WEBVTT

1
00:00.000 --> 00:08.280
So let's begin our discussion by taking a look at our policy structure.

2
00:08.280 --> 00:13.000
Specifically what we mean by this is there are two sort of major types of

3
00:13.000 --> 00:14.320
policies we have

4
00:14.320 --> 00:20.520
localized and centralized and then those also fall into two categories.

5
00:20.520 --> 00:24.840
One that affects the control plane and one that affects the data plane.

6
00:24.840 --> 00:29.240
Now of course there's different attributes and caveats of each one of these and

7
00:29.240 --> 00:29.400
that's

8
00:29.400 --> 00:32.040
what we want to discuss in this video.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

8
00:29.400 --> 00:32.040
what we want to discuss in this video.

9
00:32.040 --> 00:36.140
So that said let's jump in and take a look at more of the detail behind this

10
00:36.140 --> 00:39.280
policy structure.

11
00:39.280 --> 00:44.320
So as we mentioned during the introduction these policies can be broken down

12
00:44.320 --> 00:44.880
into a few

13
00:44.880 --> 00:46.560
categories.

14
00:46.560 --> 00:52.180
So first let's talk about control plane policies control plane policies or of

15
00:52.180 --> 00:53.200
course things

16
00:53.200 --> 00:55.400
that affect the control plane.

17
00:55.400 --> 01:02.400
So essentially routing protocols such as BGP or OSPF or OMP.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

17
00:55.400 --> 01:02.400
So essentially routing protocols such as BGP or OSPF or OMP.

18
01:02.400 --> 01:06.860
So anything that affects the learning of information is going to be the control

19
01:06.860 --> 01:07.760
plane.

20
01:07.760 --> 01:10.560
That's what these policies are going to affect.

21
01:10.560 --> 01:16.400
These control policies then fall into further categories such as centralized

22
01:16.400 --> 01:17.280
which means

23
01:17.280 --> 01:18.960
a few things.

24
01:18.960 --> 01:24.040
First it means that this is going to affect network wide routing.

25
01:24.040 --> 01:28.140
When we're affecting the control plane this of course is going to affect the

26
01:28.140 --> 01:28.760
contents

27
01:28.760 --> 01:33.640
of what's in the routing table on the controller.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
01:28.760 --> 01:33.640
of what's in the routing table on the controller.

28
01:33.640 --> 01:36.240
This is all stored on the controller.

29
01:36.240 --> 01:39.880
This never gets sent out to the edge router.

30
01:39.880 --> 01:44.440
So these are some of the attributes of our centralized control policy.

31
01:44.440 --> 01:49.480
So if the opposite of that would be the localized policy.

32
01:49.480 --> 01:52.360
This is more like a traditional route policy.

33
01:52.360 --> 01:59.280
This affects the local site and this will get sent out to the actual routers.

34
01:59.280 --> 02:01.280
So just a quick note here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

34
01:59.280 --> 02:01.280
So just a quick note here.

35
02:01.280 --> 02:06.080
I chose to go the way that Cisco documentation does here.

36
02:06.080 --> 02:12.190
Meaning we're splitting up our major categories by control plane versus data

37
02:12.190 --> 02:13.160
plane and then

38
02:13.160 --> 02:18.450
within each of those discussing whether they are centralized or localized

39
02:18.450 --> 02:19.440
policies.

40
02:19.440 --> 02:24.930
But just so you're aware when we jump into SDWAN manager later and we take a

41
02:24.930 --> 02:26.400
look at these,

42
02:26.400 --> 02:32.050
you're going to notice that in the graphical interface what we actually do is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

42
02:26.400 --> 02:32.050
you're going to notice that in the graphical interface what we actually do is

43
02:32.050 --> 02:33.760
choose centralized

44
02:33.760 --> 02:39.820
or localized and then we choose policies that would affect either the control

45
02:39.820 --> 02:40.480
plane or

46
02:40.480 --> 02:41.880
the data plane.

47
02:41.880 --> 02:46.530
There's actually no clear distinction in the interface as far as whether it's

48
02:46.530 --> 02:47.120
control

49
02:47.120 --> 02:48.560
plane or data plane.

50
02:48.560 --> 02:53.780
So like I said, I went the way here that Cisco documentation does by splitting

51
02:53.780 --> 02:55.120
it up as control

52
02:55.120 --> 02:57.160
plane versus data plane.

53
02:57.160 --> 03:02.670
But again, when you get to the interface, it's actually centralized versus
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
02:57.160 --> 03:02.670
But again, when you get to the interface, it's actually centralized versus

54
03:02.670 --> 03:04.880
localized first,

55
03:04.880 --> 03:07.560
then we choose the policy we want to configure.

56
03:07.560 --> 03:12.320
So just keep that in mind as we move forward.

57
03:12.320 --> 03:17.920
So of course, the next type of policy to discuss is the data plane policy.

58
03:17.920 --> 03:20.520
This again, of course, is going to affect the data plane.

59
03:20.520 --> 03:25.800
So the actual forwarding of the traffic itself.

60
03:25.800 --> 03:31.350
So once again, we have centralized this again is going to affect network wide
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
03:25.800 --> 03:31.350
So once again, we have centralized this again is going to affect network wide

61
03:31.350 --> 03:32.600
data traffic.

62
03:32.600 --> 03:36.840
This is specifically going to affect the traffic going through the VPNs.

63
03:36.840 --> 03:40.320
In other words, the overlay network.

64
03:40.320 --> 03:44.500
One of the main things we're going to be doing here is either permitting or

65
03:44.500 --> 03:46.040
denying traffic

66
03:46.040 --> 03:49.040
based on a six-touple match.

67
03:49.040 --> 03:53.200
The six-touple is matching on the things we have listed here.

68
03:53.200 --> 03:59.060
So that would be the source IP address, the destination IP address, the source

69
03:59.060 --> 03:59.600
TCP or

70
03:59.600 --> 04:05.800
UDP port number, the destination TCP UDP port number, the DSCP field or the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

70
03:59.600 --> 04:05.800
UDP port number, the destination TCP UDP port number, the DSCP field or the

71
04:05.800 --> 04:07.320
differentiated

72
04:07.320 --> 04:13.040
services code point, which is being used for the QOS process.

73
04:13.040 --> 04:15.600
Also, the protocol.

74
04:15.600 --> 04:21.280
So again, this would be looking at the protocol header inside of the IP header.

75
04:21.280 --> 04:25.590
There are a few other ways we can also match not just on the six-touple, but we

76
04:25.590 --> 04:26.280
could also

77
04:26.280 --> 04:31.040
for example, permit or deny based on VPN membership.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
04:26.280 --> 04:31.040
for example, permit or deny based on VPN membership.

78
04:31.040 --> 04:33.520
That's also another choice.

79
04:33.520 --> 04:38.820
This policy, since it's going to be enforced on the edge devices, it will push

80
04:38.820 --> 04:39.520
it out to

81
04:39.520 --> 04:44.280
the edge devices, but only the necessary edge devices.

82
04:44.280 --> 04:48.070
It doesn't just blank it, we push it out to everything, it will only push it

83
04:48.070 --> 04:48.520
out to the

84
04:48.520 --> 04:53.600
devices that it needs to in order to enforce the given policy.

85
04:53.600 --> 04:58.560
Of course, the counterpart to this is your localized policy.

86
04:58.560 --> 05:03.960
This affects a single interface on a single router.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

86
04:58.560 --> 05:03.960
This affects a single interface on a single router.

87
05:03.960 --> 05:09.950
So this is sort of traditionally what we've done in networking is do things

88
05:09.950 --> 05:11.080
like a prefix

89
05:11.080 --> 05:16.310
list or an access control list, things along those lines that get applied on a

90
05:16.310 --> 05:17.680
single interface

91
05:17.680 --> 05:19.480
on a single router.

92
05:19.480 --> 05:23.560
And of course, in that case, if we wanted this to affect more things in the

93
05:23.560 --> 05:24.280
network, we

94
05:24.280 --> 05:28.780
would have to apply it on multiple interfaces on multiple devices, but we would

95
05:28.780 --> 05:29.320
be doing

96
05:29.320 --> 05:31.560
that manually.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
05:29.320 --> 05:31.560
that manually.

97
05:31.560 --> 05:34.830
These are very similar to the centralized policy and that again, we're going to

98
05:34.830 --> 05:35.360
permit or

99
05:35.360 --> 05:39.000
deny based on a six-tuple match.

100
05:39.000 --> 05:43.890
That of course is referring to this exact same information we discussed up here

101
05:43.890 --> 05:44.040
.

102
05:44.040 --> 05:47.440
It's using the exact same match methodology.

103
05:47.440 --> 05:51.620
And the other cool thing about these localized policies is that these can also

104
05:51.620 --> 05:52.480
be used to

105
05:52.480 --> 05:59.150
provision other features such as implementing class of service, policing,

106
05:59.150 --> 06:00.320
mirroring.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

106
05:59.150 --> 06:00.320
mirroring.

107
06:00.320 --> 06:05.110
So not only is this used for permitting or denying traffic, but it can also be

108
06:05.110 --> 06:05.760
used for

109
06:05.760 --> 06:08.440
these other services as well.

110
06:08.440 --> 06:14.230
So to wrap up, let's take a little bit of a closer look at these centralized

111
06:14.230 --> 06:15.240
policies.

112
06:15.240 --> 06:19.930
And specifically what we want to discuss is that these are actually broken up

113
06:19.930 --> 06:20.480
into three

114
06:20.480 --> 06:22.200
different elements.

115
06:22.200 --> 06:26.800
The first of those elements is the groups of interest.

116
06:26.800 --> 06:34.840
Groups of interest include things such as prefixes, sites, T-locks, VPNs,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

116
06:26.800 --> 06:34.840
Groups of interest include things such as prefixes, sites, T-locks, VPNs,

117
06:34.840 --> 06:36.840
colors, SLAs or service

118
06:36.840 --> 06:38.600
level agreements.

119
06:38.600 --> 06:44.960
The groups of interest are used to define the targets of the policy application

120
06:44.960 --> 06:46.280
or matching.

121
06:46.280 --> 06:51.770
Again, this is what enables the V-Smart controllers to basically have a list of

122
06:51.770 --> 06:52.520
items.

123
06:52.520 --> 06:57.920
Again, anything on this list that is going to apply the policy to and what's

124
06:57.920 --> 06:58.800
nice about

125
06:58.800 --> 07:05.130
this modular design is we can come back here anytime we want, modify any of
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

125
06:58.800 --> 07:05.130
this modular design is we can come back here anytime we want, modify any of

126
07:05.130 --> 07:06.240
these lists

127
07:06.240 --> 07:11.360
in our groups of interest and it will of course then change how and where this

128
07:11.360 --> 07:12.180
policy is

129
07:12.180 --> 07:14.200
going to be applied.

130
07:14.200 --> 07:19.440
The next piece is the policy definition itself and we did sort of already

131
07:19.440 --> 07:20.680
discuss this in

132
07:20.680 --> 07:26.670
that we know that there's control policies that affect the overlay routing and

133
07:26.670 --> 07:27.080
we have

134
07:27.080 --> 07:32.120
the data policies which are used to affect the traffic flow.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

134
07:27.080 --> 07:32.120
the data policies which are used to affect the traffic flow.

135
07:32.120 --> 07:38.150
There's also application-aware routing policies that have SLAs that we can use

136
07:38.150 --> 07:38.920
to direct

137
07:38.920 --> 07:40.720
traffic a specific way.

138
07:40.720 --> 07:45.970
We'll talk more about the AAR policies coming up but these are sort of specific

139
07:45.970 --> 07:47.000
data policies

140
07:47.000 --> 07:50.880
that can react to changing network conditions.

141
07:50.880 --> 07:56.470
Of course, the third element of all of this is the policy application where we

142
07:56.470 --> 07:57.480
're actually

143
07:57.480 --> 08:00.280
going to apply this policy.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

143
07:57.480 --> 08:00.280
going to apply this policy.

144
08:00.280 --> 08:04.690
This is going to apply the directives along with a site list so it's sort of

145
08:04.690 --> 08:05.440
important

146
08:05.440 --> 08:11.010
here to realize that this is done at the site level and ultimately that means

147
08:11.010 --> 08:11.280
that we're

148
08:11.280 --> 08:17.560
enabling these specific policies only at specific locations.

149
08:17.560 --> 08:22.720
So in this video, we were simply focusing on the actual policy structure.

150
08:22.720 --> 08:25.600
So keep in mind our important takeaways here.

151
08:25.600 --> 08:31.970
We have both centralized and localized policies and then within each of those
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

151
08:25.600 --> 08:31.970
We have both centralized and localized policies and then within each of those

152
08:31.970 --> 08:33.240
categories, we

153
08:33.240 --> 08:39.390
also have control plane versus data plane policies and don't forget that with

154
08:39.390 --> 08:40.760
our centralized

155
08:40.760 --> 08:45.640
policies we have three different elements, the groups of interest, the policy

156
08:45.640 --> 08:46.440
definition

157
08:46.440 --> 08:49.120
and the policy application.

158
08:49.120 --> 08:54.410
All of these things together allow us to affect the flow of traffic through our

159
08:54.410 --> 08:55.000
SD-WAN

160
08:55.000 --> 08:56.000
environment.

161
08:56.000 --> 09:01.110
Next, let's jump in and take a closer look at some of the aspects of our data
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

161
08:56.000 --> 09:01.110
Next, let's jump in and take a closer look at some of the aspects of our data

162
09:01.110 --> 09:02.160
policies.

163
09:02.160 --> 09:04.400
We'll do that in the next video.

164
09:04.400 --> 09:07.320
(mouse clicking)