This session will cover new and upcoming innovations to our ISR4K routing platform, as well as introduce a new solution that simplifies operations and redefines architecture at the branch.

1. Nigel Gocan
November 2016
Enterprise NFV
Virtualization of Network
Functions in the Branch

2. • What is Enterprise NFV?
• Enterprise NFV building blocks
• Enterprise Service Automation
• NFVIS
Agenda

3. Cisco Digital Network Architecture
Automation
Abstraction & Policy Control
from Core to Edge
Open & Programmable | Standards-Based
Open APIs | Developers Environment
Cloud Service Management
Policy | Orchestration
Virtualization
Physical & Virtual Infrastructure | App Hosting
Analytics
Network Data,
Contextual Insights
Insights &
Experiences
Automation
& Assurance
Security &
Compliance
Network-enabled Applications
Cloud-enabled | Software-delivered
Principles

4. Management and Orchestration
Cisco Enterprise Branch and WAN
Transport
Independence
Application
Optimization
Secure
Connectivity
Intelligent
Path Control
Platform
ASR 1000
UCS E-Series
ISR 800 & 4000
Physical
IWAN App ESA Easy QoS
APIC-EM / Prime
SDN Applications
PnP
WAN
Intelligent WAN
Virtual
vWAASISRv vWLCASAv
Cloud
ASAv
CSR
1000V

5. Enterprise Network Function
Virtualization

6. Motivation for Virtualization in the Branch
Physical Branch
Long, Expensive Roll-Outs
Under Utilization
Inflexibility
Virtualized Branch
Service Agility
Efficient Resource Utilization
Opex Savings

7. What NFV Can Do For You
Gives you flexible deployment options
Simplify day to day operations
Quickly roll out new services and locations
Simple and easy
to design, provision,
manage the trusted
services that are critical
to your business

8. How would the branch office change ….
NIC NIM BMCSwitch
X86 Processor
Life Cycle MGT Automation
Policy
Enforcement
Virtualization Layer - KVM
Operating System
Router
Firewall
Wireless
WAN Opt
Proxy/Cache
WAN-
Opt
vAPPWLC
Route/
Path
Selection
FW/
IDS
NIC NIM BMCSwitch
X86 Processor
Life Cycle MGT Automation
Policy
Enforcement
Virtualization Layer - KVM
vAPP
Operating System
Branch on Hardware This is a Branch with
Cisco Enterprise NFV

9. What is Enterprise NFV?
Freedom of Choice
Hardware Platform
Add Software Intelligence to the Hardware
Virtualization Layer
Consistent, trusted network services across all the platforms
Virtual Network Functions (VNFs)
Central and Prescriptive Automation
Orchestration and Management

10. ISR 4K + UCS E-Series UCS C-Series
Network Functions Virtualization Infrastructure Software (NFVIS)
Enterprise Service Automation (ESA)
Virtual Router
(ISRv)
Virtual Firewall
(ASAv)
Virtual WAN
Optimization
(vWAAS)
Virtual Wireless
LAN Controller
(vWLC)
3rd Party VNFs
Introducing: Cisco Enterprise NFV
Network services in minutes, on any platform

11. Network Services from Cisco
Consistent software across physical and virtual
* FirePOWER Threat Defense for ENFV June/July 2016
Platform Hardware
NFVIS
Cisco
VNF
Cisco
VNF
3rd
VNF1
App1 Appn
Orchestration, Automation and Management (OAM)
… …
API
Interface
Platform
Management
Hypervisor
Virtual
Switching
NFVIS = Network Function Virtualization Infrastructure Software
3rd
VNFn
…
ISRv
High Performance
Rich Features
ASAv/FTD
Full DC-class Featured
Functionality
* vWAAS
Application Optimization
and Akamai Connect
vWLC
Built for small and medium
branches

12. LinuxWindows Server
Extending the Reach of NFV
Application and Network Services
Active Directory, SCCM,
File Share
Server Applications
Custom Applications
DNS/DHCP
Platform Hardware
NFVIS
Cisco
VNF
Cisco
VNF
3rd
VNF1
App1 Appn
Orchestration, Automation and Management (OAM)
… …
API
Interface
Platform
Management
Hypervisor
Virtual
Switching
NFVIS = Network Function Virtualization Infrastructure Software
3rd
VNFn
…
3rd Party
Network Services
Management & Monitoring

13. Enterprise Service Automation
• Create branch architecture
profiles based on Business
Intent
• Intent derived by intelligent
template selection based on
CVD questions
• Internet access characteristics
• Bandwidth
• Wireless
• ESA proposes suitable
templates
Platform Hardware
NFVIS
Cisco
VNF
Cisco
VNF
3rd
VNF1
App1 Appn
Orchestration, Automation and Management (OAM)
… …
API
Interface
Platform
Management
Hypervisor
Virtual
Switching
NFVIS = Network Function Virtualization Infrastructure Software
3rd
VNFn
…

14. Upload Devices to
be used
Upload the Branch
locations
Design a Profile &
select functions
Map to
Branch(s)
Assign template
and attributes
Pick validated
topologies
1 2 3
5
4
Branch Design
Enterprise Service Automation Platform Hardware
NFVIS
Cisco
VNF
Cisco
VNF
3rd
VNF1
App1 Appn
Orchestration, Automation and Management (OAM)
… …
API
Interface
Platform
Management
Hypervisor
Virtual
Switching
NFVIS = Network Function Virtualization Infrastructure Software
3rd
VNFn
…

15. Orchestration & Management
Day 0
WAN
SN,IPforhost
Office
NFVIS
IPS
WAAS
vSwitch
ProfiletoSN
mapping
Provisioning
Provisioning
APIC-EMPnP
REST
ESC-Lite
Platform Hardware
NFVIS
Cisco
VNF
Cisco
VNF
3rd
VNF1
App1 Appn
Orchestration, Automation and Management (OAM)
… …
API
Interface
Platform
Management
Hypervisor
Virtual
Switching
NFVIS = Network Function Virtualization Infrastructure Software
3rd
VNFn
…
Profile mapped to branch
-Inventory
-Create Network
-Deploy Services
-Set Device
Prime Infrastructure
Enterprise Services Automation (ESA)

16. Office
NFVIS
IPS
WAAS
vSwitch
ESC-Lite
Orchestration & Management
Monitoring Platform Hardware
NFVIS
Cisco
VNF
Cisco
VNF
3rd
VNF1
App1 Appn
Orchestration, Automation and Management (OAM)
… …
API
Interface
Platform
Management
Hypervisor
Virtual
Switching
NFVIS = Network Function Virtualization Infrastructure Software
3rd
VNFn
…
WCMCSM
WAN
Enterprise Services Automation (ESA)
APIC-EMPrime Infrastructure
Monitoring
• Performance
• Health
• Fault
Service Element
Manager

17. IWAN Overlay on NFV
Provisioning APIC-EMPrime Infrastructure PnP
Day 0/1 config
repository
Enterprise Services Automation (ESA)
IWAN
App
IWAN
ENFV
vnet
ISRvWAASASAv
vnetvnet
Internet
WAN
Public/Private
Cloud
Data Center
Platform Hardware
NFVIS
Cisco
VNF
Cisco
VNF
3rd
VNF1
App1 Appn
Orchestration, Automation and Management (OAM)
… …
API
Interface
Platform
Management
Hypervisor
Virtual
Switching
NFVIS = Network Function Virtualization Infrastructure Software
3rd
VNFn
…
17

18. Demo - ESA

19. Packaged for Branch Network Services
Enterprise NFV Infrastructure Software (NFVIS)
Network Hypervisor
Enables segmentation of
virtual networks
Abstract CPU, memory,
storage resources
VNF deployment and update
VNF status and monitoring
Zero Touch Deployment
Automatic connection to PnP server
Secure connection to the
orchestration system
Easy day 0 provisioning
Life Cycle Management
Provisioning and launch of VNFs
Failure and recovery monitoring
Stop and restart services
Dynamically add and
remove services
Service Chaining
External connectivity and
to other services
Multiple service access options
No hardware offload with UCS
Open API
Programmable API for
service orchestration
REST and NETCONF API

20. Power in Software
NFVIS Software Stack
Linux
Platform
Drivers
Interface
Drivers
NFVIS
Virtualization Layer – Hypervisor & vSwitch
Orchestration
API
HTTPS
Plug-n-Play
Client
Plug-n-Play
Server
Console
/SSH
YANG
APIC-
EM/Prime
CLI NETCONF REST
Health Monitor
Device Web
Portal

21. • Enterprise NFV local management capabilities
• Components:
• Local GUI, VM Life-cycle Manager
• Local PnP Agent
• Useful if WAN connectivity is unavailable
• For small deployments
NFVIS Local Management
The POWER under the hood
All controls written using public APIs!!
Linux
NFVIS
Virtualization Layer
Hypervisor & vSwitch
Orchestration API
Plug-n-Play
Client
CLI
REST/
NETCONF
Health
Monitor
HTTPS

22. NFVIS Security Today
Capability To Protect Against Description
Secure Service Chains DDOS attacks, Snoops Bridged service chains cannot be modified
Secure Hypervisor Breakouts, Exfiltration VM isolation protects memory, compute and forwarding. Apps in
protected user space.
Secure Protocols on External
interfaces
Man In The Middle
Exfiltration
TLS 1.2 and SSHv2 only.
Network Segmentation.
Boot Integrity Malware Boot sequence integrity check with ENCS
Run Time Defenses Command Injection. Cross-
Site Scripting
Structured Models for inputs, no web services. No shell access.
Process & Library hardening.
Access Controls & Attack
Surface Reduction
Exploiting Access Control &
Backdoors
KVM and Secure Linux best practices. Logging
No Shell Access. Network & System Segmentation
Designed with Security in Mind Zero Day & known
vulnerabilities.
Threat Modeling, White-Hat Penetration Testing, Cisco Secure
Development Lifecycle best practices

23. Demo – NFVIS Portal

24. Reliable
Long life cycle Secure
What’s needed from the platform
Form factor
Expandable
Programmable Scalable
Strong Support

25. Freedom of Choice
Cisco Intelligent Branch
Virtual Router
Virtual Services
UCS C-Series/COTS
Enterprise NFV
Physical Router
Virtual Services
ISR 4000 Series + UCS E-Series
Traditional
Physical Router
ISR 4000 Series
Centralized Services
Fixed Integrated Services
Conservative
Upgradable H/W
Deterministic Routing Performance
Late Adopter
Elastic Routing and Services
Performance
Early Adopter
Cisco ONE License
Portability
Investment
Protection
Access to Ongoing
Innovation

26. Cisco UCS E-Series DC-class Servers
Cisco® UCS E160D
 Double-Wide Service Module
 VMware, Hyper-V,
Citrix certified
 Intel E5 6 core processor
 96GB DRAM
Cisco UCS E180D
 Double-Wide Service Module
 VMware, Hyper-V,
Citrix certified
 Intel E5 8 core processor
 96GB DRAM
Cisco UCS® E140S
 Service module
 VMware, Hyper-V,
Citrix certified
 Intel E3 4 core processor
 16GB DRAM
Performance
Scalability
Cisco UCS® E160S
 Single-Wide Service module
 VMware, Hyper-V,
Citrix certified
 Intel Broadwell 6 core
processor
 32GB DRAM
 USB 3.0 & 10Gb Interface
Intel Broadwell
Intel Ivy Bridge
Intel Ivy Bridge
Intel Ivy Bridge