BRKENS 2503a
BRKENS 2503a
2
#CiscoLive
Cisco Webex App
Questions?
Use Cisco Webex App to chat
with the speaker after the session
How
1 Find this session in the Cisco Live Mobile App
2 Click “Join the Discussion”
3 Install the Webex App or go directly to the Webex space
Enter your personal notes here
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 33
• Introduction
• What is Intent-Based Networking?
• Recipe to transform to IBN
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 4
Introduction
• 22+ years in IT
• Consultant, Creator, Engineer,
Software Developer, Early Adopter
• Cisco Champion & Tech Field Day delegate
• Blogger, Trainer
• Married, 2 daughters
• Hobbies: Cyclist, Photography, Cooking
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 5
Intent-Based
Networking
What is Intent?
Intent = Purpose
Intent Steps
Take the mower out of the garage, connect it to power, pull cord to start, push onto lawn and
I need the lawn cut mow in lanes until lawn is finished, power off the mower, remove grass from the lawn,
disconnect the mower, clean grass from the mower, and put it back in the garage.
Check whether there is enough fuel is in the car; if not, drive to the nearest gas station and fill
Driving a car
up the tank; start driving.
Prepare a budget proposal for the CFO explaining why replacement is required, present the
I need to replace
proposal, wait for approval, request quotes, procure hardware, execute project to replace
our firewalls
firewalls in production
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 7
Intent-Based Networking
Cisco’s Digital Network Architecture is IBN
o Operate Intent-Based
Network Infrastructure
S E C U R I T Y
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 8
Request Intent-based
intent feedback
IBN work?
Steps metrics
https://www.infratech.academy/p/ita1002-ibn101
BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 9
IBN(t) = Base network + ∑(intents)
Intent Based Networks are the
Sum of All Intents plus the Base Network
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 10
What is an (Enterprise) Architecture?
Examples of architectures:
• Buildings, Car manufacturing, Network design, Recipes
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 11
What is an (Enterprise) Architecture
• An architecture framework
• Helpsyou setup and manage
an enterprise design
• Often
modeled as a "multi-layer”
approach with 4 architectures
• The “Network" is (like IT) often
in the Technology architecture
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 12
Cisco’s Intent-Based Network
Delivered by Cisco Digital Network Architecture (DNA)
SAAS
ACI
Data Center
LEARNING
SD-Access
SD-Access
SECURITY
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 13
Cisco Digital Network Architecture (DNA)
Powering the Intent Based Network
Security
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 14
How is Cisco DNA related to IBN?
Business
Request
Cisco DNA Intent Intent-based
feedback
Activation Assurance
Translates steps Validates intent based
into configuration on feedback & telemetry
Security
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 15
Building Blocks
1• Management
Cisco DNA
2• Automation
1 Cloud Service Management
3• Identity
2 Automation Analytics 6
4• Security
3 Identity & Virtualization
5• Infrastructure
Physical & Virtual Infrastructure
6• Analytics 5
Security 4
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 16
Building blocks
1.1 Management Cisco DNA
• This is the new Cisco DNA Center
appliance, GUI and related APIs 1 Cloud Service Management
• Application Program Interfaces (APIs) are
used by developers to expose features or Automation Analytics
functionalities in such a way that other
developers can (re)use them in their
Identity & Virtualization
applications
• Within DNA, API’s are used so that Physical & Virtual Infrastructure
applications within the building blocks can
use functionality and features of other
building blocks
Security
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 17
Building blocks
1.
2 Automation
Cisco DNA
• The Cisco DNA Center appliance includes
a built in Automation system, which Cloud Service Management
manages all network device configurations
• There are multiple mechanisms and 2 Automation Analytics
protocols used for configuration, such as
SSH/CLI, SNMP or NetConf/YANG, and
DNA Center uses one or more for each Identity & Virtualization
device type
• All automation events, timestamps and Physical & Virtual Infrastructure
status are logged and can be reviewed in
DNA Center or exported via APIs to ITSM
or other tools
Security
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 18
Building blocks
1.3 Identity Cisco DNA
• Cisco Identity Services Engine (ISE)
provides all endpoint authentication and Cloud Service Management
authorization, provides this information to
Cisco DNA Center
Automation Analytics
• Cisco ISE can interoperate with multiple
sources of “identity”, such as Active 3 Identity & Virtualization
Directory, LDAP, DNS records,
AWS/Azure/GoogleCloud, etc.
Physical & Virtual Infrastructure
• The endpoint identity can then be used by
the Automation & Analytics systems for
policy configuration and assurance
Security
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 19
Building blocks
1.4 Security
Cisco DNA
• Security is increasingly important and
required for all aspects of the network Cloud Service Management
• Within Cisco DNA, security is tightly
integrated within the design, with
role-based access control, trusted Automation Analytics
certificates, and direct integration with
Cisco ISE for authorization, identity Identity & Virtualization
and security policies
• Based on the identity of an endpoint (user Physical & Virtual Infrastructure
and/or device), the correct security or
application policy can be applied to that
endpoint
Security 4
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 20
Building blocks
1.5 Infrastructure
Cisco DNA
• DNA is the network architecture for the future,
which means that the hardware needs to be ready
for the future Cloud Service Management
• The hardware and software must support the
design principles, such as data models and Automation Analytics
pervasive analytics & automation
• All Cisco Catalyst 9000 hardware
Identity & Virtualization
• All Cisco ISR 4000 hardware
• All Cisco AireOS hardware Physical & Virtual Infrastructure
5
• Cisco Legacy hardware, with limitations
• Cisco NFV software, with limitations
Security
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 21
Building blocks
1.6 Analytics
Cisco DNA
• The Cisco DNA Center appliance includes
a built in Assurance system, which Cloud Service Management
manages analytics and telemetry
• Key Performance Indicators (KPIs) are 6
used to check whether the network, Automation Analytics
clients and applications are running within
set parameters Identity & Virtualization
• To ease troubleshooting - pervasive
analytics (AI, Machine Learning and other Physical & Virtual Infrastructure
modern data analytics) are used to quickly
ascertain specific behaviors, and whether
an incident is app, client,
or network-related
Security
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 22
Cisco DNA & EA
BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 23
A recipe to transform
How is IBN like a Recipe?
Purpose Built
List of Components
Ordered Steps
Combination Methods
Repeatable
Customizable
www.hellofresh.com/recipes/parmesan-crusted-chicken-5dd8306c1605ed7a9a6ab4b5
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 25
Agenda
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 26
Agenda
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 27
1. Identify Challenges
determine state of Steps:
campus network &
organization
Day to day operations
2. Prepare for Intent Create an inventory
Meet all requirements,
introduction of IBN Level of standardization
supporting tech +
standardisation
Maturity of organization
3. Design & Deploy Stakeholders
Design, implement &
transform your campus Prioritise and create
network action plan
4. Enabling Intent
Bring your Intent-
enabled network to the
enterprise
Create an Inventory
Do you know which devices & versions you have?
•DNA (and IBN) requires DNA ready hardware
⦁ Up-to-date hardware and software is required
for any digitalized business
•Create a detailed list of all installed hardware
and software in the network
⦁ Include whether device is EoL, software is EoL,
and when it needs to be replaced
⦁ Aggregate the list of inventory
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 29
Inventory Example
Family Type Name SW version
…
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 30
Level of Standardization
Can you predict the behavior of your network?
IBN requires high level of standardization
Analyze the business on how much
of the network is standardized?
• Device hardware (type)
• Device software (version)
• Device configuration Image source: atbautomation.eu
• Design documentation
• Implementation details
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 31
Stakeholders
Changes like IBN requires long time support
• Identify
• Involve
• Ownership
• Accountable
• Stakeholder map
• RACI model
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 32
Priorities & Action Plan
Focus on Maturity, Standardization and Stakeholders
• Chance of Success 1
Low maturity level Organization is too much ad hoc oriented,
of organization enterprise needs to mature first.
• Commitment
Not all stakeholders see benefit of IBN. Risk of
2 Stakeholders
• Time failure is high
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 33
Identify Challenges
determine state of Steps:
campus network &
organization
Match requirements
Prepare for Intent
Meet all requirements, Migrate from port-centric to policy
introduction of IBN
supporting tech + centric
standardisation
Introduce DNAC Assurance
Design & Deploy Introduce Automation
Design, implement &
transform your campus
network
Enabling Intent
Bring your Intent-
enabled network to the
enterprise
Matching Requirements
Potentially a Long-running Step
Organizational
Remarks
requirements
Maturity level should Journey to IBN requires years not months, having documented vision, procedures and designs
be 3 or 4 are critical to transform.
The network team needs to be able to perform the changes. Financial commitment for extra
Resource Availability
resources is critical
Infrastructure IBN is based on Cisco DNA, and your network needs to be DNA ready. Life cycle management
Requirements need to take place.
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 35
Standardization is a prerequisite for
Automation
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 36
Port-Centric to Policy-Centric
DC
Policy-centric approach is a critical step for IBN WAN
CSW
ISE
Deployment
• A central policy server assigns a VLAN or other attributes
Campus
• Based on the identity of the endpoint (802.1x, MAB, etc.) Network
Port-Centric Policy-Centric
SW1 Policy on ISE
interface gig1/0/1
description printer-1
switchport access vlan 10
! SWx
interface gig1/0/2
description ap interface gig1/0/1
switchport accessdescription
vlan 101 printer-x
switchport access vlan 10
!
interface gig1/0/2 SW20
description iot-x
switchport access vlan 50gig1/0/1
interface
description printer-20
switchport access vlan 10 SW1 … SW20
!
interface gig1/0/2 interface range gig1/0/1-24
description iot-1 description access-port
switchport access vlan 221 macro dot1x
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 37
Standardized VLAN plan
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 38
Standardized IP plan
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 39
“Automation enables me
to get rid of boring things like updating
software”
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 40
Introducing Automation
Cisco DNA
Center
• Automation is critical to IBN
• Automation introduces fear
• Startwith small things that are resource "iosxe_rest" "vlan_example_patch" {
}
• Change of SNMP parameters }
)
}
ntp_server { ‘10.141.1.1’:
ensure => ‘present’, key => 94,
prefer => true,
minpoll => 4,
maxpoll => 14,
source_interface => ‘vlan 42’,
}
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 41
Agenda
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 42
Agenda
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 43
Identify Challenges
determine state of Steps:
campus network &
organization
Enabling Intent
Bring your Intent-
enabled network to the
enterprise
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 44
Setup a Lab environment
• Create a copy of your existing network
• Allowsfor training and testing of new
configurations
• Must meet DNAC requirements
• Mustreflect production in hard- and
software
• Flexible setup; different topologies
• Use for training, testing and development
of new services/configs
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 45
Choosing a Technology
Lab can be used for different technologies
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 46
Cisco Software Defined Access
▪ Network Automation – Simple GUI
Automation and APIs for intent-based Automation
Identity Cisco DNA Center of wired and wireless fabric devices
Cisco ISE
Services
▪ Network Assurance – Data Collectors
analyze Endpoint to Application flows
Assurance and monitor fabric device status
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 47
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 48
Transform to IBN
✅ Four steps to transform
1. Deploy Baseline
2. Convert to Intents
3. Extending Intents
4. Identity Security
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 49
1. Deploy Baseline
Identify the “First Site"
Friendly Users
Not business critical
Close to IT support
Resembles a typical site in the Campus network
Not too big or too small
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 50
2. Convert to Intents
Define intents for the network from coarse to granular
Intent Name Description Wired Wireless Special requirements
Guest
Wireless guest access No Yes Only access after a sponsor created account & acceptance of AUP
access
BYOD
Bring Your Own Device is allowed Yes Yes Only allow access after successful on-boarding to Cisco ISE
access
Security Special access for video wall, emergency response can connect after
CCTV for physical security Yes No
cameras support requests
Key-fobs Key-fobs on all doors No Yes Only allowed connection to door management system
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 51
2. Convert to Intents
Parameter Description
Wireless Guest
Services
$SSIDName Name of SSID
Try to create
templates from similar services $BroadCastSSID Whether or not to broadcast SSID
Wireless for
employees $externalVLAN VLAN Identifier for SSID
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 52
3. Extending Intents
Extend your IBN-enabled services across your network
Location
Intents
Yes
in Intents
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 53
4. Identity Security
Security is essential for any Intent-Based Network
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 54
Steps:
IBN Recap
Why extend Intent to the Enterprise
API's for Intent
Create a service catalog
Bring IBN to the enterprise
Intent-based Examples
Enabling Intent
Bring your Intent-
enabled network to the
enterprise
55
IBN & DNA Recap
Enabling "Business Intent"
Business
•
Validation
& metrics
•
Translates steps Validates intent based
into configuration on feedback & telemetry
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 56
Application Programmable Interfaces
APIs are the “language” that an app speaks to get or set info with another app
DNA Center
// Define a RestService
let restApp = RestService()
// set URL and credentials
restApp.serviceURL = “https://dnac.cisco.com/api/v1/endpoints" User “Chuck Robbins” on endpoint “iPad Chuck”
restApp.setCredentials(login: “myuser”, password: “superSecret”) is connected to “CiscoCEOWireless”
// get all endpoints User “Pieter-Jan Nefkens” on endpoint “Apple Watch”
let endpoints = restApp.getEndpoints() is connected to “Internet”
for endpoint in endpoints { User “Shawn Wargo” on endpoint “WinLT12351”
// print the endpoint name & user is connected to “Blizzard”
print(“User \(endpoint.loggedInUser) on endpoint \(endpoint.name)”)
print(“is connected to: \(endpoint.network.name)”)
}
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 57
Agenda
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 58
Service Catalog
Define a list of services (Intents) that can be easily deployed on the network
• Define
what Intents users and apps can
request from the network
• Model the actions
(use software engineers if necessary)
• Define services
• Define corresponding API calls
• Test services on LAB environment
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 59
Bring IBN to the Enterprise
• Understand the business
• Setup pilots / proof of concepts
• Build apps / portals
• Setup a marketing / communication plan
• Share your successes (and failures!)
• Allowdevelopers to do things on your network
(from the Service Catalog)
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 60
Summary
• IBNis not a technology, it is a concept on how to manage, operate and
deploy your network;
• Transformation is executed in four phases:
1. Identifying challenges
2. Matching requirements
3. Design & Deploy
4. Enabling Intent
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 61
Pay for Learning with
Cisco Learning Credits
Cisco Learning and Certifications (CLCs) are prepaid training
vouchers redeemed directly
From technology training and team development to Cisco certifications and learning with Cisco.
plans, let us help you empower your business and career. www.cisco.com/go/certs
Here at the event? Visit us at The Learning and Certifications lounge at the World of Solutions
#CiscoLive BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 62
• Visit the Cisco Showcase
for related demos
BRKENS-2503a © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 63
Thank you
64
#CiscoLive
#CiscoLive 65