The definitive Cisco SD-Access resource, from the architects who train Cisco's own engineers and partners
This comprehensive book guides you through all aspects of planning, implementing, and operating Cisco Software-Defined Access (SD-Access). Through practical use cases, you'll learn how to use intent-based networking, Cisco ISE, and Cisco DNA Center to improve any campus network's security and simplify its management.
Drawing on their unsurpassed experience architecting solutions and training technical professionals inside and outside Cisco, the authors explain when and where to leverage Cisco SD-Access instead of a traditional legacy design. They illuminate the fundamental building blocks of a modern campus fabric architecture, show how to design a software-defined campus that delivers the most value in your environment, and introduce best practices for administration, support, and troubleshooting.
Case studies show how to use Cisco SD-Access to address secure segmentation, plug and play, software image management (SWIM), host mobility, and more. The authors also present full chapters on advanced Cisco SD-Access and Cisco DNA Center topics, plus detailed coverage of Cisco DNA monitoring and analytics.
* Learn how Cisco SD-Access addresses key drivers for network change, including automation and security
* Explore how Cisco DNA Center improves network planning, deployment, evolution, and agility
* Master Cisco SD-Access essentials: design, components, best practices, and fabric construction
* Integrate Cisco DNA Center and Cisco ISE, and smoothly onboard diverse endpoints
* Efficiently operate Cisco SD-Access and troubleshoot common fabric problems, step by step
* Master advanced topics, including multicast flows, Layer 2 flooding, and the integration of IoT devices
* Extend campus network policies to WANs and data center networks
* Choose the right deployment options for Cisco DNA Center in your environment
* Master Cisco DNA Assurance analytics and tests for optimizing the health of clients, network devices, and applications
Autorentext
Jason Gooley, CCIE No. 38759 (RS and SP), is a very enthusiastic and spontaneous person who has more than 25 years of experience in the industry. Currently, Jason works as a technical evangelist for the Worldwide Enterprise Networking sales team at Cisco Systems. Jason is very passionate about helping others in the industry succeed. In addition to being a Cisco Press author, Jason is a distinguished speaker at CiscoLive, contributes to the development of the Cisco CCIE and DevNet exams, provides training for Learning@Cisco, is an active CCIE mentor, is a committee member for the Cisco Continuing Education Program (CE), and is a program committee member of the Chicago Network Operators Group (CHI-NOG), www.chinog.org. Jason also hosts a show called MetalDevOps. Jason can be found at www.MetalDevOps.com, @MetalDevOps, and @Jason_Gooley on all social media platforms.
Roddie Hasan, CCIE No. 7472 (RS), is a technical solutions architect for Cisco Systems and has 29 years of networking experience. He has been with Cisco for more than 12 years and is a subject matter expert on enterprise networks. His role is supporting customers and account teams globally, with a focus on Cisco DNA Center and Cisco Software-Defined Access. He also specializes in technologies such as MPLS, Enterprise BGP, and SD-WAN. Prior to joining Cisco, Roddie worked in the U.S. federal government and service provider verticals. Roddie blogs at www.ccie.tv and can be found on Twitter at @eiddor.
Srilatha Vemula, CCIE No. 33670 (SEC), is a technical solutions architect for the Worldwide Enterprise Networking Sales team at Cisco Systems. There, she works with account teams and systems engineers to help Cisco customers adopt Cisco DNA Center, Cisco SD-Access, Cisco Identity Services Engine, and Cisco TrustSec. Srilatha has served in multiple roles at Cisco, including technical consulting engineer and security solutions architect. She led the design and implementation of security projects using Cisco flagship security products for key U.S. financial customers.
Inhalt
Introduction xvii
Chapter 1 Today's Networks and the Drivers for Change 1
Networks of Today 1
Common Business and IT Trends 4
Common Desired Benefits 5
High-Level Design Considerations 6
Cisco Digital Network Architecture 10
Past Solutions to Today's Problems 12
Spanning-Tree and Layer 2-Based Networks 13
Introduction to Multidomain 16
Cloud Trends and Adoption 18
Summary 20
Chapter 2 Introduction to Cisco Software-Defined Access 21
Challenges with Today's Networks 22
Software-Defined Networking 22
Cisco Software-Defined Access 23
Cisco Campus Fabric Architecture 24
Campus Fabric Fundamentals 25
Cisco SD-Access Roles 27
Network Access Control 30
Why Network Access Control? 31
Introduction to Cisco Identity Services Engine 32
Overview of Cisco Identity Services Engine 32
Cisco ISE Features 34
Secure Access 34
Device Administration 37
Guest Access 38
Profiling 40
Bring Your Own Device 45
Compliance 46
Integrations with pxGrid 48
Cisco ISE Design Considerations 50
Cisco ISE Architecture 50
Cisco ISE Deployment Options 51
Standalone Deployment 51
Distributed Deployment 51
Dedicated Distributed Deployment 52
Segmentation with Cisco TrustSec 54
Cisco TrustSec Functions 54
Classification 55
Propagation 55
Enforcement 57
Summary 58
Chapter 3 Introduction to Cisco DNA Center 59
Network Planning and Deployment Trends 59
History of Automation Tools 60
Cisco DNA Center Overview 62
Design and Visualization of the Network 64
Site Design and Layout 64
Network Settings 69
Wireless Deployments 70
Network Discovery and Inventory 72
Discovery Tool 72
Inventory 74
Device Configuration and Provisioning 77
Summary 79
Chapter 4 Cisco Software-Defined Access Fundamentals 81
Network Topologies 81
Cisco Software-Defined Access Underlay 82
Manual Underlay 83
Automated Underlay: LAN Automation 84
Wireless LAN Controllers and Access Points in Cisco Software-Defined Access 89
Shared Services 90
Transit Networks 91
IP-Based Transit 91
SD-Access Transit 92
Fabric Creation 92
Fabric Location 93
Fabric VNs 94
Fabric Device Roles 94
Control Plane 95
Fabric Borders 96
Border Automation 98
Border and Control Plane Collocation 99
Fabric Edge Nodes 100
Intermediate Nodes 103
External Connectivity 104
Fusion Router 104
Host Onboarding 105
Authentication Templates 105
VN to IP Pool Mapping 106
SSID to IP Pool Mapping 108
Switchport Override 109
Summary 110
References in This Chapter 110
Chapter 5 Cisco Identity Services Engine with Cisco DNA Center 111
Policy Management in Cisco DNA Center with Cisco ISE 112
Integration of Cisco DNA Center and ISE 113
Certificates in Cisco DNA Center 113
Certificates on Cisco Identity Services Engine 115
Cisco ISE and Cisco DNA Center Integration Process 116
Group-Based Access Control 122
Segmentation with Third-Party RADIUS Server 126
Secure Host Onboarding in Enterprise Networks 128
Endpoint Host Modes in…
