SD-Access architecture

What if you could give time back to IT? Provide network access in minutes for any user or device to any application – without compromise? SD-Access is the industry’s first policy-based automation from network edge to cloud. Your foundation for your digital network, Cisco SD-Access. Built on the principles of the Cisco DNA, SD-Access provides end-to-end segmentation to keep user, device and application traffic separate without a redesign of the network. It automates user access policy so organizations can make sure the right policies are set for any user or device with any application across the network. This is accomplished with a single network fabric across LAN and WLAN which creates a consistent user experience anywhere without compromising on security.

There are many challenges today in managing the network to drive business outcomes. These limitations are due to manual configuration and fragmented tool offerings. SD-Access provides:

●      A transformational management solution that reduces operational expenses and enhances business agility

●      Consistent management of wired and wireless network provisioning and policy

●      Automated network segmentation and group-based policy

●      Contextual insights for fast issue resolution and capacity planning

●      Open and programmable interfaces for integration with third-party solutions

For an overview of key use-cases SD-Access addresses, refer to SD-Access Solution Overview.

Platform benefits

Cisco IOS XE opens a completely new paradigm in network configuration, operation, and monitoring through network automation. Cisco’s automation solution is open, standards-based, and extensible across the entire lifecycle of a network device. The various automation mechanisms are outlined below.

●      Automated device provisioning is the ability to automate the process of upgrading software images and installing configuration files on Cisco Catalyst switches when they are being deployed in the network for the first time. Cisco provides both turnkey solutions such as Plug and Play and off-the-shelf tools such as Zero-Touch Provisioning (ZTP) and Preboot Execution Environment (PXE) that enable an effortless and automated deployment.

●      API-driven configuration is available with modern network switches such as the Cisco Catalyst 9300 Series. It supports a wide range of automation features and provides robust open APIs over NETCONF and RESTCONF and GNMI using YANG data models for external tools, both off-the-shelf and custom built, to automatically provision network resources.

●      Granular visibility enables model-driven telemetry to stream data from a switch to a destination. The data to be streamed is identified through subscription to a data set in a YANG model. The subscribed data set is streamed to the destination at specified intervals. Additionally, Cisco IOS XE enables the push model. It provides near-real-time monitoring of the network, leading to quick detection and rectification of failures.

●      Seamless software upgrades and patching supports OS resilience. Cisco IOS XE supports patching, which provides fixes for critical bugs and security vulnerabilities between regular maintenance releases. This support lets you add patches without having to wait for the next maintenance release.

Security

●      Encrypted Traffic Analytics (ETA) is a unique capability for identifying malware in encrypted traffic coming from the access layer. Since more and more traffic is becoming encrypted, the visibility this feature affords for threat detection is critical for keeping your network secure at different layers.

●      AES-256 MACsec encryption is the IEEE 802.1AE standard for authenticating and encrypting packets between switches. The Cisco Catalyst 9300 Series switches support 256-bit and 128-bit Advanced Encryption Standard (AES), providing the most secure link encryption.

●      IPSec encryption delivers secure end-to-end encrypted traffic between sites and connectivity to the Cloud. C9300X models support line rate IPSEC up to 100 Gbps delivering uncompromised secure connectivity.

●      Trustworthy solutions built with Cisco Trust Anchor Technologies provide a highly secure foundation for Cisco products. With the Catalyst 9300 Series, these technologies enable hardware and software authenticity assurance for supply chain trust and strong mitigation against man-in-the-middle attacks that compromise software and firmware. Trust Anchor capabilities include:

◦    Image signing: Cryptographically signed images provide assurance that the firmware, BIOS, and other software are authentic and unmodified. As the system boots, the system’s software signatures are checked for integrity.

◦    Secure Boot: Cisco Secure Boot technology anchors the boot sequence chain of trust to immutable hardware, mitigating threats against a system’s foundational state and the software that is to be loaded, regardless of a user’s privilege level. It provides layered protection against the persistence of illicitly modified firmware.

◦    Cisco Trust Anchor module: A tamper-resistant, strong cryptographic, single-chip solution provides hardware authenticity assurance to uniquely identify the product so that its origin can be confirmed to Cisco. This provides assurance that the product is genuine.

Cloud Security

●      Umbrella DNS Integration:

Small to midsize networks reliant on managed service providers can now host Cisco Umbrella agent directly on their Catalyst 9300 series switches. This allows the business to easily customize their DNS filtering policies granularly at user or group level to prevent BYOD or IoT guest or corporate users from accessing malicious or inappropriate websites, without having to rely on the MSP to push the policies out. It also lets them optimize use of bandwidth by allowing direct cloud access for trusted apps. Requires DNA-Advantage License and Umbrella License per device.

Service Assurance

●      Cisco ThousandEyes Integration:

Deliver superior network and service experience for your users, employees and partners with groundbreaking observability from network to app. Cisco ThousandEyes network tests are now integrated into Cisco Catalyst 9300 series switches with Cisco DNA Advantage licenses, giving you visibility beyond your campus perimeter so you solve issues faster. The Cisco ThousandEyes Network and Application Synthetics license is included by default upon the selection of a Cisco DNA Advantage option with a 3 year, 5 year or a 7 year subscription. Each Catalyst 9300 Cisco DNA Advantage subscription entitles the customer to run the equivalent of one Cisco ThousandEyes network or web test every 5 mins from a Cisco ThousandEyes enterprise agent (22 units per month), up to a maximum of 110,000 units per month of Cisco ThousandEyes test capacity per customer.

Resiliency and high availability

●      StackWise-1T: Cisco Catalyst 9300 Series modular uplink models (C9300X SKUs) support the industry’s highest back-panel stacking bandwidth solution (1Tbps) with StackWise-1T. Up to 8 Switches can be configured in a StackWise-1T with the special connector at the back of the switch using dedicated stack cables.

●      StackWise-480: Cisco Catalyst 9300 Series modular uplink models (C9300 SKUs) support high-speed back-panel stacking bandwidth solution (480 Gbps) with StackWise-480. Up to 8 Switches can be configured in a StackWise-480 with the special connector at the back of the switch using dedicated stack cables.

●      StackWise-320: Cisco Catalyst 9300 Series fixed uplink models (C9300L SKUs) support stacking bandwidth solution (320 Gbps) with StackWise-320. Up to 8 Switches can be optionally configured in a StackWise-320 with the special Stack Kit at the back of the switch using dedicated stack cables.

●      Cisco StackPower: Cisco StackPower is an innovative power interconnect system that allows the power supplies in a stack to be shared as a common resource among all the switches. This allows you to simply add one extra power supply in any switch of the stack and either provide power redundancy for any of the stack members or simply add more power to the shared pool. Up to 4 switches can be configured in a StackPower stack with the special connector at the back of the switch. However, with the use of XPS-2200 appliance, up to 8 switches can be configured in the StackPower stack. Cisco StackPower is only supported on the models with modular uplink stack - C9300 and C9300X SKUs. C9300X models support StackPower+ delivering more power over StackPower cables compared to C9300 models.

Cisco Catalyst 9300 Series StackPower

●      High availability: The Catalyst 9300 Series supports high-availability features, including the following:

◦    Cross-stack EtherChannel provides the ability to configure Cisco EtherChannel technology across different members of the stack for high resiliency.

◦    Flexlink+: Flexlink+ allows the setting up of active and backup interfaces or port channels, which can provide Layer 2 failover redundancy without the use of Spanning Tree Protocol (STP).

◦    Extended Fast Software Upgrade provides the ability to upgrade the platform software or to reload the system in under 30 seconds of traffic impact; both stand-alone and stack configurations.

◦    IEEE 802.1s Multiple Spanning Tree Protocol (MSTP) provides rapid spanning tree convergence independent of spanning tree timers and also offers the benefit of Layer 2 load balancing and distributed processing.

◦    Per-VLAN Rapid Spanning Tree (PVRST+) allows rapid spanning tree (IEEE 802.1w) reconvergence on a per-VLAN spanning tree basis, providing simpler configuration than MSTP. In both MSTP and PVRST+ modes, stacked units behave as a single spanning tree node.

◦    Switch-port auto-recovery (“err-disable” recovery) automatically attempts to reactivate a link that is disabled because of a network error.

◦    The Catalyst 9300 Series platform delivers the best NSF/SSO resiliency architecture in a stackable solution with sub-50-ms failover.

◦    Always-On wireless network with stateful switchover when wireless functionality is enabled on stack of Catalyst 9300 Series switches.

Deep buffer Technology

Cisco Catalyst 9300 higher scale models have a deeper buffer to address the requirements of rich multi-media lossless content delivery and large routing tables in a fixed access solution with a wide range of uplink choices for deployment flexibility.

Flexible Netflow

●      Flexible NetFlow (FNF): Cisco IOS Software FNF is the next generation in flow visibility technology. It enables optimization of the network infrastructure, reduces operation costs, and improves capacity planning and security incident detection with increased flexibility and scalability. The Catalyst 9300 Series is capable of up to 64,000 flow entries on 48-port, 24-port and 12-port models and up to 128,000 flow entries on Multigigabit models.

Application visibility and control

●      NBAR2: Next-Generation Network-Based Application Recognition (NBAR2) enables advanced application classification techniques, accuracy with up to 1400 predefined and well-known application signatures and up to 150 encrypted applications on the Cisco Catalyst 9000 switches. The most popular applications included are Skype, Office 365, Microsoft Lync, Cisco WebEx^®, and Facebook, among many others that are predefined and easy to configure. NBAR2 provides the network administrator with an important tool to identify, control, and monitor end-user application usage while helping ensure a quality user experience and securing the network from malicious attacks. NBAR2 leverages FNF to report application performance and activities within the network to any supported NetFlow collector, such as Cisco Prime^®, Cisco Stealthwatch^®, or any compliant third-party tool.

QoS

●      Superior QoS: The Cisco Catalyst 9300 Series offers Gigabit Ethernet speeds with intelligent services that keep traffic flowing smoothly, even at 10 times the normal network speed. Industry-leading mechanisms for cross-stack marking, classification, and scheduling deliver superior performance for data, voice, and video traffic at wire speed. Superior QoS includes granular wireless bandwidth management and fair sharing, 802.1p Class of Service (CoS) and Differentiated Services Code Point (DSCP) field classification, Shaped Round Robin (SRR) scheduling, Committed Information Rate (CIR), and eight egress queues per port.

Service discovery

●      Multicast DNS (mDNS) gateway: This service discovery gateway capability facilitates sharing of services advertised using the Apple mDNS (Bonjour) protocol, such as printers, Apple TVs, and file services across the network. Additionally, the administrator can create policies defining which services can be seen and accessed by the users in the network. This capability facilitates a Bring-Your-Own-Device (BYOD) rollout.

Smart operation

●      WebUI: WebUI is an embedded GUI-based device-management tool that provides the ability to provision the device, to simplify device deployment and manageability, and to enhance the user experience. It comes with the default image, so there is no need to enable anything or install any license on the device. You can use WebUI to build configurations, and to monitor and troubleshoot the device without having CLI expertise.

●      Efficient switch operation^*: Cisco Catalyst 9300 Series switches provide optimum power saving with Energy Efficient Ethernet (EEE) on the RJ-45 ports and low-power operations for industry best-in-class power management and power consumption capabilities. The ports support reduced power modes so that ports not in use can move into a lower power utilization state. Other efficient switch operation features are as follows:

◦    Per-port power consumption command allows customers to specify a maximum power setting on an individual port.

◦    Per-port PoE power sensing measures actual power being drawn, enabling more intelligent control of powered devices. The PoE MIB provides proactive visibility into power usage and allows you to set different power-level thresholds.

●      RFID tags: Catalyst 9300 Series switches have an embedded RFID tag that facilitates easy asset and inventory management using commercial RFID readers.

●      Blue beacon: Catalyst 9300 Series switches support a blue beacon LED for easy identification of the switch being accessed.

Open standards based fabric

The Cisco Catalyst 9300 Series Switches support modern fabric technologies such as VXLAN with BGP-EVPN control plane, with open APIs. This technology provides the flexibility to build open standards based fabrics to secure infrastructure, users and data. This fabric architecture provides rich unicast and multicast protocol support to optimally route or bridge traffic as well as support for integrated campus services all of which can be automated via open APIs to effectively configure and monitor the network.

Programmability

Cisco IOS-XE provides open standards based APIs such as NETCONF, RESTCONF, gNMI to simplify provisioning and configuration, that allows network administrators to save time when provisioning new network devices and to prevent the human errors that often are a byproduct of manual configuration. Integrating Zero Touch Provisioning with various Devops toolkits allows network admins to drastically reduce the time and resources needed to onboard a device onto their network. The ability to collect real-time statistics through model driven telemetry through gRPC and gNMI allows administrator to integrate to many health monitoring tools to optimize their environments and to troubleshoot and provide alerts about any potential problems.

High-Performance IP routing

The Cisco Express Forwarding hardware routing architecture delivers extremely high-performance IP routing in Cisco Catalyst 9300 Series switches, based on:

●      IP unicast routing protocols (including static, Routing Information Protocol Version 1 [RIPv1], RIPv2, RIPng, and Open Shortest Path First [OSPF], Routed Access) are supported for small network routing applications with the Network Essentials stack. Equal-cost routing facilitates Layer 3 load balancing and redundancy across the stack.

●      Advanced IP unicast routing protocols (including Full [OSPF], Enhanced Interior Gateway Routing Protocol [EIGRP], Border Gateway Protocol Version 4 [BGPv4], and Intermediate System-to-Intermediate System Version 4 [IS-ISv4]) are supported for load balancing and for constructing scalable LANs. IPv6 routing (using OSPFv3 and BGPv6) is supported in hardware for maximum performance.

●      Protocol-Independent Multicast (PIM) for IP multicast routing is supported, including PIM Sparse Mode (PIM SM), and Source-Specific Multicast (SSM).

●      IPv6 addressing is supported on interfaces with appropriate show commands for monitoring and troubleshooting.

Audio Video Bridging (AVB)

Starting with Cisco IOS XE Software Release 16.8, the Cisco Catalyst 9300 Series supports the IEEE 802.1 AVB standard. This standard provided the means for highly reliable delivery of low-latency, time-synchronized audio and video streaming services through Layer 2 Ethernet networks. The standard also makes it easier to integrate new services and for AV equipment from different vendors to interoperate.

Benefits

●      Improves quality of experience by lowering jitter and latency for time-synchronized delivery of high-quality AV.

●      Provides scalability of applications across networked deployments, including expansive and complex AV infrastructure.

●      Lowers Total Cost of Ownership (TCO) with reduced cabling (lowers CapEx) and no license fees
(lowers OpEx).

Multigigabit Ethernet technology: Cisco Multigigabit Ethernet technology allows you to achieve bandwidth speeds from 1 Gbps to 10 Gbps over traditional Category 5e/6 cabling or above. This technology addresses the need for exponential increases in bandwidth with the enormous growth of 802.11ac Wave 2, to be eclipsed by the growth of Wi-Fi 6 and new wireless applications without having to replace current cabling infrastructure.

Multiprotocol label switching (MPLS)

The Cisco Catalyst 9300 Series Switches support Multiprotocol label switching (MPLS) which combines the performance and capabilities of Layer 2 (data link layer) switching with the proven scalability of Layer 3 (network layer) routing. MPLS enables the explosive growth in network utilization while providing the opportunity to differentiate services without sacrificing the existing network infrastructure. MPLS support includes

●      MPLS L3 VPN: An MPLS Virtual Private Network (VPN) consists of a set of sites that are interconnected by means of a Multiprotocol Label Switching (MPLS) provider core network. At each customer site, one or more customer edge (CE) devices attach to one or more provider edge (PE) devices.

●      VPLS: VPLS (Virtual Private LAN Service) enables enterprises to link together their Ethernet-based LANs from multiple sites via the infrastructure provided by their service provider.

●      EoMPLS: EoMPLS is a category of Any Transport over MPLS (AToM) to transport Layer 2 packets over an MPLS backbone.

●      MPLS over GRE: L3VPN over GRE and VPLS over GRE, are supported to tunnel MPLS/VPLS packets over non-MPLS networks utilizing GRE tunneling

Power over ethernet leadership

Cisco Universal Power over Ethernet (Cisco UPOE^® and Cisco UPOE+): PoE removes the need for wall sockets to power each PoE-enabled device and eliminates the cost of additional electrical cabling and circuits that would otherwise be necessary in IP phone and WLAN deployments. Cisco UPOE extends the IEEE PoE+ standard to double the power per port to 60 watts. This facilitates delivery of network power to a broad range of devices requiring higher power, including virtual desktop terminals, IP turrets, compact switches, building management gateways, LED lights, wireless access points, and IP phones. Designed for smart building and IoT applications, Cisco Catalyst 9300 UPOE+ switches (delivering PoE power up to 90W) provide data and power over a single cable to power devices like wireless access points, digital signage, security cameras, thermal cameras with PTZ features, LED lighting fixtures and large display screens. UPOE+ offers reduced cabling and installation costs without need for permits, device daisy-chaining application that require higher power draw, real-time device information, centralized management and remote control, faster and flexible device installation where devices can be positioned in a practical location instead of proximity to the electrical outlets.

Catalyst 9300 Series modular uplink (C9300 and C9300X SKUs) models support Cisco UPOE+, Cisco UPOE, PoE+ and PoE, thereby addressing the largest range of network power needs.

Catalyst 9300 Series fixed uplink (C9300L SKUs) models support Cisco UPOE or PoE+ and PoE.