topic Re: SDA IP Pool limits in Software-Defined Access (SD-Access)

SDA IP Pool limits

MaxSL — Tue, 25 Jan 2022 17:10:51 GMT

Hello, community.

I'm a bit confused with terminology in the DNA-C datasheet (https://www.connext.com.mx/wp-content/uploads/2020/11/DNA-Analytics-and-Assurance-1.1.pdf), hopefully, I will find an answer here...

There is a limit of 100x IP Pools supported by DN2-HW-APL...does it apply to the "Global" IP Pools or the "Sub-IP Pools/Reserved Subnets" as well?

By "Sub-IP Pool" I mean the "subnet" we "reserve" out of "Global" IP Pool for specific purposes, such as a device type, VN, etc...
I have a potential design where I need to accommodate nearly 400 unique SSIDs per site and not sure if I will be able to do it with SDA.

Thank you.

Re: SDA IP Pool limits

balaji.bandi — Tue, 25 Jan 2022 17:25:41 GMT

You can use biggest IP pool /16 like more with more VLAN for your SSID 400 ?

OIther side - i am more intrested :

400 SSID - is very huge numbers what is the use case.

how many controllers ?

how big is the deployment ?

Re: SDA IP Pool limits

Flavio Miranda — Tue, 25 Jan 2022 18:07:28 GMT

The limit is per site. As per your box, it seems that it goes up to 500 fabric sites and 64 VN per site. Then, your intensional design will not be possible as DNAC only support one IP pool per SSID. (Each SSID must be attached to only one IP pool).

Look at Table 14. Scale and hardware specifications of the document:

https://www.cisco.com/c/en/us/products/collateral/cloud-systems-management/dna-center/nb-06-dna-center-data-sheet-cte-en.html

Re: SDA IP Pool limits

MaxSL — Tue, 25 Jan 2022 18:31:02 GMT

WLC is 9800-40.
The use case is the following: there is a WAP in the hotel room and I need to restrict bandwidth from that specific WAP based on the room class.

The original idea I had is to dedicate an SSID per room and apply "Policer" (to limit available bandwidth) per SSID...But if there is a 100 IP Pool limit on SDA I will probably have to use a single SSID/WLAN and multiple Policy profiles, so I could mix them under a Policy Tag. And then "tag" different WAPs with different Policy tags...Single SSID is not optimal due to "sticky client" though.

Re: SDA IP Pool limits

Flavio Miranda — Tue, 25 Jan 2022 18:53:29 GMT

You can do Per Client QoS on the WLC. However, this may note available on the DNAC profile. This is something that makes me sad about DNAC cause I expect to see the very same option I have on WLC gui, in the DNAC gui.

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/215441-configure-qos-rate-limiting-on-catalyst.html

Re: SDA IP Pool limits

rasmus.elmholt — Wed, 26 Jan 2022 08:18:48 GMT

Hi,

You can create an IP Pool for each bandwidth "class", and then do a IP based firewall policy with different configuration according to the IP subnet.

Or a better solution would be to have one SSID for the entire guest-net and then different EAP-PEAP usernames per room. Then use this to map the client to a policy or IP Pool.