present. Off No link is present. When the link speed LED is: Green link speed is 10 Gbps. Amber link speed is 1 Gbps. Off link speed is 100 Mbps or less. Note Although capable of operating at lower speeds, the DNA Center appliance Enterprise and Cluster ports are intended to operate at 10Gbps only. 6

11 Review the Appliance Features Front and Rear Panels Component 6 Description 10Gbps Enterprise Port (Port 1, enp9s0, Network Adapter 4): This is the first 10Gbps port on the Cisco Virtual Interface Card (VIC) 1227 in the appliance mlom slot. It is identified as Port 1 on the rear panel, and as enp9s0 and Network Adapter 4 in the Maglev Configuration Wizard. Connect this port to an access switch with connections to the enterprise network. This port has a link status ("ACT") LED and a link speed ("LINK") LED. When the link status LED is: Green, blinking Traffic is present on the active link. Green Link is active but there is no traffic present. Off No link is present. When the speed LED is: Green link speed is 10 Gbps. Amber link speed is 1 Gbps. Off link speed is 100 Mbps or less. Note Although capable of operating at lower speeds, the DNA Center appliance Enterprise and Cluster ports are intended to operate at 10Gbps only. 7 8 USB 3.0 ports (two) 1Gbps CIMC Port (M): This is the embedded port to the right of the two USB ports and to the left of the RJ45 serial port. It is labeled M on the back panel and is assigned an IP address when you enable browser access to the appliance's CIMC GUI (see Enable Browser Access to CIMC, on page 40). This port is reserved for out-of-band management of the DNA Center appliance chassis and software. Connect it to a switch providing access to your enterprise management network. This port has a link status LED and a link speed LED. When the link status LED is: Green, blinking Traffic is present on the active link. Green Link is active but there is no traffic present. Off No link is present. When the speed LED is: Green link speed is 1 Gbps. Amber link speed is 100 Mbps. Off link speed is 10 Mbps or less. 9 Serial port (RJ-45 connector) 7

12 Physical Specifications Review the Appliance Features Component 10 Description 1Gbps DNA Center GUI Port (1, enp1s0f0, Network Adapter 2): This is the first Intel i350 1Gb Ethernet controller port, embedded on the appliance motherboard. It is identified as 1 on the rear panel, and as enp1s0f0 and Network Adapter 2 in the Maglev Configuration Wizard. This port is required, as it allows access to the DNA Center graphic user interface. Connect it to a switch providing access to your enterprise management network. This port has a link status LED and a link speed LED. When the status LED is: Green, blinking Traffic is present on the active link. Green Link is active but there is no traffic present. Off No link is present. When the speed LED is: Green link speed is 1 Gbps. Amber link speed is 100 Mbps. Off link speed is 10 Mbps or less. 11 1Gbps Cloud Port (2, enp1s0f1network Adapter 3): This is the second embedded 1Gbps Ethernet controller port. It is identified as 2 on the rear panel, and as enp1s0f1 and Network Adapter 3 in the Maglev Configuration Wizard. This port is optional, used for connecting to the Internet when it is not possible to do so via the 10Gbps Enterprise Port. Connect to the Internet or a proxy server with connections to the Internet. This port has a link status LED and a link speed LED. When the link status LED is: Green, blinking Traffic is present on the active link. Green Link is active but there is no traffic. Off No link is present. When the speed LED is: Green link speed is 1 Gbps. Amber link speed is 100 Mbps. Off link speed is 10 Mbps or less VGA video port (DB-15). This panel area around this port is blue. Blue LED locator button Physical Specifications The following table lists the physical specifications for the Cisco DNA Center appliance. 8

13 Review the Appliance Features Environmental Specifications Table 2: Physical Specifications Description Height Width Depth (length) Front Clearance Side Clearance Rear Clearance Maximum weight (fully loaded chassis) Specification 1.7 in. (4.32 cm) in. (43.0 cm) Including handles: in. (48.2 cm) 29.8 in. (75.6 cm) Including handles: in. (78.7 cm) 3 in. (76 mm) 1 in. (25 mm) 6 in. (152 mm) 37.9 lb. (17.2 kg) Environmental Specifications The following table lists the environmental specifications for the Cisco DNA Center appliance. Table 3: Environmental Specifications Description Temperature, operating Temperature, non-operating (when the appliance is stored or transported) Humidity (RH), operating Humidity, non-operating Altitude, operating Altitude, non-operating (when the appliance is stored or transported) Sound power level, measure A-weighted per ISO7779 LwAd (Bels), operation at 73 F (23 C) Specification 41 to 95 F (5 to 35 C) Derate the maximum temperature by 1 C per every 1000 ft. (305 meters) of altitude above sea level. 40 to 149 F ( 40 to 65 C) 10 to 90%, non-condensing at 82 F (28 C) 5 to 93% at 82 F (28 C) 0 to 10,000 ft. (0 to 3,000 m) 0 to 40,000 ft. (0 to 12,192 m) 5.4 9

14 Power Specifications Review the Appliance Features Description Sound pressure level, measure A-weighted per ISO7779 LpAm (dba), Operation at 73 F (23 C) Specification 37 Power Specifications The specifications for the dual 770 W AC power supply (Cisco part number UCSC-PSU1-770W) supplied with the Cisco DNA Center appliance are listed in the table below. Caution Do not mix power supply types in the appliance. Both power supplies must be identical. Table 4: DNA Center AC Power Supply Specifications Description AC input voltage AC input frequency Maximum AC input current Maximum input volt-amperes Maximum output power per PSU Maximum inrush current Maximum hold-up time Power supply output voltage Power supply standby voltage Efficiency rating Form factor Input connector Specification Nominal range: VAC, VAC (Range: VAC, VAC) Nominal range: 50 to 60Hz (Range: Hz) 9.5 A at 100 VAC 4.5 A at 208 VAC 950 VA at 100 VAC 770 W 15 A (sub-cycle duration) 12 ms at 770 W 12 VDC 12 VDC Climate Savers Platinum Efficiency (80Plus Platinum certified) RSP2 IEC320 C14 You can get more specific power information for your exact appliance configuration by using the Cisco UCS Power Calculator: 10

15 CHAPTER 2 Plan the Deployment Planning Workflow Planning Workflow, on page 11 About DNA Center and Software-Defined Access, on page 12 Required Interface Cable Connections, on page 12 Required IP Addresses and Subnets, on page 15 Required Internet URLs and FQDNs, on page 18 Provide Secure Access to the Internet, on page 19 Required Network Ports, on page 20 Required SD-Access Ports and Protocols, on page 22 Required Configuration Information, on page 28 Required First-Time Setup Information, on page 30 The following table details the planning and information-gathering tasks you must perform before attempting to install, configure and set up your DNA Center appliances. When you have completed the tasks in this table successfully, you can continue by physically installing your appliances in the data center, as explained in #unique_11. Click this link for a video series giving an overview of DNA Center and of the DNA Center installation and configuration process. For information about DNA center and SDA, see About DNA Center and Software-Defined Access, on page 12. Table 5: DNA Center Planning Tasks Step Description Review the recommended cabling and switching requirements for standalone and cluster installations: Required Interface Cable Connections, on page 12. Gather the IP addressing, subnetting, and other IP traffic information that you will apply during appliance configuration: Required IP Addresses and Subnets, on page 15. Prepare a solution for DNA Center's required access to Web-based resources: Required Internet URLs and FQDNs, on page 18 and Provide Secure Access to the Internet, on page

16 About DNA Center and Software-Defined Access Plan the Deployment Step 4 5 Description Reconfigure your firewalls and security policies for DNA Center traffic: Required Network Ports, on page 20. If you are using DNA Center to manage an SDA network, also see Required SD-Access Ports and Protocols, on page 22. Gather additional information used during appliance configuration and first-time setup: Required Configuration Information, on page 28 and Required First-Time Setup Information, on page 30. About DNA Center and Software-Defined Access You can use DNA Center to manage any type of network, including networks that employ Cisco's Software-Defined Access Fabric architecture (also known as SD-Access or SDA). The revolutionary SDA approach transforms conventional networks into Intent-Based Networks, where business logic becomes a physical part of the network, making it easy to automate day-to-day tasks such as configuration, provisioning and troubleshooting. Cisco's SD-Access Solution reduces the time it takes to adapt the network to business needs, improves issue resolutions, and reduces security-breach impacts. A complete discussion of the SDA solution is outside the scope of this guide. Network architects and administrators planning to implement an SDA Fabric architecture for use with DNA Center can find additional information and guidance from the following resources: For a brief introduction to SDA and the Cisco Digital Network Architecture, see the white paper The Cisco Digital Network Architecture Vision An Overview. For more on how DNA Center leverages SD-Access to automate solutions that are not possible with normal networking approaches and techniques, see Software Defined Access: Enabling Intent-Based Networking. For validated designs demonstrating how to implement SDA in your network, see the latest version of the Cisco Software-Defined Access Design Guide. For wireless-specific design guidance, see SD-Access Wireless Design and Deployment Guide. For more on the Digital Network Architecture that is the foundation of DNA Center and the SDA solution, and the roles other Cisco and third-party products and solutions play in this innovative architecture, see the Cisco DNA Design Zone. For other design guides, deployment guides, and white papers, see the Cisco Design Zone Required Interface Cable Connections In order to use DNA Center to manage your network, you must connect the appliance interface ports to your network, using switches to manage these connections. While there are many possible alternative connection schemes, Cisco recommends that you make the following port-to-switch connections: 10Gbps Cluster Port (Port 2, enp10so, Network Adapter 1): This is the left-hand port on the VIC 1227 card in the appliance mlom slot. Its purpose is to enable communications among the master and 12

17 Plan the Deployment Required Interface Cable Connections add-on nodes in a DNA Center cluster. Cable this port to an access switch with connections to the other nodes in the cluster. 10Gbps Enterprise Port (Port 1, enp9s0, Network Adapter 4): This is the right-hand port on the VIC 1227 card in the appliance mlom slot. Its purpose is to enable DNA Center to communicate with and manage your network. Cable this port to an access switch with connections to the enterprise network. 1Gbps CIMC Port (M): This port provides browser access to the CIMC out-of-band appliance management interface and its graphic user interface. Its purpose is to allow you to manage the appliance and its hardware. Cable this port to an access switch with connections to your enterprise management network. 1Gbps DNA Center GUI Port (1, enp1s0f0, Network Adapter 2): This port provides access to the DNA Center graphic user interface. Its purpose is to enable users to manage your network using the DNA Center software. Cable this port to an access switch with connections to your enterprise management network. 1Gbps Cloud Port (2, enp1s0f1, Network Adapter 3): This port is optional. Use it only if you cannot connect the appliance to the Internet (including to your Internet proxy server) using the 10Gbps Enterprise Port (Port 1, enp9s0, Network Adapter 4). If you need to use the Cloud Port, cable it to an access switch with connections to your Internet proxy server. The following figure shows the recommended connections for a standalone DNA Center master node: Figure 3: Recommended Cabling for Standalone Master Node The following figure shows recommended connections for a three-node cluster of DNA Center appliances. As you can see, all but one of the connections for each node in the cluster are the same as those for a standalone node, and use the same ports. The exception is the cluster port, which is required so that each host in the cluster can communicate with the others. 13

18 Required Interface Cable Connections Plan the Deployment Figure 4: Recommended Cabling for Three-Node Cluster For a short video presentation about the rear-panel ports and how they are used, see the first five minutes of Unboxing DNA Center Appliance for Assurance and SD-Access (under the section "Get Started"). For more details on each of the ports, see the Figure 2: DNA Center Appliance Rear Panel, on page 5 diagram and accompanying descriptions in Front and Rear Panels, on page 2. Note Multi-node cluster deployments require all member nodes to be in the same network and at the same site. DNA Center does not support distribution of nodes across multiple networks or sites. When cabling the 10Gbps Enterprise and Cluster ports, please note that both ports support the following media types only: FP-10G-USR (Ultra short range, MMF) SFP-10G-SR(Short range, MMF) SFP-10G-LR(Long range, SMF) 10GBASE-CU SFP+ Cable 1 Meter 10GBASE-CU SFP+ Cable 3 Meter 10GBASE-CU SFP+ Cable 5 Meter 10GBASE-CU SFP+ Cable 7 Meter SFP-10GB-ACU Cable 7 Meter Cisco access switches will automatically detect and adjust to the media type you use. 14

19 Plan the Deployment Required IP Addresses and Subnets Required IP Addresses and Subnets Before beginning the installation, you will need to ensure that your network has sufficient IP addresses available to assign to each of the DNA Center appliance ports you plan on using. Depending on whether you are installing the appliance as the master node or as an add-on node in a cluster, and on other options you select, you will need the following appliance port (NIC) addresses: Note All of the IP addresses called for in these requirements must be valid, physical IPv4 addresses with valid IPv4 netmasks. 1. Cloud Port Address (Optional): One IP address with subnet mask for the 1Gbps Cloud Port (2, enp1s0f1, Network Adapter 3) shown in the figure below. This is an optional port, used only when you cannot connect to the cloud using the Enterprise Port. You do not need an IP for the Cloud Port unless you must use it for this purpose. 2. DNA Center GUI Port Address (Required): One IP address with subnet mask for the 1Gbps DNA Center Port (1, enp1s0f0, Network Adapter 2) shown in the figure below. This port is required, as it allows you to access the DNA Center GUI. 3. CIMC Port Address (Required): One IP address with subnet mask for the 1Gbps CIMC Port (Port M) shown in the figure below. 4. Enterprise Port Address (Required): One IP address with subnet mask for the 10Gbps Enterprise Port (Port 1, enp9s0, Network Adapter 4) shown in the figure below. 5. Cluster Port Address (Required): One IP address with subnet mask for the 10Gbps Cluster Port (Port 2, enp10so, Network Adapter 1) shown in the figure below. During configuration, the Maglev Configuration Wizard will not permit you to proceed until you have assigned the Cluster Link option to an interface. Cisco recommends that you designate port enp10s0 as the Cluster Link. Please be aware, however, that the interface marked as the Cluster Link cannot be changed once configuration completes. If you must later change the interface marked as the Cluster Link, a reinstall will be required. With this in mind, Cisco recommends setting up the Cluster Port with an IP address even if it is not going to be cabled, so as to allow for expansion to a three-node cluster in the future. 15

20 Required IP Addresses and Subnets Plan the Deployment Figure 5: Appliance Ports Needing IP Addresses For more details on each of these ports, see the Figure 2: DNA Center Appliance Rear Panel, on page 5 diagram and descriptions in Front and Rear Panels, on page 2. For cabling information on each of these ports, see the diagrams and descriptions in Required Interface Cable Connections, on page 12. You will also need the following additional IP addresses and dedicated IP subnets, which are prompted for and applied during configuration of the appliance: 1. Cluster Virtual IP Address (Required): One IP address with subnet mask for a VIP used for all traffic between the appliance cluster and your enterprise network. As this is a virtual IP, it is stored as part of the master node configuration. If you are installing the appliance as standalone master node, this is technically optional. However, you will be prompted for it during configuration and it is required in order to add nodes and create a multi-node cluster configuration. For these reasons, Cisco strongly recommends that you choose and assign the cluster VIP address during configuration of the master node. 2. Default Gateway IP Address (Required): The IP address for your network's preferred default gateway. If no other routes match the traffic, traffic will be routed through this IP address. The default gateway IP must be in the same subnet as the Enterprise Port Address. 3. DNS Server IP Addresses (Required): The IP address and subnet mask for one or more of your network's preferred DNS servers. During configuration, you can specify multiple DNS server IP addresses and netmasks by entering them as a space-separated list. Note that, due to an unresolved bug, customers currently cannot change the list of DNS servers after configuration. If you find that you must change the list of DNS server IPs after configuration, contact the Cisco Technical Assistance Center (TAC). 4. Static Route Addresses (Optional): The IP addresses, subnet masks and gateways for one or more static routes. During configuration, you can specify multiple static-route IP addresses, netmasks and gateways by entering them as a space-separated list. 16

21 Plan the Deployment Required IP Addresses and Subnets You can set one or more static routes for any interface on the appliance. You should supply static routes when you want to route traffic in a specific direction other than the default gateway. Each of the interfaces with static routes will be set as the "device" the traffic will be routed through in the IP route command table. For this reason, it is important to match the static route directions with the interface though which the traffic will be sent. Static routes are not recommended in network device routing tables such as those used by switches and routers. Dynamic routing protocols are better for this. However, you should add them where needed to allow the DNA Center appliance access to particular parts of the network that can be reached no other way. 5. NTP Server IP Addresses (Required): The DNS-resolvable hostname, or IP address and subnet mask, for at least one Network Time Protocol (NTP) server. During configuration, you can specify multiple NTP server IPs/masks or hostnames by entering them as a space-separated list. For a production deployment, Cisco recommends that you configure a minimum of three NTP servers. You will specify these servers during pre-flight hardware synchronization and again during configuration of the DNA Center software on each appliance in the cluster. Time synchronization is critical to the accuracy of DNA Center data and coordination of processing across a multi-host cluster. Before deploying DNA Center in production, make sure that the time on the appliance system clock is current and that the Network Time Protocol (NTP) servers you specified are keeping accurate time. If you are planning to integrate DNA Center with Cisco Identity Services Engine (ISE), you should also ensure that ISE is synchronizing with the same NTP servers as DNA Center. 6. Services Subnet (Required): Identifies one dedicated IP subnet for DNA Center to use in managing and getting IPs for communications among its internal application services, such as Assurance, inventory collection, and so on. The dedicated IPv4 Services Subnet must not conflict or overlap with any other subnet in use in the enterprise network, including the Cluster Services Subnet. The minimum size of the subnet is 21 bits; the recommended size is 20 bits to 16 bits. The Services Subnet must conform with the IETF RFC1918 specification for private networks (for details, see RFC1918, Address Allocation for Private Internets, and the Wikipedia article "Private network"). An example of a conformant Services Subnet would be / Cluster Services Subnet (Required): Identifies one dedicated IP subnet for DNA Center to use in managing and getting IPs for communications among its infrastructure services, such as database access, the message bus, and so on. The dedicated IPv4 Cluster Services subnet must not conflict or overlap with any other subnet in use in the enterprise network, including the dedicated DNA Center Services Subnet. The minimum size of the subnet is 21 bits; the recommended size is from 20 bits to 16 bits. The Cluster Services Subnet must conform with the IETF RFC1918 specification for private networks (for details, see RFC1918, Address Allocation for Private Internets, and the Wikipedia article "Private network"). An example of a conformant Cluster Services Subnet would be /21. If you were to specify /21 as your Services Subnet, you could also specify a Cluster Services Subnet of /21, since these two subnets do not overlap. Also note that the Configuration Wizard will detect any overlap between these subnets and will prompt you to correct the overlap. The recommended total IP address space for the two Services and Cluster Services subnets forms a single /20 supernet of 4,096 addresses, which is broken down into two /21 subnets of 2,048 addresses each, to avoid overlaps. IP addresses in this space are assigned to NICs, VIPs, Calico and BGP routing, BGP Route Reflectors (RR), and Kubernetes nodes, pods and services. One reason DNA Center requires this amount of address space is to maintain system performance. Because it uses internal routing and tunneling technologies for east-west (inter-node) communications, using overlapping 17

22 Required Internet URLs and FQDNs Plan the Deployment address spaces would force DNA Center to run Virtual Routing and Forwarding FIBs internally. This would lead to multiple encaps/decaps for packets going from one service to another, causing high internal latency at a very low level, with cascading impacts at higher layers. Another reason is the product's Kubernetes design. DNA Center uses the IP addresses in this space per Kubernetes K8 node. Multiple nodes can make up a single service. Currently, DNA Center supports more than 100 services, each requiring several IP addresses, and new features and corresponding services are added all the time. The address space requirement is purposely kept large at the start to ensure that Cisco can add new services and features to DNA Center without either running out of IPs or requiring customers to re-allocate contiguous address spaces simply to upgrade their systems. The services supported over these subnets are also enabled at Layer 3. The Cluster Services space, in particular, carries data between application and infrastructure services, and is heavily used. The RFC1918 requirement is due to DNA Center's need to download packages and updates from the cloud. If the selected IP ranges do not conform with RFC1918, this can quickly lead to problems with public IP overlaps. Required Internet URLs and FQDNs DNA Center requires secure access to the following table of Uniform Resource Locators (URLs) and Fully Qualified Domain Names (FQDNs). The table describes the features of DNA Center that make use of each URL/FQDN. You must configure either your network firewall itself, or a proxy server, so that IP traffic can travel to and from DNA Center and these resources. If you cannot provide this access for any listed URL/FQDN, the associated DNA Center features will be impaired or inoperable. For more on requirements for proxy access to the Internet, see Provide Secure Access to the Internet, on page 19. Table 6: Required URLs and FQDN Access for DNA Center Features In order to... Download updates to DNA Center's system and application package software, submit user feedback to the DNA Center product team...dna Center must access these URLs and FQDNs Recommended: *.ciscoconnectdna.com:443 1 Customers who want to avoid wildcards can specify these URLs instead:

23 Plan the Deployment Provide Secure Access to the Internet In order to... Integrate with Cisco Meraki...DNA Center must access these URLs and FQDNs Recommended: *.meraki.com:443 Customers who want to avoid wildcards can specify these URLs instead: dashboard.meraki.com:443 api.meraki.com:443 n63.meraki.com:443 Integrate with Cisco.com and Cisco Smart Licensing *.cisco.com:443 Customers who want to avoid wildcards can specify these URLs instead: software.cisco.com cloudsso.cisco.com cloudsso1.cisco.com cloudsso2.cisco.com apiconsole.cisco.com api.cisco.com apx.cisco.com sso.cisco.com apmx-prod1-vip.cisco.com apmx-prod2-vip.cisco.com Render accurate information in DNA Center's site and location maps *.tiles.mapbox.com/* :443. For a proxy, the destination is *.tiles.mapbox.com/* 1 Cisco owns and maintains ciscoconnectdna.com and its subdomains. The Cisco Connect DNA infrastructure meets Cisco's Security and Trust guidelines and undergoes continuous security testing. It is robust, with built-in load balancing and automation capabilities, and is monitored and maintained by a cloud operations team to ensure 24x7x365 availability. Provide Secure Access to the Internet By default, DNA Center is configured to access Cisco.com and other URLs via the Internet, in order to download DNA Center software updates, licenses, and device software, as well as provide up-to-date map information, user feedback, and so on. Providing Internet connections for these purposes is a mandatory requirement. 19

24 Required Network Ports Plan the Deployment Using an HTTPS proxy server is a reliable way to access remote URLs securely. Cisco recommends that you use an HTTPS proxy server to provide DNA Center with the access it needs to the URLs listed in Required Internet URLs and FQDNs, on page 18. During DNA Center installation, you will be prompted to enter the URL and port number of the proxy server you want to use for this purpose, along with the proxy's login credentials (if the proxy requires them). As of this release, DNA Center supports communication with proxy servers over HTTP only. You may locate the HTTPS proxy server anywhere within your network. The proxy server can communicate with the Internet using HTTPS, while DNA Center communicates with the proxy server via HTTP. For these reasons, you will want to be sure to specify the proxy's HTTP port when configuring the proxy during DNA Center configuration. If for any reason you need to change the DNA Center proxy setting after configuration, you can do so via the DNA Center GUI interface. Required Network Ports The following tables list the well-known network service ports that DNA Center appliances use. You must ensure that these ports are open for traffic flows to and from the appliances, whether you open them via firewall settings or a proxy gateway. Additional ports, protocols, and types of traffic must be accomodated if you are deploying DNA Center in a network that employs SDA infrastructure. For details, see Required SD-Access Ports and Protocols, on page 22. Ensure that proper protections exist in your network for accessing port For example, you can configure a proxy gateway or secure subnets to access this port. Table 7: Ports: Incoming Traffic Port Number Permitted Traffic SSH HTTP NTP SNMP HTTPS SCEP Protocol (TCP or UDP) TCP TCP UDP UDP TCP TCP Table 8: Ports: Outgoing Traffic Port Number Permitted Traffic SSH (to the network devices) Telnet (to the network devices) DNS Protocol (TCP or UDP) TCP TCP UDP 20

25 Plan the Deployment Required Network Ports Port Number Permitted Traffic Port 80 may be used for an outgoing proxy configuration. Additionally, other common ports such as 8080 may also be used when a proxy is being configured by the DNA Center configuration wizard (if a proxy is already in use for your network). To access Cisco supported certificates and trust pools, you can configure your network to allow for outgoing IP traffic from the controller to Cisco addresses at the following URL: pki/ NTP SNMP agent HTTPS ISE XMP for PxGrid ISE ERS API traffic Protocol (TCP or UDP) TCP UDP UDP TCP TCP TCP The following table lists the ports that permit incoming IP traffic to DNA Center: Table 9: Ports: IP Traffic Protocol (TCP or UDP) TCP TCP TCP TCP UDP UDP UDP TCP Port Number Traffic Type SSH SSH HTTP HTTPS bootps NTP SNMP SCEP 21

26 Required SD-Access Ports and Protocols Plan the Deployment Additionally, you can configure your network to allow for outgoing IP traffic from DNA Center to Cisco addresses at the following URL: DNA Center uses the IP addresses listed at the above URL to access Cisco supported certificates and trust pools. Required SD-Access Ports and Protocols This topic details the ports, protocols and types of traffic native to a typical SDA fabric deployment like the one shown in the figure below. 22

27 Plan the Deployment Required SD-Access Ports and Protocols Figure 6: SDA Fabric Infrastructure If you have implemented SDA in your network, use the information in the following tables to plan firewall and security policies that secure your SDA infrastructure properly while providing DNA Center with the access it requires to automate your network management. 23

28 Required SD-Access Ports and Protocols Plan the Deployment Table 10: DNA Center Traffic Source Port 2 Source Destination Port Destination Description DNA Center UDP 53 DNS Server From DNA Center to DNS server DNA Center TCP 22 Fabric underlay From DNA Center to fabric switches' loopbacks for SSH DNA Center TCP 23 Fabric underlay From DNA Center to fabric switches' loopbacks for TELNET DNA Center UDP 161 Fabric underlay From DNA Center to fabric switches' loopbacks for SNMP device discovery ICMP DNA Center ICMP Fabric underlay From DNA Center to fabric switches' loopbacks for SNMP device discovery DNA Center TCP 443 Fabric underlay From DNA Center to fabric switches for software upgrades (also to the Internet if there is no proxy) DNA Center TCP 80 Fabric underlay From DNA Center to fabric switches for PnP (also to the Internet if there is no proxy) DNA Center TCP 830 Fabric underlay From DNA Center to fabric switches for Netconf (SDA embedded wireless) UDP 123 DNA Center UDP 123 Fabric underlay From DNA Center to fabric switches for initial time during LAN automation DNA Center UDP 123 NTP Server From DNA Center to NTP server DNA Center TCP 22, UDP 161 WLC From DNA Center to WLC ICMP DNA Center ICMP WLC From DNA Center to WLC 2 Cluster, PKI, SFTP server and proxy port traffic are not included in this table. Table 11: Internet Connectivity Traffic Source Port Source Destination Port Destination Description DNA Center TCP 443 registry.ciscoconnectdna.com Download DNA Center package updates DNA Center TCP Download DNA Center package updates 24

29 Plan the Deployment Required SD-Access Ports and Protocols DNA Center TCP 443 registry-cdn.ciscoconnectdna.com Download DNA Center package updates DNA Center TCP 443 cdn-ciscoconnectdna.com Download DNA Center package updates DNA Center TCP 443 software.cisco.com Download device software DNA Center TCP 443 cloudsso.cisco.com Validate Cisco.com and Smart Account credentials DNA Center TCP 443 cloudsso1.cisco.com Validate Cisco.com and Smart Account credentials DNA Center TCP 443 cloudsso2.cisco.com Validate Cisco.com and Smart Account credentials DNA Center TCP 443 apiconsole.cisco.com CSSM Smart Licensing API DNA Center TCP 443 sso.cisco.com CCO and Smart Licensing DNA Center TCP 443 api.cisco.com CCO and Smart Licensing DNA Center TCP 443 apx.cisco.com CCO and Smart Licensing DNA Center TCP 443 dashboard.meraki.com Meraki integration DNA Center TCP 443 api.meraki.com Meraki integration DNA Center TCP 443 n63.meraki.com Meraki integration DNA Center TCP 443 dnacenter.uservoice.com User feedback submission DNA Center Admin Client TCP 443 *.tiles.mapbox.com Render maps in the browser (for access via proxy, the destination is *.tiles.mapbox.com/*) DNA Center TCP Maps and WLC country code identification Table 12: SDA Fabric Underlay Traffic Source Port 3 Source Destination Port Destination Description UDP 68 Fabric underlay UDP 67 DHCP server From fabric switches to DHCP server for DHCP Relay packet initiated by switches Fabric underlay TCP 80 DNA Center From fabric switches loopback IPs to DNA Center for PnP Fabric underlay TCP 443 DNA Center From fabric switches loopback IPs to DNA Center for image upgrade Fabric underlay UDP 162 DNA Center From fabric switches loopback IPs to DNA Center for SNMP Traps Fabric underlay UDP 514 DNA Center From fabric switches to DNA Center for Assurance 25

30 Required SD-Access Ports and Protocols Plan the Deployment Fabric underlay UDP 6007 DNA Center From fabric switches to DNA Center for NetFlow Fabric underlay UDP 123 DNA Center From fabric switches to DNA Center, used when doing LAN automation ICMP Fabric underlay ICMP DNA Center From fabric switches' loopbacks to DNA Center for SNMP: Device Discovery UDP 161 Fabric underlay DNA Center From fabric switches' loopbacks to DNA Center for SNMP: Device Discovery Fabric underlay UDP 53 DNS Server From fabric switches to DNS Server for name resolution Fabric underlay UDP 1645/1646/1812/1813 ISE From fabric switches loopback IPs to ISE for RADIUS ICMP Fabric underlay ICMP ISE From fabric switches to ISE for troubleshooting UDP 1700/3799 Fabric underlay ISE From fabric switches to ISE for COA Fabric underlay UDP 123 NTP Server From fabric switches loopback IPs to NTP Server control-plane UDP and TCP 4342/4343 WLC From control-plane loopback IP to WLC for Fabric enabled Wireless 3 Border routing protocol, SPAN, profiling and telemetry traffic are not included in this table. Table 13: Wireless LAN Controller (WLC) Traffic Source Port UDP 5246/5247/5248 ICMP UDP 161 ICMP Source WLC WLC WLC WLC WLC WLC WLC WLC WLC Destination Port ICMP UDP 69/5246/ /12223 TCP 22 UDP and TCP 4342/4343 TCP UDP 162 ICMP UDP 53 Destination AP IP Pool AP IP Pool AP IP Pool Control plane DNA Center DNA Center DNA Center DNA Center DNS Server Description From WLC to AP subnet for CAPWAP From WLC to APs allowing Ping for troubleshooting From WLC to AP subnet for CAPWAP/LWAPP From WLC to control-plane loopback IP From WLC to DNAC for device discovery From WLC to DNA Center for SNMP From WLC to DNA Center for SNMP traps From WLC to allow Ping for troubleshooting From WLC to DNS Server 26

31 Plan the Deployment Required SD-Access Ports and Protocols WLC TCP 443 ISE From WLC to ISE for Guest SSID Web authorization WLC UDP 1812/1645/1813/1646 ISE From WLC to ISE for RADIUS authentication ICMP WLC ICMP ISE From WLC to ISE ICMP for troubleshooting WLC UDP 123 NTP server From WLC to NTP server Table 14: Fabric-Enabled Wireless Access Point (AP) IP Pool Traffic Source Port Source Destination Port Destination Description UDP 68 AP IP Pool UDP 67 DHCP server From AP IP Pool to DHCP server ICMP AP IP Pool ICMP DHCP server From AP IP Pool to ICMP for troubleshooting AP IP Pool UDP 69/5246/5247/5248/12222/12223 WLC From AP IP Pool to WLC for CAPWAP/LWAPP ICMP AP IP Pool ICMP WLC From AP IP Pool to WLC, allowing Ping for troubleshooting Table 15: Identity Services Engine (ISE) Traffic Source Port 4 Source Destination Port Destination Description ISE TCP Border From ISE to Border Node for SXP ISE UDP 514 DNA Center From ISE to Syslog server (DNA Center) UDP 1645/1646/1812/1813 ISE Fabric underlay From ISE to fabric switches for RADIUS and authorization ISE UDP 1700/3799 Fabric underlay From ISE to fabric switches loopback IPs for care-of-address ICMP ISE ICMP Fabric underlay From ISE to fabric switches for troubleshooting ISE UDP 123 NTP Server From ISE to NTP server UDP 1812/1645/1813/1646 ISE WLC From ISE to WLC for RADIUS ICMP ISE ICMP WLC From ISE to WLC for troubleshooting 4 Note: High availability and profiling traffic are not included in this table. 27

32 Required Configuration Information Plan the Deployment Table 16: DHCP Server Traffic Source Port Source Destination Port Destination Description UDP 67 DHCP server UDP 68 AP IP Pool From DHCP server to fabric APs ICMP DHCP server ICMP AP IP Pool ICMP for troubleshooting: Fabric to DHCP UDP 67 DHCP server UDP 68 Fabric underlay From DHCP to fabric switches ICMP DHCP server ICMP Fabric underlay ICMP for troubleshooting: Fabric to DHCP UDP 67 DHCP server UDP 68 User IP Pool From DHCP server to fabric switches ICMP DHCP server ICMP User IP Pool ICMP for troubleshooting: User to DHCP Table 17: NTP Server Traffic Source Port Source Destination Port Destination Description UDP 123 NTP Server ISE From NTP server to ISE UDP 123 NTP Server DNA Center From NTP server to DNA Center UDP 123 NTP Server Fabric underlay From NTP server to fabric switches loopback UDP 123 NTP Server WLC From NTP server to WLC Table 18: DNS Server Traffic Source Port Source Destination Port Destination Description UDP 53 DNS Server Fabric underlay From DNS server to fabric switches UDP 53 DNS Server WLC From DNS server to WLC Required Configuration Information During appliance configuration, you will be prompted for the following information, in addition to the Required IP Addresses and Subnets, on page 15: 28

33 Plan the Deployment Required Configuration Information 1. Linux User Name: This is maglev. This user name is the same on all DNA Center appliances in a cluster, including both the master node and add-on nodes, and cannot be changed. 2. Linux Password : Identifies the password for the Linux User Name maglev. This password ensures secure access to each appliance's Maglev database root and clients via the Linux command line. Access to the Maglev root and clients requires this password. If you choose to do so, you can assign a different Linux Password for each maglev Linux User Name on each appliance in a cluster. You must create the Linux Password because there is no default. The password must meet the following requirements: Eight character minimum length. Does NOT contain a tab or a line break. Does contain characters from at least three of the following categories: Uppercase alphabet Lowercase alphabet Numeral Special characters (for example,! or #) The Linux password is encrypted and hashed in the DNA Center database. If you are deploying a multi-node cluster, you will also be prompted to enter the master node's Linux Password on each of the add-on nodes. 3. Password Generation Seed (Optional): Instead of inventing the Linux Password, you can enter a seed phrase and press Generate Password. The Maglev Configuration Wizard will generate a random and secure password using that seed phrase. You can further edit the generated password using the Auto Generated Password field. 4. Administrator Passphrase: Identifies the password used for web access to DNA Center in a cluster. This is the password for the superuser account admin, which you use to log in to DNA Center for the first time (see Log In for the First Time, on page 78). You will be prompted to change this password when you log in for the first time, to ensure it is secure. You must create this password because there is no default. The Administrator Passphrase must meet the same requirements as the Linux Password described above. 5. CIMC User Password: Identifies the password used for access to the CIMC graphic user interface. The factory default is password, but you will be prompted to change it when you first set up CIMC for access via Web browser (see Enable Browser Access to CIMC, on page 40). The CIMC User password must meet the same requirements as the Linux Password described above. It can be changed back to password only by a reset to factory defaults. 6. Master Node IP Address: Required only when you are installing add-on nodes in a cluster. This is the IP address of the Cluster Port on the master node (see Required Interface Cable Connections, on page 12). 29

34 Required First-Time Setup Information Plan the Deployment Required First-Time Setup Information Once you have completed configuration of your appliances, you will log into DNA Center for the first time and complete essential setup tasks. During this first-time setup, you will need to have the following information: 1. New Admin Superuser Password: You will be prompted to enter a new password for the DNA Center admin superuser. Resetting the superuser password enhances operational security. This is especially important if, for example, the enterprise staff who installed and configured the DNA Center appliance will not be DNA Center users or administrators. 2. Cisco.com Credentials: The Cisco.com user ID and password that your organization uses to register software downloads and receive system communications via Cisco Smart Account Credentials: The Cisco.com Smart Account user ID and password your organization uses for managing your device and software licenses. 4. IP Address Manager URL and Credentials: The host name, URL, admin user name and admin password of the third-party IP address manager (IPAM) server you plan to use with DNA Center. The current release supports InfoBlox or Bluecat. 5. Proxy URL, Port and Credentials: The URL (host name or IP address), port number, user name and user password of the proxy server you plan to use with DNA Center in order to get updates to the DNA Center software, manage device licenses, and retrieve other downloadable content. 6. DNA Center Users: User names, passwords, and privilege settings for the new DNA Center users you will be creating. Cisco recommends that you always use one of these new user accounts for all your normal DNA Center operations. Avoid using the admin superuser account for anything but reconfiguring DNA Center and other operations where superuser privileges are explicitly required. For details about how to launch and respond to the first-time setup wizard that prompts you for this information, see Log In for the First Time, on page 78 You will also need the following information to complete the remaining setup tasks, which can be done after your first login: 1. ISE Server IP and Credentials: You will need the Cisco Identify Services Engine (ISE) server IP address, administrative user name, and password. These are needed to log in to and configure your organization's ISE server to share data with DNA Center, as explained in Integrate Cisco ISE With DNA Center, on page Authorization and Policy Server Information: If you are using Cisco ISE as your authentication and policy server, you will need the same information as for the ISE integration above, plus the ISE CLI user name, CLI password, server FQDN, a subscriber name (such as dnac), the ISE SSH key (optional), the protocol choice (RADIUS or TACACS), the authentication port, the accounting port, and retry/timeout settings. If you are using a different authorization and policy server, you will need that server's IP address, protocol choice (RADIUS or TACACS), authentication port, accounting port, and retry/timeout settings. You will use this information to integrate DNA Center with your chosen authentication and policy server, as explained in Configure Authentication and Policy Servers, on page SNMP Retry and Timeout Values: Needed to setup up device polling and monitoring, as explained in Configure SNMP Properties, on page

35 CHAPTER 3 Install the Appliance Appliance Installation Workflow, on page 31 Unpack and Inspect the Appliance, on page 32 Review the Installation Warnings and Guidelines, on page 33 Review the Rack Requirements, on page 34 Connect and Power On the Appliance, on page 34 Check the LEDs, on page 35 Appliance Installation Workflow The following table details the physical installation tasks and the order in which to perform them. Follow these steps for each DNA Center appliance you install. Be sure to install all of the appliances before configuring the first, master node. When you have completed all of the tasks in this table successfully, continue by following the steps in Appliance Configuration Workflow, on page 39. Click this link for video demonstrating the DNA Center appliance unboxing, installation and configuration process. 31

36 Unpack and Inspect the Appliance Install the Appliance Table 19: DNA Center Appliance Installation Tasks Step 1 Description Review and address the deployment planning requirements, including gathering the information you will need to supply during configuration and setup: About DNA Center and Software-Defined Access, on page 12 Required Interface Cable Connections, on page 12 Required IP Addresses and Subnets, on page 15 Required Internet URLs and FQDNs, on page 18 Provide Secure Access to the Internet, on page 19 Required Network Ports, on page 20 Required Configuration Information, on page 28 Required First-Time Setup Information, on page 30 2 Review the appliance's features and specifications: Feature Summary, on page 1 Front and Rear Panels, on page 2 Physical Specifications, on page 8 Environmental Specifications, on page 9 Power Specifications, on page Unpack the appliance: Unpack and Inspect the Appliance, on page 32 Review the operational warnings and guidelines about the appliance: Review the Installation Warnings and Guidelines, on page 33 Install the appliance in a rack: Review the Rack Requirements, on page 34 Connect power to the appliance and power it on: Connect and Power On the Appliance, on page 34 Check the front- and back-panel LEDs to ensure the appliance is functional: Check the LEDs, on page 35 Unpack and Inspect the Appliance Caution When handling internal appliance components, wear an ESD strap and handle modules by the carrier edges only. 32

37 Install the Appliance Review the Installation Warnings and Guidelines Tip Keep the shipping container in case the appliance requires shipping in the future. Note The chassis is thoroughly inspected before shipment. If any damage occurred during transportation or any items are missing, contact your customer service representative immediately. Step 1 Step 2 Step 3 Remove the appliance from its cardboard container and save all packaging material. Compare the shipment to the equipment list provided by your customer service representative. Verify that you have all items. Check for damage and report any discrepancies or damage to your customer service representative. Have the following information ready: Invoice number of shipper (see the packing slip) Model and serial number of the damaged unit Description of damage Effect of damage on the installation Review the Installation Warnings and Guidelines Warning To prevent the system from overheating, do not operate it in an area that exceeds the maximum recommended ambient temperature of: 95 F (35 C). Statement 1047 Warning The plug-socket combination must be accessible at all times, because it serves as the main disconnecting device. Statement 1019 Warning This product relies on the building s installation for short-circuit (overcurrent) protection. Ensure that the protective device is rated not greater than: 250 V, 15 A. Statement 1005 Warning Installation of the equipment must comply with local and national electrical codes. Statement

38 Review the Rack Requirements Install the Appliance Caution To ensure proper airflow it is necessary to rack the appliances using rail kits. Physically placing the units on top of one another or stacking without the use of the rail kits blocks the air vents on top of the appliances, which could result in overheating, higher fan speeds, and higher power consumption. We recommend that you mount your appliances on rail kits when you are installing them into the rack because these rails provide the minimal spacing required between the appliances. No additional spacing between the appliances is required when you mount the units using rail kits. Caution Avoid uninterruptible power supply (UPS) types that use ferroresonant technology. These UPS types can become unstable with systems such as the Cisco UCS, which can have substantial current-draw fluctuations due to fluctuating data traffic patterns. When you are installing an appliance, follow these guidelines: Plan your site configuration and prepare the site before installing the appliance. See the Cisco UCS Site Preparation Guide for help with recommended site planning and preparation tasks. Ensure that there is adequate space around the appliance to allow for servicing the appliance and for adequate airflow. The airflow in this appliance is from front to back. Ensure that the site air-conditioning meets the thermal requirements listed in the Environmental Specifications, on page 9. Ensure that the cabinet or rack meets the requirements listed in Review the Rack Requirements, on page 34. Ensure that the site power meets the requirements listed in Power Specifications, on page 10. If available, you can use a UPS to protect against power failures. Review the Rack Requirements For proper operation, the rack in which you install the DNA Center appliance must meet the following requirements: A standard 19-in. (48.3-cm) wide, four-post EIA rack, with mounting posts that conform to English universal hole spacing, per section 1 of ANSI/EIA-310-D The rack post holes can be square 0.38-inch (9.6 mm), round 0.28-inch (7.1 mm), #12-24 UNC, or #10-32 UNC when you use the supplied slide rails. The minimum vertical rack space per server must be one RU, equal to 1.75 in. (44.45 mm). Connect and Power On the Appliance This section describes how to power on the DNA Center appliance and check that it is functional. 34

39 Install the Appliance Check the LEDs Step 1 Attach the supplied power cord to each power supply in the appliance and then attach the power cords to a grounded AC power outlet. See Power Specifications, on page 10 for details. Wait for approximately two minutes to let the appliance boot into standby power mode during the first boot up. You can verify the power status by looking at the Power Status LED: Off There is no AC power present in the appliance. Amber The appliance is in standby power mode. Power is supplied only to the CIMC and some motherboard functions. Green The appliance is in main power mode. Power is supplied to all appliance components. Step 2 For more information on these and other appliance LEDs, see Front and Rear Panels, on page 2. Connect a USB keyboard and VGA monitor to the server, using the supplied KVM cable connected to the KVM connector on the front panel. Alternatively, you can use the VGA and USB ports on the rear panel. You can only connect to one VGA interface at a time. What to do next Continue by following the procedure in Check the LEDs, on page 35. Check the LEDs After you have powered up the DNA Center appliance, check the state of the front-panel and rear-panel LEDs and buttons to ensure it is functioning. The following illustrations show the LEDs for a functional appliance after physical installation and first power-up and before configuration. 35

40 Check the LEDs Install the Appliance Figure 7: DNA Center Front Panel LEDs LED Desired Status Indicator Drive Fault LEDs: Off. Drive Activity LEDs: Green Power Status: Green System Status: Green Fan Status: Green Temperature Status: Green Power Supply Status: Green Network Link Activity: Off Figure 8: DNA Center Rear Panel LEDs 36

41 Install the Appliance Check the LEDs LED 1 2 Desired Status Indicator At initial power-up, all ports should have their Link Status and Link Speed LEDs showing as Off, and their Power Status LED should be Green. After network settings are configured and tested using the Maglev Configuration Wizard (see Configure the Master Node, on page 51 and Configure Add-On Nodes, on page 64), the Link Status, Link Speed and Power Status LEDs for all cabled ports should be Green. All uncabled port LEDs should be unchanged. Power Supply Fault LEDs: Off. AC Power LEDs: Green If you see LEDs with colors other than those shown above, you may have a problem condition. See Front and Rear Panels, on page 2 for details on the likely causes of the status. Be sure to correct any problem conditions before proceeding to configure the appliance. 37

42 Check the LEDs Install the Appliance 38

43 CHAPTER 4 Configure the Appliance Appliance Configuration Workflow, on page 39 Enable Browser Access to CIMC, on page 40 Execute Pre-Flight Checks, on page 45 Configure the Master Node, on page 51 Configure Add-On Nodes, on page 64 Appliance Configuration Workflow You can deploy the DNA Center appliance in your network in one of two modes: Standalone: As a single node offering all DNA Center functions. This option is usually preferred for initial or test deployments and in smaller network environments. Cluster: As one of a cluster of up to three nodes. In this mode, DNA Center shares all of its services and data among the hosts. This is the preferred option for large deployments. If you choose standalone mode for your initial deployment, you can add more appliances later to form a cluster. Be sure when configuring the standalone host to set it up as the first, or master, node in the cluster. If you choose cluster mode for your initial deployment, be sure to finish configuring the master node before going on to configure the add-on nodes. The following table details the configuration tasks and the order in which to perform them. When you have completed the tasks in this table successfully, continue by completing first-time setup, as explained in First-Time Setup Workflow, on page 77. Click this link for video demonstrating the DNA Center appliance configuration process. Table 20: DNA Center Appliance Configuration Tasks Step 1 2 Description Enable browser access to the appliance's Cisco Integrated Management Controller (CIMC) graphic user interface: Enable Browser Access to CIMC, on page 40. Ensure trouble-free configuration by checking and adjusting hardware and switch settings: Execute Pre-Flight Checks, on page

44 Enable Browser Access to CIMC Configure the Appliance Step 3 4 Description Launch the Maglev Configuration wizard from CIMC and configure the master node in the cluster: Configure the Master Node, on page 51. If you have installed three appliances and want to add the second and third nodes to the cluster: Configure Add-On Nodes, on page 64. Enable Browser Access to CIMC After installing the appliance as described in Appliance Installation Workflow, on page 31, use the Cisco IMC Configuration Utility to assign an IP address and gateway to the appliance's Cisco Integrated Management Controller (CIMC) Port. This will give you browser access to the CIMC graphic user interface, which you use to configure the appliance for use. Once you have completed this CIMC setup, you will want to log in to CIMC and run several tasks that help to ensure correct configuration (see Execute Pre-Flight Checks, on page 45). Tip To help ensure the security of your deployment, CIMC prompts you to change the CIMC user's default password when you boot the appliance for the first time. If you want to change the CIMC user password later, it is easiest to use the CIMC GUI, as follows: 1. Select > Admin > User Management > Local User Management. 2. Select ID 1, then click Modify User. Enter the new password in the Change Password field, then click Save.. Step 1 Step 2 Step 3 Access the appliance console by attaching either: a) A KVM cable to the KVM connector on the appliance's front panel (component 12 on the illustraton of the Figure 1: DNA Center Appliance Front Panel, on page 3 shown in Front and Rear Panels, on page 2), or, b) A keyboard and monitor to the USB and VGA ports on the appliance's rear panel (components 7 and 12, respectively, on the illustraton of the Figure 2: DNA Center Appliance Rear Panel, on page 5 shown in Front and Rear Panels, on page 2). Make sure that the appliance power cord is plugged in and the power is on. Press the Power button on the front panel to boot the appliance. Watch for the Cisco IMC Configuration Utility boot screen to be displayed, as shown below. 40

45 Configure the Appliance Enable Browser Access to CIMC Step 4 As soon as the boot screen is displayed, press F8 to perform Cisco IMC Configuration. The Cisco IMC Configuration Utility displays the CIMC User Details screen, as shown below. Step 5 Step 6 Enter the default CIMC user password (the default on a new appliance is password) in the Enter current CIMC Password field. Then enter and confirm the new CIMC user password in the Enter new CIMC password and Re-Enter new CIMC passwordfields. When you press Enter in the Re-Enter new CIMC password field, the Cisco IMC Configuration Utility displays the NIC Properties screen, as shown below. 41

46 Enable Browser Access to CIMC Configure the Appliance Step 7 Make the following changes: NIC mode Select Dedicated. IP (Basic) Select IPV4. CIMC IP Enter the IP address of the CIMC Port (M). Prefix/Subnet Enter the subnet mask for the CIMC Port IP address. Gateway Enter the IP address of your preferred default gateway. Pref DNS Server Enter the IP address of your preferred DNS server. NIC Redundancy Select None. Step 8 Press F1 to specify Additional settings. The Cisco IMC Configuration Utility displays the Common Properties screen, as shown below. 42

47 Configure the Appliance Enable Browser Access to CIMC Step 9 Make the following changes: Hostname: Enter a hostname for CIMC on this appliance. Dynamic DNS: Unselect the checkbox to disable this feature. Factory Defaults: Unselect the checkbox to disable this feature. Default User (Basic): Leave these fields blank. Port Properties: Enter new settings or accept the defaults shown in these fields. Port Profiles: Unselect the checkbox to disable this feature. Step 10 Step 11 Step 12 Press F10 to Save the settings. Press Escape to Exit and reboot the appliance. After the settings are saved and the appliance finishes rebooting, open a compatible browser on a client machine with access to the subnet on which the appliance is installed and enter the following URL: where CIMC_ip_address is the CIMC Port IP address that you entered in Step 5. Your browser displays a main Cisco Integrated Management Controller GUI login window like the one shown below. 43

48 Enable Browser Access to CIMC Configure the Appliance Step 13 Login using the CIMC user ID and password you set in Step 5. If login is successful, your browser displays a Cisco Integrated Management Controller Chassis Summary window like the one shown below. 44

49 Configure the Appliance Execute Pre-Flight Checks What to do next Perform tasks that help to ensure a trouble-free configuration: Execute Pre-Flight Checks, on page 45. Execute Pre-Flight Checks After installing the appliance as described in Appliance Installation Workflow, on page 31 and setting up access to the CIMC GUI as described in Enable Browser Access to CIMC, on page 40, use CIMC to perform the following pre-configuration tasks, which help to ensure correct configuration and deployment: 1. Synchronize the appliance hardware with the Network Time Protocol (NTP) servers you use to manage your network. These must be the same NTP servers whose hostnames or IPs you gathered for use when planning your implementation, as explained in Required IP Addresses and Subnets, on page 15. This is a critical task that ensures that your DNA Center data is synchronized properly across the network. 2. Check that the appliance's 10Gbps ports are enabled and properly configured for high throughput. 3. Reconfigure the access switches connected to the 10Gbps appliance ports to support higher throughput settings. 4. Reconfigure the access switches connected to the 10Gbps appliance ports to support oversize 802.1p frames.. Step 1 Login to the appliance's CIMC using the CIMC IP address, user ID and password you set in Enable Browser Access to CIMC, on page 40. If login is successful, your browser displays the Cisco Integrated Management Controller Chassis Summary window, as shown below. 45

50 Execute Pre-Flight Checks Configure the Appliance Step 2 Synchronize the appliance hardware with the Network Time Protocol (NTP) servers you use to manage your network, as follows: a) With the Chassis Summary window displayed, click the icon to display the CIMC menu. b) From the CIMC menu, select Admin > Networking > NTP Setting. CIMC displays the NTP Setting tab. c) Make sure the NTP Enabled box is checked, then enter up to four NTP server host names or addresses in the four numbered Server fields, as in the example shown below. d) When you are finished, click Save Changes. CIMC will validate your entries, then begin to synchronize the time on the appliance hardware with the time on the NTP servers. Step 3 Next, check that the appliance NICs are configured to support high throughput, as follows: a) If needed, click the icon to display the CIMC menu. b) From the CIMC menu, select Chassis > Inventory > Cisco VIC Adapters. Verify that the Product ID "UCSC-MLOM-CSC-02" is listed for the MLOM slot, as shown below: c) Select > Compute > BIOS > Configure BIOS > Advanced. Verify that the Reboot Host Immediately checkbox is unchecked and note the location of the LOM and PCIe Slots Configuration dropdown. 46

51 Configure the Appliance Execute Pre-Flight Checks d) Select LOM and PCIe Slots Configuration. Then, using the dropdown selectors, set PCIe Slot: MLOM OptionROM to Enabled and PCIe Slot: MLOM Link Speed to Auto. e) Click Save. You will be prompted to reboot the host. Click Cancel to continue instead of rebooting. f) Select > Networking > Adapter Card MLOM > General. Take note of the MAC addresses for Port-0 and Port-1 (shown in the External Ethernet Interfaces section at the bottom of the page). In the Adapter Card 47

52 Execute Pre-Flight Checks Configure the Appliance Properties section, use the dropdown selectors next to Port-0 and Port-1 to set the speed of both these ports to Auto, as shown below. Then click Save Changes. g) Click the vnics tab and select eth0 from the vnics dropdown. Use the selectors and fields to set these values for eth0: VLAN Mode: Trunk MTU: 1500 Default VLAN: 99 (Please note that "99" is only an example. You should enter the default VLAN you want your DNA Center appliances and their access switches to use.) 48

53 Configure the Appliance Execute Pre-Flight Checks Tip 1500 is the minimum MTU size. You can improve throughput on the 10Gbps ports by entering any higher value, up to a maximum of h) Click Save Changes. You will be prompted to reboot the host again. Click Cancel to continue instead of rebooting. i) Select eth1 from the vnics dropdown. Use the dropdown selectors to set the same values for eth1 that you set for eth0 above. j) When you are finished, click Save Changes. You will be prompted to reboot the host. This time, click OK to reboot the appliance. k) When the appliance is finished rebooting, log in to the CIMC GUI again. Select > Networking > Adapter Card MLOM > General > vnics. Verify the accuracy of the vnic MAC addresses and the MTU, VLAN and VLAN Mode parameters you set earlier. l) When you are finished: Click the Host Power menu at top right and select Power Cycle. Then click OK. Step 4 Next, reconfigure your access switches to match the high-throughput settings on the appliance, as follows: a) Using a Secure Shell (SSH) client, login to the switch to be configured and enter EXEC mode at the switch prompt. b) Enter the following series of commands to configure the switch port: 49

54 Execute Pre-Flight Checks Configure the Appliance MySwitch#Config terminal MySwitch(config)#interface tengigabitethernet 1/1/3 MySwitch(config-if)#switchport mode trunk MySwitch(config-if)#switchport trunk allowed vlan 99 MySwitch(config-if)#speed auto MySwitch(config-if)#duplex full MySwitch(config-if)#mtu 1500 MySwitch(config-if)#no shut MySwitch(config-if)#end MySwitch(config)#copy running-config startup-config Please note that these commands are examples only. Use the same VLAN ID and MTU values you entered when configuring the appliance NICs above. The command values for link speed, duplex and MTU are the defaults for the example switch, so you will need to enter them only if you have changed the defaults. You may, as with the appliance NICs, also set the MTU up to a maximum of 9000, for better throughput. c) Run the command show interface tengigabitethernet portid and verify that the port is connected and running, and has the correct MTU, duplex, and link type settings in the command output. For example: MySwitch#show interface tengigabitethernet 1/1/3 TenGigabitEthernet1/1/3 is up, line protocol is up (connected) Hardware is Ten Gigabit Ethernet, address is XXXX b7 (bia XXX b7) MTU 1500 bytes, BW Kbit/sec, DLY 10 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive not set Full-duplex, 10GB/s, link type is auto, media type is SFP-10Gbase-SR d) Run the command show run interface tengigabitethernet portid to configure the switch ports where the cables from the VIC 1227 ports are connected. For example: MySwitch#show run interface tengigabitethernet 1/1/3 Building configuration... Current configuration : 129 bytes! interface TenGigabitEthernet1/1/3 switchport trunk allowed vlan 99 switchport mode trunk ip device tracking maximum 10 end MySwitch# e) Run the command show mac address-table interface tengigabitethernet portid and verify the MAC address from the command output. For example: MySwitch#show mac address-table interface tengigabitethernet 1/1/3 Mac Address Table -- Vlan Mac Address Type Ports b4de c DYNAMIC Te1/1/3 Total Mac Addresses for this criterion: 1 MySwitch# Step 5 Finally, configure the access switches connected to the 10Gbps appliance ports to support oversize 802.1p frames: a) If you have not already done so, use a Secure Shell (SSH) client to login in to the switch to be configured and enter EXEC mode at the switch prompt. b) Enter the following series of commands to configure the switch port to support 802.1P frames: MySwitch#Config terminal MySwitch(config)#interface tengigabitethernet 1/1/3 50

55 Configure the Appliance Configure the Master Node MySwitch(config-if)#switchport voice vlan dot1p MySwitch(config-if)#no shut MySwitch(config-if)#end MySwitch(config)#copy running-config startup-config c) Run the command show run interface tengigabitethernet portid and verify from the command output that the port has the correct voice vlan dot1p setting. For example: MySwitch#show run interface tengigabitethernet 1/1/3 Building configuration... Current configuration : 62 bytes! interface tengigabitethernet1/1/3 switchport mode trunk switchport voice vlan dot1p MySwitch#end What to do next Continue by configuring the first installed appliance as the cluster's master node: Configure the Master Node, on page 51. Configure the Master Node Perform the following steps to configure the first installed DNA Center appliance as the master node. You must always configure the first appliance as the master node, whether it will operate standalone or as part of a DNA Center cluster. If you are configuring the installed appliance as an add-on node for an existing cluster that already has a master node, follow the steps in Configure Add-On Nodes, on page 64 instead. Before you begin Ensure that you: Collected all of the information called for in Required IP Addresses and Subnets, on page 15 and Required Configuration Information, on page 28. Installed the first appliance as described in Appliance Installation Workflow, on page 31. Configured CIMC browser access on the master node, as described in Enable Browser Access to CIMC, on page 40. Checked that the master node appliance's ports and the switches it uses are properly configured, as described in Execute Pre-Flight Checks, on page 45. Are using a browser that is compatible with CIMC and DNA Center. For a list of compatible browsers, see the Release Notes for the version of DNA Center you are installing. Step 1 Point your browser to the CIMC IP address you set during the CIMC GUI configuration you performed, and login to the CIMC GUI as the CIMC user (see Enable Browser Access to CIMC, on page 40). 51

56 Configure the Master Node Configure the Appliance After successful login, the appliance displays the Cisco Integrated Management Controller Chassis Summary window, with a blue link menu at the upper right, as shown below. Step 2 From the blue link menu, choose Launch KVM and then select either Java based KVM or HTML based KVM. If you select the Java-based KVM, you will need to launch the Java startup file from your browser or file manager in order to view the KVM console in its own window. If you select the HMTL-based KVM, it will launch the KVM console in a separate browser window or tab automatically. Irrespective of the KVM type you choose, use the KVM console to monitor the progress of the configuration and respond to Maglev Configuration Wizard prompts. Step 3 With the KVM displayed, reboot the appliance by making one of the following selections: a) In the main CIMC GUI browser window: Choose Host Power > Power Cycle. Then switch to the KVM console to continue. b) In the KVM console: Choose Power > Power Cycle System (cold boot). If asked to confirm your choice to reboot the appliance, click OK. After displaying reboot messages, the KVM console displays the Maglev Configuration Wizard welcome screen, shown below. 52

57 Configure the Appliance Configure the Master Node Step 4 Choose Start a DNA-C cluster to begin configuring the master node. The Wizard discovers all of the ports on the appliance and presents them to you one by one, in separate screens, in the following order: 1. 10Gbps Cluster Port (Port 2, enp10s0, Network Adapter #1) 2. 1Gbps DNA Center GUI Port (1, enp1s0f0, Network Adapter #2) 3. 1Gbps Cloud Port (2, enp1s0f1, Network Adapter #3) 4. 10Gbps Enterprise Port (Port 1, enp9s0, Network Adapter #4) Note If the Wizard fails to display one or both of the 10Gbps ports during the course of configuration, these ports may be non-functional or disabled. These 10Gbps ports are required for DNA Center functionality. If you discover they are non-functional, choose cancel to exit the configuration immediately. Be sure you have completed all of the steps provided in Execute Pre-Flight Checks, on page 45 before resuming configuration or contacting the Cisco Technical Assistance Center (TAC). Step 5 The Wizard discovers the 10Gbps Cluster Port (Port 2, enp10s0) first, and presents it as NETWORK ADAPTER #1. As explained in Required Interface Cable Connections, on page 12, this port is used to link the appliance to the cluster, so apply the host IP address, netmask, and other settings appropriate for this purpose (see Required IP Addresses and Subnets, on page 15, and Required Configuration Information, on page 28). 53

58 Configure the Master Node Configure the Appliance Enter configuration values for NETWORK ADAPTER #1 as shown in the table below. Table 21: Master Node Entries for Network Adapter #1: 10Gbps Cluster Port (enp10s0) Host IP address Netmask Default Gateway IP address DNS Servers Static Routes Cluster Link Configure IPv6 Address Enter the IP address for the Cluster Port. This is required. Note that you cannot change the address of the Cluster Port later. Enter the netmask for the port's IP address. This is required. Enter a default gateway IP address to use for the port. This is usually required on the Enterprise Port only. Enter the IP address of the preferred DNS server. If entering multiple DNS servers, separate the IP addresses in the list with spaces. This is usually required on the DNA Center GUI Port only. Enter one or more static routes in the following format, separated by spaces: <network>/<netmask>/<gateway>. This is usually required on the DNA Center GUI Port only. Select the checkbox to indicate that this port will be the link to a DNA Center cluster. This is required on the Cluster Port only. Reserved for future use. Leave this field blank. 54

59 Configure the Appliance Configure the Master Node When you are finished entering configuration values, enter next>> to proceed. After entering next>>, the Wizard validates the values you entered and issues an error message if any are incorrect. If you receive an error message, check that the value you entered is correct, then re-enter it. If needed, select <<back to re-enter it. Step 6 After successful validation of the Cluster Port values you entered, the Wizard presents the 1Gbps DNA Center GUI Port (1, enp1s0f0) as NETWORK ADAPTER #2. As explained in Required Interface Cable Connections, on page 12, this port is used to access the DNA Center GUI from your management network. Apply the host IP address, netmask, and other values appropriate for this purpose (see Required IP Addresses and Subnets, on page 15, and Required Configuration Information, on page 28 for the values to enter). Enter configuration values for NETWORK ADAPTER #2 as shown in the table below. Table 22: Master Node Entries for Network Adapter #2: 1Gbps DNA Center GUI Port (enp1s0f0) Host IP address Netmask Default Gateway IP address DNS Servers Enter the IP address for the 1Gpbs DNA Center GUI Port. This is required. Enter the netmask for the port's IP address. This is required. Enter a default gateway IP address to use for the port. This is usually required on the Enterprise Port only. Enter the IP address of the preferred DNS server. If entering multiple DNS servers, separate the IP addresses in the list with spaces. 55

60 Configure the Master Node Configure the Appliance Static Routes Cluster Link Configure IPv6 Address Enter one or more static routes in the following format, separated by spaces: <network>/<netmask>/<gateway>. Leave this field blank. It is required on the Cluster Port only. Reserved for future use. Leave this field blank. When you are finished, enter next>> to proceed. Correct any validation errors as you did in previous screens. Step 7 After successful validation of the DNA Center GUI Port values you entered, the Wizard presents the 1Gbps Cloud Port (2, enp1s0f1) as NETWORK ADAPTER #3. As explained in Required Interface Cable Connections, on page 12, this is an optional port used to link the appliance to the Internet when you cannot do so through the 10Gbps Enterprise Port (Port 1, enp9s0). Apply the host IP address, netmask, and other values appropriate for this purpose (see Required IP Addresses and Subnets, on page 15, and Required Configuration Information, on page 28 for the values to enter). Enter configuration values for NETWORK ADAPTER #3 as shown in the table below. Table 23: Master Node Entries for Network Adapter #3: 1Gbps Cloud Port (enp1s0f1) Host IP address Netmask Enter the IP address for the Cloud Port. This is required only if you are using the Cloud Port for internet connection; otherwise, you can leave it blank. Enter the netmask for the port's IP address. This is required if you enter an IP address. 56

61 Configure the Appliance Configure the Master Node Default Gateway IP address DNS Servers Static Routes Cluster Link Configure IPv6 Address Enter a default gateway IP address to use for the Cloud Port. This is usually required on the Enterprise Port only. Enter the IP address of the preferred DNS server. If entering multiple DNS servers, separate the IP addresses in the list with spaces. This is usually required on the Enterprise Port only. Enter one or more static routes in the following format, separated by spaces: <network>/<netmask>/<gateway>. This is usually required on the DNA Center GUI Port only. Leave this field blank. It is required on the Cluster Port only. Reserved for future use. Leave this field blank. When you are finished, enter next>> to proceed. Correct any validation errors as you did in previous screens. Step 8 After successful validation of the Cloud Port values you entered, the Wizard presents the 10Gbps Enterprise Port (Port 1, enp9s0) as NETWORK ADAPTER #4. As explained in Required Interface Cable Connections, on page 12, this is a required port used to link the appliance to the enterprise network. Apply the host IP address, netmask, and other values appropriate for this purpose, (see Required IP Addresses and Subnets, on page 15, and Required Configuration Information, on page 28 for the values to enter). Enter configuration values for NETWORK ADAPTER #4 as shown in the table below. 57

62 Configure the Master Node Configure the Appliance Table 24: Master Node Entries for Network Adapter #4: 10Gbps Enterprise Port (enp9s0) Host IP address Netmask Default Gateway IP address DNS Servers Static Routes Cluster Link Configure IPv6 Address Enter the IP address for the 10Gpbs Enterprise Port. This is required. Enter the netmask for the port's IP address. This is required. Enter a default gateway IP address to use for the port. This is required. Enter the IP address of the preferred DNS server. If entering multiple DNS servers, separate the IP addresses in the list with spaces. This is required. Enter one or more static routes in the following format, separated by spaces: <network>/<netmask>/<gateway>. This is usually required on the DNA Center GUI Port only. Leave this field blank. It is required on the Cluster Port only. Reserved for future use. Leave this field blank. When you are finished, enter next>> to proceed. Correct any validation errors as you did in previous screens. The Wizard will validate and apply your network adapter configurations. Step 9 Once network adapter configuration is complete, the Wizard will prompt you to enter configuration values for the NETWORK PROXY you are using, as shown below. 58

63 Configure the Appliance Configure the Master Node Enter configuration values for the NETWORK PROXY as shown in the table below. Table 25: Master Node Entries for Network Proxy HTTPS Proxy HTTPS Proxy Username HTTPS Proxy Password Enter the URL or host name of an HTTPS network proxy used to access the Internet. Note Connection from DNA Center to the HTTPS proxy is supported only via HTTP in this release. Enter the user name used to access the network proxy. If no proxy login is required, leave this field blank. Enter the password used to access the network proxy. If no proxy login is required, leave this field blank. When you are finished, enter next>> to proceed. Correct any validation errors as you did in previous screens. Step 10 Once network proxy configuration is complete, the Wizard will prompt you to enter a virtual IP address for the master node, in MAGLEV CLUSTER DETAILS, as shown below. 59

64 Configure the Master Node Configure the Appliance Enter the virtual IP address used for all traffic between the cluster and your enterprise network. This is required. When you are finished, enter next>> to proceed. Correct any validation errors as you did in previous screens. Step 11 Once the virtual IP address is entered, the Wizard will prompt you to enter values for USER ACCOUNT SETTINGS, as shown below. 60

65 Configure the Appliance Configure the Master Node Enter values for USER ACCOUNT SETTINGS as shown in the table below. Table 26: Master Node Entries for User Account Settings Linux Password Re-enter Linux Password Password Generation Seed Auto Generated Password Administrator Passphrase Re-enter Administrator Passphrase Enter a Linux password for the maglev user. Confirm the Linux password by entering it a second time. If you do not want to create the Linux Password yourself, enter a seed phrase in this field and then press <Generate Password> to generate the password. (Optional) The seed phrase appears as part of a random and secure password. If desired, you can either use this password "as is", or you can further edit this auto-generated password. Press <Use Generated Password> to save the password. Enter a password for the default admin superuser, used to log in to DNA Center for the first time. Confirm the administrator passphrase by entering it a second time. When you are finished, enter next>> to proceed. Correct any validation errors as you did in previous screens. 61

66 Configure the Master Node Configure the Appliance Step 12 Once user account details are entered, the Wizard will prompt you to enter values for NTP SERVER SETTINGS, as shown below. Enter one or more NTP server addresses or hostnames, separated by spaces. At least one NTP address or hostname is required. When you are finished, enter next>> to proceed. Correct any validation errors as you did in previous screens. The Wizard will validate and apply your NTP server configuration. Step 13 Once you have specified NTP servers, the Wizard will prompt you to enter values for MAGLEV ADVANCED SETTINGS, as shown below. 62

67 Configure the Appliance Configure the Master Node Enter configuration values for MAGLEV ADVANCED SETTINGS as shown in the table below. Table 27: Master Node Entries for Maglev Advanced Settings Services Subnet Cluster Services Subnet Enter a dedicated IP subnet for DNA Center to use in managing its own services. Enter a dedicated IP subnet for DNA Center to use in managing its clustering services. When you are finished, enter next>> to proceed. Correct any validation errors as you did in previous screens. Step 14 When you are finished entering Maglev Advanced Settings, a final message appears stating that the Wizard is now ready to proceed with applying the configuration, as shown below. 63

68 Configure Add-On Nodes Configure the Appliance Enter proceed>> to complete the configuration. The host will reboot automatically and display messages on the KVM console as it applies your settings and brings up services. This process can take several hours. You can monitor its progress via the KVM console. At the end of the configuration process, the appliance power-cycles again, then displays a CONFIGURATION SUCCEEDED! message. What to do next When this task is complete: If you are deploying this DNA Center appliance in standalone mode only, continue by performing first-time setup: First-Time Setup Workflow, on page 77. If you are deploying this DNA Center appliance as the master node in a cluster, configure the second and third installed appliances in the cluster: Configure Add-On Nodes, on page 64. Configure Add-On Nodes Perform the steps in this procedure to configure DNA Center on the second and third appliances in the cluster. When joining each new add-on node to the cluster, you must specify the first host in the cluster as the master node. Please note the following when joining add-on nodes to a cluster: 64

69 Configure the Appliance Configure Add-On Nodes Before adding a new node to the cluster, be sure that all installed packages are deployed on the master node. You can check this by using Secure Shell to log in to the master node's DNA Center GUI port as the Linux User (maglev) and then running the command maglev package status. All installed packages should appear in the command output as DEPLOYED. In the following example, the application-policy, sd-access, sensor-assurance and sensor-automation packages were not installed, so they are the only packages whose status is NOT_DEPLOYED. Your package status should look similar to this before configuring an add-on node. $ ssh maglev@ p 2222 Welcome to the Maglev Appliance maglev@ 's password: Welcome to the Maglev Appliance System information as of Wed July 5 18:38:32 UTC 2020 System load: 4.2 IP address for enp9s0: Usage of /: 51.6% of 28.03GB IP address for enp10s0: Memory usage: 60% IP address for enp1s0f0: Swap usage: 0% IP address for docker0: Processes: 1646 IP address for tunl0: Users logged in: 0 => There are 2 zombie processes. Last login: Tues July 4 13:42: from [Wed Sep 19 16:27:08 UTC] maglev@ (maglev-master-1) ~ $ maglev package status [administration] password for 'admin': maglev-1 [main - NAME DEPLOYED AVAILABLE STATUS application-policy NOT_DEPLOYED assurance DEPLOYED automation-core DEPLOYED base-provision-core DEPLOYED command-runner DEPLOYED device-onboarding DEPLOYED image-management DEPLOYED ncp-system DEPLOYED ndp-base-analytics DEPLOYED ndp-platform DEPLOYED ndp-ui DEPLOYED network-visibility DEPLOYED path-trace DEPLOYED sd-access NOT_DEPLOYED sensor-assurance NOT_DEPLOYED sensor-automation NOT_DEPLOYED system DEPLOYED Be sure to join only a single node to the cluster at a time. Do not attempt to add multiple nodes at the same time, as doing so will result in unpredictable behavior. Expect some DNA Center service downtime during the cluster attachment process for each add-on node. Services will need to be redistributed across the nodes and the cluster will be down for periods of time during that process. 65

70 Configure Add-On Nodes Configure the Appliance Before you begin Ensure that you: Configured DNA Center on the first appliance in the cluster, following the steps in Configure the Master Node, on page 51. Collected all of the information called for in Required IP Addresses and Subnets, on page 15 and Required Configuration Information, on page 28. Installed the second and third appliances as described in Appliance Installation Workflow, on page 31. Configured CIMC browser access on both add-on appliances as described in Enable Browser Access to CIMC, on page 40. Checked that both add-on node appliances' ports and the switches they use are properly configured, as described in Execute Pre-Flight Checks, on page 45. Are using a browser that is compatible with CIMC and DNA Center. For a list of compatible browsers, see the Release Notes for the version of DNA Center you are installing. Step 1 Point your browser to the CIMC IP address you set during the CIMC GUI configuration you performed, and login to the CIMC GUI as the CIMC user (see Enable Browser Access to CIMC, on page 40). After successful login, the appliance displays the Cisco Integrated Management Controller Chassis Summary window, with a blue link menu at the upper right, as shown below. Step 2 From the blue link menu, choose Launch KVM and then select either Java based KVM or HTML based KVM. If you select the Java-based KVM, you will need to launch the Java startup file from your browser or file manager in order to view the KVM console in its own window. If you select the HMTL-based KVM, it will launch the KVM console in a separate browser window or tab automatically. Irrespective of the KVM type you choose, use the KVM console to monitor the progress of the configuration and respond to Maglev Configuration Wizard prompts. Step 3 With the KVM displayed, reboot the appliance by making one of the following selections: a) In the main CIMC GUI browser window: Choose Host Power > Power Cycle. Then switch to the KVM console to continue. b) In the KVM console: Choose Power > Power Cycle System (cold boot). If asked to confirm your choice to reboot the appliance, click OK. After displaying reboot messages, the KVM console displays the Maglev Configuration Wizard welcome screen, shown below. 66

71 Configure the Appliance Configure Add-On Nodes Step 4 Choose Join a DNA-C cluster to begin configuring the add-on node. The Wizard discovers all of the ports on the appliance and presents them to you one by one, in separate screens, in the following order: 1. 10Gbps Cluster Port (Port 2, enp10s0, Network Adapter #1) 2. 1Gbps DNA Center GUI Port (1, enp1s0f0, Network Adapter #2) 3. 1Gbps Cloud Port (2, enp1s0f1, Network Adapter #3) 4. 10Gbps Enterprise Port (Port 1, enp9s0, Network Adapter #4) Note If the Wizard fails to display one or both of the 10Gbps ports during the course of configuration, these ports may be non-functional or disabled. These 10Gbps ports are required for DNA Center functionality. If you discover they are non-functional, choose cancel to exit the configuration immediately. Be sure you have completed all of the steps provided in Execute Pre-Flight Checks, on page 45 before resuming configuration or contacting the Cisco Technical Assistance Center (TAC). Step 5 The Wizard discovers the 10Gbps Cluster Port (Port 2, enp10s0) first, and presents it as NETWORK ADAPTER #1. As explained in Required Interface Cable Connections, on page 12,this port is used to link the appliance to the cluster, so apply the host IP address, netmask, and other settings appropriate for this purpose (see Required IP Addresses and Subnets, on page 15, and Required Configuration Information, on page 28). 67

72 Configure Add-On Nodes Configure the Appliance Enter configuration values for NETWORK ADAPTER #1 as shown in the table below. Table 28: Add-On Node Entries for Network Adapter #1: 10Gbps Cluster Port (enp10s0) Host IP address Netmask Default Gateway IP address DNS Servers Static Routes Cluster Link Configure IPv6 Address Enter the IP address for the Cluster Port. This is required. Note that you cannot change the address of the Cluster Port later. Enter the netmask for the port's IP address. This is required. Enter a default gateway IP address to use for the port. This is usually required on the Enterprise Port only. Enter the IP address of the preferred DNS server. If entering multiple DNS servers, separate the IP addresses in the list with spaces. This is usually required on the DNA Center GUI Port only. Enter one or more static routes in the following format, separated by spaces: <network>/<netmask>/<gateway>. This is usually required on the DNA Center GUI Port only. Select the checkbox to indicate that this port will be the link to a DNA Center cluster. This is required on the Cluster Port only. Reserved for future use. Leave this field blank. 68

73 Configure the Appliance Configure Add-On Nodes When you are finished entering configuration values, enter next>> to proceed. After entering next>>, the Wizard validates the values you entered and issues an error message if any are incorrect. If you receive an error message, check that the value you entered is correct, then re-enter it. If needed, select <<back to re-enter it. Step 6 After successful validation of the Cluster Port values you entered, the Wizard presents the 1Gbps DNA Center GUI Port (1, enp1s0f0) as NETWORK ADAPTER #2. As explained in Required Interface Cable Connections, on page 12, this port is used to access the DNA Center GUI from your management network. Apply the host IP address, netmask, and other values appropriate for this purpose (see Required IP Addresses and Subnets, on page 15, and Required Configuration Information, on page 28 for the values to enter). Enter configuration values for NETWORK ADAPTER #2 as shown in the table below. Table 29: Add-On Node Entries for Network Adapter #2: 1Gbps DNA Center GUI Port (enp1s0f0) Host IP address Netmask Default Gateway IP address DNS Servers Enter the IP address for the 1Gpbs DNA Center GUI Port. This is required. Enter the netmask for the port's IP address. This is required. Enter a default gateway IP address to use for the port. This is usually required on the Enterprise Port only. Enter the IP address of the preferred DNS server. If entering multiple DNS servers, separate the IP addresses in the list with spaces. 69

74 Configure Add-On Nodes Configure the Appliance Static Routes Cluster Link Configure IPv6 Address Enter one or more static routes in the following format, separated by spaces: <network>/<netmask>/<gateway>. Leave this field blank. It is required on the Cluster Port only. Reserved for future use. Leave this field blank. When you are finished, enter next>> to proceed. Correct any validation errors as you did in previous screens. Step 7 After successful validation of the DNA Center GUI Port values you entered, the Wizard presents the 1Gbps Cloud Port (2, enp1s0f1) as NETWORK ADAPTER #3. As explained in Required Interface Cable Connections, on page 12, this is an optional port used to link the appliance to the Internet when you cannot do so through the 10Gbps Enterprise Port (Port 1, enp9s0). Apply the host IP address, netmask, and other values appropriate for this purpose (see Required IP Addresses and Subnets, on page 15, and Required Configuration Information, on page 28 for the values to enter). Enter configuration values for NETWORK ADAPTER #3 as shown in the table below. Table 30: Add-On Node Entries for Network Adapter #3: 1Gbps Cloud Port (enp1s0f1) Host IP address Netmask Enter the IP address for the Cloud Port. This is required only if you are using the Cloud Port for internet connection; otherwise, you can leave it blank. Enter the netmask for the port's IP address. This is required if you enter an IP address. 70

75 Configure the Appliance Configure Add-On Nodes Default Gateway IP address DNS Servers Static Routes Cluster Link Configure IPv6 Address Enter a default gateway IP address to use for the Cloud Port. This is usually required on the Enterprise Port only. Enter the IP address of the preferred DNS server. If entering multiple DNS servers, separate the IP addresses in the list with spaces. This is usually required on the Enterprise Port only. Enter one or more static routes in the following format, separated by spaces: <network>/<netmask>/<gateway>. This is usually required on the DNA Center GUI Port only. Leave this field blank. It is required on the Cluster Port only. Reserved for future use. Leave this field blank. When you are finished, enter next>> to proceed. Correct any validation errors as you did in previous screens. Step 8 After successful validation of the Cloud Port values you entered, the Wizard presents the 10Gbps Enterprise Port (Port 1, enp9s0) as NETWORK ADAPTER #4. As explained in Required Interface Cable Connections, on page 12, this is a required port used to link the appliance to the enterprise network. Apply the host IP address, netmask, and other values appropriate for this purpose, (see Required IP Addresses and Subnets, on page 15, and Required Configuration Information, on page 28 for the values to enter). Enter configuration values for NETWORK ADAPTER #4 as shown in the table below. 71

76 Configure Add-On Nodes Configure the Appliance Table 31: Add-On Node Entries for Network Adapter #4: 10Gbps Enterprise Port (enp9s0) Host IP address Netmask Default Gateway IP address DNS Servers Static Routes Cluster Link Configure IPv6 Address Enter the IP address for the 10Gpbs Enterprise Port. This is required. Enter the netmask for the port's IP address. This is required. Enter a default gateway IP address to use for the port. This is required. Enter the IP address of the preferred DNS server. If entering multiple DNS servers, separate the IP addresses in the list with spaces. This is required. Enter one or more static routes in the following format, separated by spaces: <network>/<netmask>/<gateway>. This is usually required on the DNA Center GUI Port only. Leave this field blank. It is required on the Cluster Port only. Reserved for future use. Leave this field blank. When you are finished, enter next>> to proceed. Correct any validation errors as you did in previous screens. Step 9 Once configuration of all ports is complete, the Wizard will prompt you to enter configuration values for the NETWORK PROXY you are using, as shown below. 72

77 Configure the Appliance Configure Add-On Nodes Enter configuration values for the NETWORK PROXY as shown in the table below. Table 32: Add-On Node Entries for Network Proxy HTTPS Proxy HTTPS Proxy Username HTTPS Proxy Password Enter the URL or host name of an HTTPS network proxy used to access the Internet. Note Connection from DNA Center to the HTTPS proxy is supported only via HTTP in this release. Enter the user name used to access the network proxy. If no proxy login is required, leave this field blank. Enter the password used to access the network proxy. If no proxy login is required, leave this field blank. When you are finished, enter next>> to proceed. Correct any validation errors as you did in previous screens. Step 10 Once network proxy configuration is complete, the Wizard will prompt you to identify the Cluster Port on the master node, and master node login details, in MAGLEV CLUSTER DETAILS, as shown below. Enter values for MAGLEV CLUSTER DETAILS as shown in the table below. Table 33: Add-On Node Entries for Maglev Cluster Details Cluster Virtual IP Address Enter the virtual IP address used for all traffic between the cluster and your enterprise network. This must be the same virtual IP address configured on the master node. 73

78 Configure Add-On Nodes Configure the Appliance Maglev Master Node User name Password Enter the IP address of the Cluster Port on the master node in the cluster. If you have followed recommendations for port assignment, this will be the IP address of Port 2, enp10s0, Network Adapter #1 on the master node. Enter maglev. Enter the Linux Password you configured on the master node. When you are finished, enter next>> to proceed. Correct any validation errors as you did in previous screens. Step 11 Once Maglev Cluster Details are entered, the Wizard will prompt you to enter values for USER ACCOUNT SETTINGS for this add-on node, as shown below. Enter values for USER ACCOUNT SETTINGS as shown in the table below. Table 34: Add-On Node Entries for User Account Settings Linux Password Re-enter Linux Password Password Generation Seed Enter a Linux password for the maglev user. Confirm the Linux password by entering it a second time. If you do not want to create the Linux Password yourself, enter a seed phrase in this field and then press <Generate Password> to generate the password. 74

79 Configure the Appliance Configure Add-On Nodes Auto Generated Password Administrator Passphrase Re-enter Administrator Passphrase (Optional) The seed phrase appears as part of a random and secure password. If desired, you can either use this password "as is", or you can further edit this auto-generated password. Press <Use Generated Password> to save the password. Enter a password for the default admin superuser, used to log in to DNA Center for the first time. Confirm the administrator passphrase by entering it a second time. When you are finished, enter next>> to proceed. Correct any validation errors as you did in previous screens. Step 12 Once user account details are entered, the Wizard will prompt you to enter values for NTP SERVER SETTINGS, as shown below. Enter one or more NTP server addresses or hostnames, separated by spaces. At least one NTP address or hostname is required. They should be the same NTP servers you specified for the master node. When you are finished, enter next>> to proceed. Correct any validation errors as you did in previous screens. Step 13 When you are finished entering NTP Server Settings, a final message appears, stating that the Wizard is now ready to proceed with applying the configuration, as shown below. 75

80 Configure Add-On Nodes Configure the Appliance Enter proceed>> to complete the configuration. The host will reboot automatically and display messages on the KVM console as it applies your settings and brings up services. This process can take several hours. You can monitor its progress via the KVM console. At the end of the configuration process, the appliance power-cycles again, then displays a CONFIGURATION SUCCEEDED! message. What to do next When this task is complete: If you have an additional DNA Center appliance to deploy as the third and final node in the cluster, repeat this procedure. If you are finished adding hosts to the cluster, continue by performing first-time setup: First-Time Setup Workflow, on page

81 CHAPTER 5 Complete First-Time Setup First-Time Setup Workflow, on page 77 Log In for the First Time, on page 78 Integrate Cisco ISE With DNA Center, on page 82 Configure Authentication and Policy Servers, on page 84 Configure SNMP Properties, on page 86 First-Time Setup Workflow Once you have finished configuring all the DNA Center appliances you have installed, you will need to perform the tasks listed in the following table to prepare DNA Center for production use. For the parameter information you need to complete this work, see Required First-Time Setup Information, on page 30. Table 35: DNA Center Appliance First-Time Setup Tasks Step 1 Description Make sure you are accessing DNA Center using a compatible browser. For a list of compatible browsers, see the Release Notes for the version of DNA Center you are installing. 2 Log in to the DNA Center GUI, as an administrator, for the first time. During this first administrative login, you will be prompted to: 1. Provide a new password for the admin superuser. 2. Enter the cisco.com username and password your organization uses to download software images and receive communications from Cisco. 3. Enter the cisco.com username and password your organization uses to manage its Smart Account licenses. 4. Configure the IP address manager (IPAM) server you plan to use with DNA Center. For details on these tasks, see Log In for the First Time, on page

82 Log In for the First Time Complete First-Time Setup Step Description If you are plan to use DNA Center with Cisco Identity Services Engine (ISE), make sure the two are properly integrated: Integrate Cisco ISE With DNA Center, on page 82. Connect DNA Center with your policy and AAA server (including ISE): Configure Authentication and Policy Servers, on page 84. Configure the basic SNMP retry and polling parameters: Configure SNMP Properties, on page 86. When you are finished with first-time setup: Log Out of Cisco DNA Center, on page 87. Log In for the First Time After you have installed and configured the DNA Center appliance, you can log in to its web-based GUI. You must use a compatible, HTTPS-enabled browser when accessing DNA Center. For a list of compatible browsers, see the Release Notes for the version of DNA Center you are installing. When logging in for the first time as the admin superuser (the username is "admin" and has the SUPER-ADMIN-ROLE assigned), you will be asked to complete a first-time setup wizard that helps you enhance system security and complete essential setup tasks. Although you can skip each of the steps in the wizard, Cisco recommends that you complete all of them as indicated, so that your system is ready for use as soon as possible. You will also need to create new DNA Center users. Cisco recommends that you create at least one additional user account to be used for daily operations, and that this user account have the NETWORK-ADMIN-ROLE. Before you begin To log in to DNA Center and complete the first-time setup wizard, you will need: The "admin" superuser username and password you specified when following the steps in Configure the Master Node, on page 51. The information called for in Required First-Time Setup Information, on page 30. Step 1 Step 2 Step 3 Step 4 After the DNA Center appliance reboot has completed, launch your browser. Enter the host IP address to access the DNA Center GUI. Use HTTPS and the IP address of the DNA Center GUI that was displayed at the end of the configuration process. After entering the IP address in the browser, a message stating that "Your connection is not private" appears. Ignore the message and click the Advanced link. After clicking the Advanced link, a message stating that the site s security certificate is not trusted appears. This message appears because the controller uses a self-signed certificate. Later, you will have the option to upload a trusted certificate using the DNA Center GUI. Ignore the message and click the link. The DNA Center Login window appears. 78

83 Complete First-Time Setup Log In for the First Time Step 5 In the Login window, enter the Admin username (admin) and Administrator Passphrase that you set when you configured DNA Center. Then click Log In. The Reset Login window appears. Step 6 Enter the old password, then enter and confirm a new password for the admin superuser. Then click Save. The Enter Cisco.com ID window appears. 79

84 Log In for the First Time Complete First-Time Setup Step 7 Enter the username and password for the cisco.com user, then click Next. If the cisco.com user login does not match any known Cisco Smart Account user login, the Smart Account window appears. 80

85 Complete First-Time Setup Log In for the First Time Step 8 Step 9 If the Smart Account window appears, enter the username and password for your organization's Smart Account, or click the link to open a new Smart Account. When you are finished, click Next. The IP Address Manager window appears. Enter the server, port, and administrative login for the external IP address manager your organization will use, and specify its type (for example, InfoBlox). Then click Next. The Enter Proxy Server window appears. Step 10 Step 11 Enter the proxy server information your organization will use. Include the server username and password, if your proxy server requires a login. If you want to validate this information before proceeding (recommended), ensure that the Validate Settings box is checked. When you are finished, click Next. The software EULA window appears. Click Next to accept the software End User License Agreement and continue. The Ready To Go! window appears. 81

86 Integrate Cisco ISE With DNA Center Complete First-Time Setup Step 12 You can click any of the links in this window, or click Go to System 360 to display the System 360 dashboard and begin using DNA Center. Cisco recommends that you click the User Management link to display the User Management window. Then click Add to begin adding new DNA Center users. Once you have entered the new user's name and password, and selected the user's role, click Save to create the new user. Repeat this as needed until you have added all the new users for your initial deployment. Be sure to create at least one user with the NETWORK-ADMIN-ROLE. What to do next Complete other administrative setup tasks, in any order: Integrate Cisco ISE With DNA Center, on page 82 Configure Authentication and Policy Servers, on page 84 Configure SNMP Properties, on page 86 Integrate Cisco ISE With DNA Center This release of DNA Center provides a mechanism to create a trusted communications link with Cisco Identity Services Engine (ISE) and permits DNA Center to share data with ISE in a secure manner. Once ISE is registered with DNA Center, any device DNA Center discovers, along with relevant configuration and other 82

87 Complete First-Time Setup Integrate Cisco ISE With DNA Center data, is pushed to ISE. Users can use DNA Center to discover devices and then apply both DNA Center and ISE functions to them, as these devices will be exposed in both applications. DNA Center and ISE devices are all uniquely identified by their device names. DNA Center devices, as soon as they are provisioned and belong to a particular site in the DNA Center site hierarchy, are pushed to ISE. updates to a DNA Center device (such as changes to IP address, SNMP or CLI credentials, ISE shared secret, and so on) will flow to the corresponding device instance on ISE automatically. When a DNA Center device is deleted, it is removed from ISE as well. Please note that DNA Center devices are pushed to ISE only when these devices are associated to a particular site where ISE is configured as its AAA server. Follow the steps below to integrate ISE with DNA Center. Before you begin Before attempting to integrate ISE with Cisco DNA Center, be sure you have met the following pre-requisites: You have deployed one or more ISE version 2.3 (and later) hosts on your network. For information on installing ISE, see the Cisco Identity Services Engine Install and Upgrade Guides for version 2.3 and later. If you have a standalone ISE deployment, you must integrate with, and enable the pxgrid service and ERS, on the ISE node. If you have a distributed ISE deployment: You must integrate DNA Center with the ISE admin node (PAN primary) and enable ERS on the PAN. As with single-node deployments, you must enable the pxgrid service on one of the ISE nodes within the distributed deployment. Although you can choose to do so, you do not need to enable pxgrid on the PAN. You can enable pxgrid on any of the other ISE nodes in your distributed deployment. The ISE host on which pxgrid is enabled must be reachable from DNA Center on the IP address of the ISE eth0 interface. The ISE node can reach the fabric underlay network via the appliance NIC. The ISE node has SSH enabled. The ISE CLI and GUI user accounts must use the same user name and password. The ISE admin node certificate must contain the ISE IP address or fully-qualified domain name (FQDN) in either the certificate subject name or the SAN. The DNA Center system certificate must contain the DNA Center appliance IP or FQDN in either the certificate subject name or the SAN. Step 1 Enable ISE pxgrid service and ERS, as follows: a) Log into the ISE primary admin node (PAN). b) Select Administration > Deployment. c) Select the host name of the ISE node on which you want to enable pxgrid services. In a distributed deployment, this can be any ISE node in the deployment. 83

88 Configure Authentication and Policy Servers Complete First-Time Setup d) Under the General Settings tab, make sure the pxgrid box is checked. e) Click Save. f) Select Administration > System > Settings > ERS Settings and click Enable ERS for Read/Write. Click OK at the notification prompt. Step 2 Step 3 Step 4 Step 5 Add the ISE node to DNA Center as a AAA server, as follows: a) Log in to the DNA Center web-based GUI. b) Click, then select System Settings. c) Under the Cisco ISE panel, select the Configure Settings link. d) On the Settings - Authentication and Policy Servers page, click the large plus (+) icon to display the AAA settings. e) Click the Cisco ISE slider to ensure that all of the ISE-related fields are shown. f) Enter the ISE management IP address in the IP address field. g) Enter the Shared Secret used to secure communications between your network devices and ISE. h) Enter the corresponding ISE admin credentials in the Username and Password fields. i) Enter the FQDN for the ISE node. j) Enter the Subscriber Name (for example: dnacenter). k) The SSH Key is optional and may be left blank. When you are finished populating these fields, click Update and wait for the server status to show as Active. Verify that ISE is connected to DNA Center and that the connection has subscribers, as follows: a) Log into the ISE node with which you integrated DNA Center. b) Select Administration > pxgrid Services. You should see that a subscriber with the name you entered (for example: dnacenter) has the current status online. c) If the subscriber status is Pending, select Total Pending Approval > Approve All Clients to approve this subscriber. The subscriber status should change to online. Verify that DNA Center is connected to ISE and that ISE SGT groups and devices are being pushed to DNA Center, as follows: a) Log in to the DNA Center web-based GUI. b) Click and then select System Settings. c) Under the Cisco ISE panel, select the Configure Settings link. d) On the Settings - Authentication and Policy Servers page, click the large plus (+) icon to display the AAA settings. e) Verify that the status for the Cisco ISE AAA server is still Active. f) Select Policy > Registry > Scalable Groups. You should see ISE SGT groups in the list of Scalable Groups. Configure Authentication and Policy Servers DNA Center uses AAA servers for user authentication and Cisco ISE for both user authentication and access control. Use this procedure to configure AAA servers, including Cisco ISE. Before you begin If you are using Cisco ISE to perform both policy and AAA functions, make sure that DNA Center and Cisco ISE are integrated as described in the section Integrate Cisco ISE With DNA Center, on page 82. If you are using another product (not Cisco ISE) to perform AAA functions, make sure to do the following: 84

89 Complete First-Time Setup Configure Authentication and Policy Servers Register DNA Center with the AAA server, including defining the shared-secret on both the AAA server and DNA Center. Define an attribute name for DNA Center on the AAA server. For a DNA Center multi-host cluster configuration, define all individual host IP addresses and the virtual IP address for the multi-host cluster on the AAA server. Step 1 From the DNA Center home page, click and then choose System Settings > Settings > Authentication and Policy Servers. Step 2 Click. Step 3 Configure the primary AAA server by providing the following information: Server IP Address IP address of the AAA server. Shared Secret Key for device authentications. The shared secret can be up to 128 characters in length. Step 4 To configure a AAA server (not Cisco ISE), leave the Cisco ISE Server button in the Off position and proceed to the next step. To configure a Cisco ISE server, click the Cisco ISE server button to the On position and enter information in the following fields: Cisco ISE Setting that indicates whether the server is a Cisco ISE server. Click the Cisco ISE setting to enable Cisco ISE. Username Name that is used to log in to the Cisco ISE command-line interface (CLI). Password Password for the Cisco ISE CLI username. FQDN Fully qualified domain name (FQDN) of the Cisco ISE server. The FQDN consists of two parts, a hostname and the domain name, in the following format: hostname.domainname.com. For example, the FQDN for a Cisco ISE server might be ise.cisco.com. Subscriber Name A unique text string, for example dnac, that is used during DNA Center to Cisco ISE integration to setup a new pxgrid client in Cisco ISE. SSH Key Diffie-Hellman-Group14-SHA1 SSH key used to connect and authenticate with Cisco ISE. Step 5 Click View Advanced Settings and configure the settings: Protocol TACACS or RADIUS. Radius is the default. Note You can only choose one option. The option that is dimmed is the chosen option. To select the other option, you need to choose it and then manually deselect the other option. Authentication Port Port used to relay authentication messages to the AAA server. The default is UDP port Accounting Port Port used to relay important events to the AAA server. The information in these events is used for security and billing purposes. The default UDP port is

90 Configure SNMP Properties Complete First-Time Setup Step 6 Retries Number of times that DNA Center attempts to connect with the AAA server before abandoning the attempt to connect. The default number of attempts is 1. Timeout The length of time that device waits for the AAA server to respond before abandoning the attempt to connect. Click Add. Step 7 To add a secondary server, repeat Step 2 through Step 6. Configure SNMP Properties You can configure retry and timeout values for SNMP. Before you begin Only a user with SUPER-ADMIN-ROLE or NETWORK-ADMIN-ROLE permissions can perform this procedure. Step 1 From the DNA Center home page, click the gear icon ( ) and then choose System Settings > Settings > SNMP Properties. Step 2 Configure the following fields: Table 36: SNMP Properties Field Retries Timeout (in Seconds) Description Number of attempts to connect to the device. Valid values are from 1 to 3. The default is 3. Number of seconds DNA Center waits when trying to establish a connection with a device before timing out. Valid values are from 1 to 300 seconds in intervals of 5 seconds. The default is 5 seconds. Step 3 Click Apply. Note To return to the default settings, click Revert to Defaults. 86

91 CHAPTER 6 Troubleshoot the Deployment Troubleshooting Tasks, on page 87 Log Out of Cisco DNA Center, on page 87 Reconfigure the Appliance Using the Configuration Wizard, on page 88 Power-Cycle the Appliance, on page 89 Troubleshooting Tasks When troubleshooting problems with the DNA Center appliance configuration, you will normally perform the following tasks: Table 37: Basic DNA Center Appliance Troubleshooting Tasks Step 1 2 Description If you are currently using the DNA Center GUI: Log Out of Cisco DNA Center, on page 87. If you need to reconfigure the appliance hardware, log into and use the CIMC GUI as explained in steps 12 and 13 of Enable Browser Access to CIMC, on page If you need to change the appliance configuration, launch and use the Maglev Configuration Wizard as explained in Reconfigure the Appliance Using the Configuration Wizard, on page Power-cycle the appliance, so that your changes are active: Power-Cycle the Appliance, on page 89. For more information about the appliance's network adapters, see the Managing Adapters section of the Cisco UCS C-Series Servers Integrated Management Controller CLI Configuration Guide, Release 3.1. As noted elsewhere, never attempt to manage the appliance hardware via the Linux CLI. Use only the CIMC GUI or the Maglev Configuration Wizard to change appliance settings. Log Out of Cisco DNA Center Follow the steps below to log out of the Cisco DNA Center web-based GUI interface. 87