Moving from traditional to SDA

[Hisoma Sama]

Hello

we are currently upgrading our network all c9k series and we are installing only DNA

the network will be layer 3 routed access

my 1st question can i use DNA to auto config my switches , or better to configure my switches manually then attach DNA to it and make my discovery?

2nd Q: would my OSPF design for layer 3 routed access will be enough so once we move into SDA in phase 2 will be easy or there is another things to put in mind in this design that required once to move SDA

note: i have no pre-experience to SDA and requirements

thanks you  

[jalejand]

1. DNA Center can auto-configure switches depending on the automation task.

       To configure new switches (with no configuration at all) you can use PnP to automate specific CLI commands

       To configure new switches (with no configuration at all) for underlay routed-access you can use LAN Automation

       Fabric configuration is automated by DNA

2. Any underlay IGP is in theory supported by SDA as long as jumbo frame and no summarization exists between nodes (meaning that every node must have a loopback0 advertised as /32, known by all nodes). DNA Center uses IS-IS for underlay automation, if you run OSPF as underlay, you might need to think about redistribution tasks between the existing OSPF network and future IS-iS nodes in case you want to use LAN Automation

Migration from a traditional network to SDA techniques can be reviewed here:

https://www.cisco.com/c/en/us/td/docs/solutions/CVD/Campus/cisco-sda-design-guide.html#Migration_Strategies

[Hisoma Sama]

Thanks jalejand for your reply

for LAN Automation do i need use ISE for this or DNA can handle from its own?

[jalejand]

No need for ISE, ISE in fabric is mainly used for:

  Cisco TrustSec SGT policies (microsegmentation in fabric, rules between endpoints based on their context/identity)

  Integration with assurance to include dot1x usernames on the client dashboard

  Guest Portal automation for Guest SSIDs (Portal creation and authentication rules)

Any vanilla AAA server could be used to deliver dot1x/MAB authentication for wired and wireless users, with limited support of course.

For LAN automation you don't rely on any ISE/AAA server coexistence.

[balaji.bandi]

I am in the process of deploying the same and reading many documents and understand head around this technology. but once you understand it is very simple steps :

my 1st question can i use DNA to auto config my switches , or better to configure my switches manually then attach DNA to it and make my discovery?

Take advantage of DNAC orchestration, that is the reason the tool brought in, So there are no human mistakes, so your basic configuration is simple to bring the device into the network with a standard template where on the next level it is easy to provision SD-Access later. using DNAC.

2nd Q: would my OSPF design for layer 3 routed access will be enough so once we move into SDA in phase 2 will be easy or there is another things to put in mind in this design that required once to move SDA

sure you can use any IGP (other than RIP) underlay reachability - make sure there is no summarisation required. - that is the reason cisco suggests ISIS makes the flat network. ( some use cases like migration it may not be possible we need to use exiting arrangements and migrate to SD-Access.

But this is a good journey towards Software Define Intenet-based networking.

[Hisoma Sama]

thanks balaji

any advise from where to start (since most Sw's would be stacking) and pre-configuration i make to the seed switch?

is it mandatory to create VRF's?

and for Jumbo frame wont cause an issue for some legacy applications?

since you have been through this any recommendations from your part

sorry for asking a lot I'm just new to this world.

[balaji.bandi]

any advise from where to start (since most Sw's would be stacking) and pre-configuration i make to the seed switch?

You need only basic configuration for the DNAC to reach the device with point-to-point link IP address and Local username, then rest all done using DNAC, that is the reason Lan automation does the basic setup when the device comes onboard.

is it mandatory to create VRF's?

YES/ NO, the main reason for VN is segmentation, you want to be flat network all over, that is not the end goal of SD-Access and Security features you taking advantage. (by spending good amount of money for DNAC)

Jumbo frame wont cause an issue for some legacy applications?

This is an SD-Access requirement, your Legacy application still be in your DC and Border handoff will take care of this.

since you have been through this any recommendations from your part

below URL give all the information ( as I said I am not a wise expert but we all get there by learning things slowly and eventutally)

https://www.cisco.com/c/en/us/td/docs/solutions/CVD/Campus/cisco-sda-design-guide.html#Transit_Control_Plane_Node