Cisco Connect 2018 Malaysia

1. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Cisco ACI: Delivering Intent for Data Center
Azeem Suleman
Principal Engineer, Data Center BU - Cisco Systems

2. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
CISCO CONNECT 2018 . IT’S ALL YOU
Intent Lifecycle Intent
Assurance
Configuration Analysis
“Very Large State-Space”
Analytics
Traffic Analysis
“Lots of Data”
Guarantees
Compliance
Consistency
Policy
ADM
Monitoring
Forensics
TetrationNetwork Assurance
Engine

3. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
CISCO CONNECT 2018 . IT’S ALL YOU
Problem: DC Paradigms Are Fundamentally Reactive
Intent Frequently
Breaks …
Operational Troubleshoot
We Always React …
An Inability to
Assure Intent
Proactively
Leaving Us With …
Security Scramble to fix it
Compliance Fail audits
Change Undo changes

4. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
CISCO CONNECT 2018 . IT’S ALL YOU
...Creating a Major Assurance Gap
VM
Controllers
How do I have confidence that I don’t
have errors due to my changes?
1
How do I rapidly analyze the network to
identify issues?
3
How do I easily understand the state of
my entire infrastructure?
2
Intent
Infrastructure

5. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
CISCO CONNECT 2018 . IT’S ALL YOU
Intent Assurance
Intent Encompasses Data Center Operations
Configs, Changes, Routing, VMs, Security, … Compliance, Audits
The confidence that the
infrastructure is doing what
you intended it to do

6. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
CISCO CONNECT 2018 . IT’S ALL YOU
Comprehensive, Intelligent, Continuous
Based on mathematical models of the
network
Continuously verifies and validates the
entire network
Proactively delivers the confidence
that the network is operating correctly
Introducing Cisco Network Assurance Engine

7. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
CISCO CONNECT 2018 . IT’S ALL YOU
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Idea Networks devices fundamentally are
deterministic
Leaf1
Spine
Leaf2
Header Data
0110101
Header Data
1000101
FW
We Can Build Comprehensive Mathematical Models of Network Behavior
Core Technology

8. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
CISCO CONNECT 2018 . IT’S ALL YOU
Fortunately These Problems Have Been Solved
Chip Design
Functional and Physical
Design Verification, Lint,
Timing Analysis
Software Verification
Semantic Checks, Dynamic
Testing, Memory Profiling
Mars Rover
Mars Rover (B) Still
Operational After 14 yrs
with Formal Verification
Formal Methods Assure Intent

9. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
CISCO CONNECT 2018 . IT’S ALL YOU
Cisco Network Assurance Engine: How It Works
Comprehensive
Network Modeling
Mathematically accurate models
spanning underlay, overlay and
virtualization layers
5000+ domain knowledge-based
error scenarios built-in, codified
remediation steps
Data
Collection
Captures all non-packet data:
intent, policy, state across
data center network
Intelligent
Analysis

10. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
CISCO CONNECT 2018 . IT’S ALL YOU
PREDICT THE IMPACT
OF CHANGES
Challenge
• Mainframe misconfiguration
in DR site
Potential Impact
• Mainframe cluster inaccessible
in case of fail-over event
Benefit
• Identify latent misconfigurations
before outages happen
• Avoid $$ in lost revenue
PROACTIVELY VERIFY
NETWORK-WIDE BEHAVIOR
Challenge
• Overlapping subnets due to
routes leaked across VRFs
Potential Impact
• Connectivity loss for Skype VoIP
and Video users
Benefit
• Continuous & proactive network-
wide dynamic state analysis
• Save days in downtime
ASSURE NETWORK SECURITY
POLICY AND COMPLIANCE
Challenge
• TCAM utilization hitting capacity,
inefficient security policy
definitions
Potential Impact
• Degraded security posture &
inability to deploy policies
Benefit
• Identified 17K+ redundant policies
• Surfaced opportunity for 20-70%
TCAM optimization
Stories from Customer Trials

11. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
CISCO CONNECT 2018 . IT’S ALL YOU
User Interface: Centred Around “Smart Events”
Change Management Compliance and
Visualisation
Incidence and
Problem Management
Smart Events: What, Where, Why, and How

12. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
CISCO CONNECT 2018 . IT’S ALL YOU
Cisco Network Assurance Engine – Dashboard

13. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
CISCO CONNECT 2018 . IT’S ALL YOU
Transforming Change Management with NAE
(play video)

14. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
CISCO CONNECT 2018 . IT’S ALL YOU
Tenant End-point Assurance
• Analyze
• Static configurations of VLANs, IPs, MACs ..
• Dynamic EP Learning, Mobility, …
• EP Connectivity, Communication …
• Common issues found
• Duplicate IPs: human error, NIC teaming, migrations, …
• DHCP errors
• EPs deployed against leafs without BD subnet
• EP table consistency across fabric …

15. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
CISCO CONNECT 2018 . IT’S ALL YOU
Assure Network Security Policies & Compliance
(play video)

16. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
CISCO CONNECT 2018 . IT’S ALL YOU
What Makes us Different?
Comprehensive
Capture, analyze and correlate
entire network state: across
security policies, forwarding,
end-points, TCAM utilization,
controller policies
Intelligent
5000+ built-in failure
scenarios, 30+ years of
Cisco Operational
knowledge
Continuous
Runs Continuously
Near real-time: collection,
modeling, analysis

17. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
CISCO CONNECT 2018 . IT’S ALL YOU
Cisco Network
Assurance Engine
Deployment Model
No sensors
Read only credentials
Time to Value
30 mins to deploy
60 mins to value
Form Factors
Software only OVA
Lightweight: 3 VMs (v2.0)
Available Now 30 Day Free Trial Subscription Licensing

18. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
CISCO CONNECT 2018 . IT’S ALL YOU
Available
Now
ACI Data Center
Fabric
Available
2018
Cross-platform
Network Integration Firewall
Virtual
Machine
Manager
Building a Rich Ecosystem Around Open API
Integration with
Operations Toolchains CWOM