Pass Cisco CCNP Enterprise 300-415 Exam in First Attempt Easily

Describe Cisco SD-WAN Architecture and Components

1. Welcome

Hi, everyone. Welcome to CCNP Enterprise Certification. This is for CCNP. Enterprise SDWAN. And I hope this course will be your best CCNP course so far.

2. CCNP SDWAN + CCNP Certification introduction

In CCNP Enterprise. Now you can see that we have a complete new set of certifications, and I'm going to tell you about that as well. But this particular course is related to CCNP in SDWAN. And if you want to do this, obviously you have to do the CCNP Core first, and then you have the elective. So now we have multiple electives that we can go and select for the certification. Certification. Obviously, if you do certification, you have higher visibility among different applicants. Obviously 100% of time actually companies, they are hiring for these certified candidates because their value added is more than the other members. Now, if you see that the certification that before 24 February there are a bunch of certifications like Associate, Professional, Expert, and there also they have the domain. So you are doing the Associate with respect to cloud, security, routing, switching, wireless ISPs, et cetera. Now it has been changed and simplified. Now you can see that you have one root certification, which is the Associate. And then you can choose the track. Either you are going for Enterprise or Provider Data Center, collaboration, security, and even at the expert level, you can see that CCNP Enterprise is the prerequisite; at least one of the papers is a prerequisite for either CCIE Enterprise Infrastructure or CCIE Enterprise Wireless. Now, this particular certification is actually very near the customer premises, or it's very near. That's what we are going to support in a company. So that's why there is a change in the certification. And this particular slide, which you can take a snapshot of, can also be referred to for future reference. In this course, we are going to focus on enterprise CCNP Enterprise. So you have to do the course. If you do the course, then you can go and choose one of the papers. This means you have electives: you want to do wireless, you want to do CC and Pdesign, you want to do SDWAN, et cetera. So you have multiple electives. You have the option of following CCNP Core with CCIE. Okay, here you can see that you have two CCIE labs. What are those labs? You have Enterprise infrastructure. You have Enterprise Wireless. So, from there, you can go and choose this. Then obviously you have the security service provider, and you can see the electives and the path as well. Again, you can see that for CCNP-level certification, you must do that core exam. Once you have the code, you can go to advanced routing, wireless, wireless implementation, and SDWAN. This course will focus on SDWAN, but we must move as quickly as possible to complete the course. And then you can go to any of these six electives. Then, obviously, you can go and do your CCIE—either wireless or enterprise—and all these certifications. Now you will get even more value from them because they have been collapsed. So you can now say that we have the enterprise core, which is required, and then you have the electives. You can go and choose among the electives, you can earn your CCNP, and your visibility as compared to other engineers will be greater. Once you complete your certification, obviously Cisco will give you a nice batch. You can go and use that batch. We are getting logos as well. So, for example, for CCIE and any other certification, you will get the batch you can use beneath your signature as well. Alright, so these are the certifications, and let's now, from here onward, focus on the Cisco SDWAN track.

3. Exam Topics

Let us discuss that. What are the topics we have in the esteem exam? You can see it here; actually, you can go to this link below. I will go and log into this link or open this URL, and you will see that inside these particular six sections, what are the topics we have? You can see that we have the SD-WAN architecture, the controller deployment router, deployment policies, security, and keys, and then finally we have the management and operations. Let me quickly go and log into this particular link, or let me open this URL. All right, here you can see that you have a 90-minute exam. You can see the paper code and what topics we have. So 20% weightage for architecture, checking controller components, various types of devices, their usability, etc. For you have the Cisco edge, you have the Viptilla edge, v for Viptilla C for Cisco. We have different types of hardware and software form factors that we can discuss. Then what is the controller deployment for that you have on-premises? You may have cloud deployment, and various options are there. You may have installed these devices over KBM or Hypervisor. Then what about redundancy and scale factor and various things related to controller deployment? Now once you deploy the controller, the next phase is obviously to go and deploy the data plane devices, and that's nothing but your V edge or SE edge. So not only do you want to onboard the devices, but you want to add certain features. So for example high availability and redundancy routing redundancy. So, for example, you have VRP; you have transport locators; you have transport locator extensions. Any IGP. For example, the underlying protocols are OSPF and BGP. How are you going to send this information or redistribute this information over the OMP? That is the overlay management protocol. Then the key feature we have in the SDWAN solution is the policy. Actually not only policy, but we have policies and quality of service. So what about the local policy or the central policy? What about the control policy, data policy, how you're going to create multi-topology policies, segmentation policies, service chaining policies, etc., etc., etc. There are so many policies that we can go and add. Finally, two very important things we have. One is the application aware routing plus In security, we'll see that we have application-aware firewalling as well. Then we'll talk about how we're going to configure and test the dial. This is also a huge topic. So, if you want to use that or you want to use Zscaler integration or Cisco firewall integration, those things will come here. Then you have security and quality of service. Now you can see in security that you have the application, a verifier firewall, and then the service insertion. Although in the CCNP label all the security stuff is not added, only two things have been added. However, if you go and inspect the entire security suit, You'll find that you have advanced malware protection; you have URL filtering IPS ideas; you have firewalling; and you have Cisco Umbrella integration as well. Although it is sufficient in this curriculum to use an app-aware firewall and service redirection. Actually, both are very much possible with the WebTilla operating system or V edges. But in iOS XC, we have much more features than in QS. We have scheduling, queueing, shipping, and policy. You can tell that it's traditional or like the existing Cisco Q solution. Finally, management and operation are obviously done via We Manage. So, from where we manage, what are our reporting options, what tools do we have, and how can we check from the rest API as well? What about the software upgrade, as well as any type of management piece or management tasks that we can perform from the Vanish? So this is the overall agenda. It's like a mid level type of course means it is the professional not very associate level or not expert level like CCIE level. But you must understand the theory behind the thing—how things happen, how things are organized—and, if you get an enterprise-label SDWAN deployed solution, how we can assist in operations—even if you can do the deployment yourself. So this is something like "you can add three things here." design, implementation, and operation. Everything is added to this particular curriculum.

4. SDWAN Architecture

Let us start with section one, where we have to understand the architecture and various components. What are the topics we have inside Section one? First of all, we are going to discuss the architecture and components. Then we have to understand the components of the controllers. We have the orchestration plane, management plane, controller plane, or control plane. Then we have the data plane devices. We have various things inside the data plane device, such as what is T lock, how they form the IP SEC tunnel, and what is with the Teller route. What is the BFT (bidirectional forward detection)? Now, there are some common terms that we are going to use. So in terms of data plane devices, we have V-edge or reptile-edge routers. We have a Ch that is nothing but a Cisco ISR ASR router. Those are nothing but SD-1 one router. Then we have the controller. We have a smart controller that is nothing but your control plane. We have the orchestrator plane, which is the V bond. The management then claims that there is nothing but V manage. Now, this small V is not virtual; it stands for Riptilla because we are still the parent company that has introduced SDWAN. Now the overall solution will look like this. Although this diagram will be a little bit busy, But once you understand all the components and the hierarchy, then it makes sense. Now starting from the orchestrated plane or the orchestration plane you can see that you have a couple of V bonds and those V bonds are identified as a DNS or a URL. They may be inside the DMZ zone. So one of the interfaces is towards the private datacenter, or one of the interfaces is towards the data center. Other interfaces are visible to the public. So you have the orchestration plane. Then you can see that you have a management plan that is nothing but us managing. It is recommended that you should have cluster of V manage means three manage or three service inside same cluster. Now it's actually very big, and here you can see in the slide that it can be in multi-tenant mode or dedicated, meaning dedicated to one customer or group of customers having multi-tenancy or maybe one company or organization having multiple sub organizations. Any possibility will be there. But this is the management plane from where you can manage entire fabric. This is the one common place from where you can manage everything. So you can see from this management plan that I am managing control plane devices as well as parallel devices. You can push the configuration template to all the devices to correct all the devices in the data plane. Not only in the data plane but in the control plane as well. So the usability of this is enormous, and we'll see some of the VManage use cases, but we manage. From there, you can configure monitoring and troubleshooting. In short, we can do everything from VManage, and then we have the control plane, which could be inside containers or VMs that you can spin up over the hypervisor. The control plane should also be in the group, according to the recommendation. So maybe you have two via Smart in one group and two others via Smart in another group, but they should have the same configuration. That is, these are my control plane devices; they should have the same configuration or the common configuration; otherwise, the network may be inconsistent. Now in terms of the control connection, whenever the data plane devices are forming the control connection, they can form the connection with one group of via Smart as a primary and another group of via Smart as a secondary. But in any case, all the viasmarts should have the same information. Then finally, you can see that you have the data plan devices at the bottom. So Irrespective of transport, either it's Internet, MPLS or4G they have the IPC tunnel among other devices. By default, they have a full mesh setup, meaning all the devices have an IPsec tunnel with all the other data plan devices. Correct. They can be physical, they can be virtual. So now here in the diagram, you can see if I draw it. Let me try to draw the diagram. So you can understand here you can see that this link either this can be DTLs or TLSand here also it can be DTLs or TLSin Vivon also you have the control connections. So we want to be smart like that. I'm not doing all the connections, but this is always what we want: connections that are always GTLS. Now, what are GTLS and TLS? TLS is nothing but your SSL secure socket layer plus TCP, TCP-based SSL, and DTLs are nothing but your SSL plus UDP, UDP-based SSL, which is nothing but your DTLs. Some space is there, but you can understand now that you have a control connection like that, and then you may have the data connection or the IPC connection. So, let me quickly draw the data connection and some other colors to see how it will look. So now, from device to device, you have the IPsec connection. By default, it will be full mesh. So here it's not in a bundle a single they have the IPsix connection, that is the data plane connection. So obviously the traffic will move one lead from one data plane device to the other data plane device, and from the control plane, which is your Vs Smart, you are sending the updates to the controller, which is the Vs Smart. They can send the update with the OMP protocol. That is the overlay management protocol they can use, or they can send different types of control messages related to routing updates. Security key exchange update related to policy exchange Okay, so that's actually the rule of the controller. now, here you can see that this is the overall overview or this is the summary of the architecture that we have inside the SDWAN. Now, it is very interesting and important because Cisco SDWAN can scale. So here you can see if I start from the bottom, any location, branch, colocation, cloud, any transport, satellite, Internet, MPLS, five GLTE, any service they can use, branch security, cloud-integrated services or security, application quality, experience for sales, application voice collaboration, cloud on RAM, means you can integrate with any type of service in the SDWAN. And then we have any deployment—any deployment means on-premises cloud marketing. Even MSPs, like managed service providers, are offering these services. So you can see that how open and secure our network is open that we can go and we are very much near to the cloud integration or we are near to the cloud, then we can install everything over cloud as well. Whether it's a controller or data plane device, you can integrate it with any service. It's so flexible, you can run the application over broadband or the internet as well, because anyway, they are forming very high-level secure tunnels between data plane devices. So, after adding all these points, you'll find that the SDWAN is a highly secure and desirable solution at the moment. And I think almost all the customers are going for SDWAN deployment. Now, again, you can see the SDWAN deployment architecture. You may have your branches spread across geography, you may have your physical branches, and you may have your virtual branches as well. And then you can see that you can use software as a service. You can use Dia directly for those services. The good thing about this is that wherever you have your services or applications, you can track each and everything from your dashboard. So you have a single GUI and a single dashboard. From there, you can manage or track all the applications. Okay? So not only can you track and manage the application, but you can do the configuration and changes, et cetera, et cetera. Are there a lot of tuning tunnel options? So here you can see that software as a service, or as a VPC (virtual private cloud), or as enterprise controllers, or as a private cloud. everything, each and everything. We can go and integrate with our fabric inside that architecture.

5. SDWAN Components Controllers

Let us talk about the controllers. We have three different types of controller. One is the orchestration plane, which is nothing but the V-Bond management plane, which is nothing but the Manage Will plan, which is nothing but via Smart. So we manage V-bond via Smart, or we manage V-bond via Smart, etcetera. Et cetera. In the bracket, you can see that we are Bond and comma Net and Smart comma OMP. because these features are actually very important to understand. We should understand these features. So for example, via Smart, VSmart is your control plane. And among via Smart suppose if you have two, three via Smart. So via Smart, they are running OMP, and from Smart to edge devices or via Smart to branch edge devices, again, you have OMP. So we have an overlay management protocol that is nothing but your control plane. So for example, if your OMP is down, your control plane is down. So that's the significance we have; let's learn one by one what the basic features of these controllers are. So for example, we have the orchestration plane. What are the characteristics and what is the use of the orchestration plan? They are used to do the secure bring up. So to bring up your reptile of fabric, first of all, all those devices have to go, and they have to contact the orchestration plane, or the V Bond. So what is happening? Suppose there is zero deployment and you want to deploy one of your edge devices. What will happen is that these devices and contact first of all the von. Now what we Bond will do, he will check what is the serial number, what is the chassis ID of the edge devices. And with this edge device, they will go and check the organization name, org, and the name of the V Bond. Now, once this V-bond has been satisfied due to some sort of whitelist modeling, they will have a list of all the devices that will be part of the fabric. So once we are satisfied that the request I am getting is legitimate, They will form some kind of temporary DTLs, but never permanent internal temporary DTLs. Because remember, we want to understand only DTLs. So they will create temporary DTLs and then offer this Edge device the VA Manage and VA Smart IP addresses. Now next time these guys come, they will go and contact the V Manager and the VASmart, and the same process will happen. We'll go check the serial number and chassis ID of the V Edge. V Edge will check the organ; that's part of the certificate, and that's part of the licensing certificate. Then again, the VS Smart will go and check the serial number and the chassis ID. The V Edge will then check the.org name of the Vs Smart. And then what will happen? What will be the end result? The end result is that the edge devices are here. Let me try drawing with another color. So they will form the permanent TLS or DTL connection. They will form a permanent connection with V. Manage and V. Smart, destroying your temporary tunnel. Okay, so here you can see the notes. Let me try to read out the notes. Here we have the notes that are telling us that the orchestration plane is there to do all the component work securely, bringing up the devices in the fabric and orchestrating control and the management plane. Distribute a list of Vs. Smart and manage to the edge devices or routers that facilitate net, require public IP, and could shift behind one-to-one net, be highly resilient, multi-tenant, or single tenant. So that's the purpose of the orchestration plan; their role is defined; and these are the main points. Now you can go and install this over the compute, over ESXi, or over a hypervisor. And here are some of the key points that should be accessible via the internet. They are doing the orchestration; they are securely bringing up the fabric. Now, the next very important piece we have is the management plan. This management plan will go and integrate with third-party APIs, and it is there to do. You can see what to do on day zero, day one, and day two All day, you have to bring up first and foremost you manage, and then you have to add V bond via Smart. You have to do at least minimum configuration, you have to do the licensing process. Once your controllers are up and running, we can add the data plan devices. And for that, you have to start with what we manage. This is centralized provisioning. It can be multi-tenant or single-tenant, where you can build the policies and template. You can do troubleshooting monitoring, software, upgrade GUI with RBAC. It can be integrated with third-party tools for APIs and programming. This is also highly resilient. Now, this is also software. So you can go and install the cluster over the compute either ESXi or KVM used for centralized management, API, configure, monitor and management. These things can then be done via the view manager. Finally, in the controller section, you have the V Smart. That is the actual brain behind the scene. Now, with the help of this particular version of Vs. Smart, you can do that, and it will provide you with intelligence. So you can do apparatus policies, rental policies, any type of service, insertion chaining, whatever, all policies, IPsec exchange, overall routing, management—everything is done with the help of Smart. That's your policy engine. That's your brain, okay? And this is also software. And you want to operate this via Smart in a redundant manner within a group. So you can have a group of three or four devices; you can have another group in another datacenter with three or four devices. Only thing is important that all those via smart in a single fabric, they should have consistency, they should have same database. That's the important thing. So here you can see routing information, encryption key propagation, policy management, service sharing, traffic engineering, and so many other things that we can do and achieve with respect to via smart. All right? So that's the main thing we have in the absence of control.

6. SDWAN Data plan Devices

Let us talk about the controllers. We have three different types of controller. One is the orchestration plane, which is nothing but the V-Bond management plane, which is nothing but the ManageWill plan, which is nothing but via Smart. So we manage V-bond via Smart, or we manage V-bond via Smart, etcetera. Et cetera. In the bracket, you can see that we are using bond and comma Net and smart comma OMP because these features are actually very important to understand. We should understand these features. So for example, via Smart, VSmart is your control plane. And among via Smart suppose if you have two, three via Smart. So via Smart, they are running OMP, and from Smart to edge devices or via Smart to branch edge devices, again, you have OMP. So we have an overlay management protocol that is nothing but your control plane. So for example, if your OMP is down, your control plane is down. So that's the significance we have; let's learn, one by one, what the basic features of these controllers are. So for example, we have the orchestration plane. What are the characteristics and what is the use of the orchestration plan? They are accustomed to performing the secure bring-up. So to bring up your reptile of fabric, first of all, all those devices have to go, and they have to contact the orchestration plane, or the V Bond. So what is happening? Suppose there is zero deployment and you want to deploy one of your edge devices. What will happen is that these devices and contact first of all the von. Now what we Bond will do, he will check what is the serial number, what is the chassis ID of the edge devices. And with this edge device, they will go and check the organization name, org, and the name of the V Bond. Now, once this V-bond has been satisfied due to some sort of whitelist modeling, they will have a list of all the devices that will be part of the fabric. So, once we've determined that the request I'm receiving is legitimate, they'll create temporary DTLs, but never permanent internal temporary DTLs. Because remember, we want to understand only DTLs. So they will create temporary DTLs and then offer this Edge device the VA Manage and VA Smart IP addresses. Now next time these guys come, they will go and contact the V manager and the VA Smart, and the same process will happen. We'll go check the serial number and chassis ID of the V Edge. V Edge will check the organ; that's part of the certificate, and that's part of the licensing certificate. Then again, the VS Smart will go and check the serial number and the chassis ID. The V Edge will then look up the name VsSmart.org. And then what will happen? What will be the end result? The end result is that edge devices are here. Let me try drawing with another color. So they will form the permanent TLS or DTL connection. They will form a permanent connection with V. Manage and V. Smart, destroying your temporary tunnel. Okay, so here you can see the notes. Let me try to read out the notes. Here we have the notes that are telling us that the orchestration plane is there to do all the component work securely, bringing up the devices in the fabric and orchestrating control and the management plane. Distribute a list of Vs. Smart and managed edge devices or routers that enable networking, require public IP addresses, and can be highly resilient, multi-tenant, or single tenant. So that's the purpose of the orchestration plan; their role is defined; and these are the main points. Now you can go and install this over the compute, over ESXi, or over a hypervisor. And here are some of the key points that should be accessible via the Internet. They are doing the orchestration; they are securely bringing up the fabric. Now, the next very important piece we have is the management plan. This management plan will go and integrate with third-party APIs, which it is there to do. You can see what to do on day zero, day one, and day two. All day, you have to bring up management first and foremost, and then you have to add V bond via Smart. You have to do at least the minimum configuration; you have to do the licensing process. Once your controllers are up and running, we can add the data plan devices. And for that, you have to start with what we manage. This is centralized provisioning. It can be multi-tenant or single-tenant, where you can build the policies and template. You can do troubleshooting monitoring, software, upgrade GUI with RBAC. It can be integrated with third-party tools for APIs and programming. This is also highly resilient. Now, this is also software. So you can go and install the cluster over the compute node using either ESXi or KVM for centralized management, API, configuration, monitoring, and management. These things can then be done via the view manager. Finally, in the controller section, you have the V Smart. That is the actual brain behind the scene. Now, with the help of this particular version of Vs. Smart, you can do that, and it will provide you with intelligence. So you can do apparatus policies, rental policies, any type of service, insertion chaining, whatever, all policies, IPsec exchange, overall routing, management—everything is done with the help of Smart. That's your policy engine. That's your brain, okay? And this is also software. And you want to operate this via Smart in a redundant manner within a group. So you can have a group of three or four devices; you can have another group in another datacenter with three or four devices. Only thing is important that all those viasmart in a single fabric, they should have consistency, they should have same database. That's the important thing. So here you can see routing information, encryption key propagation, policy management, service sharing, traffic engineering, and so many other things that we can do and achieve with respect to via smart. All right? So that's the main thing we have in the absence of control.

Hide