Cisco IWAN Application on DNA Center Quick Start Guide, Release 1.1 Patch 1, Limited Availability First Published: 2017-12-22 Last Modified: 2017-12-22 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883 Text Part Number:
2017 Cisco Systems, Inc. All rights reserved.
CONTENTS CHAPTER 1 Cisco IWAN App on DNA Center 1.1 Patch 1 1 CHAPTER 2 Overview of the Cisco IWAN App 3 CHAPTER 3 New and Updated Features 5 CHAPTER 4 Notes and Limitations 11 CHAPTER 5 Activating the IWAN App on DNA Center 13 CHAPTER 6 IWAN App High-level Overview 15 CHAPTER 7 Workflow Overviews 17 Workflow Overview: Configuring Hub Sites 17 Workflow Overview: Adding a Greenfield Device to a Branch Site 18 Workflow Overview: Adding a Brownfield Device to Branch Site 19 CHAPTER 8 Related Documentation 23 iii
Contents iv
CHAPTER 1 Cisco IWAN App on DNA Center 1.1 Patch 1 Note This initial release of the IWAN app is a limited availability release, for specific customers. The Cisco Digital Network Architecture (DNA) Center 1.1 Patch 1 release, in December 2017, introduces the Cisco Intelligent WAN application (IWAN app) as an optional package that operates as a component of DNA Center. Previously, the IWAN app has been available as a tool within Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM). Quick Start Guide Operating as part of DNA Center, the IWAN app functions largely as it did with APIC-EM. This Quick Start guide describes the new methods and features (New and Updated Features, on page 5) that apply to the IWAN app within DNA Center, and includes important notes and limitations (Notes and Limitations, on page 11). This guide includes a high-level overview (IWAN App High-level Overview, on page 15) of IWAN app functionality, with notes about where to execute various functions. Additionally, it includes brief overviews of a few procedures that differ from earlier releases of the IWAN app: Workflow Overview: Configuring Hub Sites, on page 17 Workflow Overview: Adding a Greenfield Device to a Branch Site, on page 18 Workflow Overview: Adding a Brownfield Device to Branch Site, on page 19 1
Cisco IWAN App on DNA Center 1.1 Patch 1 2
CHAPTER 2 Overview of the Cisco IWAN App Cisco IWAN extends Software Defined Networking (SDN) to branch sites, with an application-centric approach based on business policies and application rules. Cisco IWAN provides tools for centralized management and distributed enforcement across the network. Cisco IWAN automates deployments with an intuitive browser-based user interface. A new router can be provisioned faster, without requiring the use of router CLI commands. Business priorities are translated into network policies based on Cisco best practices and validated designs. Using automation and simple, predefined workflows, Cisco IWAN reduces the time required to configure advanced network services, such as DMVPN, PKI, AVC, QoS, and PfR. The application-centric approach offers the following benefits: Reduced operational costs Cisco IWAN helps IT deliver an unparalleled user experience over any connection, while lowering operational costs. Simplified IT operations Cisco IWAN uses a software-based controller model, automating and centralizing management tasks to ensure faster, more successful deployments. Reduced network complexity Cisco IWAN abstracts network devices into one system, eliminating network complexity and providing centralized provisioning of the infrastructure to speed up application and service rollouts. 3
Overview of the Cisco IWAN App 4
CHAPTER 3 New and Updated Features The IWAN app for DNA Center operates largely in the same way as it did in its previous release on APIC-EM, but there are some changes to note. The IWAN app integrates the DNA Center functionality, such as defining sites and managing Cisco IOS images. Tip Some tasks involve steps in DNA Center and in the IWAN app. Open DNA Center and IWAN app in two separate tabs of a browser to switch between them easily. Refresh the page if necessary to reflect updated information. The IWAN App High-level Overview, on page 15 provides a summary of tasks related to the IWAN app, and where to execute them. 5
New and Updated Features New and Updated Features: Configuring network, sites, and devices Feature/Task Global network settings Description On the IWAN app home page, the Monitor & Troubleshoot option has been replaced with Create Sites & Configure Global Settings. This option opens the DNA Center > Design > Network Settings page for configuring global settings. Mandatory global settings for using the IWAN app: Netflow Collector server DNS server Mandatory global settings for DNA Center: DHCP server Each node in the network hierarchy configured in DNA Center inherits the settings of the parent node, but you can select any node and override the inherited settings. Note Important: In this release, the IWAN app only uses the settings configured at the global level. DNA Center behind NAT DNA Center behind NAT is supported. In the IWAN app > Configure Hub Site & Settings > System tab, configure the DNA Center NAT/proxy IP. The default NAT port (80) is used. In this release, after the NAT address is set, it cannot be changed. Note In earlier releases of theiwan app, a custom NAT port could be configured. 6
New and Updated Features Feature/Task Creating sites and network hierarchy Description In DNA Center > Design > Network Hierarchy, define the network hierarchy, including sites, buildings, and floors. The IWAN app uses the leaf nodes (terminal nodes) of the hierarchy as sites within the IWAN app. These may be either buildings or floors. For example, if the following site locations are defined in DNA Center Global > HQ-East > Building-NY-01 Global > HQ-West > Building-SanFran-01 Global > Branch-LasVegas > Building10 > Floor1 Global > Branch-Dallas > Building20 > Floor1...the IWAN app presents the following sites: Building-NY-01 Building-SanFran-01 Floor1 Floor1 To distinguish nodes with the same name, the IWAN app displays the full path, where necessary, when selecting sites. Example: Floor1 Branch-LasVegas/Building10/Floor1 Setting site location In DNA Center > Design > Network Hierarchy, select a site or building and configure the geographic location. The location is shown in the IWAN app map view. Note This replaces the Set Geo feature in earlier releases of the IWAN app. 7
New and Updated Features Feature/Task Inheritance of settings, IWAN app uses only global settings Configuring a hub site Adding greenfield devices to branch sites Adding brownfield devices to branch sites Deleting a site in the IWAN app Description Each node in the network hierarchy (defined in DNA Center > Design > Network Hierarchy) inherits settings from the parent node. Note In this release, the IWAN app uses only the settings configured at the global level. In DNA Center, define hub sites and locations. When configuring a hub site, in the IWAN app > Configure Hub Site & Settings > IWAN Aggregation Site tab, use the dropdown menu to select a hub site from the list of sites configured in DNA Center. In the IWAN app > Sites > Devices tab, click the Add Greenfield Device button. This opens DNA Center > Provision > Devices > Inventory. Click Unclaimed Devices and follow the procedure for adding a new greenfield device (Workflow Overview: Adding a Greenfield Device to a Branch Site, on page 18). When adding a brownfield device, select the site name in the IWAN app > Sites > Devices tab > Site Name column. During provisioning, the IWAN app communicates this site assignment for the brownfield device to DNA Center, and the assigned site will appear in the device inventory. Deleting a site in the IWAN app changes the status of the associated devices in DNA Center. Greenfield devices discovered by Plug and Play call-home move from Inventory to Unclaimed Devices in DNA Center. Brownfield devices are removed from the inventory in DNA Center. Note Sites managed by the IWAN app can be removed only from within the IWAN app, and not directly through DNA Center. Cisco IOS image management Manage Cisco IOS images to be used for provisioning new devices, in DNA Center > Design > Images Repository. Note This replaces the Certified IOS Releases tab in earlier releases of the IWAN app. 8
New and Updated Features New and Updated Features: Monitoring Feature/Task Service Assurance and application health Description Service Assurance is a feature of DNA Center, used for evaluating network and client health. DNA Center > Assurance Note Earlier releases of the IWAN app included a beta-version Service Assurance feature, activated by an Assurance button in the map view. Earlier releases of the IWAN app displayed application health information in an Application Health tab for each site. See DNA Center for information about site traffic. 9
New and Updated Features 10
CHAPTER 4 Notes and Limitations Notes and Limitations: Installation Issue Details Not compatible with the Do not install the IWAN app together with the Automation Application Policy Policy package package. Not compatible with Cisco SDA Do not install the IWAN app together with Cisco Software-Defined Access (SDA). Notes and Limitations: Configuration Issue Details IWAN app uses the global network settings configured in DNA Center Network settings are configured on the DNA Center > Design > Network Settings page. Each node in the network hierarchy configured in DNA Center inherits the settings of the parent node, but you can select any node and override the inherited settings. In this release, the IWAN app only uses the network settings configured at the global level. DNA Center behind NAT The default NAT port (80) is used. Setting a custom NAT port is not supported in this release. After the NAT address for DNA Center is set, it cannot be changed. 11
Notes and Limitations Issue IP address pool conflict Details In the IWAN app, do not configure an address pool (global or service provider) that overlaps with an address range configured as an IP address pool in DNA Center. Similarly, in DNA Center, do not configure an address pool that overlaps with an address range configured as an IP address pool in the IWAN app. Where to configure: IP address pools in the IWAN app: IWAN app > Configure Hub Site & Settings > IP Address Pools tab IP address pools in DNA Center: DNA Center > Design > Network Settings > IP Address Pools Notes and Limitations: Monitoring and Assurance Issue Service Assurance LiveAction third-party monitoring Details Service Assurance is a component of DNA Center. Use this tool to monitor network connectivity: DNA Center > Assurance Earlier releases of the IWAN app included a beta-version Service Assurance feature, activated by an Assurance button in the map view. The Third Party Monitoring button in the IWAN app map view opens LiveAction third-party monitoring. In this early release, no LiveAction functionality is available, pending additional work by LiveAction to integrate Cisco DNA Center APIs for interoperability. The button currently attempts to open the NetFlow collector site in a new browser tab. When LiveAction functionality becomes available, it will open a LiveAction monitoring page. 12
CHAPTER 5 Activating the IWAN App on DNA Center Before You Begin Install Cisco DNA Center 1.1 Patch 1. Review the installation notes. See Notes and Limitations, on page 11. Review the software requirements described in the release notes. See Related Documentation, on page 23. Step 1 To be able to view the IWAN app package, SSH into the DNA Center console (ssh -p 2222 maglev@controller-ip) and issue the following command: magctl service setenv catalog PARENT_CATALOG_SERVER_REPOSITORY iwan-ca Step 2 In DNA Center, open App Management. DNA Center home page > Settings ( ) > System Settings > App Management Step 3 Refresh the package list. The IWAN package and a new version of the Network Controller Platform package appear in the list. Click Download to download the latest version of the Network Controller Platform (2.1.2.60007 or later). Click Install to upgrade to the latest version of Network Controller Platform package. Click Download to download the the IWAN package (2.1.1.260216 or later). Click Install to install the IWAN package. After installation, open the DNA Center home page. The IWAN app appears in the Tools list. Step 4 Step 5 Step 6 Step 7 Step 8 13
Activating the IWAN App on DNA Center 14
CHAPTER 6 IWAN App High-level Overview The following tables present a high-level overview of IWAN app functionality, with notes about where to execute various functions. Installation Task Details 1 Install DNA Center and IWAN app. See Related Documentation, on page 23. 2 Install devices within the network. Devices must be reachable by DNA Center. Devices may be physical or virtual. Configuration Task Details 1 Configure global network settings. DNA Center > Design > Network Settings 2 Configure sites and network DNA Center > Design > Network Hierarchy hierarchy. Design a network hierarchy, with sites, buildings, and so on. The network hierarchy is a construct used for organizing devices. Typically, a useful network hierarchy reflects the physical location of sites, buildings within a site, and locations within buildings. However, the design is unconstrained, and need not reflect the actual physical arrangement. 3 Configure service provider IWAN app > Configure Hub Site & Settings > Service Providers tab details. 4 Configure IP address pools IWAN app > Configure Hub Site & Settings > IP Address Pools tab to be used for devices. 15
IWAN App High-level Overview 5 6 7 8 9 Task Add devices to hub sites. Provision the hub sites (all devices at the sites). Add devices to branch sites. Provision the branch sites (all devices at the sites). Configure policy. Details IWAN app > Configure Hub Site & Settings > IWAN Aggregation Site tab Generally, hub devices are added as brownfield devices. Provisioning the device to an IWAN hub site adds an IWAN overlay to the existing device functionality. IWAN app > Configure Hub Site & Settings > IWAN Aggregation Site tab IWAN app > Manage Branch Sites > Devices tab IWAN app > Manage Branch Sites > Devices tab IWAN app > Administer Application Policy 16
CHAPTER 7 Workflow Overviews Workflow Overview: Configuring Hub Sites, page 17 Workflow Overview: Adding a Greenfield Device to a Branch Site, page 18 Workflow Overview: Adding a Brownfield Device to Branch Site, page 19 Workflow Overview: Configuring Hub Sites Before You Begin Define sites on the DNA Center > Design > Network Hierarchy page. In the IWAN app > Configure Hub Site & Settings > Service Providers tab, configure service providers. Step 1 Step 2 Open the IWAN app > Configure Hub Site & Settings > IWAN Aggregation Site tab. Use the dropdown menu to select a site defined in DNA Center. Un-provisioned leaf nodes (terminal nodes) in the network hierarchy, of types building or floor, appear in the list of sites. Step 3 If required, add a site-specific IP address pool for the hub site in the IWAN app > Configure Hub Site & Settings > IP Address Pools tab. (Optional) Add a device to a hub site. a) In the IWAN app > Configure Hub Site & Settings > IWAN Aggregation Site tab, hover over the add router Step 4 button ( ) and select a hub site. b) In the Configure Hub Border Router dialog box, enter the management IP and SSH credentials for the device to add. 17
Workflow Overview: Adding a Greenfield Device to a Branch Site Workflow Overviews c) Click Save. The device is added to the hub. It appears in the IWAN app and in the DNA Center device inventory. Step 5 Step 6 Click Save & Continue to begin the provisioning process. After you add devices to a hub site using the IWAN app, and complete provisioning of the site, check the DNA Center > Provision > Devices > Inventory page. Workflow Overview: Adding a Greenfield Device to a Branch Site The procedure for adding a greenfield device has changed since earlier versions of the IWAN app. Before You Begin In typical scenarios, define the branch site in DNA Center before adding the device. Ensure that any necessary Cisco IOS images are available in DNA Center > Design > Images Repository. The IOS images are deployed to new greenfield devices during provisioning. The image requirements will depend on the devices used in your network. Configure address pools, as needed (IWAN app). Important: Do not configure an address pool (global or service provider) that overlaps with an address range configured as an IP address pool in DNA Center. Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 In the IWAN app > Manage Branch Sites > Devices tab, click the Add Greenfield Device button. The DNA Center > Provision > Devices > Inventory page opens. Click Unclaimed Devices. Discovered devices appear in the unclaimed devices list. Note Device discovery occurs when a new device identifies itself to DNA Center using Plug and Play call-home. Wait for the Status column to show UNCLAIMED for the device. Select the device (using the checkbox at the far left) and click Claim Device. A Claim Devices page opens for the site. Use the dropdown menu to assign the device to a site. Click the Assign button. The device appears on the DNA Center > Provision > Devices > Device Inventory > Inventory list. The Provision Status column shows that the device has not been provisioned. You can press the Refresh button to see the updated status: UNCLAIMED START_PROVISIONING PROVISIONING_CONFIG When provisioning is complete, the device disappears from the Unclaimed Devices list and is added to the Inventory list. 18
Workflow Overviews Workflow Overview: Adding a Brownfield Device to Branch Site Step 7 Step 8 Step 9 Open the IWAN app > Manage Branch Sites > Devices tab. The device appears in the device list. The Discovered By column shows PNP, indicating that this is a greenfield device. The Validation Status column indicates that the device has not been validated. In the Action column, click Revalidate. If successful, the Validation Status changes to Success. Click the Provision Site button. Workflow Overview: Adding a Brownfield Device to Branch Site It is possible to add a brownfield device to the DNA Center device inventory and claim it for the IWAN app using two methods: Add the device using the DNA Center Inventory tool, then claim it using the IWAN app. Add the device and claim it using the IWAN app directly. After using one of these methods to add the brownfield device and claim it for the IWAN app, the next steps are to assign the device to a site, and eventually to provision all of the site's devices. Adding a brownfield device directly to the DNA Center inventory 1 Open the DNA Center > Inventory tool and click the Add button. 2 In the Add Device dialog box, enter the address and credentials for the device and click the Add button. The device appears in the device list. 3 Open the IWAN app > Manage Branch Sites > Devices tab. 4 Click the Add Brownfield Device button. The Add Brownfield Device dialog box opens. The brownfield device list in the dialog box shows the newly added device. 5 Claim the device for the IWAN app. a b In the Add Brownfield Device dialog box, select the radio button to the left of the device. Click the Claim Device button. The device is added to the IWAN app > Manage Branch Sites > Devices tab list of devices. A device added through the DNA Center Inventory tool is not automatically validated by the IWAN app. The Validation Status column shows WARNING. 6 In the Action column, click the refresh button to validate the device. 19
Workflow Overview: Adding a Brownfield Device to Branch Site Workflow Overviews Adding a brownfield device using the IWAN app 1 Open the IWAN app > Manage Branch Sites > Devices tab. 2 Click the Add Brownfield Device button. The Add Brownfield Device dialog box opens. 3 In the dialog box, click the Adding new device link. A new Add Brownfield Device dialog box opens, prompting you for a device address and credentials. 4 Enter the address and credentials for the device and click the Add Device button. The device is added to the DNA Center device list, and it is also added to the IWAN app > Manage Branch Sites > Devices tab list of devices. 20
Workflow Overviews Workflow Overview: Adding a Brownfield Device to Branch Site Note Using the IWAN app to add a brownfield device does three things: Adds the device to the DNA Center inventory Claims the device for the IWAN app Initiates the IWAN validation process By contrast, when using the DNA Center Inventory tool to add a brownfield device, each of these actions requires a separate step: a step to add the device to the DNA Center inventory, a step to claim it for the IWAN app, and a step to validate the device. 5 Click the Add Brownfield Device button. The Add Brownfield Device dialog box opens. The brownfield device list in the dialog box shows the newly added device. Assigning a brownfield device to a site After adding the brownfield device and claiming it for the IWAN app, the procedure for assigning it to a branch site is largely the same as in earlier releases of the IWAN app. 1 Open the IWAN app > Manage Branch Sites > Devices tab. 2 In the list of devices, in the Site Name column, use the dropdown menu to select a site. Sites are defined in the DNA Center. 3 Continue the process as in earlier releases of the IWAN app. With the integration of the IWAN app into DNA Center, note the following: After you use the IWAN app to add a brownfield device to a branch site, and then you provision the site, the IWAN app communicates the site assignment and other information for the brownfield device to DNA Center. The device appears, with its site assignment, in the DNA Center device inventory. 21
Workflow Overview: Adding a Brownfield Device to Branch Site Workflow Overviews 22
CHAPTER 8 Related Documentation Document Cisco IWAN Application on DNA Center Release Notes, Release 1.1 Patch 1 Cisco Digital Network Architecture Center Appliance Installation Guide Cisco Digital Network Architecture Center Administrator Guide Cisco Digital Network Architecture Center User Guide Release Notes for Cisco Digital Network Architecture Center, Release 1.1.0, Patch 1 Cisco IWAN Application on APIC-EM User Guide, Release 1.6.0 Information IWAN app release information, including system requirements, software compatibility, and open and resolved caveats. Installation and configuration of DNA Center, including post-installation tasks. Configuration of user accounts, RBAC scope, security certificates, authentication and password policies, and global discovery settings. Monitoring and managing DNA Center services. Backup and restore procedures. Introduction to the DNA Center GUI and its applications. Release information, including new features, system requirements, and open and resolved caveats. The user guide for the previous version of the IWAN app, running as part of Cisco APIC-EM, offers in-depth information about IWAN app functionality. 23
Related Documentation 24