SlideShare a Scribd company logo

Cisco Connect Vancouver 2017 - Cisco's Digital Network Architecture - deeper dive, from the gates to the GUI

Cisco Canada, profile picture
Cisco Canada

Dave Zacks, a distinguished engineer at Cisco, discusses the significance of hardware in a software-defined world and the company's innovations in digital network architecture. He emphasizes the need for flexible, programmable ASICs to meet modern networking demands, as traditional networks struggle with agility and security. The presentation outlines Cisco's direction towards implementing advanced networking solutions that integrate hardware and software for improved operational efficiency and security.

Technology
1 of 81
Downloaded 21 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
© 2016 Cisco and/or its affiliates. All rights reserved. 1 Your Time Is Now Connect Cisco
© 2016 Cisco and/or its affiliates. All rights reserved. 2 Dave Zacks Distinguished Engineer Enterprise Networks Business November, 2017 #HighBitRate Cisco Digital Network Architecture – Deeper Dive, “From the Gates to the GUI” The Importance of Hardware in a Software Defined World
I am a Distinguished Engineer in Cisco’s Enterprise Networking Business, based in Vancouver, and have been with Cisco for 18 years. As a DTME within the Enterprise Networks Architecture team, I work primarily on capabilities and solutions that are anywhere from 12 to 36+ months out, helping to define these projects and then assisting as they progress towards and through design, development, and solution introduction. I have a strong background in, and focus on, customer requirements, and integrating these into the products and solutions Cisco builds. I have a special interest in Flexible Hardware and Fabric architectures. Dave Zacks Distinguished TME dzacks@cisco.com @DaveZacks By Way of Introduction …
© 2016 Cisco and/or its affiliates. All rights reserved. 4Cisco Public This is an ambitious presentation
© 2016 Cisco and/or its affiliates. All rights reserved. 5Cisco Public We are going to try to cover Cisco Innovation from “The Gates to the GUI”
© 2016 Cisco and/or its affiliates. All rights reserved. 6Cisco Public No, I don’t mean this Gates …
© 2016 Cisco and/or its affiliates. All rights reserved. 7Cisco Public I mean these gates … SILICON Gates 
© 2016 Cisco and/or its affiliates. All rights reserved. 8Cisco Public From Innovations in Silicon and Software … … to Innovations in Platforms and Solutions
© 2016 Cisco and/or its affiliates. All rights reserved. 9Cisco Public And Why These Innovations Matter
© 2016 Cisco and/or its affiliates. All rights reserved. 10Cisco Public It’s going to be Quite a Ride
© 2016 Cisco and/or its affiliates. All rights reserved. 11Cisco Public So Buckle Up, and Let’s Get Started!
12© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public Cisco DNA and the Importance of Network Innovation
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 13 Innovation in the network
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 14 Source: Forrester Source: Open Compute Project Time IT spends on operations80% CEOs are worried about IT strategy not supporting business growth57% Network Expenses Deployment Speed 0 10 100 1000 Computing Networking Seconds 0 100% CAPEX OPEX 33% 67% The Need for Agility Changing Enterprise Requirements
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 15 Advanced Persistent Threats Devices per Person 3.64 Mobile world requires access to everything everywhere Mobility Devices per Admin 100K Agility and New Consumption Models Cloud IoT Things Connected 7.5BUnmanned devices growing at rapid pace Enterprise Trends Driving Digital Transformation
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 16 VLAN 1 VLAN 2 VLAN 3 WAN BranchA VLAN 1 BranchA VLAN 3 Remote VLAN 2 HQ ACL 1 ACL 2 ACL 2 ACL 3 Traditional Networks Cannot Meet the Demand Users, Device and IoT Segmentation Enabling Seamless Mobility Secure Connectivity to the Cloud Setting Up End-End Security
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 17
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 18 Security Automation Analytics Virtualization Cloud Service Management Programmable Physical and Virtual infrastructure Intent-based Network Infrastructure DNA Center AnalyticsPolicy Automation E x p r e s s I N T E N T E x t r a c t C O N T E X T I m p l e m e n t w i t h S E C U R I T Y P e r f o r m L E A R N I N G The Network. Intuitive. Based on Cisco’s DNA Cisco DNA Digital Network Architecture
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 19 Relevant IrrelevantDefault • These applications directly support business objectives • Applications should be classified, marked and treated marked according to industry best-practice recommendations • These applications may/may not support business objectives (e.g. HTTP/HTTPS/SSL) • Applications of this type should be treated with a Default Forwarding service • These applications do not support business objectives and are typically consumer-oriented • Applications of this type should be treated with a “less-than Best Effort” service RFC 4594 RFC 2474 RFC 3662 IMPORTANT UNIMPORTANTNEUTRALPROTECT PENALIZELEAVE ALONE Simplifying Networking via Intent Example with EasyQoS
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 20 Wireless AP Trust Boundary PEP 4Q (WMM) Catalyst 3650 Trust Boundary PEP 2P6Q3T Catalyst 4500 1P7Q1T Catalyst 6500 1P3Q4T 1P7Q4T 2P6Q4T … Nexus 7700 F3: 1P7Q1T WLC PEP ASR/ISRs MQC Catalyst 2960-X Trust Boundary PEP 1P3Q3T Wireless AP Trust Boundary PEP 4Q (WMM) Southbound APIs translate business intent to platform- specific configurations Network Operators express high-level business intent to the EasyQoS app EasyQoS Operation Network Controller
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 21 Network Controller EasyQoS will seamlessly interconnect all types of hardware and software queuing models to achieve consistent and compatible end-to-end treatments – aligned with the expressed business intent EasyQoS Results
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 22 ip access-list extended APIC_EM-MM_STREAM-ACL remark citrix - Citrix permit tcp any any eq 1494 permit udp any any eq 1494 permit tcp any any eq 2598 permit udp any any eq 2598 remark citrix-static - Citrix-Static permit tcp any any eq 1604 permit udp any any eq 1604 permit tcp any any range 2512 2513 permit udp any any range 2512 2513 remark pcoip - PCoIP permit tcp any any eq 4172 permit udp any any eq 4172 permit tcp any any eq 5172 permit udp any any eq 5172 remark timbuktu - Timbuktu permit tcp any any eq 407 permit udp any any eq 407 remark xwindows - XWindows permit tcp any any range 6000 6003 remark vnc - VNC permit tcp any any eq 5800 permit udp any any eq 5800 permit tcp any any range 5900 5901 permit udp any any range 5900 5901 exit ip access-list extended APIC_EM-SIGNALING-ACL remark h323 - H.323 permit tcp any any eq 1300 permit udp any any eq 1300 Your Choice …
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 23 Self-Driving Automation Future Closed Loop through Network Analytics and Machine Learning DNA Center BB Campus Fabric SDA Automated Deployment Plug and Play, Day 0 Deployment Exists Today HTTP Proxy Internet Admin Installer Step 1 Network admin previsions devices in Cisco Network Plug and Play applications Step 2 Onsite installer with mobile app installs and powers on devices, triggers deployment, checks status Step 3 New devices contact Cisco Network Plug and Play application to get provisioned Network admin can remotely monitor install status Basic Advanced One Point of Management – All from Cisco DNA Center Configure once and deploy everywhere - SD-Access DNA Center Campus Fabric SDA New Consistent Across Network Fabric The Network. Intuitive. Moving From Manual to Automated
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 24 Security Automation Analytics Virtualization Cloud Service Management Programmable Physical and Virtual infrastructure Open API Driven Principles Insights and Experiences Automation and Assurance Security and Compliance Open API Driven Programmable Software Defined Access Catalyst 9000 Flexible Network Hardware and Software DNA Center Encrypted Traffic Analytics The Road to Intent-Based Networking Our Journey Today - Overview
25© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public Cisco DNA and the Importance of Flexible Hardware
© 2016 Cisco and/or its affiliates. All rights reserved. 26Cisco Public EISG Architecture Team David Goeckeler Cisco SVP, Security and Networking Cisco Live Las Vegas 2016 Innovation in the network ASICs are a pillar of Cisco innovation …
© 2016 Cisco and/or its affiliates. All rights reserved. 27Cisco Public
© 2016 Cisco and/or its affiliates. All rights reserved. 28Cisco Public How is an ASIC built?
© 2016 Cisco and/or its affiliates. All rights reserved. 29Cisco Public Then, it starts with coding… Verilog VHDL Synthesis Process Converts code into logical gate constructs (Netlist) ASICs – From Definition to Deployment
© 2016 Cisco and/or its affiliates. All rights reserved. 30Cisco Public Imprint design on Silicon Wafer
© 2016 Cisco and/or its affiliates. All rights reserved. 31Cisco Public Discrete transistor MOSFET (metal oxide semiconductor field effect transistor) FinFET (fin field effect transistor) NAND gate NOR Gate Universal Gates XOR Gate AND Gate OR Gate NOT Gate XNOR Gate … which can be used to build any of the other logic gates … … mostly used @ 22nm and above … mostly used @ 16nm and below … which, when we put millions of them together on a silicon die, produce a chip! Silicon wafer
© 2016 Cisco and/or its affiliates. All rights reserved. 32Cisco Public Discrete transistor MOSFET (metal oxide semiconductor field effect transistor) FinFET (fin field effect transistor) NAND gate NOR Gate Universal Gates XOR Gate AND Gate OR Gate NOT Gate XNOR Gate … which can be used to build any of the other logic gates … … mostly used @ 28nm and above … mostly used @ 22nm and below UADP 1.1 191M gates UADP 2.0 270M gates Catalyst 3850 mGig Catalyst 9300, 9400, 9500
© 2016 Cisco and/or its affiliates. All rights reserved. 33Cisco Public We put a man here … … using this … Apollo Guidance Computer … which was built from nothing but that … 4100 ICs, each of which contained a single 3-input NOR gate In other words … we put a man on the moon with less than 10,000 transistors … It takes 7.46 billion transistors to route your packets! With the appropriate security, segmentation, QoS, encryption, fragmentation, etc, etc … Fun Fact!
© 2016 Cisco and/or its affiliates. All rights reserved. 34Cisco Public We are talking transistors… and how many we can pack in an ASIC die … “The number of transistors incorporated into a chip will approximately double every 18 - 24 months …” “Moore’s Law” - 1975 Transistor Width measured in Nanometers Nanometer = One Billionth of a Meter
© 2016 Cisco and/or its affiliates. All rights reserved. 35Cisco Public A human hair is ~100,000 nanometers in width A Perspective
© 2016 Cisco and/or its affiliates. All rights reserved. 36Cisco Public Red blood cell (7,000 nm) rises to 10th floor Empire State Building = 1454 feet to tip = 443 meters ONE NANOMETER – less than 1/4th of an inch! … about the same thickness as three pennies on this scale … … and we build transistors measured in nanometers … How SMALL is SMALL? Singlehumanhair ~ 100,000 nm … and then we come to this little pinprick over here …
© 2016 Cisco and/or its affiliates. All rights reserved. 37Cisco Public Photoresist SiO2 layer Silicon substrate Prepared silicon wafer Projected light Mask Lens Patterns projected onto wafer Exposed photoresist removed Exposed areas etched by gases Ions shower etched areas, doping them Doped region New photoresist spun on wafer, steps 2 – 4 repeated Metal connector Similar cycle repeated to lay down metal links between transistors About a month … the same time it takes to make one of these … How Long Does It Take to Manufacture a Wafer?
© 2016 Cisco and/or its affiliates. All rights reserved. 38Cisco Public Why Does Cisco Develop Our Own Silicon? Simpler Deployment Options Better Insight and Optimization Increased Security Most Appropriate Scalability Flexibility and Investment Protection via Programmability
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 39 Traditionally the ASIC processing pipeline is FIXEDIPv4 IPv6 Traditional Fixed ASIC Processing Pipeline
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 40 … and has challenges handling NEW PROTOCOLS … MPLS Traditional Fixed ASIC Processing Pipeline
© 2016 Cisco and/or its affiliates. All rights reserved. 41Cisco Public Flexibility in Networking … … disconnect with traditional fixed ASIC processing …. Evolution of Business Industry Trends – SDN
© 2016 Cisco and/or its affiliates. All rights reserved. 42Cisco Public
© 2016 Cisco and/or its affiliates. All rights reserved. 43Cisco Public So where can Flexible ASICs help us?
© 2016 Cisco and/or its affiliates. All rights reserved. 44Cisco Public DNA Flexible Infrastructure – Programmable ASIC Silicon
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 45 ASIC Evolution – Over Time UADP 2.0: 7.46B transistors! 2,160,000 lines of code New! Catalyst 9300 / 9400 / 9500 – 2017 Catalyst 3550 Circa 2003 60M transistors 47,226 lines of code Catalyst 3750 Circa 2008 210M transistors 86,220 lines of code Catalyst 3850 Circa 2013 UADP 1.0 – 1.3B transistors UADP 1.1 – 3.0B transistors 1,490,000 lines of code All Cisco-developed silicon Driving the benefits of vertical integration – Hardware and software working together! Just like some other famous examples …
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 46 Flex Rewrite Cisco’s UADP ASIC delivers FLEXIBILITY … Flex Parser Flexible, Programmable Processing Pipeline GRE If IPv7 were invented tomorrow … ... we could probably handle it via the Programmable Pipeline! Flex Counters Stage 1 Stage 2 Stage 3 Stage n IPv4 IPv6 VXLAN MPLS IPv7 Unified Access Data Plane – Processing Pipeline
© 2016 Cisco and/or its affiliates. All rights reserved. 47Cisco Public Parse depth of 256 Bytes 15 programmable stages Up to 250 frames across stages at one time… Underlay Outer IP Header Outer MAC Header UDP Header VXLAN Header Overlay Inner (Original)IP Header Original Payload Inner (Original) MAC Header 14 Bytes (4 Bytes Optional) Ether Type 0x0800 VLAN ID VLAN Type 0x8100 Source MAC Dest. MAC 48 48 16 16 16 Src VTEP MAC Address Next-Hop MAC Address 20 Bytes Dest. IP Source IP Header Checksum Protocol 0x11 (UDP) IP Header Misc. Data 72 8 16 32 32 Dst RLOC IP Address Src RLOC IP Address 8 Bytes Checksum 0x0000 UDP Length VXLAN Port Source Port 16 16 16 16 UDP 4789 Hash of inner L2/L3/L4 headers of original frame. Enables entropy for ECMP load balancing. 8 Bytes Reserved VN ID Segment ID VXLAN Flags RRRRIRRR 8 16 24 8 Allows 16M possible VRFs Allows 64K possible SGTs VXLAN as a protocol had not even been invented when UADP 1.0 was designed … Yet UADP forwards VXLAN in hardware, at high performance in IOS-XE 16.3+ … thanks to Flexibility! in VXLAN is a complex protocol …
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 48 Flex Rewrite Flex Parser Cisco’s UADP ASIC provides support for TUNNELLING …IPv4 … a task at which Cisco’s Programmable, Flexible ASICs excel! Tunnelled traffic requires RECIRCULATION … IPv4VXLAN High-performance, low-latency recirculation path … Flex Counters Flexible, Programmable Processing Pipeline Stage 1 Stage 2 Stage 3 Stage n Unified Access Data Plane – Processing Pipeline
© 2016 Cisco and/or its affiliates. All rights reserved. 49Cisco Public What does all of this mean for me?
© 2016 Cisco and/or its affiliates. All rights reserved. 50Cisco Public Cisco Programmable Hardware equals FLEXIBILITY ADAPTABILITY Enabling Network Evolution – a critical requirement for DNA
© 2016 Cisco and/or its affiliates. All rights reserved. 51Cisco Public http://vimeo.com/155635184 Cisco Live US – session BRKARC-3467, “Cisco Enterprise Silicon” Peter Jones, Principal Engineer Dave Zacks, Distinguished Engineer And watch us on … 90 minutes of awesome silicon geekery with Dave and Peter – this session, ++ Cisco Flexible Silicon – Want to Know More?
© 2016 Cisco and/or its affiliates. All rights reserved. 52Cisco Public http://www.cisco.com/c/m/en_us/training-events/events- webinars/webinars/techwise-tv/214-programmable-asics.html Cisco Flexible Silicon – Want to Know More?
53© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public Network Innovation – Flexible Switching Platforms, Catalyst 9000 Series
© 2016 Cisco and/or its affiliates. All rights reserved. 54Cisco Public Converged OS Open IOS-XE Converged Licensing Catalyst 9300 Lead Fixed Access Catalyst 9400 Lead Modular Access Catalyst 9500 Lead Fixed Core Built on Cisco’s Innovative UADP ASIC & Open IOS-XE Converged ASIC UADP 2.0 Introducing the Catalyst 9K Family
© 2016 Cisco and/or its affiliates. All rights reserved. 55Cisco Public Up to 32MB Packet Buffer Up to 64K x2 Netflow RecordsEmbedded Microcontrollers Shared Lookup Up to 240GE Bandwidth 384K Flex Counters Up to 2X to 4X Forwarding + TCAM Universal Deployments Adaptable Tables Enhanced Scale/Buffering Multicore resource share Investment Protection Flexible Pipeline 7.46B Transistors 28nm Technology UADP 2.0 – Next Generation of ASIC Innovation
© 2016 Cisco and/or its affiliates. All rights reserved. 56Cisco Public
57© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public Network Innovation – Leveraging Flexible Platforms for Encrypted Traffic Analytics
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 58 Network Threats are Evolving to Leverage Encryption
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 59 Providing Security While Maintaining Privacy! Encrypted Traffic Non-Encrypted Traffic How do you Analyze threats without decrypting traffic flows? Can We Actually Solve This?
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 60 • End to end confidentiality • Channel integrity during inspection • Adapts with encryption standards Malware in Encrypted Traffic Is the payload within the TLS session malicious? Malware Detection and Visibility without Decryption • Audit for TLS policy violations • Passive detection of Ciphersuite vulnerabilities Cryptographic Compliance How much of my digital business uses strong encryption? Encrypted Traffic Analytics Overview
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 61 TLS field (in ClientHello) Inference Offered Cyphersuites Browsers prefer heavy weight and more secure encryption algorithms, Mobile applications prefer efficient encryption Extensions Client: I support crypto! Server: I support that crypto, and I’m me! Client: Take this secret and let’s encrypt! Server: Your secret looks good; let’s encrypt! Client/Server: encrypted data! ETA – Initial Data Packet (IDP)
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 62 Malware Behavior Network Behavior Communication with command control server Sequence of packet lengths Write to the disk Time interval between packet ETA – Sequence of Packet lengths and Times (SPLT)
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 63 Bestafera Self-Signed Certificate Data Exfiltration C2 Message Google Search Initial Page Load Page Refresh Autocomplete Detecting Malware by Behavior IDP, SPLT, and Machine Learning
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 64 11101101100000 10001111001111 01001000100001 Catalyst 9K Switch Stealthwatch NetFlow with enhanced telemetry at line rate Machine learning Spot malware in encrypted traffic Cognitive Analytics • Analyze metadata without decrypting traffic flows • Global-to-local knowledge correlation • Automate policy and segmentation across the entire network Encrypted Traffic Analytics *Source : Identifying Encrypted Malware Traffic with Contextual Flow Data, Oct 2016 Threat Detection Accuracy* 0.01% False Positives* 99% Encrypted Traffic Analytics Solution Overview UADP 2.0 ASIC
65© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public Network Innovation – Leveraging Flexible Platforms for Software Defined Access
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 66 Slower Issue ResolutionComplex to ManageDifficult to Segment Ever increasing number of users and endpoint types Ever increasing number of VLANs and IP Subnets Multiple steps, user credentials, complex interactions Multiple touch-points Separate user policies for wired and wireless networks Unable to find users when troubleshooting Traditional Networks Cannot Keep Up! Traditional Networks Key Challenges
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 67
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 68 Automated Network Fabric Single Fabric for Wired & Wireless with Workflow-based Automation Insights & Telemetry Analytics and insights into user and application behavior Identity-based Policy & Segmentation Decoupled security policy definition from VLAN and IP Address DNA Center AnalyticsPolicy Automation SD-Access Fabric IoT Network Employee Network User Mobility Policy stays with user Software Defined Access Networking at the Speed of Software!
© 2016 Cisco and/or its affiliates. All rights reserved. 69Cisco Public DNA Center TECCRS-2700 69 sioning
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 70 Automation Network AnalyticsIdentity Services Engine Routers Switches Wireless APs DNA Center DESIGN PROVISION POLICY ASSURANCE DNA Center Simple Workflows Wireless Controllers DNA Center © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 70 Overview
© 2016 Cisco and/or its affiliates. All rights reserved. 71Cisco Public Overlay – Flexible Virtual Services Mobility - Map Endpoints to Edges Services - Deliver using Overlay Scalability - Reduce Protocol State Flexible and Programmable Underlay – Simple Transport Forwarding Redundant Devices and Paths Keep It Simple and Manageable Optimize Packet Handling Maximize Network Reliability (HA) Separate the “Forwarding Plane” from the “Services Plane” IT Challenge (Business): Network Uptime IT Challenge (Employee): New Services The Boss YOU The User Software Defined Access The Power of The Fabric
© 2016 Cisco and/or its affiliates. All rights reserved. 72Cisco Public Overlay encapsulation (VXLAN) Fabric Underlay – Forwarding plane • Connects the network elements to each other • Optimized for traffic forwarding (scalability, performance) • Networking constructs like IP, VLANs, live here Overlay control plane (LISP) Underlay Overlay Employee Supplier Devices Fabric breaks the dependency between IP address and Policy. In Fabric Polices are tied to User/Device Identity Fabric brings Policy Simplification DNA Center – Automation and Assurance • Single User Interface for Fabric Management & Orchestration • Policy definition based on User, Device or App Group • Design, Deploy and Monitoring and Troubleshooting Fabric Overlay – Services plane • Dynamically connects Users/Devices/Things • IP is an ID not used for traffic forwarding • End to End Policies and Segmentation What is Unique About SD-Access? access-list 102 deny udp 167.160.188.162 0.0.0.255 gt 4230 248.11.187.246 0.255.255.255 eq 2165 access-list 102 deny udp 32.124.217.1 255.255.255.255 lt 907 11.38.130.82 0.0.31.255 gt 428 access-list 102 permit ip 64.98.77.248 0.0.0.127 eq 639 122.201.132.164 0.0.31.255 gt 1511 access-list 102 deny tcp 247.54.117.116 0.0.0.127 gt 4437 136.68.158.104 0.0.1.255 gt 1945 access-list 102 permit icmp 136.196.101.101 0.0.0.255 lt 2361 90.186.112.213 0.0.31.255 eq 116 access-list 102 deny udp 242.4.189.142 0.0.1.255 eq 1112 19.94.101.166 0.0.0.127 eq 959 access-list 102 deny tcp 82.1.221.1 255.255.255.255 eq 2587 174.222.14.125 0.0.31.255 lt 4993 access-list 102 deny tcp 103.10.93.140 255.255.255.255 eq 970 71.103.141.91 0.0.0.127 lt 848 access-list 102 deny ip 32.15.78.227 0.0.0.127 eq 1493 72.92.200.157 0.0.0.255 gt 4878 access-list 102 permit icmp 100.211.144.227 0.0.1.255 lt 4962 94.127.214.49 0.255.255.255 eq 1216 access-list 102 deny icmp 88.91.79.30 0.0.0.255 gt 26 207.4.250.132 0.0.1.255 gt 1111 access-list 102 deny ip 167.17.174.35 0.0.1.255 eq 3914 140.119.154.142 255.255.255.255 eq 4175 access-list 102 permit tcp 37.85.170.24 0.0.0.127 lt 3146 77.26.232.98 0.0.0.127 gt 1462 access-list 102 permit tcp 155.237.22.232 0.0.0.127 gt 1843 239.16.35.19 0.0.1.255 lt 4384 VLAN 20 SSID D VLAN 30 SSID A SSID C VLAN 40 VLAN 10 SSID B
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 73 First level Segmentation that ensures zero Communication between Building systems and Users 1 Virtual Networks Second level Segmentation within a Virtual Network that ensures role based access control between Two Groups Groups 1 2 IoT Virtual Network Group 3 Employee Virtual Network Group 1 Group 2 Routers Switches Wireless AP WLC Group 4 Group 5 2 Default Permit Custom Deny Default Deny Software Defined Access Integrated Segmentation
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 74 Before SD-Access After SD-Access • VLAN and IP address based • Create IP based ACLs for access policy • Deal with policy violations and errors manually • No VLAN or subnet dependency for segmentation and access control • Define one consistent policy • Policy follows Identity Group-Based Policy Policy follows IdentityCompletely Automated Drag policy to apply Users Devices Apps Employee Virtual Network IoT Virtual Network Guest Virtual Network Group 5 Group 3 Group 1 Group 6 Group 4 Group 2 Secure Onboarding of Users and Devices Segmentation and Access Control Made Simple
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 75 Stretched Subnets + No Spanning Tree + ECMP Distributed Anycast Default Gateway Limit Broadcast Domain No STP No HSRP / VRRP Equal Cost Multi-Path Routed Access 10.1.0.0/16 Software Defined Access Simplified Connectivity SD-Access Fabric
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 76 AutomationIdentity & Policy Identity Services Engine (ISE) Assurance Employees Virtual Network Group 1 Group 2 IoT Virtual Network Group 3 Group 4 Contextual Visibility and Troubleshooting Policy Mobility with no Topology Dependence SD-Access Fabric Stretched Subnets DNA Center Integrated Mobility, with User / Device Identity Software Defined Access Solution at a Glance
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 77 Separation of the Forwarding and Services Planes Overlay encapsulation Fabric Underlay is the Forwarding Plane • Connects Network Devices • Leverages existing topologies • Simple, best-practice deployment Fabric Overlay is the Services Plane • Connects Users and Devices • Leverages standard technologies • Address Independent End-to-End Policy Overlay control plane Underlay Overlay Employee Supplier Devices Cisco Flexible Silicon allows for Flexibility – Key to Supporting the Evolution to Network Fabrics DNA Flexible Infrastructure Supporting Fabric Evolution – and Software Defined Access
Cisco Public 78© 2016 Cisco and/or its affiliates. All rights reserved. Summary – Innovation Across the Network. Intuitive.
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 79 Critical Role of Flexible Silicon Building on a Strong Foundation
© 2016 Cisco and/or its affiliates. All rights reserved. 80Cisco Public From the Hardware … … to the Software and Protocols, with Integrated Security … to the Whole Solution … Cisco Innovations – In Hardware, Software, and Solutions – Tie It All Together “From the Gates – to the GUI” Integrated Security Innovation All The Way Up the Stack Hardware, Software, and Solutions
Thank you.

More Related Content

PDF
Cisco Connect Vancouver 2017 - So you want to go to the cloud! Simplifying cl...
Cisco Canada
 
PDF
Cisco Connect Vancouver 2017 - Optimizing your client's wi fi experience
Cisco Canada
 
PDF
Cisco Connect Vancouver 2017 - Compute infrastructure for a hybrid cloud
Cisco Canada
 
PDF
Cisco Connect Vancouver 2017 - Cisco Meraki -Let Simple Work For You
Cisco Canada
 
PDF
Cisco Connect Vancouver 2017 - Cisco Spark Hybrid Services Architectural Design
Cisco Canada
 
PDF
Cisco Digital Network Architecture - Introducing the Network Intuitive
Cisco Canada
 
PDF
Cisco Digital Network Architecture – Deeper Dive, “From the Gates to the GUI
Cisco Canada
 
PDF
Cisco connect winnipeg 2018 gain insight and programmability with cisco dc ...
Cisco Canada
 
Cisco Connect Vancouver 2017 - So you want to go to the cloud! Simplifying cl...
Cisco Canada
 
Cisco Connect Vancouver 2017 - Optimizing your client's wi fi experience
Cisco Canada
 
Cisco Connect Vancouver 2017 - Compute infrastructure for a hybrid cloud
Cisco Canada
 
Cisco Connect Vancouver 2017 - Cisco Meraki -Let Simple Work For You
Cisco Canada
 
Cisco Connect Vancouver 2017 - Cisco Spark Hybrid Services Architectural Design
Cisco Canada
 
Cisco Digital Network Architecture - Introducing the Network Intuitive
Cisco Canada
 
Cisco Digital Network Architecture – Deeper Dive, “From the Gates to the GUI
Cisco Canada
 
Cisco connect winnipeg 2018 gain insight and programmability with cisco dc ...
Cisco Canada
 

What's hot (20)

PDF
Cisco connect winnipeg 2018 understanding cisco's next generation sdwan sol...
Cisco Canada
 
PDF
Cisco Connect Vancouver 2017 - How to have magical meeting experiences
Cisco Canada
 
PDF
Cisco Connect Halifax 2018 Cisco dna - deeper dive
Cisco Canada
 
PDF
Cisco Connect Vancouver 2017 - Understanding Cisco next gen SD-WAN
Cisco Canada
 
PDF
Cisco Connect Halifax 2018 Cisco dna - network intuitive
Cisco Canada
 
PDF
Cisco Connect Vancouver 2017 - Putting firepower into the next generation fir...
Cisco Canada
 
PPTX
Cisco connect winnipeg 2018 a look at network assurance in dna center
Cisco Canada
 
PDF
Cisco connect winnipeg 2018 simply powerful networking with meraki
Cisco Canada
 
PDF
Cisco Connect Toronto 2018 consuming public and private clouds
Cisco Canada
 
PDF
Cisco connect winnipeg 2018 simplifying cloud adoption with cisco ucs
Cisco Canada
 
PDF
Cisco Connect Halifax 2018 Accelerating the secure digital business through...
Cisco Canada
 
PDF
Cisco connect montreal 2018 enterprise networks - say goodbye to vla ns
Cisco Canada
 
PDF
Cisco Connect Toronto 2018 DNA automation-the evolution to intent-based net...
Cisco Canada
 
PDF
Cisco connect winnipeg 2018 hybrid collaboration
Cisco Canada
 
PDF
Cisco Connect Halifax 2018 Application agility and programmability with cis...
Cisco Canada
 
PDF
Cisco Connect Toronto 2018 DevNet Overview
Cisco Canada
 
PDF
Integration cisco et microsoft connect montreal 2018
Cisco Canada
 
PDF
Cisco Connect Toronto 2018 cloud and on premises collaboration security exp...
Cisco Canada
 
PDF
Cisco Connect Vancouver 2017 - Embedding IR into the DNA of the business
Cisco Canada
 
PDF
Cisco Connect Ottawa 2018 data center - protecting your data with Cisco hyp...
Cisco Canada
 
Cisco connect winnipeg 2018 understanding cisco's next generation sdwan sol...
Cisco Canada
 
Cisco Connect Vancouver 2017 - How to have magical meeting experiences
Cisco Canada
 
Cisco Connect Halifax 2018 Cisco dna - deeper dive
Cisco Canada
 
Cisco Connect Vancouver 2017 - Understanding Cisco next gen SD-WAN
Cisco Canada
 
Cisco Connect Halifax 2018 Cisco dna - network intuitive
Cisco Canada
 
Cisco Connect Vancouver 2017 - Putting firepower into the next generation fir...
Cisco Canada
 
Cisco connect winnipeg 2018 a look at network assurance in dna center
Cisco Canada
 
Cisco connect winnipeg 2018 simply powerful networking with meraki
Cisco Canada
 
Cisco Connect Toronto 2018 consuming public and private clouds
Cisco Canada
 
Cisco connect winnipeg 2018 simplifying cloud adoption with cisco ucs
Cisco Canada
 
Cisco Connect Halifax 2018 Accelerating the secure digital business through...
Cisco Canada
 
Cisco connect montreal 2018 enterprise networks - say goodbye to vla ns
Cisco Canada
 
Cisco Connect Toronto 2018 DNA automation-the evolution to intent-based net...
Cisco Canada
 
Cisco connect winnipeg 2018 hybrid collaboration
Cisco Canada
 
Cisco Connect Halifax 2018 Application agility and programmability with cis...
Cisco Canada
 
Cisco Connect Toronto 2018 DevNet Overview
Cisco Canada
 
Integration cisco et microsoft connect montreal 2018
Cisco Canada
 
Cisco Connect Toronto 2018 cloud and on premises collaboration security exp...
Cisco Canada
 
Cisco Connect Vancouver 2017 - Embedding IR into the DNA of the business
Cisco Canada
 
Cisco Connect Ottawa 2018 data center - protecting your data with Cisco hyp...
Cisco Canada
 
Ad

Similar to Cisco Connect Vancouver 2017 - Cisco's Digital Network Architecture - deeper dive, from the gates to the GUI (20)

PDF
Cisco Digital Network Architecture Deeper Dive From The Gates To The Gui
Cisco Canada
 
PDF
Cisco Connect Toronto 2017 - Your time is now
Cisco Canada
 
PDF
Reducing Cost with DNA Automation
Cisco Canada
 
PDF
Cisco Connect Toronto 2017 - Introducing the Network Intuitive
Cisco Canada
 
PDF
Building The Right Network
Cisco Canada
 
PDF
Cisco connect winnipeg 2018 introducing the network intuitive
Cisco Canada
 
PDF
Cisco connect winnipeg 2018 unlocking business value with network programma...
Cisco Canada
 
PDF
Интуитивная сеть как платформа для надежного бизнеса
Cisco Russia
 
PDF
Gain Insight and Programmability with Cisco DC Networking
Cisco Canada
 
PDF
Cisco DC Networking: Gain Insight and Programmability with
Cisco Canada
 
PDF
Gain Insight and Programmability with Cisco DC Networking
Cisco Canada
 
PDF
Application Centric Infrastructure (ACI), the policy driven data centre
Cisco Canada
 
PDF
TechWiseTV Workshop: Programmable ASICs
Robb Boyd
 
PDF
Why Automate the Network?
Hank Preston
 
PPTX
CCNA4 Verson6 Chapter7
Chaing Ravuth
 
PPTX
CCNA (R & S) Module 02 - Connecting Networks - Chapter 7
Waqas Ahmed Nawaz
 
PPTX
Cisco Data Centre presentation - Cisco Live [COPY]
Mahadiputra S
 
PPTX
ACI Hands-on Lab
Cisco Canada
 
PDF
Cisco at DevTO - Tomorrow Starts Now for Sheridan College Students (July 28, ...
Marc Lijour, OCT, BSc, MBA
 
PDF
Education in 2015
Cisco Canada
 
Cisco Digital Network Architecture Deeper Dive From The Gates To The Gui
Cisco Canada
 
Cisco Connect Toronto 2017 - Your time is now
Cisco Canada
 
Reducing Cost with DNA Automation
Cisco Canada
 
Cisco Connect Toronto 2017 - Introducing the Network Intuitive
Cisco Canada
 
Building The Right Network
Cisco Canada
 
Cisco connect winnipeg 2018 introducing the network intuitive
Cisco Canada
 
Cisco connect winnipeg 2018 unlocking business value with network programma...
Cisco Canada
 
Интуитивная сеть как платформа для надежного бизнеса
Cisco Russia
 
Gain Insight and Programmability with Cisco DC Networking
Cisco Canada
 
Cisco DC Networking: Gain Insight and Programmability with
Cisco Canada
 
Gain Insight and Programmability with Cisco DC Networking
Cisco Canada
 
Application Centric Infrastructure (ACI), the policy driven data centre
Cisco Canada
 
TechWiseTV Workshop: Programmable ASICs
Robb Boyd
 
Why Automate the Network?
Hank Preston
 
CCNA4 Verson6 Chapter7
Chaing Ravuth
 
CCNA (R & S) Module 02 - Connecting Networks - Chapter 7
Waqas Ahmed Nawaz
 
Cisco Data Centre presentation - Cisco Live [COPY]
Mahadiputra S
 
ACI Hands-on Lab
Cisco Canada
 
Cisco at DevTO - Tomorrow Starts Now for Sheridan College Students (July 28, ...
Marc Lijour, OCT, BSc, MBA
 
Education in 2015
Cisco Canada
 
Ad

More from Cisco Canada (20)

PDF
Cisco connect montreal 2018 net devops
Cisco Canada
 
PDF
Cisco connect montreal 2018 iot demo kinetic fr
Cisco Canada
 
PPTX
Cisco connect montreal 2018 - Network Slicing: Horizontal Virtualization
Cisco Canada
 
PDF
Cisco connect montreal 2018 secure dc
Cisco Canada
 
PDF
Cisco connect montreal 2018 vision mondiale analyse locale
Cisco Canada
 
PDF
Cisco Connect Montreal 2018 Securité : Sécuriser votre mobilité avec Cisco
Cisco Canada
 
PDF
Cisco connect montreal 2018 collaboration les services webex hybrides
Cisco Canada
 
PDF
Cisco connect montreal 2018 compute v final
Cisco Canada
 
PDF
Cisco connect montreal 2018 saalvare md-program-xr-v2
Cisco Canada
 
PDF
Cisco connect montreal 2018 sd wan - delivering intent-based networking to th...
Cisco Canada
 
PDF
Cisco Connect Toronto 2018 an introduction to Cisco kinetic
Cisco Canada
 
PDF
Cisco Connect Toronto 2018 IOT - unlock the power of data - securing the in...
Cisco Canada
 
PDF
Cisco Connect Toronto 2018 DNA assurance
Cisco Canada
 
PDF
Cisco Connect Toronto 2018 network-slicing
Cisco Canada
 
PDF
Cisco Connect Toronto 2018 the intelligent network with cisco meraki
Cisco Canada
 
PDF
Cisco Connect Toronto 2018 sixty to zero
Cisco Canada
 
PDF
Cisco Connect Toronto 2018 sd-wan - delivering intent-based networking to t...
Cisco Canada
 
PDF
Cisco Connect Toronto 2018 model-driven programmability for cisco ios xr-v1
Cisco Canada
 
PDF
Cisco Connect Toronto 2018 dc-aci-anywhere
Cisco Canada
 
PDF
Cisco Connect Toronto 2018 an introduction to Cisco kinetic
Cisco Canada
 
Cisco connect montreal 2018 net devops
Cisco Canada
 
Cisco connect montreal 2018 iot demo kinetic fr
Cisco Canada
 
Cisco connect montreal 2018 - Network Slicing: Horizontal Virtualization
Cisco Canada
 
Cisco connect montreal 2018 secure dc
Cisco Canada
 
Cisco connect montreal 2018 vision mondiale analyse locale
Cisco Canada
 
Cisco Connect Montreal 2018 Securité : Sécuriser votre mobilité avec Cisco
Cisco Canada
 
Cisco connect montreal 2018 collaboration les services webex hybrides
Cisco Canada
 
Cisco connect montreal 2018 compute v final
Cisco Canada
 
Cisco connect montreal 2018 saalvare md-program-xr-v2
Cisco Canada
 
Cisco connect montreal 2018 sd wan - delivering intent-based networking to th...
Cisco Canada
 
Cisco Connect Toronto 2018 an introduction to Cisco kinetic
Cisco Canada
 
Cisco Connect Toronto 2018 IOT - unlock the power of data - securing the in...
Cisco Canada
 
Cisco Connect Toronto 2018 DNA assurance
Cisco Canada
 
Cisco Connect Toronto 2018 network-slicing
Cisco Canada
 
Cisco Connect Toronto 2018 the intelligent network with cisco meraki
Cisco Canada
 
Cisco Connect Toronto 2018 sixty to zero
Cisco Canada
 
Cisco Connect Toronto 2018 sd-wan - delivering intent-based networking to t...
Cisco Canada
 
Cisco Connect Toronto 2018 model-driven programmability for cisco ios xr-v1
Cisco Canada
 
Cisco Connect Toronto 2018 dc-aci-anywhere
Cisco Canada
 
Cisco Connect Toronto 2018 an introduction to Cisco kinetic
Cisco Canada
 

Recently uploaded (20)

PDF
Per capita expenditure prediction using model stacking based on satellite ima...
IAESIJAI
 
PDF
Build a system with the filesystem maintained by OSTree @ COSCUP 2025
Jian-Hong Pan
 
PDF
Empathic Computing: Creating Shared Understanding
Mark Billinghurst
 
PDF
Mobile App Security Testing_ A Comprehensive Guide.pdf
flufftailshop
 
PDF
Review of recent advances in non-invasive hemoglobin estimation
IAESIJAI
 
PPTX
20250228 LYD VKU AI Blended-Learning.pptx
DatVoNgoc
 
PDF
Building Integrated photovoltaic BIPV_UPV.pdf
SandeepSingh286037
 
PDF
Encapsulation theory and applications.pdf
gurumoop
 
PPTX
Effective Security Operations Center (SOC) A Modern, Strategic, and Threat-In...
ReZa AdineH
 
PDF
Machine learning based COVID-19 study performance prediction
IAESIJAI
 
PPTX
Detection-First SIEM: Rule Types, Dashboards, and Threat-Informed Strategy
ReZa AdineH
 
PDF
Spectral efficient network and resource selection model in 5G networks
IAESIJAI
 
PDF
Approach and Philosophy of On baking technology
30anthuong17
 
PDF
Shreyas Phanse Resume: Experienced Backend Engineer | Java • Spring Boot • Ka...
SHREYAS PHANSE
 
PPT
Teaching material agriculture food technology
LiaRayya
 
PPTX
Big Data Technologies - Introduction.pptx
kuthubussaman1
 
PDF
NewMind AI Monthly Chronicles - July 2025
NewMind AI
 
PDF
Bridging biosciences and deep learning for revolutionary discoveries: a compr...
IAESIJAI
 
PDF
Advanced methodologies resolving dimensionality complications for autism neur...
IAESIJAI
 
PDF
KodekX | Application Modernization Development
KodekX
 
Per capita expenditure prediction using model stacking based on satellite ima...
IAESIJAI
 
Build a system with the filesystem maintained by OSTree @ COSCUP 2025
Jian-Hong Pan
 
Empathic Computing: Creating Shared Understanding
Mark Billinghurst
 
Mobile App Security Testing_ A Comprehensive Guide.pdf
flufftailshop
 
Review of recent advances in non-invasive hemoglobin estimation
IAESIJAI
 
20250228 LYD VKU AI Blended-Learning.pptx
DatVoNgoc
 
Building Integrated photovoltaic BIPV_UPV.pdf
SandeepSingh286037
 
Encapsulation theory and applications.pdf
gurumoop
 
Effective Security Operations Center (SOC) A Modern, Strategic, and Threat-In...
ReZa AdineH
 
Machine learning based COVID-19 study performance prediction
IAESIJAI
 
Detection-First SIEM: Rule Types, Dashboards, and Threat-Informed Strategy
ReZa AdineH
 
Spectral efficient network and resource selection model in 5G networks
IAESIJAI
 
Approach and Philosophy of On baking technology
30anthuong17
 
Shreyas Phanse Resume: Experienced Backend Engineer | Java • Spring Boot • Ka...
SHREYAS PHANSE
 
Teaching material agriculture food technology
LiaRayya
 
Big Data Technologies - Introduction.pptx
kuthubussaman1
 
NewMind AI Monthly Chronicles - July 2025
NewMind AI
 
Bridging biosciences and deep learning for revolutionary discoveries: a compr...
IAESIJAI
 
Advanced methodologies resolving dimensionality complications for autism neur...
IAESIJAI
 
KodekX | Application Modernization Development
KodekX
 

Cisco Connect Vancouver 2017 - Cisco's Digital Network Architecture - deeper dive, from the gates to the GUI

  • 1. © 2016 Cisco and/or its affiliates. All rights reserved. 1 Your Time Is Now Connect Cisco
  • 2. © 2016 Cisco and/or its affiliates. All rights reserved. 2 Dave Zacks Distinguished Engineer Enterprise Networks Business November, 2017 #HighBitRate Cisco Digital Network Architecture – Deeper Dive, “From the Gates to the GUI” The Importance of Hardware in a Software Defined World
  • 3. I am a Distinguished Engineer in Cisco’s Enterprise Networking Business, based in Vancouver, and have been with Cisco for 18 years. As a DTME within the Enterprise Networks Architecture team, I work primarily on capabilities and solutions that are anywhere from 12 to 36+ months out, helping to define these projects and then assisting as they progress towards and through design, development, and solution introduction. I have a strong background in, and focus on, customer requirements, and integrating these into the products and solutions Cisco builds. I have a special interest in Flexible Hardware and Fabric architectures. Dave Zacks Distinguished TME dzacks@cisco.com @DaveZacks By Way of Introduction …
  • 4. © 2016 Cisco and/or its affiliates. All rights reserved. 4Cisco Public This is an ambitious presentation
  • 5. © 2016 Cisco and/or its affiliates. All rights reserved. 5Cisco Public We are going to try to cover Cisco Innovation from “The Gates to the GUI”
  • 6. © 2016 Cisco and/or its affiliates. All rights reserved. 6Cisco Public No, I don’t mean this Gates …
  • 7. © 2016 Cisco and/or its affiliates. All rights reserved. 7Cisco Public I mean these gates … SILICON Gates 
  • 8. © 2016 Cisco and/or its affiliates. All rights reserved. 8Cisco Public From Innovations in Silicon and Software … … to Innovations in Platforms and Solutions
  • 9. © 2016 Cisco and/or its affiliates. All rights reserved. 9Cisco Public And Why These Innovations Matter
  • 10. © 2016 Cisco and/or its affiliates. All rights reserved. 10Cisco Public It’s going to be Quite a Ride
  • 11. © 2016 Cisco and/or its affiliates. All rights reserved. 11Cisco Public So Buckle Up, and Let’s Get Started!
  • 12. 12© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public Cisco DNA and the Importance of Network Innovation
  • 13. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 13 Innovation in the network
  • 14. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 14 Source: Forrester Source: Open Compute Project Time IT spends on operations80% CEOs are worried about IT strategy not supporting business growth57% Network Expenses Deployment Speed 0 10 100 1000 Computing Networking Seconds 0 100% CAPEX OPEX 33% 67% The Need for Agility Changing Enterprise Requirements
  • 15. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 15 Advanced Persistent Threats Devices per Person 3.64 Mobile world requires access to everything everywhere Mobility Devices per Admin 100K Agility and New Consumption Models Cloud IoT Things Connected 7.5BUnmanned devices growing at rapid pace Enterprise Trends Driving Digital Transformation
  • 16. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 16 VLAN 1 VLAN 2 VLAN 3 WAN BranchA VLAN 1 BranchA VLAN 3 Remote VLAN 2 HQ ACL 1 ACL 2 ACL 2 ACL 3 Traditional Networks Cannot Meet the Demand Users, Device and IoT Segmentation Enabling Seamless Mobility Secure Connectivity to the Cloud Setting Up End-End Security
  • 17. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 17
  • 18. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 18 Security Automation Analytics Virtualization Cloud Service Management Programmable Physical and Virtual infrastructure Intent-based Network Infrastructure DNA Center AnalyticsPolicy Automation E x p r e s s I N T E N T E x t r a c t C O N T E X T I m p l e m e n t w i t h S E C U R I T Y P e r f o r m L E A R N I N G The Network. Intuitive. Based on Cisco’s DNA Cisco DNA Digital Network Architecture
  • 19. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 19 Relevant IrrelevantDefault • These applications directly support business objectives • Applications should be classified, marked and treated marked according to industry best-practice recommendations • These applications may/may not support business objectives (e.g. HTTP/HTTPS/SSL) • Applications of this type should be treated with a Default Forwarding service • These applications do not support business objectives and are typically consumer-oriented • Applications of this type should be treated with a “less-than Best Effort” service RFC 4594 RFC 2474 RFC 3662 IMPORTANT UNIMPORTANTNEUTRALPROTECT PENALIZELEAVE ALONE Simplifying Networking via Intent Example with EasyQoS
  • 20. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 20 Wireless AP Trust Boundary PEP 4Q (WMM) Catalyst 3650 Trust Boundary PEP 2P6Q3T Catalyst 4500 1P7Q1T Catalyst 6500 1P3Q4T 1P7Q4T 2P6Q4T … Nexus 7700 F3: 1P7Q1T WLC PEP ASR/ISRs MQC Catalyst 2960-X Trust Boundary PEP 1P3Q3T Wireless AP Trust Boundary PEP 4Q (WMM) Southbound APIs translate business intent to platform- specific configurations Network Operators express high-level business intent to the EasyQoS app EasyQoS Operation Network Controller
  • 21. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 21 Network Controller EasyQoS will seamlessly interconnect all types of hardware and software queuing models to achieve consistent and compatible end-to-end treatments – aligned with the expressed business intent EasyQoS Results
  • 22. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 22 ip access-list extended APIC_EM-MM_STREAM-ACL remark citrix - Citrix permit tcp any any eq 1494 permit udp any any eq 1494 permit tcp any any eq 2598 permit udp any any eq 2598 remark citrix-static - Citrix-Static permit tcp any any eq 1604 permit udp any any eq 1604 permit tcp any any range 2512 2513 permit udp any any range 2512 2513 remark pcoip - PCoIP permit tcp any any eq 4172 permit udp any any eq 4172 permit tcp any any eq 5172 permit udp any any eq 5172 remark timbuktu - Timbuktu permit tcp any any eq 407 permit udp any any eq 407 remark xwindows - XWindows permit tcp any any range 6000 6003 remark vnc - VNC permit tcp any any eq 5800 permit udp any any eq 5800 permit tcp any any range 5900 5901 permit udp any any range 5900 5901 exit ip access-list extended APIC_EM-SIGNALING-ACL remark h323 - H.323 permit tcp any any eq 1300 permit udp any any eq 1300 Your Choice …
  • 23. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 23 Self-Driving Automation Future Closed Loop through Network Analytics and Machine Learning DNA Center BB Campus Fabric SDA Automated Deployment Plug and Play, Day 0 Deployment Exists Today HTTP Proxy Internet Admin Installer Step 1 Network admin previsions devices in Cisco Network Plug and Play applications Step 2 Onsite installer with mobile app installs and powers on devices, triggers deployment, checks status Step 3 New devices contact Cisco Network Plug and Play application to get provisioned Network admin can remotely monitor install status Basic Advanced One Point of Management – All from Cisco DNA Center Configure once and deploy everywhere - SD-Access DNA Center Campus Fabric SDA New Consistent Across Network Fabric The Network. Intuitive. Moving From Manual to Automated
  • 24. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 24 Security Automation Analytics Virtualization Cloud Service Management Programmable Physical and Virtual infrastructure Open API Driven Principles Insights and Experiences Automation and Assurance Security and Compliance Open API Driven Programmable Software Defined Access Catalyst 9000 Flexible Network Hardware and Software DNA Center Encrypted Traffic Analytics The Road to Intent-Based Networking Our Journey Today - Overview
  • 25. 25© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public Cisco DNA and the Importance of Flexible Hardware
  • 26. © 2016 Cisco and/or its affiliates. All rights reserved. 26Cisco Public EISG Architecture Team David Goeckeler Cisco SVP, Security and Networking Cisco Live Las Vegas 2016 Innovation in the network ASICs are a pillar of Cisco innovation …
  • 27. © 2016 Cisco and/or its affiliates. All rights reserved. 27Cisco Public
  • 28. © 2016 Cisco and/or its affiliates. All rights reserved. 28Cisco Public How is an ASIC built?
  • 29. © 2016 Cisco and/or its affiliates. All rights reserved. 29Cisco Public Then, it starts with coding… Verilog VHDL Synthesis Process Converts code into logical gate constructs (Netlist) ASICs – From Definition to Deployment
  • 30. © 2016 Cisco and/or its affiliates. All rights reserved. 30Cisco Public Imprint design on Silicon Wafer
  • 31. © 2016 Cisco and/or its affiliates. All rights reserved. 31Cisco Public Discrete transistor MOSFET (metal oxide semiconductor field effect transistor) FinFET (fin field effect transistor) NAND gate NOR Gate Universal Gates XOR Gate AND Gate OR Gate NOT Gate XNOR Gate … which can be used to build any of the other logic gates … … mostly used @ 22nm and above … mostly used @ 16nm and below … which, when we put millions of them together on a silicon die, produce a chip! Silicon wafer
  • 32. © 2016 Cisco and/or its affiliates. All rights reserved. 32Cisco Public Discrete transistor MOSFET (metal oxide semiconductor field effect transistor) FinFET (fin field effect transistor) NAND gate NOR Gate Universal Gates XOR Gate AND Gate OR Gate NOT Gate XNOR Gate … which can be used to build any of the other logic gates … … mostly used @ 28nm and above … mostly used @ 22nm and below UADP 1.1 191M gates UADP 2.0 270M gates Catalyst 3850 mGig Catalyst 9300, 9400, 9500
  • 33. © 2016 Cisco and/or its affiliates. All rights reserved. 33Cisco Public We put a man here … … using this … Apollo Guidance Computer … which was built from nothing but that … 4100 ICs, each of which contained a single 3-input NOR gate In other words … we put a man on the moon with less than 10,000 transistors … It takes 7.46 billion transistors to route your packets! With the appropriate security, segmentation, QoS, encryption, fragmentation, etc, etc … Fun Fact!
  • 34. © 2016 Cisco and/or its affiliates. All rights reserved. 34Cisco Public We are talking transistors… and how many we can pack in an ASIC die … “The number of transistors incorporated into a chip will approximately double every 18 - 24 months …” “Moore’s Law” - 1975 Transistor Width measured in Nanometers Nanometer = One Billionth of a Meter
  • 35. © 2016 Cisco and/or its affiliates. All rights reserved. 35Cisco Public A human hair is ~100,000 nanometers in width A Perspective
  • 36. © 2016 Cisco and/or its affiliates. All rights reserved. 36Cisco Public Red blood cell (7,000 nm) rises to 10th floor Empire State Building = 1454 feet to tip = 443 meters ONE NANOMETER – less than 1/4th of an inch! … about the same thickness as three pennies on this scale … … and we build transistors measured in nanometers … How SMALL is SMALL? Singlehumanhair ~ 100,000 nm … and then we come to this little pinprick over here …
  • 37. © 2016 Cisco and/or its affiliates. All rights reserved. 37Cisco Public Photoresist SiO2 layer Silicon substrate Prepared silicon wafer Projected light Mask Lens Patterns projected onto wafer Exposed photoresist removed Exposed areas etched by gases Ions shower etched areas, doping them Doped region New photoresist spun on wafer, steps 2 – 4 repeated Metal connector Similar cycle repeated to lay down metal links between transistors About a month … the same time it takes to make one of these … How Long Does It Take to Manufacture a Wafer?
  • 38. © 2016 Cisco and/or its affiliates. All rights reserved. 38Cisco Public Why Does Cisco Develop Our Own Silicon? Simpler Deployment Options Better Insight and Optimization Increased Security Most Appropriate Scalability Flexibility and Investment Protection via Programmability
  • 39. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 39 Traditionally the ASIC processing pipeline is FIXEDIPv4 IPv6 Traditional Fixed ASIC Processing Pipeline
  • 40. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 40 … and has challenges handling NEW PROTOCOLS … MPLS Traditional Fixed ASIC Processing Pipeline
  • 41. © 2016 Cisco and/or its affiliates. All rights reserved. 41Cisco Public Flexibility in Networking … … disconnect with traditional fixed ASIC processing …. Evolution of Business Industry Trends – SDN
  • 42. © 2016 Cisco and/or its affiliates. All rights reserved. 42Cisco Public
  • 43. © 2016 Cisco and/or its affiliates. All rights reserved. 43Cisco Public So where can Flexible ASICs help us?
  • 44. © 2016 Cisco and/or its affiliates. All rights reserved. 44Cisco Public DNA Flexible Infrastructure – Programmable ASIC Silicon
  • 45. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 45 ASIC Evolution – Over Time UADP 2.0: 7.46B transistors! 2,160,000 lines of code New! Catalyst 9300 / 9400 / 9500 – 2017 Catalyst 3550 Circa 2003 60M transistors 47,226 lines of code Catalyst 3750 Circa 2008 210M transistors 86,220 lines of code Catalyst 3850 Circa 2013 UADP 1.0 – 1.3B transistors UADP 1.1 – 3.0B transistors 1,490,000 lines of code All Cisco-developed silicon Driving the benefits of vertical integration – Hardware and software working together! Just like some other famous examples …
  • 46. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 46 Flex Rewrite Cisco’s UADP ASIC delivers FLEXIBILITY … Flex Parser Flexible, Programmable Processing Pipeline GRE If IPv7 were invented tomorrow … ... we could probably handle it via the Programmable Pipeline! Flex Counters Stage 1 Stage 2 Stage 3 Stage n IPv4 IPv6 VXLAN MPLS IPv7 Unified Access Data Plane – Processing Pipeline
  • 47. © 2016 Cisco and/or its affiliates. All rights reserved. 47Cisco Public Parse depth of 256 Bytes 15 programmable stages Up to 250 frames across stages at one time… Underlay Outer IP Header Outer MAC Header UDP Header VXLAN Header Overlay Inner (Original)IP Header Original Payload Inner (Original) MAC Header 14 Bytes (4 Bytes Optional) Ether Type 0x0800 VLAN ID VLAN Type 0x8100 Source MAC Dest. MAC 48 48 16 16 16 Src VTEP MAC Address Next-Hop MAC Address 20 Bytes Dest. IP Source IP Header Checksum Protocol 0x11 (UDP) IP Header Misc. Data 72 8 16 32 32 Dst RLOC IP Address Src RLOC IP Address 8 Bytes Checksum 0x0000 UDP Length VXLAN Port Source Port 16 16 16 16 UDP 4789 Hash of inner L2/L3/L4 headers of original frame. Enables entropy for ECMP load balancing. 8 Bytes Reserved VN ID Segment ID VXLAN Flags RRRRIRRR 8 16 24 8 Allows 16M possible VRFs Allows 64K possible SGTs VXLAN as a protocol had not even been invented when UADP 1.0 was designed … Yet UADP forwards VXLAN in hardware, at high performance in IOS-XE 16.3+ … thanks to Flexibility! in VXLAN is a complex protocol …
  • 48. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 48 Flex Rewrite Flex Parser Cisco’s UADP ASIC provides support for TUNNELLING …IPv4 … a task at which Cisco’s Programmable, Flexible ASICs excel! Tunnelled traffic requires RECIRCULATION … IPv4VXLAN High-performance, low-latency recirculation path … Flex Counters Flexible, Programmable Processing Pipeline Stage 1 Stage 2 Stage 3 Stage n Unified Access Data Plane – Processing Pipeline
  • 49. © 2016 Cisco and/or its affiliates. All rights reserved. 49Cisco Public What does all of this mean for me?
  • 50. © 2016 Cisco and/or its affiliates. All rights reserved. 50Cisco Public Cisco Programmable Hardware equals FLEXIBILITY ADAPTABILITY Enabling Network Evolution – a critical requirement for DNA
  • 51. © 2016 Cisco and/or its affiliates. All rights reserved. 51Cisco Public http://vimeo.com/155635184 Cisco Live US – session BRKARC-3467, “Cisco Enterprise Silicon” Peter Jones, Principal Engineer Dave Zacks, Distinguished Engineer And watch us on … 90 minutes of awesome silicon geekery with Dave and Peter – this session, ++ Cisco Flexible Silicon – Want to Know More?
  • 52. © 2016 Cisco and/or its affiliates. All rights reserved. 52Cisco Public http://www.cisco.com/c/m/en_us/training-events/events- webinars/webinars/techwise-tv/214-programmable-asics.html Cisco Flexible Silicon – Want to Know More?
  • 53. 53© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public Network Innovation – Flexible Switching Platforms, Catalyst 9000 Series
  • 54. © 2016 Cisco and/or its affiliates. All rights reserved. 54Cisco Public Converged OS Open IOS-XE Converged Licensing Catalyst 9300 Lead Fixed Access Catalyst 9400 Lead Modular Access Catalyst 9500 Lead Fixed Core Built on Cisco’s Innovative UADP ASIC & Open IOS-XE Converged ASIC UADP 2.0 Introducing the Catalyst 9K Family
  • 55. © 2016 Cisco and/or its affiliates. All rights reserved. 55Cisco Public Up to 32MB Packet Buffer Up to 64K x2 Netflow RecordsEmbedded Microcontrollers Shared Lookup Up to 240GE Bandwidth 384K Flex Counters Up to 2X to 4X Forwarding + TCAM Universal Deployments Adaptable Tables Enhanced Scale/Buffering Multicore resource share Investment Protection Flexible Pipeline 7.46B Transistors 28nm Technology UADP 2.0 – Next Generation of ASIC Innovation
  • 56. © 2016 Cisco and/or its affiliates. All rights reserved. 56Cisco Public
  • 57. 57© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public Network Innovation – Leveraging Flexible Platforms for Encrypted Traffic Analytics
  • 58. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 58 Network Threats are Evolving to Leverage Encryption
  • 59. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 59 Providing Security While Maintaining Privacy! Encrypted Traffic Non-Encrypted Traffic How do you Analyze threats without decrypting traffic flows? Can We Actually Solve This?
  • 60. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 60 • End to end confidentiality • Channel integrity during inspection • Adapts with encryption standards Malware in Encrypted Traffic Is the payload within the TLS session malicious? Malware Detection and Visibility without Decryption • Audit for TLS policy violations • Passive detection of Ciphersuite vulnerabilities Cryptographic Compliance How much of my digital business uses strong encryption? Encrypted Traffic Analytics Overview
  • 61. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 61 TLS field (in ClientHello) Inference Offered Cyphersuites Browsers prefer heavy weight and more secure encryption algorithms, Mobile applications prefer efficient encryption Extensions Client: I support crypto! Server: I support that crypto, and I’m me! Client: Take this secret and let’s encrypt! Server: Your secret looks good; let’s encrypt! Client/Server: encrypted data! ETA – Initial Data Packet (IDP)
  • 62. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 62 Malware Behavior Network Behavior Communication with command control server Sequence of packet lengths Write to the disk Time interval between packet ETA – Sequence of Packet lengths and Times (SPLT)
  • 63. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 63 Bestafera Self-Signed Certificate Data Exfiltration C2 Message Google Search Initial Page Load Page Refresh Autocomplete Detecting Malware by Behavior IDP, SPLT, and Machine Learning
  • 64. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 64 11101101100000 10001111001111 01001000100001 Catalyst 9K Switch Stealthwatch NetFlow with enhanced telemetry at line rate Machine learning Spot malware in encrypted traffic Cognitive Analytics • Analyze metadata without decrypting traffic flows • Global-to-local knowledge correlation • Automate policy and segmentation across the entire network Encrypted Traffic Analytics *Source : Identifying Encrypted Malware Traffic with Contextual Flow Data, Oct 2016 Threat Detection Accuracy* 0.01% False Positives* 99% Encrypted Traffic Analytics Solution Overview UADP 2.0 ASIC
  • 65. 65© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public Network Innovation – Leveraging Flexible Platforms for Software Defined Access
  • 66. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 66 Slower Issue ResolutionComplex to ManageDifficult to Segment Ever increasing number of users and endpoint types Ever increasing number of VLANs and IP Subnets Multiple steps, user credentials, complex interactions Multiple touch-points Separate user policies for wired and wireless networks Unable to find users when troubleshooting Traditional Networks Cannot Keep Up! Traditional Networks Key Challenges
  • 67. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 67
  • 68. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 68 Automated Network Fabric Single Fabric for Wired & Wireless with Workflow-based Automation Insights & Telemetry Analytics and insights into user and application behavior Identity-based Policy & Segmentation Decoupled security policy definition from VLAN and IP Address DNA Center AnalyticsPolicy Automation SD-Access Fabric IoT Network Employee Network User Mobility Policy stays with user Software Defined Access Networking at the Speed of Software!
  • 69. © 2016 Cisco and/or its affiliates. All rights reserved. 69Cisco Public DNA Center TECCRS-2700 69 sioning
  • 70. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 70 Automation Network AnalyticsIdentity Services Engine Routers Switches Wireless APs DNA Center DESIGN PROVISION POLICY ASSURANCE DNA Center Simple Workflows Wireless Controllers DNA Center © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 70 Overview
  • 71. © 2016 Cisco and/or its affiliates. All rights reserved. 71Cisco Public Overlay – Flexible Virtual Services Mobility - Map Endpoints to Edges Services - Deliver using Overlay Scalability - Reduce Protocol State Flexible and Programmable Underlay – Simple Transport Forwarding Redundant Devices and Paths Keep It Simple and Manageable Optimize Packet Handling Maximize Network Reliability (HA) Separate the “Forwarding Plane” from the “Services Plane” IT Challenge (Business): Network Uptime IT Challenge (Employee): New Services The Boss YOU The User Software Defined Access The Power of The Fabric
  • 72. © 2016 Cisco and/or its affiliates. All rights reserved. 72Cisco Public Overlay encapsulation (VXLAN) Fabric Underlay – Forwarding plane • Connects the network elements to each other • Optimized for traffic forwarding (scalability, performance) • Networking constructs like IP, VLANs, live here Overlay control plane (LISP) Underlay Overlay Employee Supplier Devices Fabric breaks the dependency between IP address and Policy. In Fabric Polices are tied to User/Device Identity Fabric brings Policy Simplification DNA Center – Automation and Assurance • Single User Interface for Fabric Management & Orchestration • Policy definition based on User, Device or App Group • Design, Deploy and Monitoring and Troubleshooting Fabric Overlay – Services plane • Dynamically connects Users/Devices/Things • IP is an ID not used for traffic forwarding • End to End Policies and Segmentation What is Unique About SD-Access? access-list 102 deny udp 167.160.188.162 0.0.0.255 gt 4230 248.11.187.246 0.255.255.255 eq 2165 access-list 102 deny udp 32.124.217.1 255.255.255.255 lt 907 11.38.130.82 0.0.31.255 gt 428 access-list 102 permit ip 64.98.77.248 0.0.0.127 eq 639 122.201.132.164 0.0.31.255 gt 1511 access-list 102 deny tcp 247.54.117.116 0.0.0.127 gt 4437 136.68.158.104 0.0.1.255 gt 1945 access-list 102 permit icmp 136.196.101.101 0.0.0.255 lt 2361 90.186.112.213 0.0.31.255 eq 116 access-list 102 deny udp 242.4.189.142 0.0.1.255 eq 1112 19.94.101.166 0.0.0.127 eq 959 access-list 102 deny tcp 82.1.221.1 255.255.255.255 eq 2587 174.222.14.125 0.0.31.255 lt 4993 access-list 102 deny tcp 103.10.93.140 255.255.255.255 eq 970 71.103.141.91 0.0.0.127 lt 848 access-list 102 deny ip 32.15.78.227 0.0.0.127 eq 1493 72.92.200.157 0.0.0.255 gt 4878 access-list 102 permit icmp 100.211.144.227 0.0.1.255 lt 4962 94.127.214.49 0.255.255.255 eq 1216 access-list 102 deny icmp 88.91.79.30 0.0.0.255 gt 26 207.4.250.132 0.0.1.255 gt 1111 access-list 102 deny ip 167.17.174.35 0.0.1.255 eq 3914 140.119.154.142 255.255.255.255 eq 4175 access-list 102 permit tcp 37.85.170.24 0.0.0.127 lt 3146 77.26.232.98 0.0.0.127 gt 1462 access-list 102 permit tcp 155.237.22.232 0.0.0.127 gt 1843 239.16.35.19 0.0.1.255 lt 4384 VLAN 20 SSID D VLAN 30 SSID A SSID C VLAN 40 VLAN 10 SSID B
  • 73. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 73 First level Segmentation that ensures zero Communication between Building systems and Users 1 Virtual Networks Second level Segmentation within a Virtual Network that ensures role based access control between Two Groups Groups 1 2 IoT Virtual Network Group 3 Employee Virtual Network Group 1 Group 2 Routers Switches Wireless AP WLC Group 4 Group 5 2 Default Permit Custom Deny Default Deny Software Defined Access Integrated Segmentation
  • 74. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 74 Before SD-Access After SD-Access • VLAN and IP address based • Create IP based ACLs for access policy • Deal with policy violations and errors manually • No VLAN or subnet dependency for segmentation and access control • Define one consistent policy • Policy follows Identity Group-Based Policy Policy follows IdentityCompletely Automated Drag policy to apply Users Devices Apps Employee Virtual Network IoT Virtual Network Guest Virtual Network Group 5 Group 3 Group 1 Group 6 Group 4 Group 2 Secure Onboarding of Users and Devices Segmentation and Access Control Made Simple
  • 75. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 75 Stretched Subnets + No Spanning Tree + ECMP Distributed Anycast Default Gateway Limit Broadcast Domain No STP No HSRP / VRRP Equal Cost Multi-Path Routed Access 10.1.0.0/16 Software Defined Access Simplified Connectivity SD-Access Fabric
  • 76. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 76 AutomationIdentity & Policy Identity Services Engine (ISE) Assurance Employees Virtual Network Group 1 Group 2 IoT Virtual Network Group 3 Group 4 Contextual Visibility and Troubleshooting Policy Mobility with no Topology Dependence SD-Access Fabric Stretched Subnets DNA Center Integrated Mobility, with User / Device Identity Software Defined Access Solution at a Glance
  • 77. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 77 Separation of the Forwarding and Services Planes Overlay encapsulation Fabric Underlay is the Forwarding Plane • Connects Network Devices • Leverages existing topologies • Simple, best-practice deployment Fabric Overlay is the Services Plane • Connects Users and Devices • Leverages standard technologies • Address Independent End-to-End Policy Overlay control plane Underlay Overlay Employee Supplier Devices Cisco Flexible Silicon allows for Flexibility – Key to Supporting the Evolution to Network Fabrics DNA Flexible Infrastructure Supporting Fabric Evolution – and Software Defined Access
  • 78. Cisco Public 78© 2016 Cisco and/or its affiliates. All rights reserved. Summary – Innovation Across the Network. Intuitive.
  • 79. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 79 Critical Role of Flexible Silicon Building on a Strong Foundation
  • 80. © 2016 Cisco and/or its affiliates. All rights reserved. 80Cisco Public From the Hardware … … to the Software and Protocols, with Integrated Security … to the Whole Solution … Cisco Innovations – In Hardware, Software, and Solutions – Tie It All Together “From the Gates – to the GUI” Integrated Security Innovation All The Way Up the Stack Hardware, Software, and Solutions