CCNA Notes

200-301 Exam Prep

Progress0/67

0% complete

Practice TestsNew
1Networking Devices2Interfaces And Cables3OSI Model and TCP/IP Suite4Intro to the CLI5Ethernet LAN Switching - Part 16Ethernet LAN Switching - Part 27IPv4 Addressing - Part 18IPv4 Addressing - Part 29Switch Interfaces10The IPv4 Header11Routing Fundamentals - Part 111Static Routing - Part 212Life of a Packet13Subnetting - Part 114Subnetting - Part 215Subnetting (VLSM) - Part 316VLANs - Part 117VLANs - Part 218VLANs - Part 319DTP / VTP20Spanning Tree Protocol - Part 121Spanning Tree Protocol - Part 222Rapid Spanning Tree Protocol23Etherchannel24Dynamic Routing25RIP / EIGRP26OSPF - Part 127OSPF - Part 228OSPF - Part 329First Hop Redundancy Protocol30TCP and UDP31IPv6 - Part 132IPv6 - Part 233IPv6 - Part 334Standard Access Control List35Extended Access Control List36CDP and LLDP37NTP - Network Time Protocol38DNS - Domain Name System39DHCP - Dynamic Host Configuration Protocol40SNMP - Simple Network Management Protocol41SYSLOG42SSH - Secure Shell43FTP and TFTP44NAT (Static) - Part 145NAT (Dynamic) - Part 246QoS (Voice VLAN) - Part 147QoS (Quality of Service) - Part 248Security Fundamentals49Port Security50DHCP Snooping51Dynamic ARP Inspection52LAN Architectures53WAN Architectures54Virtualization and Cloud - Part 154Virtualization (Containers) - Part 254Virtualization (VRF) - Part 355Wireless Fundamentals56Wireless Architectures57Wireless Security58Wireless Configuration59Introduction to Network Automation60JSON, XML, and YAML61REST APIs62Software Defined Networking63Ansible, Puppet, and Chef67CCNA Complete Cheatsheet
/Software Defined Networking
Topic 625 min read

Software Defined Networking

/
Tip: Select text to highlight or pin your reading position

62. SOFTWARE DEFINED NETWORKING (SDN)

SD REVIEW

  • SOFTWARE DEFINED NETWORKING (SDN) is an approach to networking that centralizes the control plane into an application called a controller
  • Traditional control planes use a distributed architecture
  • A SDN controller centralizes control plane functions like calculating routes
  • The controller can interact programmatically with the network devices using APIs
  • The SBI (South Bound Interface) is used for communications between the controller and the network device it controls
  • The NBI (North Bound Interface) is what allows us to interact with the controller with our scripts and applications

SDN ARCHITECTURE

imageClick to enlarge

CISCO SD-ACCESS

  • Cisco SD-ACCESS is Cisco’s SDN solution for automating campus LANs
    • ACI (Application Centric Infrastructure) is their SDN solution for automating data center networks
    • SD-WAN is their SDN solution for automating WANs
  • Cisco DNA (Digital Network Architecture) Center is the controller at the center of SD-Access

imageClick to enlarge

  • The UNDERLAY is the underlying physical network of devices and connections (including wired and wireless) which provide IP connectivity (ie: using IS-IS)
    • Multilayer Switches and their connections

imageClick to enlarge

  • The OVERLAY is the virtual network built on top of the physical underlay network

imageClick to enlarge

  • The FABRIC is the combination of the OVERLAY and UNDERLAY; the physical and virtual network as a whole

imageClick to enlarge

SD-ACCESS UNDERLAY

  • The UNDERLAY’s purpose is to support the VXLAN tunnels of the OVERLAY

  • There are THREE different ROLES for switches in SD-ACCESS:

    • EDGE NODES : Connect to End HOSTS
    • BORDER NODES : Connect to devices outside of the SD-ACCESS Domain ; ie: WAN routers
    • CONTROL NODES : Uses LISP (Locator ID Separation Protocol) to perform various control plane functions

  • You can add SD-ACCESS on top of the existing network (brownfield deployment) if your network hardware and software supports it

    • Google ‘Cisco SD-ACCESS compatibility matrix’ if you are curious
    • In this case DNA CENTER won’t configure the UNDERLAY

  • A NEW deployment (greenfield deployment) will be configured by DNA CENTER to use the optimal SD-ACCESS UNDERLAY:

    • ALL Switches are LAYER 3 and use IS-IS as their ROUTING PROTOCOL
    • All Links between Switches are ROUTED PORTS. This means STP is not needed
    • EDGE NODES (ACCESS SWITCHES) act as the the DEFAULT GATEWAY of END HOSTS (Routed Access Layer)

imageClick to enlarge

imageClick to enlarge

SD-ACCESS OVERLAY

  • LISP (Locator ID Separation Protocol) provides the control plane of SD-ACCESS

    • A list of mappings of EIDs (endpoint identifiers) to RLOCs (routing locators) is kept
    • EIDs identify END HOSTS connected to EDGE SWITCHES
    • RLOCS identify the EDGE SWITCH which can be used to reach the END HOST
    • There is a LOT more detail to cover about LISP but I think you can see how it differs from traditional CONTROL PLANE

  • Cisco TrustSec (CTS) provides policy control (QoS, Security Policy, etc.)

  • VXLAN provides the DATA PLANE of SD-ACCESS

imageClick to enlarge

imageClick to enlarge

imageClick to enlarge

CISCO DNA CENTER

  • Cisco DNA Center has TWO MAIN ROLES:

    • The SDN Controller in SD-ACCESS
    • A network manager in a traditional network (non-SD-ACCESS)

  • DNA Center is an application installed on Cisco UCS server hardware

  • It has a REST API which can be used to interact with DNA Center

  • The SBI supports protocols such as NETCONF and RESTCONF (as well as traditional protocols like Telnet, SSH, and SNMP)

  • DNA Center enables Intent-Based Networking (IBN)

    • The goal is to allow the engineer to communicate their intent for network behavior to DNA Center, and then DNA Center will take care of the details of the actual configurations and policies on devices

  • Traditional security policies using ACLs can become VERY cumbersome

    • ACLs can have thousands of entries
    • The intent of entries is forgotten with time and as engineers leave and new engineers take over

  • DNA Center allows the engineer to specify the intent of the policy

    • Examples :
      • THIS group of users can’t communicate with THAT group
      • THIS group can access THIS server but not THAT server
    • DNA CENTER will take care of the exact details of implementing this policy

imageClick to enlarge

For more details, you can check out sandboxdnac.cisco.com (User: devnetuser, Password: Cisco123!)

DNA CENTER NETWORK MANAGEMENT VS. TRADITIONAL

Traditional Management :

  • DEVICES are configured one-by-one via SSH or Console connection
  • DEVICES are manually configured via Console connection before being deployed
  • Configurations and polices are managed per-device
  • New network deployments can take a long time due to the manual labor required
  • Errors and failures are more likely due to increased manual effort

DNA CENTER-based Network Management :

  • DEVICES are centrally managed and monitored from the DNA CENTER GUI or other applications using it’s REST API
  • The Administrator communicates their intended network behavior to DNA CENTER, which changes those intentions into configurations on the managed network devices
  • Configurations and policies are centrally managed
  • Software versions are also centrally managed. DNA CENTER can monitor cloud servers for new versions and then update the managed devices
  • New network deployments are much quicker. New devices can automatically receive their configurations from DNA CENTER without manual configuration

imageClick to enlarge

PreviousREST APIs
NextAnsible, Puppet, and Chef