Duration
Securing Cisco Digital Network Architecture (DNA)
5 days
Module 1: Introduction to Cisco’s Software Defined Access (SD-Access)
- DNA Introduction
- SD-Access Overview
- SD-Access Benefits
- SD-Access Key Concepts
- SD-Access Main Components, Campus Frabric, Wired, Wireless
- Nodes - Edge, Border, Control Plane
- DNA Centre (Controller)
- ISE (Policy)
- StealthWatch (Policy)
- NDP (Analytics and Assurance)
Module 2: SD-Access Campus Fabric
- The concept of Fabric
- Node types - Fabric Edge, Control Plane, Border
- LISP as protocol for Control Plane
- Configure LISP for Control Plane
- VXLAN as protocol for Data Plane
- Configure VXLAN for Data Plane
- Virtual Networks (VN)
- Fabric-enabled WLAN, WLC and AP's
- SDA-ready Cisco Catalyst LAN Switches
- Role of Cat9k in Cisco SD-Access solution and deployment models as border, control and edge nodes
Module 3: DNA Centre and Workflow for SD-Access
- Introduction to DNA Centre
- Workflow for SD-Access in DNA Centre - Design, Policy, Provision, Assurance
- Integration with Cisco ISE for Policy Enforcement
- Integration with Cisco StealthWatch for Policy Enforcement
- Integration with Cisco NDP for Analytics and Assurance
Module 4: Deployment and initial setup for DNA Centre
- Requirements
- Deployment Procedure
- Initial Setup
- GUI Navigation
Module 5: Deployment and initial setup for ISE and Integrate with DNA Centre
- Introduction to Cisco ISE
- Requirements
- Cisco IDE Deployment Model
- Deployment Procedure
- Initial Setup
- GUI Navigation
- Integration with DNA Centre
Module 6: Deploy Netflow Collector and StealthWatch Management Centre (SMC)
- Introduction to Netflow and SMC
- Requirements
- Deployment Procedure
- Initial Setup
- GUI Navigation
- Integration with DNA Centre / SD Access
Module 7: Implementing Policy Plane using Cisco TrustSec for Segmentation
- Cisco TrustSec phases - Classification, Propagation, Enforcement
- Configuring Classification
- Configuring SGT tag propagation
- Configure Enforcement
- Introducing Cisco TrustSec in ISE
- Cisco ISE as controller for Software-defined segmentation (groups and policies)
- Configuring ISE for Dynamic SGT assignment
- Configuring ISE for Static SGT assignment
- Configuring Policy Enforcement
Module 8: Cisco StealthWatch Management Console (SMC)
- Configuring Host Groups in the SMC
- Configuring Flexible NetFlow on Cisco Devices
- Verify Netflow Data Collection on SMC
- Configuring Cisco StealthWatch and ISE Integration
Module 9: DNA Centre Workflow First Step - Design
- Creating Enterprise and Sites Hierarchy
- Configuring General Network Settings
- Loading maps into the GUI
- IP Address Management
- Software Image Management
- Network Device Profiles
Module 10: DNA Centre Workflow Second Step - Policy
- 2-level Hierarchy
- Macro Level: Virtual Network (VN)
- Micro Level: Scalable Group (SG)
- Policy Types - Access Policy, Access Control Policy, Traffic Copy Policy
- Cross Domain Policies
Module 11: DNA Centre Workflow Third Step - Provision
- Devices Onboarding
- Discovering Devices
- Assigning Devices to a site
- Provisioning device with profiles
- Fabric Domains
- Understanding Fabric Domains
- Using Default LAN Fabric Domain
- Creating Additional Fabric Domains
- Adding Nodes
- Adding Fabric Edge Nodes
- Adding Control Plane Nodes
- Adding Border Nodes
Module 12: DNA Centre Workflow Fourth Step – Assurance
- Introduction to Analytics
- NDP Fundamentals
- Overview of DNA Assurance
- Components of DNA Assurance
- DNA Centre Assurance Dashboard
Module 13: Implementing WLAN in SD-Access Solution
- WLAN Integration Strategies in SD-Access Fabric
- CUWN Wireless Over The Top (OTT)
- SD-Access Wireless (Fabric enabled WLC and AP)
- SD-Access Wireless Architecture
- Control Plane: LISP and WLC
- Data Plane: VXLAN
- Policy Plane and Segmentation: VN and SGT
Module 14: Implementing Campus Fabric External Connectivity for SD-Access
- Role of Border Nodes
- Types of Border Nodes - Border, Default Border
- Single Border vs. Multiple Border Designs
- Collocated Border and Control Plane Nodes
- Distributed (separated) Border and Control Plane Nodes
- Configuring Border Nodes
Module 15: SDA Migration Strategies
- Migrate to SD-Access using a quality-assured process, state-of-the-art tools and proven methodologies
- The need for additional planning
- Typical considerations
- Primary Approaches for migration
- Building SD-Access network in parallel and then integrate
- Do incremental migrations of access switches into an SD-Access fabric
Labs
- Lab 1: Deploy and Setup DNA Centre
- Lab 2: Deploy and Setup ISE
- Lab 3: Deploy and Setup StealthWatch
- Lab 4: Integrate ISE with DNA Centre
- Lab 5: Integrate StealthWatch with SD-Access infrastructure
- Lab 6: Performing SD-Access Design Step in DNA Centre
- Lab 7: Performing SD-Access Policy Step in DNA Centre and ISE
- Lab 8: Performing SD-Access Provision Step in DNA Centre
- Lab 9: Integrating WLAN services through SD-Wireless architecture
- Lab 10: Deploy and Setup Border Node
- Lab 11: Monitoring SDA Operations
- Lab 12: Troubleshooting SDA Operations
Programme scope, delivery arrangements and suitability are confirmed during enquiry.