RMA Process for Fabric Borders - Looking for most efficient way

[ImrichPalascak]

Hello SDA Experts,

I'm working on PoC for the hospital enviroment in Switzerland and we're in the place where we're trying to test the RMA procedure for Fabric Devices.

Base info. :

DNAC : 2.2.2.3

Borders : CAT9500 (will be 9600 in the production)

Edges : Mix of 9300s and 9400s

SW Version : 17.3.3

Topology : included as the attachement

Because of nature of the enviroment, there is a requirement to replace the faulty device as soon as possible (4 hours RMA). The biggest headache for us is - how to most effectively replace the Fabric Border. RMA Workflow for the Fabric Border is not there, especially if you use LAN Automation for building the Underlay - thats absolutely clear. What we've tried is copy pasting the configuration, from faulty device to the replacement device. At the end it worked, but it took several hours, considering the fact that we had to do lots of manual configuration, including Multicast, iBGP, building the underlay ETC. After that running LAN automation to configure the downliks towards the IN or FE nodes. 

Any chance there is or there will be more effective way to do so? Any help is much appreciated.

[jalejand]

Hi, In newer DNA Center releases, zero touch RMA for lan-automation devices is in the roadmap. What you are doing is called "1-touch RMA", which is the preferred method (that does not require TAC intervention / database manipulation ).

The thing is that you don't need to paste the entire configuration of the faulty device, but only the basic underlay and credentials. For example for a Border, create an SVI/L3 interface towards a Fusion or another Border to reach the DNAC with a static route on it, you can re-use the interfaces and routing protocol (isis/bgp/static) to achieve basic connectivity.

Then configure:

ip domain name x
crypto key generate rsa modulus xx
username x privilege 15 secret x

snmp-server community x y (or snmpv3 if exists)

line vty 0 15

 login local

 transport input all

This should be enough to discover the device and use it as replacement, DNAC will push the old configuration along new certificates and update CTS information in ISE.

[ImrichPalascak]

Alejandro , thanks a lot for reply.

When you say “In newer DNA Center releases” which one you mean ? I’ve seen something (2.2.3.x) but I’m not really sure if we’re in the right one so far.

We’re close to getting into production phase, and it’s a kind of showstopper for now so if we can participate in EFT just because of this feature in the road map so be it, right ? 

Regards,

Imrich

[jalejand]

Hi Imrich, unfortunately, the only information I can disclose is a tentative release target.

• Zero Touch RMA workflow for Lan Automated devices is targeted for DNAC 2.3.1

[Scott Hodgdon]

@ImrichPalascak and @jalejand ,

The Release Notes for DNA Center version 2.2.3.3 call out the new capability: https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/2-2-3/release_notes/b_cisco_dna_center_rn_2_2_3.html#Cisco_Reference.dita_566c7bf1-035a-4aa9-b5b5-06f6c0d6e49f

New Device Support for Return Material Authorization

You can replace a failed device with a new device and use the Return Material Authorization (RMA) workflow to replace the image, license, and configuration on the new device. Cisco DNA Center provides one-touch RMA support for the following switches: Switches that are discovered and configured using LAN automation, including the seed devices (LAN automation primary and peer devices) Devices configured as fabric in a box (standalone only)

This version of DNA Center is planned to become Generally Available by month's end, subject to any last minute issues that could arise.

Cheers,
Scott Hodgdon

Senior Technical Marketing Engineer

Enterprise Networking and Cloud Group

[ImrichPalascak]

Thanks Scott a lot for information.

Imrich

[bofele]

Hi Scott,

That covers one gap in RMA, but I feel there are still cracks there:

• chassis based boxes,
• stacked devices,
• stacked FIABs,
• SVL members,
• EN/PEN nodes.

Is my observation correct? If yes, then how does a customer address that? Hope that there is a better way than deleting failed node and starting from scratch.

Kind regards,

Bostjan

[Scott Hodgdon · Accepted solution]

@bofele ,

You are correct. We are working on removing restrictions for the others as well, but the most critical was to get the borders that were part of LAN Automation supported.

Cheers,
Scott Hodgdon

Senior Technical Marketing Engineer

Enterprise Networking and Cloud Group

[ImrichPalascak]

Thanks a lot Scott and Alejandro. 

Bostjan - very nice to get in touch again  

Imrich