Free CCNA | Software-Defined Networking | Day 62 | CCNA 200-301 Complete Course — Transcript

Full transcript

1. 0:01Welcome to Jeremy’s IT Lab.
2. 0:03This is a free, complete course for the CCNA.
3. 0:06If you like these videos, please subscribe to follow along with the series.
4. 0:10Also, please like and leave a comment, and share the video to help spread this free series
5. 0:14of videos.
6. 0:15Thanks for your help.
7. 0:17In this video we will look at software-defined networking.
8. 0:21In the first video of this network automation series we already covered the fundamentals
9. 0:25such as centralizing the control plane in an SDN controller, northbound and southbound
10. 0:30APIs, etc.
11. 0:32So, in this video we’ll take a more in-depth look at one of Cisco’s SDN offerings, SD-Access,
12. 0:39Software-Defined Access.
13. 0:40We’ll cover exam topics 6.3 and 6.4.
14. 0:44You’ll learn new terms like overlay, underlay, and fabric which are essential concepts in
15. 0:49SDN that we haven’t covered yet.
16. 0:52Here’s what we’ll cover in this video.
17. 0:56First I’ll briefly review the points about SDN that you’ll need to remember for this
18. 0:59video.
19. 1:01Then I’ll introduce Cisco’s SD-Access, including important concepts like underlay,
20. 1:05overlay, and fabric.
21. 1:07I’ll also introduce Cisco’s DNA Center management platform, which is an essential
22. 1:12part of SD-Access, and compare it to traditional network management.
23. 1:18Make sure to watch until the end of the video for a bonus practice question from Boson Software’s
24. 1:23ExSim, the best practice exams for the CCNA.
25. 1:26Let’s reviews some points about SDN.
26. 1:31SDN is an approach to networking that centralizes the control plane into an application called
27. 1:36a controller.
28. 1:38Traditional control planes use a distributed architecture, which means that every network
29. 1:42device has its own control plane.
30. 1:44The control planes of each network device use protocols like OSPF to communicate with
31. 1:49each other and share routing information, each device has its own ACLs and security
32. 1:54rules, etc.
33. 1:55That’s a distributed control plane.
34. 1:58An SDN controller centralizes control plane functions like calculating routes.
35. 2:03Network devices no longer use OSPF to share information with each other, instead they
36. 2:08share information with the controller, which takes that information and calculates routes
37. 2:12for the entire network.
38. 2:14Now, depending on the SDN solution the entire control plane might be centralized in the
39. 2:19SDN controller, or perhaps only part of the control plane is centralized, leaving some
40. 2:24functions on the individual network devices.
41. 2:29The controller can interact programmatically with the network devices using APIs.
42. 2:34Specifically it uses what we call the southbound interface to do that.
43. 2:39Then there is also the northbound interface, which is what allows us to interact with the
44. 2:43controller using our scripts and applications.
45. 2:45Okay, those are the fundamental points of SDN that I wanted to review.
46. 2:52And here’s one more look at the SDN architecture we covered in the first video of this automation
47. 2:57section.
48. 2:58The applications are on top, the controller in the middle, and the network devices on
49. 3:02the bottom.
50. 3:03Actually, these three ‘layers’ of the architecture have names.
51. 3:07On top there is the application layer.
52. 3:10This layer contains scripts and applications that tell the SDN controller what network
53. 3:14behaviors are desired.
54. 3:16Note that this isn’t the application layer of the OSI model, this is a totally different
55. 3:21concept.
56. 3:22We’re not talking about the OSI model here.
57. 3:24Anyway, next is the control layer.
58. 3:27This contains the SDN controller that receives and processes instructions from the application
59. 3:31layer.
60. 3:32Although this is a separate concept from the ‘control plane’, this layer is also what
61. 3:37contains the centralized control plane of the network.
62. 3:41And finally there is the infrastructure layer, which contains the actual devices that are
63. 3:44responsible for forwarding messages across the network.
64. 3:48I didn’t mention these layers in earlier videos, so take the time to learn them now.
65. 3:53The application layer contains apps and scripts for instructing the SDN controller, the control
66. 3:58layer contains the SDN controller, and the infrastructure layer contains the network
67. 4:03devices.
68. 4:04Okay, so I’ve told you the basics of what SDN is and its purpose, but we still haven’t
69. 4:09looked at a specific example of SDN.
70. 4:12So, let’s take a look at one, Cisco Software-Defined Access.
71. 4:19Cisco SD-Access is Cisco’s SDN solution for automating campus LANs.
72. 4:23So, office wired and wireless LANs, for example.
73. 4:28Cisco has other SDN solutions, for example ACI, Application Centric Infrastructure, is
74. 4:33their SDN solution for automating data center networks.
75. 4:37Remember when I explained spine-leaf architecture earlier in the course?
76. 4:41That is used extensively in ACI data center networks.
77. 4:46Cisco also has SD-WAN, their SDN solution for automating WANs.
78. 4:50But for now let’s look at SD-Access.
79. 4:54Cisco DNA, Digital Network Architecture, Center is the controller at the center of SD-Access.
80. 5:01In the previous video about REST APIs we sent a REST API call to DNA Center, so perhaps
81. 5:07you remember that name.
82. 5:08Okay, let’s look at the basic SD-Access architecture.
83. 5:12At the center, in the control layer, we have DNA Center.
84. 5:16And then under it we have the network devices in our campus LAN in the infrastructure layer.
85. 5:21These devices form the fabric of SD-Access, and I’ll explain that term in the next slide.
86. 5:27In the application layer we have our scripts and apps that interact with DNA center.
87. 5:33These could be tools we develop, third-party tools, or tools directly from Cisco.
88. 5:38DNA Center itself also has a GUI that we can use to control it.
89. 5:43Okay, so that’s the basic architecture of Cisco’s SD Access.
90. 5:48Notice how it fits perfectly into the SDN Application layer, Control layer, Infrastructure
91. 5:53layer model.
92. 5:54Next let’s look at that term ‘fabric’.
93. 5:57To understand the fabric, you need to understand two other terms.
94. 6:01First, the underlay is the underlying physical network of devices and connections, wired
95. 6:07and wireless, which provide IP connectivity, for example with a routing protocol like IS-IS.
96. 6:14Usually I’d use OSPF as an example, since it’s the most common interior gateway routing
97. 6:18protocol, but soon you’ll see why I chose IS-IS for this example.
98. 6:24Basically the underlay is a bunch of multilayer switches and their connections.
99. 6:29Then the overlay is the virtual network built on top of the physical underlay network.
100. 6:34For example, SD-Access uses a protocol called VXLAN, virtual extensible LAN, to build tunnels.
101. 6:41And fabric is the term we use to refer to the combination of the overlay and underlay,
102. 6:47the physical and virtual network as a whole.
103. 6:50For example, this is the underlay network.
104. 6:53The physical multilayer switches and their connections form the underlay, and they are
105. 6:57perhaps running IS-IS to share routing information and provide connectivity throughout the network.
106. 7:04Then the overlay network consists of VXLAN tunnels, for example between these two switches.
107. 7:11When hosts in the LAN communicate with each other, their traffic is sent over the VXLAN
108. 7:15tunnels.
109. 7:16That’s the overlay network.
110. 7:19And the fabric refers to the physical and virtual network as a whole, overlay plus underlay.
111. 7:24Both are necessary to make SD-Access work.
112. 7:27Okay, now let me give a little more detail about both the underlay and overlay.
113. 7:32So, let’s talk about the underlay.
114. 7:36The underlay’s purpose is to support the VXLAN tunnels of the overlay.
115. 7:40To make a virtual network of tunnels, the devices first need to be connected and able
116. 7:44to reach other of course, so the underlay is very important.
117. 7:49There are three different roles for switches in SD-Access.
118. 7:53Those are edge node, these are switches that connect to end hosts, like a traditional access
119. 7:58layer switch.
120. 7:59Then there are border nodes, which connect to devices outside of the SD-Access domain,
121. 8:05for example connecting to a WAN router.
122. 8:08And finally there are control nodes, which use a protocol called LISP, Locator ID Separation
123. 8:14Protocol, to perform various control plane functions.
124. 8:17I think LISP is far beyond what you need to know for the CCNA, so just know that it is
125. 8:22used for the control plane of SD-Access.
126. 8:26Note that you can add SD-Access on top of an existing network if your network hardware
127. 8:30and software supports it.
128. 8:33This is called a brownfield deployment, when you add it on to an already existing network.
129. 8:39If you’re curious which hardware supports it, you can google ‘Cisco SD-Access compatibility
130. 8:44matrix’, but you don’t have to know the specific devices for the CCNA.
131. 8:49And also note that in this case DNA center won’t configure the underlay, because this
132. 8:54could be a major risk to the current working production network.
133. 8:59Ideally you will be using a greenfield deployment, which is a totally new network built for the
134. 9:03purpose of SD-Access.
135. 9:06In this case DNA center will configure the devices for the optimal SD-access underlay.
136. 9:12For example, all switches are layer 3 and use IS-IS as their routing protocol.
137. 9:17That’s why I mentioned IS-IS in the example earlier.
138. 9:20Additionally all links between switches are routed ports, so STP is not needed to avoid
139. 9:26Layer 2 loops.
140. 9:28And edge nodes, so access switches, act as the default gateway of end hosts.
141. 9:33This is known as a routed access layer, we’ve brought layer 3 all the way down to the access
142. 9:38switches that end hosts connect to.
143. 9:41Let me demonstrate with a diagram.
144. 9:44Here’s a traditional LAN.
145. 9:46Notice that STP is used to avoid layer 2 loops, and an FHRP, for example HSRP, is used by
146. 9:53the distribution layer switches to provide a redundant default gateway for the end hosts.
147. 9:58So, to send traffic out of their local network, they will send it to the virtual IP provided
148. 10:03by the FHRP, 192.168.1.1.
149. 10:09In an SD-access underlay, however, all connections between switches are Layer 3 and IS-IS is
150. 10:14used to exchange routing information.
151. 10:17Note that STP is no longer needed, and an FHRP isn’t needed either.
152. 10:22Instead, the access layer switches are the default gateways of the end hosts.
153. 10:27Now we have a routed access layer.
154. 10:31Now let me briefly introduce a few aspects of the SD-Access overlay.
155. 10:36First, LISP provides the control plane of SD-Access.
156. 10:39A list of mappings of EIDs to RLOCs is kept.
157. 10:44Let me explain those terms.
158. 10:46EIDs, endpoint identifiers, identify end hosts connected to edge switches, and RLOCs, routing
159. 10:53locators, identify the edge switch which can be used to reach the end host.
160. 10:58Of course, there is a lot more detail to cover about LISP, but I think with just that you
161. 11:02can see how it differs from the traditional control plane.
162. 11:05Instead of a traditional routing table to locate destination hosts, a DNS-like system
163. 11:10of mappings is used.
164. 11:13Cisco TrustSec, CTS, provides policy control such as QoS and security policy.
165. 11:20Just remember that name, Cisco TrustSec, you don’t have to know about its functionality.
166. 11:25And finally VXLAN provides the data plane of SD-Access, the tunnels that are used to
167. 11:30actually forward traffic in the data plane.
168. 11:33Let’s look at how VXLAN tunnels work with LISP.
169. 11:37Notice that SW3 is a control node, so it is important for the function of LISP.
170. 11:43PC2 is connected to SW2, and it tells the control node that PC2 is reachable via SW2.
171. 11:49So, SW3 creates that mapping.
172. 11:53Now PC1 wants to send traffic to PC2, so it sends it to the default gateway, SW1.
173. 11:58SW1 asks SW3, how can I reach PC2?
174. 12:02And SW3 informs it that PC2 is reachable via SW2.
175. 12:06So, the message from PC1 is forwarded over a VXLAN tunnel between SW1 and SW2.
176. 12:12Okay, that’s all I’ll say about the overlay for now.
177. 12:15VXLAN does more than just create tunnels, it provides a lot of features to SD-Access
178. 12:20which I won’t get into in this video.
179. 12:23Just know the difference between fabric, overlay, and underlay, and know some basics of SD-Access
180. 12:28like edge node, border node, and control node, LISP, VXLAN, and Cisco TrustSec.
181. 12:36Now let’s look a bit more at DNA Center.
182. 12:39DNA Center itself has two main roles.
183. 12:42First, it is the SDN controller used in SD-Access, as I mentioned earlier.
184. 12:48Additionally it can be a network manager in a traditional network that isn’t using SD-Access.
185. 12:53In that case, although it doesn’t provide SD-Access functions, it still acts as a central
186. 12:58point to monitor, analyze, and configure the network.
187. 13:02Although I will mention both purposes, for this lecture we’re focusing on the SD-Access
188. 13:07application.
189. 13:08Note that DNA Center is a software application installed on Cisco UCS server hardware.
190. 13:14I mentioned Cisco UCS in the virtualization lecture of this course.
191. 13:19DNA Center has a REST API, as you already know, which can be used to interact with it.
192. 13:25And its southbound interface supports protocols such as NETCONF and RESTCONF, as well as traditional
193. 13:31protocols Telnet, SSH, and SNMP to control and monitor devices.
194. 13:37DNA Center enables something called intent-based networking, IBN, yet another buzzword.
195. 13:44Basically, the goal is to allow the engineer to communicate their intent for network behavior
196. 13:49to DNA Center, and then DNA Center will take care of the details of the actual configurations
197. 13:54and policies on the devices.
198. 13:57It simplifies the process, and allows engineers to spend time on more important things than
199. 14:01analyzing and configuring policies on devices one at a time.
200. 14:05Here’s one example.
201. 14:07Traditional security policies using ACLs can become very cumbersome.
202. 14:11For example, ACLs can have thousands of entries, and the intent of entries is easily forgotten
203. 14:16with time and as engineers leave and new engineers take over.
204. 14:21Looking at another engineer’s configurations and trying to figure out the intent is often
205. 14:25not an easy task.
206. 14:27And configuring and applying ACLs correctly across a network is cumbersome and leaves
207. 14:31room for error.
208. 14:32DNA Center, on the other hand, allows the engineer to specify the intent of the policy,
209. 14:38for example this group of users can’t communicate with this group, or this group can access
210. 14:43this server but not that server, etc, and DNA Center will take care of the exact details
211. 14:48of implementing the policy.
212. 14:51This is what configuring policies on DNA Center looks like.
213. 14:55Notice on the left here we have source groups.
214. 14:57Of course, you’d have to define the groups first, which users belong in which groups.
215. 15:02And here we have those same groups as destination.
216. 15:05Up here we have the legend for the colors in the policy grid.
217. 15:09Note that the entire grid is white now, so default.
218. 15:12However, let’s say any traffic sourced from users in the developers group and destined
219. 15:17for the Test_Servers group should be permitted.
220. 15:20Now, what about traffic sourced from the guest group?
221. 15:23They shouldn’t be able to access our servers, so we’ll make that red.
222. 15:28How about users in the employees group?
223. 15:30Maybe that depends on various factors, we can’t just permit or deny all traffic, so
224. 15:35we would want to make a custom policy for that.
225. 15:39We can go ahead and define policies like this, it’s a very simple and straightforward way
226. 15:43of creating and applying policies across the entire SD-Access fabric.
227. 15:48No need to configure policies on devices one at a time.
228. 15:51I’m not showing the whole process here of course, but one thing to note is that the
229. 15:55engineer can write an explanation for each policy made, making it much easier to understand
230. 15:59the purpose of policies later.
231. 16:01Okay, now let’s take a look at some of the other features of DNA Center.
232. 16:07In the menu on the left side you can see there are various sections, and I’ve opened the
233. 16:11design section.
234. 16:13Here we can build the network hierarchy, manage IP addresses and subnets, configure DHCP servers,
235. 16:19DNS servers, etc, among other things.
236. 16:22Here, for example, I’m looking at one site, SJC-20, on a map.
237. 16:28You can map your enterprise’s sites all over the world and create hierarchies based
238. 16:31on country, etc.
239. 16:35In the policy menu you can configure policies like the example I showed you earlier.
240. 16:39You tell DNA Center how the network devices should behave, and DNA Center will change
241. 16:43that into configurations on the devices in the network.
242. 16:47For example, here’s that group-based access control page again.
243. 16:50A simple and logical way to configure network policies.
244. 16:54In the provision menu we can manage our device inventory and add new devices.
245. 16:59Other services are available as well, as you can see in the menu.
246. 17:03Here’s the inventory page.
247. 17:06In the side bar you can see that there are 3 unassigned devices under global.
248. 17:10By default, when you add devices to DNA Center they will be under the global site, until
249. 17:15you assign them to a specific site.
250. 17:18You can see their status of ‘managed’ here, this means they are under control of
251. 17:22DNA Center, they are not independent devices.
252. 17:25This is also the default setting when you register a device in DNA Center.
253. 17:29Here you can see the compliance status of the devices.
254. 17:32The top device is compliant with our policies, but the bottom two aren’t.
255. 17:37I clicked on one of the non-compliant devices, and you can see why it is labeled as non-compliant.
256. 17:43The software image, the version of IOS, is not up to date.
257. 17:48The version should be 17.03.03, but currently it is 16.11.1c.
258. 17:54We can use DNA Center to update that later if we want.
259. 17:57And here you can see that it is also non-compliant with some security advisories.
260. 18:03Anyway moving on, in the assurance section of the menu you can monitor the status of
261. 18:07the network.
262. 18:08You can make sure the devices are all up and running without issues.
263. 18:12For example, here I can see which devices in the network are considered ‘healthy’
264. 18:16by DNA Center.
265. 18:183 of 4 devices are in good health, and 1 of them simply has no health data.
266. 18:22Okay, that’s all we’ll look at for now, but if you want to look around DNA Center
267. 18:26yourself you can check out the DevNet sandbox at sandboxdnac.cisco.com, and you can see
268. 18:33the username and password here.
269. 18:35I highly recommend checking it out and looking around at what DNA Center has to offer.
270. 18:40Okay, that was a quick look at DNA Center, but to be honest you don’t have to be familiar
271. 18:46with all of the functions of DNA Center for the CCNA.
272. 18:49Basically, just understand its role as a network controller in SD-Access architecture, and
273. 18:54also understand that it can be a network management platform in a traditional network.
274. 18:59However, the exam topics do state that you should be able to compare DNA Center-enabled
275. 19:04device management with traditional device management.
276. 19:07Actually, I’ve covered most of these points already when I first introduced network automation,
277. 19:13but let’s review to make sure.
278. 19:14First, let’s review some characteristics of traditional network management.
279. 19:19Devices are configured one-by-one via SSH or console connection.
280. 19:23This is what we’ve been doing throughout the labs in this course.
281. 19:27Devices are manually configured via console connection before being deployed.
282. 19:31This means when deploying a new device to a network.
283. 19:33You first have to manually set it up before connecting it to the network.
284. 19:39Configurations and policies are managed per-device, in a distributed manner.
285. 19:42There is no central management.
286. 19:45New network deployments take a long time due to the manual labor required.
287. 19:49Setting up dozens of new devices manually takes a lot of time, and also errors and failures
288. 19:54are more likely due to increased manual effort.
289. 19:57Now, I don’t want to make it seem like traditional network management is bad, but you should
290. 20:01be aware of these potential downsides.
291. 20:05Now some characteristics of DNA Center-based network management.
292. 20:09Devices are centrally managed and monitored from the DNA Center GUI or other applications
293. 20:14using its REST API.
294. 20:16In this video I showed you the DNA Center GUI, but using the REST API other applications
295. 20:21can be used to interact with DNA Center too.
296. 20:25With DNA Center, the administrator communicates their intended network behavior to DNA Center,
297. 20:31which changes those intentions into configurations on the managed network devices.
298. 20:37Configurations and policies are centrally managed, they’re all stored and managed
299. 20:40on DNA Center.
300. 20:42Software versions are also centrally managed.
301. 20:44DNA Center can monitor cloud servers for new versions and then update the managed devices
302. 20:49when needed.
303. 20:50In this video you saw an example of DNA Center showing us an alert for a device with an old
304. 20:55software version.
305. 20:57Finally, with DNA Center new network deployments are much quicker.
306. 21:01New devices can automatically receive their configurations from DNA Center without manual
307. 21:07configuration.
308. 21:08Not only is this faster, human error is reduced too, which is a huge bonus.
309. 21:12Okay, that’s all I’ll say about this.
310. 21:16Most of these points we have already covered, but make sure you’re aware of them because
311. 21:19it is mentioned on the exam topics.
312. 21:21Okay, let’s review what we covered.
313. 21:24We first reviewed SDN, and I newly introduced the terms application layer, control layer,
314. 21:29and infrastructure layer.
315. 21:31Then, as an example of SDN, I introduced some concepts of Cisco SD-Access.
316. 21:37The main takeaways from this section are the concepts of underlay, overlay, and fabric.
317. 21:41Make sure you understand those concepts.
318. 21:44Then I showed you some functions of Cisco DNA Center, and compared network management
319. 21:48with DNA Center to traditional network management.
320. 21:52Remember, DNA Center is an SDN controller in SD-Access architecture, but it can also
321. 21:57be used as a general network management tool even in networks that don’t use SD-Access.
322. 22:03Make sure to watch until the end of the quiz for a bonus practice question from Boson Software’s
323. 22:07ExSim, the best practice exams for the CCNA.
324. 22:10Okay, let’s go to quiz question 1.
325. 22:14Which of the following terms describes the network of devices and physical connections?
326. 22:20Pause the video now to select the best answer.
327. 22:24Okay, the answer is A, underlay.
328. 22:29The underlay refers to the underlying physical network, and then the virtual overlay network
329. 22:33is built on top of it.
330. 22:35The combination of underlay and overlay is called the fabric.
331. 22:38Okay, let’s go to question 2.
332. 22:42In which of the following layers would you expect to find scripts that interact with
333. 22:46the controller?
334. 22:47Pause the video now to select the best answer.
335. 22:52Okay, the answer is B, application.
336. 22:57In SDN architecture, the application layer includes apps and scripts that can be used
337. 23:01to interact with the controller, which is in the control layer.
338. 23:05Finally the bottom layer is the infrastructure layer, which includes the network devices.
339. 23:09Okay, let’s go to question 3.
340. 23:14Which of the following is a characteristic of an optimal SD-Access underlay network as
341. 23:18configured by DNA-Center?
342. 23:20Pause the video now to select the best answer.
343. 23:25Okay, the answer is B, all links between switches are layer 3.
344. 23:31This means that spanning tree is not needed, and no links will have to be disabled because
345. 23:35there is no risk of layer 2 loops.
346. 23:37Okay, let’s go to question 4.
347. 23:41Which protocol is used to create virtual tunnels in the SD-Access overlay?
348. 23:46Pause the video now to select the best answer.
349. 23:50Okay, the answer is D, VXLAN.
350. 23:55It is used to create virtual tunnels in the overlay network.
351. 23:59And although we didn’t cover any details at all, the ‘extensible’ in the name ‘virtual
352. 24:03extensible LAN’ is very important.
353. 24:06It means that VXLAN supports many different features which are used by SD-Access.
354. 24:10Okay, let’s go to question 5.
355. 24:15Which of the following are valid switch roles in Cisco SD-Access?
356. 24:18(select three) Pause the video now to select the best answers.
357. 24:24Okay, the answers areA, C, and D. Control, border, and edge nodes.
358. 24:32These are the three different switch roles in Cisco SD-Access, and there is no such thing
359. 24:36as a management node.
360. 24:37Okay, that’s all for the quiz.
361. 24:40Now let’s take a look at a bonus question in Boson Software’s ExSim for CCNA.