WEBVTT

1
00:00.000 --> 00:06.030
So after defined access is a combination of building out a fabric but also

2
00:06.030 --> 00:08.000
adding an SDN

3
00:08.000 --> 00:11.840
element, especially an SDN controller.

4
00:11.840 --> 00:14.990
What we want to do is we want to solve problems that go beyond the Layer 2 and

5
00:14.990 --> 00:15.880
Layer 3 issues

6
00:15.880 --> 00:17.600
as we just set.

7
00:17.600 --> 00:21.460
And so when we talk about a fabric, this is great for solving the Layer 2 and

8
00:21.460 --> 00:22.080
Layer 3

9
00:22.080 --> 00:23.080
conundrum.

10
00:23.080 --> 00:25.680
It allows us to achieve the best of both worlds.

11
00:25.680 --> 00:30.660
It's a wonderful approach that enables us to deliver something that traditional
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:25.680 --> 00:30.660
It's a wonderful approach that enables us to deliver something that traditional

12
00:30.660 --> 00:31.140
networks

13
00:31.140 --> 00:33.700
have never been able to deliver.

14
00:33.700 --> 00:35.640
But it doesn't solve all the other issues.

15
00:35.640 --> 00:40.510
The SDN controller and what we're going to find with SDA is actually a pair of

16
00:40.510 --> 00:41.700
controllers.

17
00:41.700 --> 00:45.750
But this operational layer is what's going to give us the ability to wrap our

18
00:45.750 --> 00:46.360
arms around

19
00:46.360 --> 00:47.360
better management.

20
00:47.360 --> 00:51.100
So all of those issues on the right side of the chalkboard and the last video

21
00:51.100 --> 00:51.320
that we

22
00:51.320 --> 00:55.820
said we've got all kinds of issues with managing a large environment and it's

23
00:55.820 --> 00:56.680
going to allow

24
00:56.680 --> 01:00.800
us to manage the security issues that we talked about as well.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
00:56.680 --> 01:00.800
us to manage the security issues that we talked about as well.

25
01:00.800 --> 01:05.700
This is why SDA combines the fabric with the SDN world because we're trying to

26
01:05.700 --> 01:06.200
solve

27
01:06.200 --> 01:11.760
more problems than just the bits and bytes that are flowing around our network.

28
01:11.760 --> 01:15.880
So let's gain a quick reminder of what exactly a fabric looks like.

29
01:15.880 --> 01:22.600
We know in a traditional network we are going to build this around a 3-tier

30
01:22.600 --> 01:24.000
architecture.

31
01:24.000 --> 01:28.160
And this 3-tier model is going to extend our core connectivity.

32
01:28.160 --> 01:32.120
So here's our network core down to a distribution layer.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

32
01:28.160 --> 01:32.120
So here's our network core down to a distribution layer.

33
01:32.120 --> 01:37.700
So this distribution layer is the dividing line between the Layer 3 world and

34
01:37.700 --> 01:38.320
the Layer

35
01:38.320 --> 01:43.000
2 world if we're building Layer 2 out to the edge.

36
01:43.000 --> 01:46.360
So we could also extend Layer 3 out here.

37
01:46.360 --> 01:49.640
This would be that Layer 2 versus Layer 3 debate.

38
01:49.640 --> 01:54.320
And from here we're going to connect down to individual access closets.

39
01:54.320 --> 01:57.800
And we have to decide how exactly we want to connect to the access closet.

40
01:57.800 --> 02:01.560
So we could do the triangle approach like I've drawn here on the left.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:57.800 --> 02:01.560
So we could do the triangle approach like I've drawn here on the left.

41
02:01.560 --> 02:05.940
And then I'm going to connect more switches down here and then loop through

42
02:05.940 --> 02:06.560
them.

43
02:06.560 --> 02:11.270
And this is going to give us some pros and cons relative to the other option

44
02:11.270 --> 02:12.040
which is

45
02:12.040 --> 02:17.050
to do this square methodology which allows us to connect through all of the

46
02:17.050 --> 02:18.000
switches this

47
02:18.000 --> 02:19.400
way.

48
02:19.400 --> 02:24.590
And just depending on outages and situations of which links go down, which

49
02:24.590 --> 02:25.560
switches might

50
02:25.560 --> 02:30.020
go down, either one of these topologies is going to have benefits and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
02:25.560 --> 02:30.020
go down, either one of these topologies is going to have benefits and

51
02:30.020 --> 02:31.280
disadvantages in

52
02:31.280 --> 02:33.520
those types of situations.

53
02:33.520 --> 02:37.540
And so we can build this out in either way and ideally recall that we benefit

54
02:37.540 --> 02:38.080
greatly

55
02:38.080 --> 02:43.480
if we replace this with a chassis switch or a stack of switches.

56
02:43.480 --> 02:49.490
And especially if we deploy VSS or these days, what Cisco calls stack wise

57
02:49.490 --> 02:50.520
virtual, either

58
02:50.520 --> 02:54.090
one of these technologies here at the distribution layer will greatly reduce

59
02:54.090 --> 02:55.800
spanning trees influence

60
02:55.800 --> 02:57.240
on this topology.

61
02:57.240 --> 03:01.280
And yet spanning tree is going to have to continue to run in one form or the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
02:57.240 --> 03:01.280
And yet spanning tree is going to have to continue to run in one form or the

62
03:01.280 --> 03:01.680
other.

63
03:01.680 --> 03:05.280
So there are things that we can do in this traditional 3-tier model.

64
03:05.280 --> 03:09.840
And the invention of these various technologies along the way or along the last

65
03:09.840 --> 03:10.400
couple of

66
03:10.400 --> 03:14.760
decades have really helped us out with our access layer designs.

67
03:14.760 --> 03:18.040
And we're also going to have to decide between layer 2 and layer 3.

68
03:18.040 --> 03:21.480
What I've drawn here is assuming a layer 2 environment.

69
03:21.480 --> 03:25.750
If we draw a layer 3 network out, we're likely going to go with the topology

70
03:25.750 --> 03:26.480
here on the

71
03:26.480 --> 03:32.310
left, which allows me to do layer 3 out to this head end node and then a sort
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

71
03:26.480 --> 03:32.310
left, which allows me to do layer 3 out to this head end node and then a sort

72
03:32.310 --> 03:32.840
of many

73
03:32.840 --> 03:37.480
layer 2 network that's inside of the network closet.

74
03:37.480 --> 03:43.880
Now we compare this or maybe contrast it with the idea of a fabric.

75
03:43.880 --> 03:49.150
And so with a fabric, we're going to take our many different access layer

76
03:49.150 --> 03:50.080
switches or

77
03:50.080 --> 03:53.600
ultimately our access closets, especially the head ends.

78
03:53.600 --> 03:59.360
And we're going to connect these into a layer 3 network.

79
03:59.360 --> 04:02.240
And we're going to build tunnels across the top of them.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
03:59.360 --> 04:02.240
And we're going to build tunnels across the top of them.

80
04:02.240 --> 04:06.040
So from a physical perspective, we still have our distribution switches in here

81
04:06.040 --> 04:06.280
.

82
04:06.280 --> 04:12.400
We're still connecting out to all of these different access closets.

83
04:12.400 --> 04:18.700
But from a layer 2 perspective, we're going to build tunnels among our

84
04:18.700 --> 04:20.000
different access

85
04:20.000 --> 04:21.680
layer closets.

86
04:21.680 --> 04:28.560
And these tunnels are going to allow us to carry layer 2 traffic.

87
04:28.560 --> 04:32.800
This is going to use a protocol known as VXLAN in order to do this.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

87
04:28.560 --> 04:32.800
This is going to use a protocol known as VXLAN in order to do this.

88
04:32.800 --> 04:36.160
And this allows a subnet to be stretched.

89
04:36.160 --> 04:40.640
We'll draw it like this all the way over here.

90
04:40.640 --> 04:45.460
So this layer 2, let's call it VLAN 10, can be stretched between these two

91
04:45.460 --> 04:46.360
access layer

92
04:46.360 --> 04:53.110
closets with devices at both closets being on the same subnet, being in the

93
04:53.110 --> 04:54.120
same VLAN.

94
04:54.120 --> 04:59.920
And yet they are layer 3 segmented because this underlay is layer 3.

95
04:59.920 --> 05:04.910
The reason why this works is because we see the VXLAN tunnel extends layer 2
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

95
04:59.920 --> 05:04.910
The reason why this works is because we see the VXLAN tunnel extends layer 2

96
05:04.910 --> 05:05.960
connectivity

97
05:05.960 --> 05:08.800
between the access layer closets.

98
05:08.800 --> 05:13.890
So this fabric concept is going to solve the layer 2 and layer 3 conundrum for

99
05:13.890 --> 05:14.360
us.

100
05:14.360 --> 05:16.600
We're going to build this network on layer 3.

101
05:16.600 --> 05:21.960
It's going to look a lot like a layer 3 access closet design at the beginning.

102
05:21.960 --> 05:25.800
Yet we're going to extend layer 2 via the XLAN.

103
05:25.800 --> 05:30.880
And so this completely eliminates spanning tree protocol, which is wonderful.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
05:25.800 --> 05:30.880
And so this completely eliminates spanning tree protocol, which is wonderful.

104
05:30.880 --> 05:33.040
We don't have that problem anymore.

105
05:33.040 --> 05:40.860
It also maximizes our flexibility because now we can have devices in the same

106
05:40.860 --> 05:41.400
subnet and

107
05:41.400 --> 05:47.160
two different access closets even though they are layer 3 segmented.

108
05:47.160 --> 05:49.200
Scaling is no issue whatsoever.

109
05:49.200 --> 05:55.680
We have wonderful scaling here because of the underlying layer 3 architecture.

110
05:55.680 --> 06:03.800
And so this is why we basically have all of the pros of layer 2 and layer 3.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

110
05:55.680 --> 06:03.800
And so this is why we basically have all of the pros of layer 2 and layer 3.

111
06:03.800 --> 06:09.720
And we have none of the cons of either one of those, neither of the downsides.

112
06:09.720 --> 06:13.040
Now we could argue that complexity is there.

113
06:13.040 --> 06:14.760
Maybe one factor there.

114
06:14.760 --> 06:17.760
We have said layer 3 is a little more complex to manage because we have

115
06:17.760 --> 06:18.840
additional protocols

116
06:18.840 --> 06:20.520
that we have to worry about.

117
06:20.520 --> 06:24.420
And we could make that argument that, hey, this is a lot that we have to manage

118
06:24.420 --> 06:24.640
.

119
06:24.640 --> 06:29.920
But deploying a fabric on its own is very different than deploying it with an

120
06:29.920 --> 06:31.240
SDN controller.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

120
06:29.920 --> 06:31.240
SDN controller.

121
06:31.240 --> 06:36.390
And so hopefully the claim at least is that this will actually be a lot simpler

122
06:36.390 --> 06:37.040
to manage

123
06:37.040 --> 06:42.280
than even the layer 3 side of things on the traditional or in the traditional

124
06:42.280 --> 06:43.200
network.

125
06:43.200 --> 06:46.960
And so the SDN controller is going to help us with that.

126
06:46.960 --> 06:51.450
So now let's explore what the SDN controller is going to help us do and that's

127
06:51.450 --> 06:52.080
going to

128
06:52.080 --> 06:56.760
start with a conversation around management.

129
06:56.760 --> 06:57.760
Management of our network.

130
06:57.760 --> 07:03.020
Again, it goes past the just switching of layer 2 frames and deciding about
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

130
06:57.760 --> 07:03.020
Again, it goes past the just switching of layer 2 frames and deciding about

131
07:03.020 --> 07:03.880
layer 2 and

132
07:03.880 --> 07:05.480
layer 3 architectures.

133
07:05.480 --> 07:11.200
And it's helping us with the sheer number of access layer switches.

134
07:11.200 --> 07:14.490
That continues to be one of the biggest problems and one of the biggest

135
07:14.490 --> 07:15.520
challenges for large

136
07:15.520 --> 07:20.850
organizations, especially when we think about college campuses and many

137
07:20.850 --> 07:22.240
locations and many

138
07:22.240 --> 07:24.000
access closets.

139
07:24.000 --> 07:28.800
And this can become very challenging as far as some of the management items

140
07:28.800 --> 07:29.440
that we had

141
07:29.440 --> 07:31.040
talked about earlier.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

141
07:29.440 --> 07:31.040
talked about earlier.

142
07:31.040 --> 07:35.820
Well, with an SDN controller, we are typically going to have a single

143
07:35.820 --> 07:38.240
management pane.

144
07:38.240 --> 07:44.000
Now pane is spelled P-A-N-E, not a pain like it hurts us.

145
07:44.000 --> 07:48.080
But a single management pane, meaning something that we log into.

146
07:48.080 --> 07:51.480
Usually, this is going to be a graphical user interface.

147
07:51.480 --> 07:56.510
And sometimes we're still going to get some amount of CLI tools, although the

148
07:56.510 --> 07:57.200
CLI is

149
07:57.200 --> 07:58.200
minimized.

150
07:58.200 --> 08:01.240
It's not the same thing as a traditional network.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

150
07:58.200 --> 08:01.240
It's not the same thing as a traditional network.

151
08:01.240 --> 08:04.490
As far as how much CLI we're going to use, we're largely going to rely on the

152
08:04.490 --> 08:05.120
graphical

153
08:05.120 --> 08:06.960
user interface.

154
08:06.960 --> 08:12.320
That said, because of programmability elements, we can also take advantage of R

155
08:12.320 --> 08:12.960
EST APIs and

156
08:12.960 --> 08:15.440
deploy configuration scripts that way.

157
08:15.440 --> 08:20.820
So if we like how we do things with the CLI, it's probably worth learning the

158
08:20.820 --> 08:21.520
APIs a little

159
08:21.520 --> 08:24.640
bit because that's effectively the new CLI.

160
08:24.640 --> 08:26.640
I can write a script.

161
08:26.640 --> 08:32.690
Now in, let's say Python, and it was in JSON in there, rather than using Cisco
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

161
08:26.640 --> 08:32.690
Now in, let's say Python, and it was in JSON in there, rather than using Cisco

162
08:32.690 --> 08:33.360
CLI.

163
08:33.360 --> 08:38.230
And that Python script can run and take advantage of the REST APIs and do

164
08:38.230 --> 08:39.440
things in a much

165
08:39.440 --> 08:43.560
cleaner fashion as far as deploying to a lot of switches.

166
08:43.560 --> 08:47.000
This allows us to deploy global configurations.

167
08:47.000 --> 08:51.240
So we're talking about earlier, we said quality of service can be a challenge

168
08:51.240 --> 08:52.320
to give us end

169
08:52.320 --> 08:55.280
to end policy enforcement.

170
08:55.280 --> 08:56.480
Well now we have it.

171
08:56.480 --> 09:00.090
Even if we have multiple types of hardware in our environment, the fact that we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

171
08:56.480 --> 09:00.090
Even if we have multiple types of hardware in our environment, the fact that we

172
09:00.090 --> 09:00.800
have a

173
09:00.800 --> 09:04.910
controller-based management approach allows the controller to deal with the n

174
09:04.910 --> 09:05.600
itty gritty

175
09:05.600 --> 09:12.560
of QOS even across different hardware platforms.

176
09:12.560 --> 09:16.920
It also allows us to manage the images.

177
09:16.920 --> 09:22.670
So our image management can now lock in on particular software versions to say

178
09:22.670 --> 09:23.160
that we

179
09:23.160 --> 09:27.520
want to make sure we're running this software version on all of our switches.

180
09:27.520 --> 09:31.700
And now we can make sure that that's happening much more seamlessly using that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

180
09:27.520 --> 09:31.700
And now we can make sure that that's happening much more seamlessly using that

181
09:31.700 --> 09:32.400
single pane

182
09:32.400 --> 09:34.120
of management.

183
09:34.120 --> 09:39.800
Now all of this can lead to a conversation around network assurance, which we

184
09:39.800 --> 09:40.160
're calling

185
09:40.160 --> 09:45.900
the last video, we were talking about how we wanted to be more proactive in

186
09:45.900 --> 09:47.040
identifying

187
09:47.040 --> 09:51.190
issues that are coming, in identifying issues that are here, and in terms of

188
09:51.190 --> 09:52.280
troubleshooting,

189
09:52.280 --> 09:54.160
being faster with troubleshooting.

190
09:54.160 --> 10:00.080
And because we have an aggregated amount of data, we can run analytics.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

190
09:54.160 --> 10:00.080
And because we have an aggregated amount of data, we can run analytics.

191
10:00.080 --> 10:03.730
And by running analytics against the data that we've been collecting across

192
10:03.730 --> 10:05.520
this entire infrastructure,

193
10:05.520 --> 10:10.620
we have the ability to also deliver that assurance, being a proactive approach

194
10:10.620 --> 10:12.320
to resolving issues

195
10:12.320 --> 10:15.360
and troubleshooting things as they come up.

196
10:15.360 --> 10:20.800
Now lastly, all of this is also going to lead us to a much better security

197
10:20.800 --> 10:21.640
model.

198
10:21.640 --> 10:22.920
We're looking at security.

199
10:22.920 --> 10:27.280
We don't have to worry as much about ACL management.

200
10:27.280 --> 10:32.050
The joke is always how often do we go and remove ACLs or how often do we remove
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

200
10:27.280 --> 10:32.050
The joke is always how often do we go and remove ACLs or how often do we remove

201
10:32.050 --> 10:33.120
ACL entries,

202
10:33.120 --> 10:37.480
the access control entries, the lines that make up an ACL.

203
10:37.480 --> 10:38.800
We don't like to do that.

204
10:38.800 --> 10:43.120
Nobody likes to remove ACLs and generally speaking any amount of configuration

205
10:43.120 --> 10:44.680
that's in place.

206
10:44.680 --> 10:48.220
And so this is going to be managed now by our controller so that all of our

207
10:48.220 --> 10:49.040
access control

208
10:49.040 --> 10:53.720
lists are in sync with our current active policy.

209
10:53.720 --> 10:57.710
This is also going to allow us to perform access control at a much more

210
10:57.710 --> 10:58.880
granular level.

211
10:58.880 --> 11:06.450
So now our access control can be based on the user and no longer the VLAN or
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

211
10:58.880 --> 11:06.450
So now our access control can be based on the user and no longer the VLAN or

212
11:06.450 --> 11:07.640
the subnet.

213
11:07.640 --> 11:12.470
And that can again lead us back to saying that this host and this host cannot

214
11:12.470 --> 11:13.300
communicate

215
11:13.300 --> 11:16.880
with one another even though they're on the same subnet and they're not going

216
11:16.880 --> 11:17.880
to go through

217
11:17.880 --> 11:22.240
a SVI to route to one another.

218
11:22.240 --> 11:26.240
And lastly, this means that we have a much more dynamic policy.

219
11:26.240 --> 11:28.000
We mentioned that's a very static policy.

220
11:28.000 --> 11:33.380
I could deploy security mechanisms and security configurations to maybe this
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

220
11:28.000 --> 11:33.380
I could deploy security mechanisms and security configurations to maybe this

221
11:33.380 --> 11:34.880
port on this switch,

222
11:34.880 --> 11:39.620
but what if this user migrates to a different machine or what if this machine

223
11:39.620 --> 11:40.240
migrates to

224
11:40.240 --> 11:42.080
a different switch?

225
11:42.080 --> 11:46.220
Either way, we're talking about a much more dynamic security mechanism because

226
11:46.220 --> 11:46.440
we can

227
11:46.440 --> 11:50.620
identify that the user is now over here on a different switch port and we can

228
11:50.620 --> 11:51.080
apply

229
11:51.080 --> 11:56.960
the exact same policy, whether it's the same PC or a different PC.

230
11:56.960 --> 11:58.280
It doesn't matter.

231
11:58.280 --> 11:59.720
It's in a different location.

232
11:59.720 --> 12:00.920
It's user driven.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

232
11:59.720 --> 12:00.920
It's user driven.

233
12:00.920 --> 12:05.200
And so we can manage our access control in a much more dynamic way.

234
12:05.200 --> 12:09.980
So this is a set of all of the advantages that we are trying to achieve by

235
12:09.980 --> 12:10.760
combining these

236
12:10.760 --> 12:15.360
two technologies by saying that we're going to deploy a fabric now to our

237
12:15.360 --> 12:16.360
network edge.

238
12:16.360 --> 12:20.120
And we're going to take advantage of SDN elements and specifically SDN

239
12:20.120 --> 12:21.160
controllers in order

240
12:21.160 --> 12:25.720
to bring the rest of the problems hopefully to resolution.