Cisco SDN Flashcards
Four Workflows of DNA
- Design
- Policy
- Provision
- Assurance
Two Models of Underlay
- Manual Underlay - configured and managed manually via CLI or API rather than thru Cisco DNA
- Automated Underlay - Configured and managed by Cisco DNA Center LAN Automation Feature
3 Basic Planes of Operation in SD-Access fabric
- Control Plane - based on Locator/ID Separation Protocol (LISP)
- Data Plane - based on VXLAN
- Policy Plane - based on Cisco TrustSec
5 Basic Role in the fabric overlay
- Control Plane node - contains the settings to provide endpoint-to-location (EID-to-RLOC) mapping system for the fabric overlay
- Fabric border node - this fabric device connects external Layer 3 network to the SDA fabric
- Fabric Edge node - conneced wired endpoints to the SDA fabric
- Fabric WLAN controller - connect wireless and AP to the SDA Fabric
- Intermediate Nodes - these are intermediate routers or extended switches that do not provide any SDA fabric roles other than underlay services
Provide onboarding and mobility services for wired users and devices (including AP and WLC) connected to the fabric
Fabric Edge Nodes
is a LISP map server/resolver (MS/MR) with enhanced functions for SD-Acccess such as fabric wireless and SGT mapping
Fabric Control Plane node
are LISP proxy tunnel routers (PxTRs) that connect external Layer 3 network to the SD-Access fabric and translate reachability and policy information, such as VRF and SGT information
Fabric Border nodes
3 Types of border nodes
- Internal border - connects only to the known areas of the org
- Default border - connects only to unknown areas outside org
- Interna+Default border - connects transits areas as well known areas of the company
connects APs and wireless endpoints to the SD-Acces fabric
Fabric Wireless Controller (WLC)
SD-Access fabric concepts
- Virual Network (VN) - provide virtualization at device level using VRF
- Host Pool - group of endpoints assigned to an IP Pool subnet in the SDA-Access fabric
- Scalable group - group of endpoints with similar policies
- Anycast gateway - provides a pervasive L3 default gateway where the same SVI is provisione on every edge node
Provides all of the management subsystem for the management layer and this is all provided by Cisco DNA centre and CISCO ISE
Controller layer
3 Main Controller subsystems
- Cisco Network Control Platform (NCP) - directly integrated into Cisco DNA that provides all the underlay and fabric automation and orchestration. uses NETCONF/YANG
- Cisco Network Data Platform (NDP) - is a data collection and analytics and assurance subystem that is integrated directly into Cisco DNA Centre. (Netflow - SPAN)
- Cisco Identity Services Engine (ISE) provide all the identity and policy services for the physical layer and network layer
the user interface/user experience (UI/UX) layer where all the information from the other layers is presented to the user in the form of a centralized management
Management layer
Cisco SD-WAN solution 4 main components
vManage Network Management System (NMS) - single pane of glass (GUI) for managing the SD-WAN solutions
vSmart Controller - brain of the solutions
vBond Orchestrator - authenticates and orchestrates connectivity between SD-WAN routers and vSmart controllers
vAnalytics - optional analytics and assurance service
SD-WAN routers options available
vEdge - original viptela platforms running Viptela software
cEdge - Viptela software integratred with Cisco IOS-XE. supported on CSR, ISR
Two types of hypervisor
- Type 1 - hypervisor runs directly on the system hardware
- Type 2 - hypervisor requires a host OS
Is an isolated environment where containerized applications run
container
is a software based layer 2 switch that operates like a physical Ethernet switch
vSwitch
Is a architectural framework created by the European Telecomnunications Standards Institute (ESTI) that defines standards to decouple network functions from proprietary hardware-based appliances and have them run in soft-ware on standard x86 servers
Network Functions Virtualization (NFV)
Allows VNFs to have direct access to Physical PCI devices which appear and behave as if they were physically attached to VNF
PCI Passthrough
is an enhancement to PCI passthrough that allows multiple VNFs to share the same pNIC.
SR-IOV
Cisco solution based on the ETSI NFV architectural framework. reduces operational complexity of enterprise branch environments by running the required networking functions as network virtual functions (VNF) on standard x86 hosts.
Cisco Enterprise Network Functions Virtualization (ENFV)
Cisco ENFV Solution Architecture 4 Components
- Management and Orchestration (MANO)
- VNFs
- Network Functions Virtualization Infrastructure software (NFVIS) - operating system the provides virtualisation capabilities
- Hardware resource
API - often used to communicate from a network controller to its management software
Northbound API
If a network operators makes a change to a switch configuration management software of the controller, those changes are pushed down to the individuals via this API
Southbound API
This API use HTTP methods to gather and manipulate data
Representation State Transfer (REST) APIs
HTTP Function and uses cases
- GET - request data
- POST - submit data
- PUT - replaces data (updating)
- Patch - appends data (adding)
- Delete
CRUD Functions
Create
Read
Update
Delete
HTTP Status codes
200 - OK
201 - Created
400 - Bad Request
401 - Unauthorised
403 - Forbidden
404 - Not Found
Cisco IOS Tool that allows engineer to build software applet that can automate many tasks.
Embedded Event Manager (EEM)
Robust configuration management and automation tool.
Puppet
Open source configuration management tool that is designed to automate configurations and operations of a network and server environment
Chef
Another configuration management tool. build in python
SaltStack
Automation tool that is capable of automating cloud provisioning, deployment of applications, and configuration management. Agentless tool and opensource
Ansible
Allows you to leverage the power of Puppet without having to install a puppet master or puppet agents on devices and nodes. Connect using SSH or WinRM
Puppet Bolt
Saltstatck offer this option that allow user to run Salt Commands without having to install a minion on the remote device or node
Salt SSH
IETF standard protocol that uses YANG Data models to communicate with various devices on the network. Runs vers SSH,TLS
RFC 4741 and 6241
NETCONF
NETCONF Operations
<get>
<get-config>
<edit-config>
<copy-config>
<delete-config>
</delete-config></copy-config></edit-config></get-config></get>
RFC 8040, used programmatically interface with data defined in YANG models while also using the datastore concept defined in NETCONF.
RESTCONF
