Cisco IWAN Application 2.2 on DNA Center, Quick Start Guide

First Published: 2018-06-04 Last Modified: 2018-06-04 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883

CONTENTS CHAPTER 1 Cisco IWAN App, Release 2.2 CHAPTER 2 Overview of Cisco IWAN 3 CHAPTER 3 New and Updated Features 5 1 Release History 5 Notable Features: IWAN App on DNA Center 6 CHAPTER 4 Notes and Limitations 11 CHAPTER 5 Activating the IWAN App on DNA Center 13 CHAPTER 6 Overview of IWAN App Tasks 15 CHAPTER 7 Workflow Overviews 17 Workflow Overview: Configuring Hub Sites 17 Workflow Overview: Adding a Greenfield Device to a Branch Site 18 Workflow Overview: Adding a Brownfield Device to Branch Site 19 CHAPTER 8 Related Documentation 23 iii

Contents iv

Cisco IWAN App, Release 2.2 CHAPTER 1 The Cisco Intelligent WAN Application (Cisco IWAN App) first appeared as a component of Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM), and in December 2017 was added as an optional package to Cisco Digital Network Architecture Center (DNA Center). The IWAN App 2.2 release, operating on DNA Center 1.2, brings further integration of the IWAN App with DNA Center infrastructure, and introduces a utility for migrating an IWAN App configuration on APIC-EM to DNA Center. Quick Start Guide Operating as part of DNA Center, the IWAN App functions largely as it did with APIC-EM. This Quick Start guide describes the new methods and features (New and Updated Features, on page 5) that apply to the IWAN App within DNA Center, and includes important notes and limitations (Notes and Limitations, on page 11). This guide includes a high-level overview (Overview of IWAN App Tasks, on page 15) summarizing IWAN App tasks, with notes about where to execute various functions. This guide describes a few procedures that differ from earlier releases of the IWAN App: Workflow Overview: Configuring Hub Sites, on page 17 Workflow Overview: Adding a Greenfield Device to a Branch Site, on page 18 Workflow Overview: Adding a Brownfield Device to Branch Site, on page 19 1

Cisco IWAN App, Release 2.2 2

CHAPTER 2 Overview of Cisco IWAN Cisco IWAN extends Software Defined Networking (SDN) to branch sites, with an application-centric approach based on business policies and application rules. Cisco IWAN provides tools for centralized management and distributed enforcement across the network. Cisco IWAN automates deployments with an intuitive browser-based user interface. A new router can be provisioned faster, without requiring the use of router CLI commands. Business priorities are translated into network policies based on Cisco best practices and validated designs. Using automation and simple, predefined workflows, Cisco IWAN reduces the time required to configure advanced network services, such as DMVPN, PKI, AVC, QoS, and PfR. The application-centric approach offers the following benefits: Reduced operational costs Cisco IWAN helps IT deliver an unparalleled user experience over any connection, while lowering operational costs. Simplified IT operations Cisco IWAN uses a software-based controller model, automating and centralizing management tasks to ensure faster, more successful deployments. Reduced network complexity Cisco IWAN abstracts network devices into one system, eliminating network complexity and providing centralized provisioning of the infrastructure to speed up application and service rollouts. 3

Overview of Cisco IWAN 4

New and Updated Features CHAPTER 3 The IWAN App for DNA Center operates in mostly same way as on APIC-EM, but there are some changes to note. The IWAN App integrates the DNA Center functionality, such as defining sites and managing Cisco IOS images. Tip Some tasks involve steps in DNA Center and in the IWAN App. Open DNA Center and IWAN App in two separate tabs of a browser to switch between them easily. Refresh the page if necessary to reflect updated information. Release History The Overview of IWAN App Tasks, on page 15 provides a summary of tasks related to the IWAN App, and where to execute them. Release History, on page 5 Notable Features: IWAN App on DNA Center, on page 6 Release IWAN App 2.2 on DNA Center 1.2 June 2018 Description New features, improved integration with DNA Center. Utility for migration from APIC-EM to DNA Center. Refer to Cisco TAC for assistance. Improved integration of IP address pool allocation with DNA Center. Includes validation of IP pools configured in the IWAN app, ensuring that they do not overlap with IP pools already configured in DNA Center. Additional integration with DNA Center: When the IWAN app requires configuration of something managed by DNA Center, the user interface directs you to DNA Center to make the required configuration. Example: configuring a DHCP server domain name. For DNA Center behind NAT, configuring a custom NAT port is supported. The default port is 80. 5

Notable Features: IWAN App on DNA Center New and Updated Features Release IWAN App 2.1 on DNA Center 1.1 December 2017 Description IWAN app introduced to DNA Center. Integration with DNA Center. DNA Center handles global settings (Netflow collector server, DNS servers, and so on), defining network sites and hierarchy, Cisco IOS image management, package management. Notable Features: IWAN App on DNA Center New and Updated Features: Configuring network, sites, and devices Feature/Task Global network settings Description On the IWAN App home page, the Monitor & Troubleshoot option has been replaced with Create Sites & Configure Global Settings. This option opens the DNA Center > Design > Network Settings page for configuring global settings. Mandatory global settings for using the IWAN App: Netflow Collector server Domain name for DNS server NTP server Each node in the network hierarchy configured in DNA Center inherits the settings of the parent node, but you can select any node and override the inherited settings. Note Important: In this release, the IWAN App only uses the settings configured at the global level. 6

New and Updated Features Notable Features: IWAN App on DNA Center Feature/Task DNA Center behind NAT Operation with PnP Description DNA Center behind NAT is supported. In the IWAN App > Configure Hub Site & Settings > System tab, configure the DNA Center NAT/proxy IP. The default NAT port (80) is used. Configuring a custom NAT port is supported. Note In an earlier release of the IWAN App on DNA Center, configuring a custom NAT port was not supported. For the DNA Center PnP component to operate correctly with the IWAN App, an NTP server must be specified. Specify the NTP server in DNA Center: DNA Center > Design > Network Settings > Network > Add Servers 7

Notable Features: IWAN App on DNA Center New and Updated Features Feature/Task Creating sites and network hierarchy Description In DNA Center > Design > Network Hierarchy, define the network hierarchy, including sites, buildings, and floors. The IWAN App uses the leaf nodes (terminal nodes) of the hierarchy as sites within the IWAN App. These may be either buildings or floors. For example, if the following site locations are defined in DNA Center Global > HQ-East > Building-NY-01 Global > HQ-West > Building-SanFran-01 Global > Branch-LasVegas > Building10 > Floor1 Global > Branch-Dallas > Building20 > Floor1...the IWAN App presents the following sites: Building-NY-01 Building-SanFran-01 Floor1 Floor1 To distinguish nodes with the same name, the IWAN App displays the full path, where necessary, when selecting sites. Example: Floor1 Branch-LasVegas/Building10/Floor1 Setting site location In DNA Center > Design > Network Hierarchy, select a site or building and configure the geographic location. The location is shown in the IWAN App map view. Note This replaces the Set Geo feature in earlier releases of the IWAN App on APIC-EM. 8

New and Updated Features Notable Features: IWAN App on DNA Center Feature/Task Inheritance of settings, IWAN app uses only global settings Configuring a hub site Adding greenfield devices to branch sites Adding brownfield devices to branch sites Deleting a site in the IWAN app Description Each node in the network hierarchy (defined in DNA Center > Design > Network Hierarchy) inherits settings from the parent node. Note In this release, the IWAN App uses only the settings configured at the global level. In DNA Center, define hub sites and locations. When configuring a hub site, in the IWAN App > Configure Hub Site & Settings > IWAN Aggregation Site tab, use the dropdown menu to select a hub site from the list of sites configured in DNA Center. In the IWAN App > Sites > Devices tab, click the Add Greenfield Device button. This opens DNA Center > Provision > Devices > Inventory. Click Unclaimed Devices and follow the procedure for adding a new greenfield device (Workflow Overview: Adding a Greenfield Device to a Branch Site, on page 18). In the IWAN App > Sites > Devices tab, click the Add Brownfield Device button. During provisioning, the IWAN App communicates this site assignment for the brownfield device to DNA Center, and the assigned site will appear in the device inventory. Deleting a site in the IWAN App changes the status of the associated devices in DNA Center. Greenfield devices discovered by Plug and Play call-home move from Inventory to Unclaimed Devices in DNA Center. Brownfield devices are removed from the inventory in DNA Center. Note Sites managed by the IWAN App can be removed only from within the IWAN App, and not directly through DNA Center. Cisco IOS image management Manage Cisco IOS images to be used for provisioning new devices, in DNA Center > Design > Images Repository. Note This replaces the Certified IOS Releases tab in earlier releases of the IWAN app on APIC-EM. 9

Notable Features: IWAN App on DNA Center New and Updated Features New and Updated Features: Monitoring Feature/Task Service Assurance and application health Description Service Assurance is a feature of DNA Center, used for evaluating network and client health. DNA Center > Assurance Note Earlier releases of the IWAN App on APIC-EM included a beta-version Service Assurance feature, activated by an Assurance button in the map view. Earlier releases of the IWAN App on APIC-EM displayed application health information in an Application Health tab for each site. See DNA Center for information about site traffic. 10

CHAPTER 4 Notes and Limitations Notes and Limitations: Installation Issue Details Not compatible with the Policy package Do not install the IWAN App together with the Automation Application Policy package. Not compatible with Cisco SDA Do not install the IWAN App together with Cisco Software-Defined Access (SDA). Notes and Limitations: Configuration Issue Details IWAN app uses the global Network settings are configured on the DNA Center > Design > Network network settings Settings page. configured in DNA Each node in the network hierarchy configured in DNA Center inherits the settings Center of the parent node, but you can select any node and override the inherited settings. In this release, the IWAN App only uses the network settings configured at the global level. IP address pool conflict In the IWAN App, do not configure an address pool (global or service provider) that overlaps with an address range configured as an IP address pool in DNA Center. Similarly, in DNA Center, do not configure an address pool that overlaps with an address range configured as an IP address pool in the IWAN App. Where to configure: IP address pools in the IWAN App: IWAN App > Configure Hub Site & Settings > IP Address Pools tab IP address pools in DNA Center: DNA Center > Design > Network Settings > IP Address Pools 11

Notes and Limitations Issue IP address pool scheduler Operation with PnP Details The scheduler option for IP Address Pool changes is no longer supported, beginning with the IWAN App release 2.2. For the DNA Center PnP component to operate correctly with the IWAN App, an NTP server must be specified. Specify the NTP server in DNA Center: DNA Center > Design > Network Settings > Network > Add Servers Notes and Limitations: Monitoring and Assurance Issue Service Assurance LiveAction third-party monitoring Details Service Assurance is a component of DNA Center. Use this tool to monitor network connectivity: DNA Center > Assurance Earlier releases of the IWAN App included a beta-version Service Assurance feature, activated by an Assurance button in the map view. The Third Party Monitoring button in the IWAN App map view opens LiveAction third-party monitoring. In this early release, no LiveAction functionality is available, pending additional work by LiveAction to integrate Cisco DNA Center APIs for interoperability. The button currently attempts to open the NetFlow collector site in a new browser tab. When LiveAction functionality becomes available, it will open a LiveAction monitoring page. 12

CHAPTER 5 Activating the IWAN App on DNA Center Before you begin Install Cisco DNA Center release 1.2. Review the installation notes. See Notes and Limitations, on page 11. Review the software requirements described in the release notes. See Related Documentation, on page 23. Step 1 To be able to view the IWAN app package, SSH into the DNA Center console (ssh -p 2222 maglev@controller-ip) and issue the following command: magctl service setenv catalog PARENT_CATALOG_SERVER_REPOSITORY iwan-waas-ga Step 2 In DNA Center, open Software Updates. DNA Center home page > Settings ( ) > System Settings > Software Updates > Updates Step 3 Under Automation, look for IWAN. Step 4 In the Action column, click Download. The Download button changes to Install. Step 5 In the Action column, click Install and wait for installation to complete. Step 6 Click Installed Apps and verify that IWAN appears in the list. Step 7 After installation, open the DNA Center home page. The IWAN App appears in the Tools list. 13

Activating the IWAN App on DNA Center 14

CHAPTER 6 Overview of IWAN App Tasks Installation Task Details 1 Install DNA Center and IWAN App. See Related Documentation, on page 23. 2 Install devices within the network. Devices must be reachable by DNA Center. Devices may be physical or virtual. Configuration Task Details 1 Configure global network settings. DNA Center > Design > Network Settings 2 Configure sites and network DNA Center > Design > Network Hierarchy hierarchy. Design a network hierarchy, with sites, buildings, and so on. The network hierarchy is a construct used for organizing devices. Typically, a useful network hierarchy reflects the physical location of sites, buildings within a site, and locations within buildings. However, the design is unconstrained, and need not reflect the actual physical arrangement. 3 Configure service provider details. IWAN app > Configure Hub Site & Settings > Service Providers tab 4 Configure IP address pools IWAN App > Configure Hub Site & Settings > IP Address Pools tab to be used for devices. 5 Add devices to hub sites. IWAN App > Configure Hub Site & Settings > IWAN Aggregation Site tab Generally, hub devices are added as brownfield devices. Provisioning the device to an IWAN hub site adds an IWAN overlay to the existing device functionality. 15

Overview of IWAN App Tasks 6 7 8 9 Task Provision the hub sites (all devices at the sites). Add devices to branch sites. Provision the branch sites (all devices at the sites). Configure policy. Details IWAN App > Configure Hub Site & Settings > IWAN Aggregation Site tab IWAN App > Manage Branch Sites > Devices tab IWAN App > Manage Branch Sites > Devices tab IWAN App > Administer Application Policy 16

CHAPTER 7 Workflow Overviews Workflow Overview: Configuring Hub Sites, on page 17 Workflow Overview: Adding a Greenfield Device to a Branch Site, on page 18 Workflow Overview: Adding a Brownfield Device to Branch Site, on page 19 Workflow Overview: Configuring Hub Sites Before you begin Define sites on the DNA Center > Design > Network Hierarchy page. In the IWAN App > Configure Hub Site & Settings > Service Providers tab, configure service providers. Step 1 Open the IWAN App > Configure Hub Site & Settings > IWAN Aggregation Site tab. Step 2 Use the dropdown menu to select a site defined in DNA Center. Un-provisioned leaf nodes (terminal nodes) in the network hierarchy, of types building or floor, appear in the list of sites. Step 3 If required, add a site-specific IP address pool for the hub site in the IWAN App > Configure Hub Site & Settings > IP Address Pools tab. Step 4 (Optional) Add a device to a hub site. a) In the IWAN App > Configure Hub Site & Settings > IWAN Aggregation Site tab, hover over the add router button ( ) and select a hub site. b) In the Configure Hub Border Router dialog box, enter the management IP and SSH credentials for the device to add. c) Click Save. The device is added to the hub. It appears in the IWAN App and in the DNA Center device inventory. Step 5 Click Save & Continue to begin the provisioning process. Step 6 After you add devices to a hub site using the IWAN App, and complete provisioning of the site, check the DNA Center > Provision > Devices > Inventory page. 17

Workflow Overview: Adding a Greenfield Device to a Branch Site Workflow Overviews Workflow Overview: Adding a Greenfield Device to a Branch Site The procedure for adding a greenfield device has changed since earlier versions of the IWAN App. Before you begin In typical scenarios, define the branch site in DNA Center before adding the device. Ensure that any necessary Cisco IOS images are available in DNA Center > Design > Images Repository. The IOS images are deployed to new greenfield devices during provisioning. The image requirements will depend on the devices used in your network. Configure address pools, as needed (IWAN app). Important: Do not configure an address pool (global or service provider) that overlaps with an address range configured as an IP address pool in DNA Center. Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 In the IWAN App > Manage Branch Sites > Devices tab, click the Add Greenfield Device button. The DNA Center > Provision > Devices > Inventory page opens. Click Unclaimed Devices. Discovered devices appear in the unclaimed devices list. Note Device discovery occurs when a new device identifies itself to DNA Center using Plug and Play call-home. Wait for the Status column to show UNCLAIMED for the device. Select the device (using the checkbox at the far left) and click Actions > Claim Device. A Claim Devices page opens for the site. Use the dropdown menu to assign the device to a site. Click the Apply button. The device appears on the DNA Center > Provision > Devices > Device Inventory > Inventory list. The Provision Status column shows that the device has not been provisioned. You can press the Refresh button to see the updated status: When provisioning is complete, the device disappears from the Unclaimed Devices list and is added to the Inventory list. Open the IWAN app > Manage Branch Sites > Devices tab. The device appears in the device list. The Discovered By column shows PNP, indicating that this is a greenfield device. The Validation Status column indicates that the device has not been validated. In the Action column, click Revalidate. If successful, the Validation Status changes to Success. 18

Workflow Overviews Workflow Overview: Adding a Brownfield Device to Branch Site Step 9 Click the Provision Site button. Workflow Overview: Adding a Brownfield Device to Branch Site It is possible to add a brownfield device to the DNA Center device inventory and claim it for the IWAN app using two methods: Add the device using the DNA Center Inventory tool, then claim it using the IWAN app. Add the device and claim it using the IWAN App directly. After using one of these methods to add the brownfield device and claim it for the IWAN app, the next steps are to assign the device to a site, and eventually to provision all of the site's devices. Adding a brownfield device directly to the DNA Center inventory 1. Open the DNA Center > Inventory tool and click the Add button. 2. In the Add Device dialog box, enter the address and credentials for the device and click the Add button. The device appears in the device list. 3. Open the IWAN app > Manage Branch Sites > Devices tab. 4. Click the Add Brownfield Device button. The Add Brownfield Device dialog box opens. The brownfield device list in the dialog box shows the newly added device. 5. Claim the device for the IWAN App. 1. In the Add Brownfield Device dialog box, select the radio button to the left of the device. 2. Click the Claim Device button. The device is added to the IWAN app > Manage Branch Sites > Devices tab list of devices. A device added through the DNA Center Inventory tool is not automatically validated by the IWAN App. The Validation Status column shows WARNING. 6. In the Action column, click the refresh button to validate the device. Adding a brownfield device using the IWAN app 1. Open the IWAN app > Manage Branch Sites > Devices tab. 2. Click the Add Brownfield Device button. The Add Brownfield Device dialog box opens. 3. In the dialog box, click the Adding new device link. 19

Workflow Overview: Adding a Brownfield Device to Branch Site Workflow Overviews A new Add Brownfield Device dialog box opens, prompting you for a device address and credentials. 4. Enter the address and credentials for the device and click the Add Device button. The device is added to the DNA Center device list, and it is also added to the IWAN app > Manage Branch Sites > Devices tab list of devices. 20

Workflow Overviews Workflow Overview: Adding a Brownfield Device to Branch Site Note Using the IWAN App to add a brownfield device does three things: Adds the device to the DNA Center inventory Claims the device for the IWAN App Initiates the IWAN validation process By contrast, when using the DNA Center Inventory tool to add a brownfield device, each of these actions requires a separate step: a step to add the device to the DNA Center inventory, a step to claim it for the IWAN app, and a step to validate the device. 5. Click the Add Brownfield Device button. The Add Brownfield Device dialog box opens. The brownfield device list in the dialog box shows the newly added device. Assigning a brownfield device to a site After adding the brownfield device and claiming it for the IWAN App, the procedure for assigning it to a branch site is largely the same as in earlier releases of the IWAN App. 1. Open the IWAN app > Manage Branch Sites > Devices tab. 2. In the list of devices, in the Site Name column, use the dropdown menu to select a site. Sites are defined in the DNA Center. 3. Continue the process as in earlier releases of the IWAN App. With the integration of the IWAN App into DNA Center, note the following: After you use the IWAN App to add a brownfield device to a branch site, and then you provision the site, the IWAN App communicates the site assignment and other information for the brownfield device to DNA Center. The device appears, with its site assignment, in the DNA Center device inventory. 21

Workflow Overview: Adding a Brownfield Device to Branch Site Workflow Overviews 22

CHAPTER 8 Related Documentation Document Cisco IWAN Application 2.2 on DNA Center, Release Notes DNA Center documentation Cisco Digital Network Architecture Center Appliance Installation Guide Cisco IWAN Application on APIC-EM User Guide, Releases 1.6.0, 1.6.1 Information IWAN app release information, including system requirements, software compatibility, and open and resolved caveats. DNA Center user documentation, including release notes and user guides. Installation and configuration of DNA Center, including post-installation tasks. The user guide for the IWAN app, running as part of Cisco APIC-EM, offers in-depth information about IWAN app functionality. 23