- [Instructor] The Cisco Digital Network Architecture,
otherwise known as DNA is also referred to
as intent-based networking.
Now, the DNA solution provides automation,
assuring services across campus networks,
wide area networks, and also branch networks,
so also including remote branch offices.
Now this solution is based on open
and very extensible platforms,
and provides the policy, automation
and analytics capabilities that I'm actually showing here
in this screen.
So basically at the heart of the DNA solution,
DNAC, or the DNA Center, is basically the command
and control element that actually provides
that centralized management.
Now, regarding the management,
it can be done through dashboards
as you actually are seeing in the screen,
and I'm doing a quick demo here of the DNA Center.
But the more robust capability for DNA Center is
actually the extensive APIs that it offers, right?
So you can actually automate a lot
and integrate many, many different other solutions
like the Cisco Identity Services Engine and many others.
Now in this screen I'm
actually just showing the ISE configure
as an authentication, authorization and accounting,
or AAA server in that Cisco DNA Center
and network settings screens.
For the exam you don't need
to know all the different configurations for DNA Center.
However, Cisco has a lot of sandboxes and active demos
that you can take advantage of are definite,
and are the links that I'm actually sharing in the screen.
Now let's go back to the Cisco DNA Policies, right?
So policies created in the DNA Center can actually
be group-based access control policies,
IP-based Access Control policies,
Application access control policies,
and also Traffic Copy policies.
And basically here I'm actually showing the DNA Center
Policy Dashboard.
There you can actually see the number of virtual networks,
group-based access control policies,
the IP access control policies, and many others.
Now, whenever you configure group-based
access control policies,
you need to integrate the Cisco ISE.
So the Cisco Identity Service Engine with the DNA Center.
Now, in ISE you can actually configure the
work process setting as a Single Matrix.
Now I'm going a little bit beyond
of what probably you will see in the text in the exam,
because there are concentration exams for CCMP
or the CCA lab will absolutely concentrate
on the configuration and troubleshooting
of the deployment of DNA Center,
and the underlying network capabilities.
Now, another thing that I want to highlight is
that depending on the organization environment
and access requirements,
you can actually segregate your groups
into different virtual networks
to provide further segmentation.
So whenever you integrate ISE with the DNA Center,
the scalable groups that actually assist
in ISE are propagated to the DNA Center configuration.
So if a scalable group that you need does not exist,
you can actually create it in Cisco ISE,
and it will then be propagated to DNA Center.
Now DNA Center also has the concept
of Access Control Contracts,
and a contract specifies a set of rules that allow
or deny network traffic,
based on such traffic matching a particular protocol
or a particular port.
Now, as I mentioned to you, you can also configure IP-based
access control policies as I'm actually showing in here.
You can also configure Application policies in DNA Center,
and this policies allow you to provide things like quality
of service capabilities,
but also application awareness capabilities as well.
Now in DNA Center applications can be grouped
into logical groups called Application Sets.
These Application Sets can then
be assigned a business relevance within a policy.
You may also map applications to industry standards,
traffic classes that are defining in standards,
like the RFC 4594 for example.
Another thing that you can configure in the Cisco DNA Center
is the use of Encapsulated Remote Switched Port Analyzer,
or ERSPAN.
And basically that allows you so that the IP traffic flow
between two entities is actually copied
to a given destination for monitor or troubleshooting.
So in order for you to actually configure ERSPAN
using DNA Center, you need to create a traffic control
or Traffic Copy policy rather that defines the source
and destination of the traffic flow that you want to copy.
Now, the Cisco DNAC Assurance solution also allows you
to configure sensors to test the health
of networking devices like wireless networks, right?
A wireless network includes things like APs,
WLAN configurations, wireless network services and so on.
Now sensors can be either dedicated sensors
or on demand sensor.
And a dedicated sensor is actually whenever you configure
an access point or an AP, and then it's converted
into a sensor and it basically stays in sensor mode.
And it's not basically used for serving wireless clients,
unless it actually manually is converted back to AP mode.
So you have to keep that in consideration,
because if you actually configure an AP
as a dedicated sensor, that's the only thing
that it will actually do.
It will not serve any clients,
or no clients will terminate to that.
So you have to think about that for in your deployment.
Now, an on demand sensor is actually whenever
an AP is temporarily converted into a sensor
to run test, and after the test are complete,
the sensor actually goes back to AP mode.
Now, as I mentioned before, one of the key benefits
of the Cisco DNA Center is the comprehensive APIs
that are available.
They also call them intent APIs, right?
But this intent APIs are northbound rest APIs
that expose the specific capabilities
of the Cisco DNAC, or Cisco DNA Center Platform.
And these APIs provide policy-based obstruction
of business intent, so what you want to actually do,
and then allows you to focus on an outcome to achieve,
instead of struggling with a lot of the mechanisms
that are part of the implementation,
and of course you can actually automate
and perform an extensible architecture, right?
And at the end of the day it will allow you
to be consistent,
and consistency also drives towards security.