- [Instructor] The Cisco digital network architecture,
otherwise known as DNA,
is also referred to as intent-based networking.
Now, the DNA solution provides automation assurance services
across campus networks, wide area networks,
and also branch networks.
So also including remote branch offices.
Now this solution is based on open
and very extensible platforms
and provides the policy automation
and analytics capabilities
that I'm actually showing here in the screen.
So basically at the heart of the DNA solution
the DNAC, or the DNA Center,
is basically the command and control element
that actually provides that centralized management.
Now regarding the management,
it can be done through dashboards
as you actually are seeing in the screen.
And I'm doing a quick demo here of the DNA Center,
but the more robust capability for DNA Centers
is actually the extensive APIs
that, you know, it offers, right?
So you can actually automate a lot
and integrate many, many different other solutions
like the Cisco identity service engine
and you know, many others.
Now in this screen,
I'm actually just showing the ISE configure
as an authentication authorization on accounting
or AAA server in that Cisco DNA Center
and network setting screens, you know.
For the exam, you don't need to know
all the different configurations for DNA Center.
However, Cisco has a lot of sandboxes and active demos
that you can take advantage of at DevNet
and at the links that I'm actually sharing in the screen.
Now let's go back to the Cisco DNA policies, right?
So policies created in the DNA Center
can actually be group-based access control policies,
IP-based access control policies,
application access control policies,
and also traffic copy policies.
And basically here,
I'm actually showing the DNA Center policy dashboard.
There, you can actually see the number of virtual networks,
group based access control policies,
the IP access control policies, and many others.
Now whenever you configure
group-based access control policies,
you need to integrate the Cisco ISE.
So the Cisco identity service engine with the DNA Center.
Now, in ISE,
you can actually configure the work process setting
as a single matrix.
Now I'm going a little bit beyond
of what probably you will see in the text in the exam,
because, you know, there are concentration exams
for CCMP or the CCA lab
will absolutely concentrate on the configuration
and troubleshooting of the deployment of DNA Center
and the underlying network capabilities.
Now, another thing that I want to highlight is that,
depending on the organization environment
and access requirements,
you can actually segregate your groups
into different virtual networks
to provide further segmentation.
So whenever you integrate ISE with the DNA Center
the scalable groups that actually assist in ISE
are propagated to the DNA Center configuration.
So if a scalable group that you need does not exist,
you can actually create it in Cisco ISE,
and it will then be propagated to DNA Center.
Now DNA Center also has the concept
of access control contracts,
and a contract specifies a set of rules
that allow or deny network traffic,
based on such traffic matching a particular protocol
or a particular port.
Now, as I mentioned to you,
you can also configure IP based access control policies,
as I'm actually showing in here.
You can also configure application policies in DNA Center.
And these, you know, policies allow you to provide things
like quality of service capabilities,
but also application awareness capabilities as well.
Now in DNA Center, applications can be grouped
into logical groups called application sets.
These application sets can then be assigned
a business relevance within the policy.
You may also map applications
to industry standards traffic classes
that are defined in standards
like the RFC 4594, for example.
Another thing that you can configure in the Cisco DNA Center
is the use of Encapsulated Remote Switch Port Analyzer,
or ERSPAN.
And basically that allows you,
so that the IP traffic flow
between two entities is actually copied
to a given destination for monitoring or troubleshooting.
So in order for you to actually configure ERSPAN
using DNA Center,
you need to create a traffic control,
or traffic copy policy rather,
that defines the source and destination
of the traffic flow that you want to copy.
Now, the Cisco DNAC assurance solution also allows you
to configure sensors,
to test the health of networking devices
like wireless networks, right?
A wireless network includes things
like APs, WLAN configurations, you know,
wireless network services, and so on.
Now sensors can be either dedicated sensors
or on demand sensor.
And a dedicated sensor is actually
whenever you configure an access point or an AP
and then it's converted into a sensor,
and it basically stays in sensor mode,
and it's not basically used for serving wireless clients,
unless it actually manually is converted back to AP mode.
So you have to keep that in consideration because
if you actually configure an AP as a dedicated sensor
that's the only thing that it will actually do.
It will not serve any clients.
No clients will terminate to that.
So you have to think about that for,
you know, in your deployment.
Now, an on demand sensor is actually
whenever an AP is temporarily converted
into a sensor to run tests,
and after the tests are complete,
the sensor actually goes back to AP mode.
Now, as I mentioned before,
one of the key benefits of the Cisco DNA Center is
the comprehensive APIs that are available.
They also call them intent APIs, right?
But these intent APIs are Northbound Rest APIs
that expose specific capabilities of the, you know,
Cisco DNAC or Cisco DNA center platform.
And these APIs provide policy based abstraction
of business intent,
so what you want to actually do,
and then allows you to focus on an outcome to achieve
instead of struggling with, you know,
a lot of the mechanisms that are, you know,
part of the implementation, you know,
of course you can actually automate, you know,
and perform an extensible architecture, right?
And at the end of the day,
it will allow you to be consistent,
and consistency also, you know, drives towards security.