WEBVTT 1 00:00.000 --> 00:03.520 All right, it's time to jump into software defined access. 2 00:03.520 --> 00:08.760 So SDA is all about giving us a method for deploying a campus fabric. 3 00:08.760 --> 00:12.520 Campus fabric is going to be a new way of deploying our access layer. 4 00:12.520 --> 00:15.840 So we don't have to choose between layer two and layer three. 5 00:15.840 --> 00:19.930 So once again, pause the questions before we get into the answers in order to 6 00:19.930 --> 00:20.320 take a 7 00:20.320 --> 00:21.840 crack at it yourself. 8 00:21.840 --> 00:25.000 So question number one here, and there's eight questions this time as well. 9 00:25.000 --> 00:27.880 What are two goals for deploying campus fabrics? 10 00:27.880 --> 00:32.560 Well, what we're trying to do once again is evaluate layer two versus layer WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 10 00:27.880 --> 00:32.560 Well, what we're trying to do once again is evaluate layer two versus layer 11 00:32.560 --> 00:34.360 three to the 12 00:34.360 --> 00:35.840 access layer. 13 00:35.840 --> 00:37.320 And both of these have pain points. 14 00:37.320 --> 00:41.160 Layer two is flexible, but it has spanning tree protocol. 15 00:41.160 --> 00:47.160 Layer three has an immense amount of scale, but we lack the flexibility. 16 00:47.160 --> 00:50.520 And so we want to try to find the best of both worlds. 17 00:50.520 --> 00:54.720 And this leads us to the campus fabric. 18 00:54.720 --> 00:58.800 The idea of the campus fabric is I will build a layer three underlay. 19 00:58.800 --> 01:02.640 So we're basically embracing layer three to the access. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 19 00:58.800 --> 01:02.640 So we're basically embracing layer three to the access. 20 01:02.640 --> 01:07.440 So our switches all communicate via layer three to one another. 21 01:07.440 --> 01:12.600 But we're going to build tunnels that allow us to still connect at layer two. 22 01:12.600 --> 01:17.340 We've got this concept where yeah, I'm layer three segmented, but I've got 23 01:17.340 --> 01:18.440 hosts over here. 24 01:18.440 --> 01:25.520 I've got hosts over here and they're all part of the same subnet, whatever that 25 01:25.520 --> 01:25.640 is pretty 26 01:25.640 --> 01:27.560 fascinating and really neat. 27 01:27.560 --> 01:31.320 And what this allows us to do is first of all, hey, eliminate spanning tree. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 27 01:27.560 --> 01:31.320 And what this allows us to do is first of all, hey, eliminate spanning tree. 28 01:31.320 --> 01:35.100 One of the best things you can ever tell a network engineer is we'd never have 29 01:35.100 --> 01:35.520 to deal 30 01:35.520 --> 01:40.680 with spanning tree ever again, because our architecture is fully layer three. 31 01:40.680 --> 01:41.880 We're not going to eliminate routing. 32 01:41.880 --> 01:45.630 We're actually going to deploy routing some kind of routing protocol under the 33 01:45.630 --> 01:47.440 hood there. 34 01:47.440 --> 01:51.960 And the other goal here is to maintain our layer two networks. 35 01:51.960 --> 01:53.240 We're not looking to remove them. 36 01:53.240 --> 01:56.760 So in that sense, we're also embracing the layer two side of things. 37 01:56.760 --> 01:58.920 I mean, I really can't describe any better. 38 01:58.920 --> 02:00.860 It's a best of both worlds approach. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 38 01:58.920 --> 02:00.860 It's a best of both worlds approach. 39 02:00.860 --> 02:04.930 We don't have to worry about the pain points for either one, but we get the 40 02:04.930 --> 02:05.680 benefits of 41 02:05.680 --> 02:06.680 each one. 42 02:06.680 --> 02:07.960 It's pretty fascinating. 43 02:07.960 --> 02:13.040 Now security is not an inherent part of deploying campus fabrics. 44 02:13.040 --> 02:15.800 It is an inherent part of SDA. 45 02:15.800 --> 02:19.000 It's go baked security into SDA from the ground up. 46 02:19.000 --> 02:22.210 But for this question, we're specifically talking about campus fabrics 47 02:22.210 --> 02:23.160 independent of 48 02:23.160 --> 02:25.880 SD access. 49 02:25.880 --> 02:30.920 Question two, what are the four layers of the Cisco SD access solution? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 49 02:25.880 --> 02:30.920 Question two, what are the four layers of the Cisco SD access solution? 50 02:30.920 --> 02:35.690 So we talked about the four layers for SD when now we're talking about the four 51 02:35.690 --> 02:36.240 layers 52 02:36.240 --> 02:38.880 of SD access. 53 02:38.880 --> 02:43.240 So the four different layers are going to be very different this time. 54 02:43.240 --> 02:52.140 It's going to involve the physical layer, the network layer, the controller 55 02:52.140 --> 02:52.640 layer, and 56 02:52.640 --> 02:56.400 the management layer. 57 02:56.400 --> 02:59.990 Now we're not going to dive too deep into any one of these, but as a very quick 58 02:59.990 --> 03:00.880 overview, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 58 02:59.990 --> 03:00.880 overview, 59 03:00.880 --> 03:05.550 remember, a physical layer involves the different devices that are going to be 60 03:05.550 --> 03:06.400 at play here. 61 03:06.400 --> 03:10.370 We've got specific devices, catalyst nine case, for example, that we're going 62 03:10.370 --> 03:10.840 to want 63 03:10.840 --> 03:14.800 to deploy into the physical layer side of the network. 64 03:14.800 --> 03:18.630 We're going to also, by the way, keep in mind, we've got wireless devices like 65 03:18.630 --> 03:19.180 wireless 66 03:19.180 --> 03:21.040 land controllers in there as well. 67 03:21.040 --> 03:23.360 The network is where things start to get a little bit interesting. 68 03:23.360 --> 03:27.010 We've got those three different components we're going to be talking about here 69 03:27.010 --> 03:27.120 that 70 03:27.120 --> 03:30.320 allow us to build out our fabrics. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 70 03:27.120 --> 03:30.320 allow us to build out our fabrics. 71 03:30.320 --> 03:33.950 And so I won't spoil it because we're going to ask questions about it coming up 72 03:33.950 --> 03:34.200 . 73 03:34.200 --> 03:37.500 But if you do recall those three different protocols that are very important as 74 03:37.500 --> 03:37.720 part 75 03:37.720 --> 03:39.160 of the network layer. 76 03:39.160 --> 03:44.040 The controller is going to consist of our two controllers. 77 03:44.040 --> 03:49.990 First of all, our primary one, what used to be known as DNA center or D-NAC is 78 03:49.990 --> 03:50.440 now known 79 03:50.440 --> 03:51.960 as catalyst center. 80 03:51.960 --> 03:56.220 And then we've also got ICE for identity services engine and identity 81 03:56.220 --> 03:57.280 management. 82 03:57.280 --> 04:01.080 And then management layer itself, this is going to be where we have a graphical WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 82 03:57.280 --> 04:01.080 And then management layer itself, this is going to be where we have a graphical 83 04:01.080 --> 04:01.440 user 84 04:01.440 --> 04:04.320 interface in order for us to manage the environment. 85 04:04.320 --> 04:06.120 But we've also got REST APIs. 86 04:06.120 --> 04:10.520 And we can be very programmatic in our approach to deploying software defined 87 04:10.520 --> 04:11.200 access. 88 04:11.200 --> 04:13.560 So let's remember these four different layers. 89 04:13.560 --> 04:15.160 They're very different from SD-WAN. 90 04:15.160 --> 04:18.360 We need to make sure that we're keeping all of these layers straight in our 91 04:18.360 --> 04:18.880 minds. 92 04:18.880 --> 04:22.120 All right, I said I wasn't going to spoil it. 93 04:22.120 --> 04:24.320 And so now we're going to talk about those protocols. 94 04:24.320 --> 04:29.850 So match the protocol to the plane of operation within the SD access network 95 04:29.850 --> 04:30.640 layer. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 95 04:29.850 --> 04:30.640 layer. 96 04:30.640 --> 04:32.480 So now we've got layers and we've got planes. 97 04:32.480 --> 04:33.920 What's going on here? 98 04:33.920 --> 04:37.400 Well, when we're talking about planes of operation, we're talking about the 99 04:37.400 --> 04:38.480 data plane, control 100 04:38.480 --> 04:39.680 plane and policy plane. 101 04:39.680 --> 04:43.150 This sounds a little closer to those planes of operation, the layers, whatever 102 04:43.150 --> 04:43.520 we want 103 04:43.520 --> 04:46.160 to call them in SD-WAN. 104 04:46.160 --> 04:51.200 Within SD access, we're going to take that network layer and we're going to 105 04:51.200 --> 04:51.840 split it 106 04:51.840 --> 04:55.640 up into different planes. 107 04:55.640 --> 04:58.520 And specifically these planes of operation. 108 04:58.520 --> 05:00.440 So this is a layer. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 108 04:58.520 --> 05:00.440 So this is a layer. 109 05:00.440 --> 05:01.600 These are planes. 110 05:01.600 --> 05:06.240 Once again, we have to keep in mind which one is which, but the planes fit into 111 05:06.240 --> 05:07.480 the layer. 112 05:07.480 --> 05:11.220 Now the data plane, this is where we're going to, again, we've got to identify 113 05:11.220 --> 05:12.000 the protocols 114 05:12.000 --> 05:15.520 we're using at the data plane, we're forming tunnels. 115 05:15.520 --> 05:20.500 We saw on SD-WAN, we're using IPsec tunnels, but that won't work with SD access 116 05:20.500 --> 05:21.080 where we 117 05:21.080 --> 05:22.080 need a layer two. 118 05:22.080 --> 05:26.630 So we're going to rely on a different mechanism that gives us layer two and 119 05:26.630 --> 05:28.160 that is the X-LAN. 120 05:28.160 --> 05:32.280 We'll be diving into VX-LAN in more detail coming up here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 120 05:28.160 --> 05:32.280 We'll be diving into VX-LAN in more detail coming up here. 121 05:32.280 --> 05:35.660 And by the way, we'll be diving into something else in more detail coming up, 122 05:35.660 --> 05:36.040 which is the 123 05:36.040 --> 05:41.320 control plane protocol known as LISP, which changes the way we share routes. 124 05:41.320 --> 05:44.360 We don't push routes everywhere just in case anymore. 125 05:44.360 --> 05:49.060 We just pull them in on an as needed basis and the policy plane is going to use 126 05:49.060 --> 05:49.280 Cisco 127 05:49.280 --> 05:50.280 trussec. 128 05:50.280 --> 05:55.110 Cisco trussec is going to include a security tag, something called a scalable 129 05:55.110 --> 05:55.800 group tag 130 05:55.800 --> 06:00.480 used to be called security group tags, either way, they're SGTs. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 130 05:55.800 --> 06:00.480 used to be called security group tags, either way, they're SGTs. 131 06:00.480 --> 06:04.480 And that allows switches to know, hey, is this device allowed to talk to 132 06:04.480 --> 06:05.560 another device? 133 06:05.560 --> 06:13.080 It really helps us out with onboarding devices and generally speaking access 134 06:13.080 --> 06:13.480 control. 135 06:13.480 --> 06:17.650 Question four, identify the SD access device type that's responsible for each 136 06:17.650 --> 06:18.160 of these 137 06:18.160 --> 06:19.160 operations. 138 06:19.160 --> 06:21.000 We need to go through all four of these. 139 06:21.000 --> 06:24.840 So what device type, first of all, what are we talking about with the device 140 06:24.840 --> 06:25.400 types? 141 06:25.400 --> 06:28.590 Well, I'm thinking about things like the control plane nodes, we're thinking 142 06:28.590 --> 06:29.360 about the border 143 06:29.360 --> 06:30.360 nodes. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 143 06:29.360 --> 06:30.360 nodes. 144 06:30.360 --> 06:37.280 Some of these guys, we've got the just simply the fabric edge nodes. 145 06:37.280 --> 06:39.440 These are a big one. 146 06:39.440 --> 06:43.560 And then out of all of these, we might also be concerned about fabric wireless 147 06:43.560 --> 06:44.720 and controllers. 148 06:44.720 --> 06:49.640 So we'll look at gateway access to non-SDA networks. 149 06:49.640 --> 06:53.680 When we're talking about non-SDA, we're talking about the external world. 150 06:53.680 --> 06:55.480 We've got a fabric here. 151 06:55.480 --> 06:58.120 We've got all of these switches. 152 06:58.120 --> 06:59.880 These are all access closets. 153 06:59.880 --> 07:03.790 At some point, we're going to need to get out to the network core to route out WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 153 06:59.880 --> 07:03.790 At some point, we're going to need to get out to the network core to route out 154 07:03.790 --> 07:04.360 to other 155 07:04.360 --> 07:05.440 networks. 156 07:05.440 --> 07:06.840 Maybe that's the internet. 157 07:06.840 --> 07:09.520 Maybe that's the data center, wherever we're going. 158 07:09.520 --> 07:13.800 Well, that's going to be the responsibility of the fabric border node. 159 07:13.800 --> 07:16.710 And yes, Cisco does like to include the word fabric and we should probably 160 07:16.710 --> 07:17.440 include it as 161 07:17.440 --> 07:18.440 well. 162 07:18.440 --> 07:23.300 So we have a fabric border node that sits here and we're going to send traffic 163 07:23.300 --> 07:24.160 to the border 164 07:24.160 --> 07:28.750 node with either the border node telling us, hey, I've got a route to the data 165 07:28.750 --> 07:29.480 center, 166 07:29.480 --> 07:33.080 or simply put, I don't think that we know where this destination is. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 166 07:29.480 --> 07:33.080 or simply put, I don't think that we know where this destination is. 167 07:33.080 --> 07:36.860 So I'm going to forward it to the border node, hoping it's destined out towards 168 07:36.860 --> 07:37.360 the internet 169 07:37.360 --> 07:41.920 and ultimately wherever the default gateway is pointing wireless AP manager. 170 07:41.920 --> 07:46.360 This is indeed going to be the fabric wireless LAN controller. 171 07:46.360 --> 07:50.180 There's a big difference between a standard wireless LAN controller and a 172 07:50.180 --> 07:51.080 fabric wireless 173 07:51.080 --> 07:55.880 LAN controller that changes the way that our wireless operates. 174 07:55.880 --> 07:58.760 Access layer connectivity, that would be these guys right here. 175 07:58.760 --> 08:03.600 And that would be the fabric edge node. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 175 07:58.760 --> 08:03.600 And that would be the fabric edge node. 176 08:03.600 --> 08:05.560 Fabric edge node. 177 08:05.560 --> 08:09.160 So the fabric edge node is what's going to form VX line tunnels among each 178 08:09.160 --> 08:09.720 other. 179 08:09.720 --> 08:14.160 They're essentially the access layer switches. 180 08:14.160 --> 08:21.090 This is also where we have connectivity down to our endpoints like our, hey, 181 08:21.090 --> 08:22.000 like our access 182 08:22.000 --> 08:27.520 points, like our laptops and desktops and voice over IP phones. 183 08:27.520 --> 08:32.380 Lastly, managing the endpoint tables, this is going to be that control plane WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 183 08:27.520 --> 08:32.380 Lastly, managing the endpoint tables, this is going to be that control plane 184 08:32.380 --> 08:32.680 node. 185 08:32.680 --> 08:38.850 If I want to send a packet to find a device somewhere out there in the SDA 186 08:38.850 --> 08:40.160 fabric, I'm 187 08:40.160 --> 08:47.080 going to have to know where it is. 188 08:47.080 --> 08:51.040 I don't need to know where everybody in the network lives, but I do need to 189 08:51.040 --> 08:51.760 know where 190 08:51.760 --> 08:53.080 this person lives. 191 08:53.080 --> 08:57.880 So I pull that information down, send it into a VX LAN tunnel and get it to 192 08:57.880 --> 08:58.440 where it 193 08:58.440 --> 09:03.040 belongs, whether that's another edge node or possibly to one of the border WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 193 08:58.440 --> 09:03.040 belongs, whether that's another edge node or possibly to one of the border 194 09:03.040 --> 09:03.720 nodes. 195 09:03.720 --> 09:05.440 All right. 196 09:05.440 --> 09:06.440 Halfway done. 197 09:06.440 --> 09:07.720 This is question number five. 198 09:07.720 --> 09:11.360 What are the two controllers that manage the SD access architecture? 199 09:11.360 --> 09:14.760 Well, I just gave you this answer just a few questions ago. 200 09:14.760 --> 09:16.240 Hopefully we're paying attention. 201 09:16.240 --> 09:20.080 The answer here is going to be catalyst center and ice. 202 09:20.080 --> 09:24.200 So catalyst center is going to be primarily how we manage the solution. 203 09:24.200 --> 09:29.310 It's going to push configuration down, but Cisco has chosen to rely on another 204 09:29.310 --> 09:30.280 very solid WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 204 09:29.310 --> 09:30.280 very solid 205 09:30.280 --> 09:34.070 controller and solid architecture that they have, which is the identity 206 09:34.070 --> 09:35.120 services engine, 207 09:35.120 --> 09:37.680 which is going to run Cisco trussec. 208 09:37.680 --> 09:41.480 So there's going to be an integration between ice and catalyst center. 209 09:41.480 --> 09:45.630 They haven't this again, at the least of the, as of the time of this video, we 210 09:45.630 --> 09:46.160 haven't 211 09:46.160 --> 09:48.840 actually seen Cisco combine those into one product. 212 09:48.840 --> 09:51.760 I don't expect them to anytime soon. 213 09:51.760 --> 09:56.380 I would expect them to leave them separated, but either way, until that changes 214 09:56.380 --> 09:57.000 , we are 215 09:57.000 --> 10:00.420 going to have to think about there being two different controllers in the SD WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 215 09:57.000 --> 10:00.420 going to have to think about there being two different controllers in the SD 216 10:00.420 --> 10:00.800 access 217 10:00.800 --> 10:01.800 space. 218 10:01.800 --> 10:05.840 And that would be catalyst center, which again used to be known as DNA center 219 10:05.840 --> 10:07.320 or DNAC, 220 10:07.320 --> 10:11.480 as well as the identity services engine. 221 10:11.480 --> 10:16.570 Next up in an SD access to apology with five fabric edge nodes, where do the 222 10:16.570 --> 10:17.560 gateways and 223 10:17.560 --> 10:21.890 the switch virtual interfaces, another name for that would be the VLAN 224 10:21.890 --> 10:22.880 interfaces, where 225 10:22.880 --> 10:26.040 do these get deployed for each VLAN? 226 10:26.040 --> 10:30.490 So what we're driving at here is the concept of our any cast gateways and do we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 226 10:26.040 --> 10:30.490 So what we're driving at here is the concept of our any cast gateways and do we 227 10:30.490 --> 10:31.260 understand 228 10:31.260 --> 10:33.720 how exactly this works? 229 10:33.720 --> 10:38.070 And as a very quick overview, the idea here is, remember, we draw this 230 10:38.070 --> 10:39.280 architecture, we 231 10:39.280 --> 10:40.520 said, Hey, this is great. 232 10:40.520 --> 10:42.200 I've got a note over here. 233 10:42.200 --> 10:43.360 I've got a note over here. 234 10:43.360 --> 10:45.880 They're both part of the same subnet. 235 10:45.880 --> 10:48.680 And we have layer three segmentation up here. 236 10:48.680 --> 10:52.800 So yeah, I can tunnel via VX land between the two. 237 10:52.800 --> 10:56.360 But here's the question, where does the gateway live? 238 10:56.360 --> 11:00.810 Because of it lives over here, then this device is going to have to loop WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 238 10:56.360 --> 11:00.810 Because of it lives over here, then this device is going to have to loop 239 11:00.810 --> 11:01.680 through and 240 11:01.680 --> 11:05.830 possibly just get trombone back to talk to another device that's out the same 241 11:05.830 --> 11:06.600 switch. 242 11:06.600 --> 11:10.120 If it's over here, we have to do it vice versa. 243 11:10.120 --> 11:15.430 And so really what we're trying to drive at here is we want D here, the gate 244 11:15.430 --> 11:16.120 ways to 245 11:16.120 --> 11:20.480 be duplicated onto all of the edges. 246 11:20.480 --> 11:25.270 So yes, if I have five different switches, like the scenario says, I'm going to 247 11:25.270 --> 11:25.760 deploy 248 11:25.760 --> 11:34.280 one SVI, let's say for VLAN 100, that VLAN 100 SVI is going to be is going to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 248 11:25.760 --> 11:34.280 one SVI, let's say for VLAN 100, that VLAN 100 SVI is going to be is going to 249 11:34.280 --> 11:35.000 exist on 250 11:35.000 --> 11:37.240 all five edge nodes. 251 11:37.240 --> 11:40.440 So is this going to create a duplicate IP situation? 252 11:40.440 --> 11:41.440 Sure. 253 11:41.440 --> 11:46.370 If I try to SSH into this interface, I'm going to land on whichever one of 254 11:46.370 --> 11:47.280 those I happen 255 11:47.280 --> 11:48.720 to be the closest to. 256 11:48.720 --> 11:54.680 It's called any cast truly is referring to the nearest resource. 257 11:54.680 --> 11:58.350 And so in this case, we wouldn't want to use that interface to log into a 258 11:58.350 --> 11:59.040 switch. 259 11:59.040 --> 12:01.280 We don't know which switch we're logging into at that point. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 259 11:59.040 --> 12:01.280 We don't know which switch we're logging into at that point. 260 12:01.280 --> 12:05.820 But what we could do is allow each one of these hosts to simply go up to the 261 12:05.820 --> 12:06.480 nearest 262 12:06.480 --> 12:10.810 instance of the SVI, which would be directly attached to them via the access 263 12:10.810 --> 12:11.560 switch. 264 12:11.560 --> 12:15.510 And then I can get routed to whatever other SVI or layer three interface I'm 265 12:15.510 --> 12:16.000 trying to 266 12:16.000 --> 12:17.360 get routed towards. 267 12:17.360 --> 12:19.960 So any cast gateways are a huge part of Cap and fabrics. 268 12:19.960 --> 12:24.360 We need to make sure we have a firm understanding of how those work. 269 12:24.360 --> 12:26.320 All right. 270 12:26.320 --> 12:27.320 Next question. 271 12:27.320 --> 12:32.960 What is the purpose of the policy plane and ice in the SD access solution? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 271 12:27.320 --> 12:32.960 What is the purpose of the policy plane and ice in the SD access solution? 272 12:32.960 --> 12:35.480 So we've mentioned a couple of times we got this policy plane. 273 12:35.480 --> 12:36.480 We're using ice. 274 12:36.480 --> 12:37.480 What's it doing? 275 12:37.480 --> 12:39.520 What exactly is it helping with? 276 12:39.520 --> 12:42.920 Well, it's going to help with access control. 277 12:42.920 --> 12:44.400 And that means a couple of things. 278 12:44.400 --> 12:49.570 First of all, it does mean onboarding users, but second of all, if I have a 279 12:49.570 --> 12:50.560 user here that's 280 12:50.560 --> 12:56.640 trying to communicate to a resource over here, are we going to allow this? 281 12:56.640 --> 13:00.520 This is very difficult to control in a layer two environment. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 281 12:56.640 --> 13:00.520 This is very difficult to control in a layer two environment. 282 13:00.520 --> 13:04.550 And we might even have the same situation on the same switch where we ask the 283 13:04.550 --> 13:05.560 same question, 284 13:05.560 --> 13:09.600 hey, should we be allowed to communicate with each other at layer two? 285 13:09.600 --> 13:14.320 Well, ice and Cisco trussack and those scalable group tags, those are going to 286 13:14.320 --> 13:14.360 be very difficult 287 13:14.360 --> 13:19.280 to make it so yes, we can control whether or not this is allowed. 288 13:19.280 --> 13:23.930 And that's why we keep saying that Cisco integrated security at a foundational 289 13:23.930 --> 13:24.360 level 290 13:24.360 --> 13:29.360 CTS, Cisco trussack is a required part of the solution. 291 13:29.360 --> 13:33.240 Cisco did not want to deploy a campus fabric that didn't have security baked in WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 291 13:29.360 --> 13:33.240 Cisco did not want to deploy a campus fabric that didn't have security baked in 292 13:33.240 --> 13:33.800 and just 293 13:33.800 --> 13:37.040 layered on top, which is what seems to happen a lot with security. 294 13:37.040 --> 13:40.600 Instead, it was one of the first thoughts that they had was this solution needs 295 13:40.600 --> 13:42.040 to be secure. 296 13:42.040 --> 13:47.720 And they do that by managing access control via ice and Cisco trussack. 297 13:47.720 --> 13:50.840 All right, question number eight. 298 13:50.840 --> 13:51.840 And you know what? 299 13:51.840 --> 13:52.840 I might have been wrong. 300 13:52.840 --> 13:53.840 I think I've got one more question. 301 13:53.840 --> 13:54.840 So hang tight. 302 13:54.840 --> 13:55.840 We might have nine here. 303 13:55.840 --> 14:00.240 So what type of tunnels are used by fabric APs when integrated with SD access? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 303 13:55.840 --> 14:00.240 So what type of tunnels are used by fabric APs when integrated with SD access? 304 14:00.240 --> 14:04.540 Again, there's a big difference between when we are integrating with SD access 305 14:04.540 --> 14:05.040 and not, 306 14:05.040 --> 14:08.630 or not, then we're going to do something called wireless over the top and just 307 14:08.630 --> 14:09.160 sort of pretend 308 14:09.160 --> 14:15.510 like the access SD access is just sort of an underlay and we're going to build 309 14:15.510 --> 14:16.120 on top 310 14:16.120 --> 14:17.120 of that. 311 14:17.120 --> 14:20.220 But when we're integrated, what's interesting about this is I'm going to have 312 14:20.220 --> 14:20.680 my access 313 14:20.680 --> 14:24.680 switch here, which is really a fabric edge node. 314 14:24.680 --> 14:28.040 And I'm going to attach an access point here. 315 14:28.040 --> 14:32.060 And normally access points form a cap whap tunnel, some wherever the wireless WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 315 14:28.040 --> 14:32.060 And normally access points form a cap whap tunnel, some wherever the wireless 316 14:32.060 --> 14:33.000 line controller 317 14:33.000 --> 14:34.680 is in the environment. 318 14:34.680 --> 14:42.580 This time I'm going to form a VX LAN tunnel for the sake of data plane traffic 319 14:42.580 --> 14:43.360 to the 320 14:43.360 --> 14:44.360 fabric edge node. 321 14:44.360 --> 14:50.100 Now, I am still going to manage and maintain a cap whap node for control plane 322 14:50.100 --> 14:50.880 traffic, 323 14:50.880 --> 14:55.770 but for data plane traffic, meaning wireless station traffic, that is actually 324 14:55.770 --> 14:56.480 going to 325 14:56.480 --> 14:58.080 leverage the XLAN. 326 14:58.080 --> 15:01.360 So if you were thinking, hey, wait a second, we're using both of these. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 326 14:58.080 --> 15:01.360 So if you were thinking, hey, wait a second, we're using both of these. 327 15:01.360 --> 15:03.880 Well, technically correct. 328 15:03.880 --> 15:07.400 That web is still used for control plane, but VX LAN is really the answer we 329 15:07.400 --> 15:07.960 were looking 330 15:07.960 --> 15:12.830 for here because when we're integrated, we're really looking at using VX LAN 331 15:12.830 --> 15:13.680 for the sake 332 15:13.680 --> 15:15.440 of the data plane. 333 15:15.440 --> 15:16.920 All right. 334 15:16.920 --> 15:20.800 Now the last question, when deploying that wireless over the top solution that 335 15:20.800 --> 15:21.280 we just 336 15:21.280 --> 15:26.160 mentioned for an SD access deployment, where is the wireless LAN controller 337 15:26.160 --> 15:27.080 deployed? 338 15:27.080 --> 15:33.570 So at this point, we are building our access points such that we want to be WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 338 15:27.080 --> 15:33.570 So at this point, we are building our access points such that we want to be 339 15:33.570 --> 15:34.720 able to form 340 15:34.720 --> 15:37.840 cap whap tunnels to the wireless LAN controller. 341 15:37.840 --> 15:40.240 And here we are building out of fabric. 342 15:40.240 --> 15:42.240 So where does it exist? 343 15:42.240 --> 15:47.440 Well, the answer is A. It lives outside the SDA fabric. 344 15:47.440 --> 15:52.850 It truly has to live on the other side of a border node in order for us to 345 15:52.850 --> 15:54.080 deploy wireless 346 15:54.080 --> 15:55.400 over the top. 347 15:55.400 --> 16:00.590 So at this point, I really am treating again this fabric, SD access as an under WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 347 15:55.400 --> 16:00.590 So at this point, I really am treating again this fabric, SD access as an under 348 16:00.590 --> 16:01.320 lay, and 349 16:01.320 --> 16:05.920 I'm going to form a cap whap tunnel through it all the way to the wireless LAN 350 16:05.920 --> 16:06.960 controller. 351 16:06.960 --> 16:13.760 And at that point, my wireless network basically behaves as if SD access wasn't 352 16:13.760 --> 16:14.920 even there, 353 16:14.920 --> 16:18.200 which is the whole point of turning a network into an underlay to begin with. 354 16:18.200 --> 16:22.920 So if we want our wireless to continue to operate as it is, we can use over the 355 16:22.920 --> 16:23.280 top. 356 16:23.280 --> 16:26.840 If we do want to integrate it into our SD access solution, it's going to make 357 16:26.840 --> 16:27.520 things a whole 358 16:27.520 --> 16:30.580 lot more efficient in a lot of ways because we'll have a whole lot less trom WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 358 16:27.520 --> 16:30.580 lot more efficient in a lot of ways because we'll have a whole lot less trom 359 16:30.580 --> 16:31.400 bone of traffic 360 16:31.400 --> 16:34.360 if we have to come back into the SD access world.