<<<<<<<<<<<<<<<<<<<< SOFTWARE DEFINED NETWORKING (SDN) >>>>>>>>>>>>>>>>>>>> SDN Domains & Controllers ---------------------------------- ACI : Data Center Automation Controller : APIC SD-WAN : WAN Automation Controllers: vManage, vSmart, vBond SD-Access : LAN Automation Controller : DNA Center (DNAC) ============================ SOFTWARE DEFINED NETWORKING (SDN) ============================ SDN DOMAINS & CONTROLLERS ---------------------------------- ACI (Application Centric Infrastructure) - Domain : Data Center - Controller : APIC - Purpose : * Automates data center network provisioning * Policy-based application network control * Integrates compute, storage, and networking - Key Difference : Focused on application-driven automation inside data centers ---------------------------------- SD-WAN (Software Defined WAN) - Domain : WAN / Branch - Controllers : vManage, vSmart, vBond - Purpose : * Simplifies WAN connectivity between sites * Dynamic path selection across MPLS, broadband, LTE * Centralized security and monitoring - Key Difference : Optimizes WAN links between geographically dispersed locations ---------------------------------- SD-Access (Software Defined Access) - Domain : LAN / Campus - Controller : DNA Center (DNAC) - Purpose : * Automates LAN provisioning and segmentation * Policy-based user/device access * Provides network assurance and analytics - Key Difference : Focused on user access, segmentation, and automation within campus/LAN ---------------------------------- SUMMARY TABLE Domain | Controller | Focus Area | Main Purpose ------------ | -------------------- | ---------------- | ---------------------------------------- ACI | APIC | Data Center | App-driven automation, network policies SD-WAN | vManage/vSmart/vBond | WAN / Branch | WAN optimization, secure connectivity SD-Access | DNA Center | LAN / Campus | Automated access, segmentation, assurance SD-WAN Terminology Update: --------------------------- | Old Term | New Term | Notes | ------------- | ----------- | ------------------------------------------------------------------- | | vEdge / cEdge | WAN Edge | Physical or virtual edge devices deployed at branches or data centers. | vManage | Manager | Centralized management platform for configuration, monitoring, and policy. | vBond | Validator | Handles secure initial authentication of WAN Edge devices and orchestration. | vSmart | Controller | Centralized controller for route distribution, policy enforcement, and path selection. <<<<<<<<<<<<<<<<<<<< SD-WAN ARCHITECTURE >>>>>>>>>>>>>>>>>>>> ----------------------------- PLANES ----------------------------- Orchestration Plane : Device authentication & discovery OSS/BSS, NSO, VMS Controller : vBond Management Plane : Configuration, policy, monitoring Controller : vManage Control Plane : Routing intelligence & policy distribution Controller : vSmart Data Plane : Traffic forwarding Devices : vEdge / cEdge (Physical or Virtual) ------------------------- SD-WAN PROVIDERS ------------------------- 1. Cisco Meraki 2. Cisco Viptela 3. VMware VeloCloud 4. Fortinet 5. Citrix 6. Palo Alto 7. Juniper AI-Driven SD-WAN **********************3️⃣ vManage (Orchestrator / Manager) -- MANAGEMENT PLANE **************************** Databases & Responsibilities ---------------------------------- RIB : Routing Information Base -> Control Plane FIB : Forwarding Information Base -> Data Plane MIB : Management Information Base -> Management Plane vManage ---------------------------------- - Centralized management & monitoring - Pushes configurations, templates, policies - Collects statistics, alarms, logs - Virtual appliance only (no physical device) Images: - VMware : .ova - KVM/Linux : .qcow2 Management Operations: - PUSH : Send configs/policies to devices - GET : Retrieve status, stats, logs NOTE: - vSmart, vEdge, vBond are managed by vManage - OMP is used AFTER initial device authentication # Role: Central management (GUI/REST API), template deployment, monitoring, reporting, policy/firmware upgrades # Deployment Location: Data Center or Cloud (private/public) # Form Factor: VM only # Images & Extensions: # - vmanage-x.x.x.qcow2 # KVM # - vmanage-x.x.x.ova # VMware # - vmanage-x.x.x.iso # rarely used # Model: vManage-VM # Connectivity: Must be reachable by vSmart and WAN Edge devices **********************1️⃣ vSmart (Controller) -- CONTROL PLANE ******************************* vSmart Controller ---------------------------------- - Central SD-WAN control-plane brain - Runs Overlay Management Protocol (OMP) - Does NOT forward user traffic - Applies centralized policies OMP Characteristics: - Cisco proprietary - Similar to BGP (but SD-WAN specific) - Enabled by default - vSmart forms FULL-MESH OMP peering with other vSmarts Security: - DTLS (UDP) - TLS (TCP) # Role: Control plane distribution (routing, OMP routes), policy enforcement, path orchestration # Deployment Location: Data Center (on-prem) or Cloud (AWS/Azure/GCP) # Form Factor: VM (no physical router) # Supported Hypervisors: VMware ESXi, KVM, Hyper-V # Images & Extensions: # - vsmart-x.x.x.qcow2 # for KVM # - vsmart-x.x.x.ova # for VMware # - vsmart-x.x.x.iso # rarely used # Model: vSmart-VM # Connectivity: Must be reachable by all WAN Edge devices (DTLS/TLS control plane) ----------------------------2️⃣ vBond (Orchestrator / Validator) -- vBond ------------------------------- Role: - Orchestration & security controller - Authenticates WAN Edge devices - Provides vManage & vSmart information to edges Requirements: - Must be publicly reachable - Public IP OR Static NAT required Images: - VMware : .ova - KVM/Linux : .qcow2 # Role: First point of authentication for WAN Edges, helps discover vSmart & vManage, secure DTLS/TLS # Deployment Location: Internet-facing DMZ or Public Cloud # Form Factor: VM only # Images & Extensions: # - vbond-x.x.x.qcow2 # KVM # - vbond-x.x.x.ova # VMware # Model: vBond-VM # Connectivity: Must be reachable by WAN Edge devices during bootstrap; public IP or NAT ********************** DATA / FORWARDING PLANE ********************* RIB=Routing infromation Base Control Plane handles Routing Packets FIB=Forwarding infromation Base Forwarding/Data plane handles Routed packets/data packets MIB=Mangement informaton Base Management Plane handles management Data vEdge Viptella Edge viptella company, now cisco owned, originally designed for SD-WAN cEdge Cisco Edge cisco ASR/ISR routers can be converted to SD-WAN Edge routers WAN Edge Devices ---------------------------------- - Forward actual user traffic - Form IPsec tunnels between each other - Communicate with vSmart using OMP Device Types: cEdge (Cisco IOS-XE SD-WAN): - ISR 1100 - ISR 4000 - ASR 1000 - ENCS 5000 - CSR 1000v (Virtual) vEdge (Viptela OS): - vEdge 100 - vEdge 1000 - vEdge 2000 - vEdge 5000 - vEdge Cloud (Virtual) NOTE: - Edge devices can be physical or virtual - All WAN edges communicate via vSmart (not directly) ---------------------------------------------------- # Deployment Summary Table # Component | Role | Deployment Location | Form Factor | Image Name / Extension | Model # vSmart | Controller (routing, policy) | DC / Cloud | VM | vsmart-x.x.x.qcow2 / .ova | vSmart-VM # vBond | Validator (auth/orchestrator) | DMZ / Public Cloud| VM | vbond-x.x.x.qcow2 / .ova | vBond-VM # vManage | Orchestrator / Manager | DC / Cloud | VM | vmanage-x.x.x.qcow2 / .ova | vManage-VM # Notes: # - Physical routers are optional; WAN Edge devices (vEdge/CSR1000v/IE) provide branch/DC routing # - Always VM-based; no physical vSmart/vBond/vManage appliances # - Cluster/HA: Best practice 2 nodes for vSmart & vManage; vBond 2–3 nodes # - Connectivity: # - WAN Edges connect to vSmart for control plane # - WAN Edges connect to vBond on bootstrap # - vManage connects to vSmart and WAN Edges for monitoring and management ------------------------------------------------------ ------------------------ OMP PROTOCOL ------------------------------ Overlay Management Protocol (OMP) ---------------------------------- - Runs between vEdge <--> vSmart - TCP Port : 17900 - Control-plane only (no data traffic) OMP Advertises: 1) OMP Routes : Customer prefixes (VPN routes) 2) TLOC Routes : Transport reachability (System-IP, color, encap) 3) Service Routes: Firewall, IDS/IPS, Load-balancer services Security: - Control plane secured with DTLS/TLS - Data plane secured with IPsec BFD (Bidirectional Forwarding Detection): ---------------------------------- - Runs over IPsec tunnels - Measures path liveliness & quality - Metrics: latency, jitter, packet loss - Starts AFTER IPsec tunnel establishment ********************** CONTROLLER HOSTING ************************** 1) Cloud: - AWS - Azure - GCP - Cisco-hosted cloud 2) On-Premises: - VMware ESXi - KVM on Linux ********************** SD-WAN ROUTING ****************************** ------------------------ UNDERLAY ROUTING -------------------------- Purpose: - Provides basic IP connectivity - SD-WAN overlay depends on underlay reachability Transport Types: - MPLS - Internet - LTE / 4G / 5G Routing Protocols: - Static - OSPF - BGP Underlay Diagram: vEdge | MPLS / Internet / LTE | vEdge NOTE: - No SD-WAN intelligence here - Only IP reachability is required ------------------------ OVERLAY ROUTING --------------------------- Topology & Route Exchange: Service Router Service Router (OSPF / BGP) (OSPF / BGP) | | | | -------- -------- | vEdge | | vEdge | -------- -------- \ / \ / ======== OMP (DTLS/TLS) ======== vSmart ======== OMP (DTLS/TLS) ======== / \ / \ -------- -------- | vEdge | | vEdge | -------- -------- | | | | Service Router Service Router (OSPF / BGP) (OSPF / BGP) Overlay Notes: ---------------------------- - vEdges NEVER exchange routes directly - All routing info flows through vSmart - vSmart applies centralized policies Route Flow: ---------------------------- 1) Service routers advertise routes (OSPF/BGP) 2) vEdge learns routes 3) vEdge redistributes routes into OMP 4) vSmart processes & applies policy 5) vSmart advertises routes to other vEdges 6) vEdges install routes & form IPsec tunnels <<<<<<<<<<<<<<<<<<<< SD-ACCESS (SDA) >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> DNA Center (DNAC) ---------------------------- - SD-Access controller - Automation, assurance, analytics, security - Wired, wireless, IoT management SDA Fabric Roles ---------------------------- Fabric Edge Node: - Access switches - Connect end devices Fabric Border Node: - Connects SDA fabric to external networks (WAN, Internet) Fabric Control Node: - Runs control-plane functions - LISP mapping - Requires higher CPU & memory SDA Deployment Models ---------------------------- Greenfield: - New hardware - New SDA fabric from scratch Brownfield: - Existing traditional network - Migrated to SDA SDA Terminology ---------------------------- Underlay: - Physical network (switches, routers, cabling) Overlay: - VXLAN tunnels between fabric nodes Fabric: - Underlay + Overlay combined <<<<<<<<<<<<<<<<<<<<<<<<<<<< WIRELESS (CISCO WLAN) >>>>>>>>>>>>>>>>>>>>>>>> ===================================== BASIC WIRELESS CONCEPTS ===================================== - Wireless = shared medium (half-duplex) - Uses RF (Radio Frequency) instead of copper/fiber - CSMA/CA used instead of CSMA/CD - All clients compete for airtime Bands: ---------------------------------- 2.4 GHz : Longer range, more interference, 3 non-overlapping channels 5 GHz : Shorter range, less interference, many channels 6 GHz : Wi-Fi 6E, clean spectrum, very low interference ===================================== WLC PORTS (PHYSICAL) ===================================== Ports are PHYSICAL hardware ports on the Wireless LAN Controller. 1) Service Port ---------------------------------- - Out-of-Band (OOB) management only - Used for: * Initial setup * Recovery * Troubleshooting - Default DHCP scope provided by WLC - Typical IP range : 192.168.1.2 – 192.168.1.30 - NOT used for AP or client traffic - Usually ACCESS port 2) Console Port ---------------------------------- - CLI access - Used during initial installation - Serial connection 3) Distribution / Network Port ---------------------------------- - Main data port - Carries: * AP CAPWAP traffic * Client data traffic * Management traffic - Configured as TRUNK - Multiple VLANs allowed ===================================== WLC INTERFACES (LOGICAL) ===================================== Interfaces are LOGICAL and VLAN-mapped. ---------------------------- STATIC INTERFACES --------------------------- 1) Management Interface ---------------------------------- - Mandatory interface - Used for: * WLC management * AP registration * CAPWAP control - Has default gateway - APs MUST reach this interface 2) Service Port Interface ---------------------------------- - Logical mapping of service port - Used for OOB management 3) Virtual Interface ---------------------------------- - Used for: * Web authentication * Client mobility * DHCP proxy - Default IP : 1.1.1.1 - Never routed - Same on all WLCs in mobility group 4) AP-Manager Interface (Legacy) ---------------------------------- - Used for CAPWAP data traffic - Merged with Management interface in newer releases ---------------------------- DYNAMIC INTERFACES -------------------------- Dynamic Interfaces: ---------------------------------- - Used for client data forwarding - Each dynamic interface maps to: * One VLAN * One subnet - WLAN (SSID) is mapped to a dynamic interface Max supported: ---------------------------------- - Up to 512 dynamic interfaces per WLC ===================================== WLAN / SSID ARCHITECTURE ===================================== WLAN = Logical configuration SSID = Broadcast name Flow: ---------------------------------- SSID (WLAN) ↓ Mapped to Dynamic Interface ↓ Mapped to VLAN ↓ Client gets IP from that VLAN Notes: ---------------------------------- - One WLAN can map to only ONE interface - Multiple WLANs can map to same interface - WLAN ID range : 1 – 16 (model dependent) ===================================== LIGHTWEIGHT ACCESS POINTS (LWAP) ===================================== - APs run lightweight IOS - No local switching logic (unless FlexConnect) - All decisions controlled by WLC AP Port Configuration: ---------------------------------- - AP connects to ACCESS port - AP VLAN = Management VLAN Client Capacity: ---------------------------------- - Recommended : 25–30 clients per radio - Actual max depends on: * AP model * Band (2.4 / 5 / 6 GHz) * Application type ===================================== CAPWAP (CONTROL AND PROVISIONING OF WIRELESS APs) ===================================== CAPWAP Ports: ---------------------------------- - Control : UDP 5246 - Data : UDP 5247 CAPWAP Tunnels: ---------------------------------- - Control tunnel (encrypted) - Data tunnel (can be encrypted or clear) Used for: ---------------------------------- - AP discovery - AP join - Configuration download - Client data (central switching) ===================================== AP DISCOVERY & JOIN PROCESS ===================================== 1) AP boots and gets IP via DHCP 2) AP discovers WLC using: - DHCP Option 43 - DNS entry (cisco-capwap-controller) - Broadcast (local subnet) - Previously joined WLC 3) AP establishes CAPWAP control tunnel 4) WLC authenticates AP (certificate) 5) AP downloads configuration & image 6) AP joins and becomes operational ===================================== FORWARDING MODES ===================================== 1) Central Switching ---------------------------------- - Client traffic tunneled to WLC - Default mode - Used for centralized policy & security 2) FlexConnect (Local Switching) ---------------------------------- - Client traffic switched locally at AP - WLC still controls AP - Used for branch sites / WAN optimization ===================================== WIRELESS SECURITY ===================================== Authentication: ---------------------------------- - Open - WPA2-PSK - WPA3-PSK - WPA2/WPA3-Enterprise (802.1X) Key Management: ---------------------------------- - Pre-Shared Key (PSK) - EAP (RADIUS) Encryption: ---------------------------------- - AES-CCMP - GCMP (Wi-Fi 6) ===================================== ROAMING & MOBILITY ===================================== Mobility Group: ---------------------------------- - Group of WLCs sharing client info - Enables seamless roaming Roaming Types: ---------------------------------- - Layer 2 roaming (same VLAN) - Layer 3 roaming (different VLANs) Fast Roaming: ---------------------------------- - 802.11r (Fast BSS Transition) - Reduces re-authentication delay ===================================== RF MANAGEMENT (RRM) ===================================== RRM Automatically Manages: ---------------------------------- - Channel assignment - Transmit power - Interference mitigation Key Parameters: ---------------------------------- - DCA (Dynamic Channel Assignment) - TPC (Transmit Power Control) ===================================== TROUBLESHOOTING QUICK HINTS ===================================== AP Issues: ---------------------------------- - Check DHCP - Check CAPWAP reachability - Check management interface Client Issues: ---------------------------------- - SSID mapping - VLAN/Dynamic interface - DHCP scope - Security mismatch Useful Commands: ---------------------------------- show ap summary show wlan summary show client summary show interface detailed ========================================= ONE-LINE SUMMARY (INTERVIEW READY) ========================================= Cisco Wireless uses a WLC-based architecture where lightweight APs form CAPWAP tunnels to a controller, WLANs map to VLANs via dynamic interfaces, and centralized control provides security, mobility, and RF optimization. <<<<<<<<<<<<<<<<<<<<<<<<<<<< CISCO WLC & LWAP MODELS >>>>>>>>>>>>>>>>>>>>>> ========================================= CISCO WIRELESS LAN CONTROLLERS (WLC) ========================================= --------------------------- PHYSICAL WLC MODELS -------------------------- Legacy / AireOS Controllers: ------------------------------------- 2504 WLC - Small branch / campus - Supports up to ~75 APs 5508 WLC - Medium enterprise - Supports up to ~500 APs 5520 WLC - High performance - Supports up to ~1500 APs 8540 WLC - Large enterprise / service provider - Supports up to ~6000 APs --------------------------- VIRTUAL WLC MODELS --------------------------- vWLC (AireOS Virtual Controller): ------------------------------------- - Runs as VM - Supports limited AP count (license-based) - Used for lab, POC, small deployments Images: - VMware ESXi : .ova - KVM : .qcow2 --------------------------- IOS-XE WLC MODELS ---------------------------- Catalyst 9800 Series (Recommended / Modern): ------------------------------------- C9800-CL - Cloud / Virtual WLC - Runs on ESXi, KVM, AWS, Azure C9800-L - Entry-level physical WLC C9800-40 - Mid-size campus WLC C9800-80 - Large campus / data center - High scalability NOTE: - IOS-XE based - Replaces AireOS WLCs - Supports Wi-Fi 6 / 6E - Integrated security & automation ========================================= LIGHTWEIGHT ACCESS POINTS (LWAP) ========================================= LWAPs use CAPWAP and are centrally controlled by WLC. --------------------------- LEGACY LWAP MODELS --------------------------- Aironet 1140 / 1240 / 1250 ------------------------------------- - 802.11a/b/g/n - End-of-life (EOL) Aironet 1600 / 2600 / 3600 ------------------------------------- - 802.11n / 802.11ac Wave 1 - Enterprise indoor APs Aironet 1700 / 2700 / 3700 ------------------------------------- - 802.11ac Wave 1 / Wave 2 - High-density deployments --------------------------- MODERN LWAP MODELS --------------------------- Catalyst 9100 Series (Wi-Fi 6 / 6E): ------------------------------------- C9105 - Entry-level indoor AP C9115 - Mid-range enterprise AP C9120 - High-density AP C9130 - High-performance AP (external antennas) C9136 - Wi-Fi 6E (6 GHz support) --------------------------- OUTDOOR LWAP MODELS -------------------------- Aironet / Catalyst Outdoor APs: ------------------------------------- C9124 - Outdoor Wi-Fi 6 AP C9136I - Outdoor Wi-Fi 6E 1540 / 1560 Series - Mesh / outdoor deployments ========================================= LWAP OPERATING MODES ========================================= Local Mode: ------------------------------------- - Central switching - Client traffic tunneled to WLC FlexConnect Mode: ------------------------------------- - Local switching at AP - Centralized control from WLC - Ideal for branch offices Monitor Mode: ------------------------------------- - Security monitoring only - No client access Sniffer Mode: ------------------------------------- - Packet capture for analysis Rogue Detector Mode: ------------------------------------- - Detects rogue APs ========================================= WLC & LWAP COMPATIBILITY NOTES ========================================= - AireOS WLCs support Aironet APs - Catalyst 9800 supports: * Catalyst 9100 APs * Selected Aironet APs - Wi-Fi 6 / 6E APs require IOS-XE WLC ========================================= ONE-LINE SUMMARY (INTERVIEW READY) ========================================= Cisco Wireless uses physical or virtual WLCs (AireOS or IOS-XE based) to centrally manage lightweight access points, with Catalyst 9800 controllers and 9100-series APs being the current enterprise standard. <<<<<<<<<<<<<<<<<<<<<<<<<<<< CISCO MERAKI (DETAILED) >>>>>>>>>>>>>>>>>>>>>>>>>>>> ===================================== WHAT IS CISCO MERAKI ===================================== Cisco Meraki is a CLOUD-MANAGED networking solution that provides centralized management for: - Wireless (Wi-Fi) - Switching - Security & SD-WAN - Cameras - Sensors Key Principle: ------------------------------- - Control & Management Plane = Meraki Cloud - Data Plane = Always local (cloud NEVER forwards user traffic) ===================================== MERAKI CORE COMPONENTS ===================================== Meraki Cloud Dashboard ------------------------------- - Centralized web-based controller - No on-prem controller required - Used for: * Configuration * Monitoring * Troubleshooting * Firmware upgrades - Single dashboard for all Meraki devices - License REQUIRED (device stops working if license expires) Meraki Devices (Hardware) ------------------------------- - MR : Wireless Access Points - MS : Switches - MX : Security & SD-WAN Appliances - MG : Cellular Gateways - MV : Smart Cameras - MT : Sensors ===================================== MERAKI ARCHITECTURE (HIGH LEVEL) ===================================== +----------------------------------+ | Meraki Cloud Dashboard | | (Management & Control Plane) | +----------------------------------+ ^ ^ | HTTPS | | | ------------------------------------------------------- | | | | MR APs MS Switches MX Firewall MV Cameras (Wireless) (Switching) (SD-WAN) (Video) IMPORTANT: ------------------------------- - Devices initiate outbound HTTPS to cloud - No inbound ports required - Devices continue forwarding traffic if cloud is unreachable ===================================== MERAKI TERMINOLOGIES ===================================== Organization ------------------------------- - Top-level container - Represents a company - Holds multiple networks Network ------------------------------- - Logical grouping of devices - Types: * Wireless * Switch * Security & SD-WAN * Combined (all-in-one) Template ------------------------------- - Used to standardize configurations - One template can manage many networks - Ideal for large deployments Claiming ------------------------------- - Adding device serial numbers to dashboard Zero Touch Provisioning (ZTP) ------------------------------- - Device auto-downloads config after internet access Firmware Management ------------------------------- - Cloud-controlled upgrades - Scheduled maintenance windows ===================================== MERAKI WIRELESS (MR SERIES) ===================================== --------------------------- MR AP MODELS --------------------------- Entry / Mid / High Density: ------------------------------- MR28 : Wi-Fi 6 (Entry) MR36 : Wi-Fi 6 (Mid-range) MR46 : Wi-Fi 6 (High density) MR56 : Wi-Fi 6 (Very high density) Wi-Fi 6E: ------------------------------- MR57 : Wi-Fi 6E (6 GHz support) Outdoor: ------------------------------- MR76 MR86 Wireless Architecture: ------------------------------- - NO WLC - APs managed directly by cloud - Local switching only ===================================== MERAKI SWITCHING (MS SERIES) ===================================== --------------------------- MS SWITCH MODELS --------------------------- Access Switches: ------------------------------- MS120 MS125 MS130 Distribution / Core: ------------------------------- MS210 MS225 MS250 MS350 MS355 Features: ------------------------------- - Layer 2 & Layer 3 - Cloud monitoring & config - Stacking supported - No CLI (dashboard only) ===================================== MERAKI SECURITY & SD-WAN (MX SERIES) ===================================== --------------------------- MX MODELS --------------------------- Branch / SMB: ------------------------------- MX64 / MX67 MX68 Mid-size: ------------------------------- MX75 MX85 Enterprise: ------------------------------- MX95 MX105 MX250 MX450 Key Features: ------------------------------- - Stateful firewall - IDS / IPS (Snort) - Content filtering - Auto VPN (SD-WAN) - Application-aware traffic shaping ===================================== MERAKI SD-WAN (AUTO VPN) ===================================== Auto VPN Characteristics: ------------------------------- - Zero-touch IPsec VPN - No manual tunnel config - Hub-and-spoke or full-mesh Architecture: ------------------------------- +----------------------+ | Meraki Cloud | | (Policy & Control) | +----------------------+ ^ ^ | HTTPS | | | +-------------+ +-------------+ | MX Branch 1 |---| MX Branch 2 | +-------------+ +-------------+ IPsec VPN (Data Plane) IMPORTANT: ------------------------------- - Cloud does NOT forward VPN traffic - IPsec tunnels are built directly between MX devices ===================================== MERAKI CELLULAR (MG SERIES) ===================================== MG Models: ------------------------------- MG21 MG41 Use Cases: ------------------------------- - Primary WAN - Backup WAN (LTE/5G) - Temporary sites ===================================== MERAKI CAMERAS (MV SERIES) ===================================== MV Models: ------------------------------- MV22 MV32 MV72 Features: ------------------------------- - On-device storage - Cloud-managed - No NVR required - AI-based analytics ===================================== MERAKI SENSORS (MT SERIES) ===================================== MT Models: ------------------------------- MT10 : Temperature / Humidity MT20 : Door open/close MT30 : Water leak detection Used for: ------------------------------- - IoT - Data center monitoring - Retail monitoring ===================================== MERAKI TRAFFIC FLOW EXAMPLES ===================================== Wireless Client Flow: ------------------------------- Client --> MR AP --> MS Switch --> MX Firewall --> Internet SD-WAN Flow: ------------------------------- Branch MX --> IPsec Tunnel --> Hub MX --> Data Center ===================================== MERAKI vs TRADITIONAL CISCO (KEY DIFFERENCE) ===================================== Meraki: ------------------------------- - Cloud managed - No controller - No CLI - Extremely fast deployment - Subscription mandatory Traditional Cisco: ------------------------------- - On-prem controllers - CLI-based - More granular control - Higher operational complexity ===================================== ONE-LINE SUMMARY (INTERVIEW READY) ===================================== Cisco Meraki is a cloud-native networking platform providing centralized management for wireless, switching, security, and SD-WAN, with local data forwarding and zero-touch deployment. <<<<<<<<<<<<<<<<<<<<<<<<< CISCO WIRELESS vs CISCO MERAKI vs CISCO VIPTELA >>>>>>>>>>>>>>>>>>>>>> ========================================= HIGH-LEVEL COMPARISON ========================================= Cisco Wireless : Enterprise WLAN (Campus Wi-Fi) Cisco Meraki : Cloud-managed networking (LAN / WLAN / WAN) Cisco Viptela : Enterprise / SP SD-WAN (WAN only) ========================================= PURPOSE & USE-CASE ========================================= Cisco Wireless ---------------------------------- - Focus: Wireless LAN (Wi-Fi) - Used in: Campus, enterprise, offices, universities, hospitals - Technology: CAPWAP-based WLAN architecture Cisco Meraki ---------------------------------- - Focus: Simplified cloud-managed networking - Used in: SMBs, distributed enterprises, retail, branches - Technology: Dashboard-driven cloud management Cisco Viptela ---------------------------------- - Focus: SD-WAN for WAN connectivity - Used in: Enterprises, ISPs, large WAN deployments - Technology: Overlay SD-WAN with centralized control ========================================= ARCHITECTURE COMPARISON ========================================= Cisco Wireless ---------------------------------- Controller-based architecture - Controller : WLC (AireOS / IOS-XE 9800) - APs : Lightweight APs (CAPWAP) - Control : On-prem or cloud-hosted controller Cisco Meraki ---------------------------------- Cloud-native architecture - Controller : Meraki Cloud Dashboard - Devices : APs, Switches, Firewalls - Control : 100% cloud-managed - Local forwarding continues even if cloud is unreachable Cisco Viptela ---------------------------------- SD-WAN controller-based architecture - vManage : Management plane - vSmart : Control plane - vBond : Orchestration - Edge : vEdge / cEdge routers ========================================= MANAGEMENT STYLE ========================================= Cisco Wireless ---------------------------------- - Managed via: * WLC GUI / CLI * Cisco DNA Center (optional) - Requires deeper networking knowledge - Highly customizable Cisco Meraki ---------------------------------- - Managed ONLY via Meraki cloud dashboard - Zero-touch provisioning - Very simple & intuitive - Requires active license Cisco Viptela ---------------------------------- - Managed via vManage - Policy-driven WAN automation - Requires strong routing & WAN knowledge ========================================= PLANE SEPARATION ========================================= Cisco Wireless ---------------------------------- - Management Plane : WLC / DNAC - Control Plane : CAPWAP - Data Plane : AP ↔ WLC (or local via FlexConnect) Cisco Meraki ---------------------------------- - Management Plane : Meraki Cloud - Control Plane : Cloud signaling - Data Plane : Local forwarding (always local) Cisco Viptela ---------------------------------- - Management Plane : vManage - Control Plane : vSmart (OMP) - Data Plane : IPsec tunnels between WAN edges ========================================= TRAFFIC FORWARDING ========================================= Cisco Wireless ---------------------------------- - Central switching (default) - Local switching (FlexConnect) Cisco Meraki ---------------------------------- - Always local switching - Cloud NEVER forwards user traffic Cisco Viptela ---------------------------------- - IPsec tunnels over MPLS / Internet / LTE - Application-aware path selection ========================================= SECURITY ========================================= Cisco Wireless ---------------------------------- - WPA2 / WPA3 - 802.1X - RADIUS / ISE integration Cisco Meraki ---------------------------------- - Built-in firewall - IDS / IPS - Content filtering - Cloud-based security policies Cisco Viptela ---------------------------------- - IPsec encryption - Segmentation (VPNs) - Integrated firewall (cEdge) - Secure service insertion ========================================= SCALABILITY & TARGET CUSTOMERS ========================================= Cisco Wireless ---------------------------------- - Medium to very large enterprises - Campus-focused deployments Cisco Meraki ---------------------------------- - SMB to mid-size enterprises - Retail, schools, distributed branches Cisco Viptela ---------------------------------- - Medium to very large enterprises - ISPs and service providers - Large WAN environments ========================================= LICENSING MODEL ========================================= Cisco Wireless ---------------------------------- - Traditional licenses - Smart licensing (IOS-XE) Cisco Meraki ---------------------------------- - Subscription-based (mandatory) - No license = device stops working Cisco Viptela ---------------------------------- - Subscription-based SD-WAN licenses - Tied to throughput & features ========================================= WHEN TO USE WHAT ========================================= Use Cisco Wireless if: ---------------------------------- - You need enterprise-grade campus Wi-Fi - Advanced RF, roaming, and control required Use Cisco Meraki if: ---------------------------------- - You want simple, fast, cloud-managed networking - Minimal CLI / deep networking required Use Cisco Viptela if: ---------------------------------- - You need intelligent WAN routing - Multiple links (MPLS + Internet + LTE) - Policy-based traffic steering ========================================= ONE-LINE SUMMARY (INTERVIEW READY) ========================================= Cisco Wireless focuses on enterprise Wi-Fi, Meraki delivers cloud-managed LAN/WLAN/WAN simplicity, while Cisco Viptela provides scalable, policy-driven SD-WAN for complex enterprise and service-provider WANs. <<<<<<<<<<<<<<<<<<<<<<<<<<<< APPLICATION CENTRIC INFRASTRUCTURE (ACI) >>>>>>>>>>>>>>>>>>>>>>>>>>>> ACI OVERVIEW ---------------------------------- - Cisco SDN solution for Data Center automation - Application-centric policy model - Integrates compute, storage, and network - Controller: APIC (Application Policy Infrastructure Controller) - Main goal: Simplify provisioning, enforce policies, and reduce manual configuration ---------------------------------- ACI COMPONENTS ---------------------------------- 1. APIC (Application Policy Infrastructure Controller) - Centralized controller for the ACI fabric - Handles policy definitions, configuration, and health monitoring - Clustered deployment (3, 5, or 7 nodes for redundancy) - Provides REST API, GUI, and CLI access 2. Spine Switches - Core of ACI fabric - High-speed backbone interconnect - Connects only to leaf switches (no leaf-to-leaf connection) - Handles all routing within fabric 3. Leaf Switches - Access layer switches in the fabric - Connects endpoints: servers, VMs, firewalls, routers - Connects to spine switches (full mesh) - Hosts Endpoint Groups (EPGs) - Provides external connectivity to WAN/DC 4. Endpoints & EPGs (Endpoint Groups) - Logical grouping of devices with similar policy - Can be physical servers, VMs, or containers - Policies are applied at EPG level (contracts, QoS, security) 5. Tenants - Logical administrative domains - Isolates apps, policies, and network segments - Can represent a customer, business unit, or environment (Prod/Dev) 6. VRFs (Virtual Routing and Forwarding) - Provides Layer 3 segmentation per tenant - Isolates traffic between tenants 7. Bridge Domains (BD) - Layer 2 domain within a tenant - Contains one or more subnets - Associates with EPGs for intra-tenant connectivity 8. Contracts - Defines communication rules between EPGs - Can include filters, QoS, and security policies - Mandatory for EPGs to communicate across BDs or tenants 9. Physical & Virtual Integrations - Supports VMware vCenter, Hyper-V, KVM - Integration with storage arrays (FC/FCoE) - Can connect to external routers/firewalls via L3Out ---------------------------------- ACI DESIGN DIAGRAM (TEXTUAL) ---------------------------------- +-----------------+ | APIC Cluster| | (Policy/GUI/API)| +-----------------+ | | Management & Policy | ========================= | Spine Layer | | High-speed Backbone | ========================= / | | \ / | | \ ================ ================= ================= | Leaf 1 | | Leaf 2 | | Leaf 3 | ... | | EPGs & | | EPGs & | | EPGs & | | | Access | | Access | | Access | | ================ ================= ================= | | | | | | +---------+ +---------+ +---------+ | Servers | | Servers | | Servers | | /VMs | | /VMs | | /VMs | +---------+ +---------+ +---------+ - Spine switches never connect to endpoints, only leaf switches - Leaf switches host endpoints and connect to spines (full-mesh) - APIC cluster ensures redundancy and policy enforcement - EPGs + Contracts define communication, not IP addresses - Tenants isolate resources logically - Bridge Domains group L2 networks, VRFs handle L3 separation ==================================================================================================== # Cisco ACI Data Center Deployment Details ==================================================================================================== # Overview: # Cisco ACI is Cisco's SDN solution for data centers. # It provides policy-based automation, multi-tenant segmentation, and application-aware networking. # ACI consists of physical and logical components deployed in a spine-leaf architecture. # 1️⃣ APIC (Application Policy Infrastructure Controller) # Role: Central management/controller of ACI fabric # Deployment Location: Data Center (on-premises) # Form Factor: Hardware appliance or VM # Models / Hardware: # - APIC-EMP / APIC-2310 / APIC-2330 (hardware) # - APIC-VM for VMware, KVM # Images / Extensions: # - apic-x.x.x.ova # VMware # - apic-x.x.x.qcow2 # KVM # Connectivity: Must reach all leaf and spine switches via management network # 2️⃣ Spine Switches # Role: Core fabric switches for high-speed east-west traffic # Deployment Location: DC fabric core # Models: # - Cisco Nexus 9500 series (fixed or modular) # - Cisco Nexus 9336 / 9364 (smaller DCs) # Form Factor: Physical switch # Connectivity: Connects to all leaf switches (full mesh) # Notes: Spines do not connect to endpoints directly # 3️⃣ Leaf Switches # Role: Access layer of the ACI fabric # Deployment Location: DC fabric edge # Models: # - Cisco Nexus 9300 / 93180 / 9372PX (ACI-capable) # - Cisco Nexus 9500 leaf modules (if modular) # Connectivity: Connects to endpoints (servers, firewalls, routers, load balancers) and all spine switches # 4️⃣ Endpoints / Devices # - Servers (physical or hypervisor) # - Firewalls, Load Balancers # - Storage (SAN/NAS) # - Can connect via leaf switches # Notes: ACI fabric abstracts networking; policies are applied via APIC # 5️⃣ ACI Fabric Overview # - Architecture: Spine-Leaf # - Management Plane: APIC cluster # - Control Plane: Embedded in leaf and spine switches (VXLAN, BGP EVPN) # - Data Plane: Hardware forwarding in leaf/spine # - Policy Model: Application Network Profile (ANP) and Endpoint Groups (EPGs) # 6️⃣ Deployment Summary Table # Component | Role | Location | Form Factor | Models / Images | Notes # APIC | Controller / Management | Data Center | HW / VM | APIC-2310/2330 / apic-x.x.x.ova/qcow2 | Central management, policy enforcement # Spine | Core fabric switch | DC Core | Physical | Nexus 9500 / 9336 / 9364 | Connects to all leaves # Leaf | Fabric edge switch | DC Edge | Physical | Nexus 9300 / 93180 / 9372PX | Connects endpoints, applies policies # Endpoints | Servers, Firewalls | DC / Rack | Physical / VM | - | Connects to leaf switches # Notes: # - APIC cluster: Best practice 3 nodes (HA) # - Spine-leaf: Non-blocking full mesh between leaf and spine # - Endpoints grouped in EPGs, policies applied via APIC # - VXLAN used for overlay network # - Integration: Can integrate with vSphere, Hyper-V, KVM, storage, firewalls, load balancers ==================================================================================================== ======================== ACI LOGICAL FLOW ======================== Tenant: Sales_Tenant ---------------------------------- - Logical administrative domain - Isolates resources & policies | v +--------------------+ | Bridge Domain | | BD: Sales_BD | | - L2 domain | | - Contains subnets | +--------------------+ | v +--------------------+ | Endpoint Group | | EPG: Sales_App | | - Logical grouping | | - Hosts servers/VMs| +--------------------+ | v +--------------------+ | Contract | | - Rules for | | EPG communication| | - Filters / QoS / | | Security | +--------------------+ | v +--------------------+ | L3Out / External| | - Connects to WAN | | - Router / Firewall| | - Outside DC access| +--------------------+ ✅ Flow Explanation: 1. Tenant defines a logical boundary for an application or business unit. 2. Bridge Domain (BD) creates Layer 2 domain inside the tenant. 3. Endpoint Groups (EPGs) host servers/VMs sharing the same policy. 4. Contracts define what EPGs can communicate with each other. 5. L3Out connects the fabric to external networks, WAN, or internet. ✅ Key Points: - Traffic between EPGs requires a contract, even within the same BD. - Multiple EPGs can share a BD, but their communication is controlled by contracts. - L3Out provides external connectivity without violating tenant isolation. - Policies are applied logically, not per IP. <<<<<<<<<<<<<<<<<<<<<<<<<< MERAKI WIRELESS vs CATALYST WIRELESS (BRIEF) >>>>>>>>>>>>>>>>>>>>>>>>>> ------------------------------- ARCHITECTURE ------------------------------- Meraki Wireless - Cloud-managed (Meraki Dashboard) - No on-prem controller - APs connect directly to cloud for management - Data traffic always forwarded locally Catalyst Wireless - Controller-based (Catalyst 9800 WLC) - On-prem or cloud-hosted controller - APs join WLC using CAPWAP - Central or local switching supported ------------------------------- MANAGEMENT ------------------------------- Meraki Wireless - Web dashboard only - No CLI - Zero-touch provisioning - Very easy to operate Catalyst Wireless - GUI + CLI - Advanced configuration & tuning - Requires deeper wireless knowledge ------------------------------- FEATURE DEPTH ------------------------------- Meraki Wireless - Simplified features - Limited RF and policy granularity - Ideal for standard enterprise Wi-Fi Catalyst Wireless - Full enterprise feature set - Advanced RF, roaming, QoS, security - Large-scale and complex designs ------------------------------- SCALABILITY ------------------------------- Meraki Wireless - Best for SMB to mid-size enterprises - Distributed branch deployments Catalyst Wireless - Designed for medium to very large enterprises - Campus, stadiums, hospitals, universities ------------------------------- SECURITY & INTEGRATION ------------------------------- Meraki Wireless - Built-in security - Limited deep integration Catalyst Wireless - Deep integration with ISE, DNAC - Advanced policy and segmentation ------------------------------- LICENSING ------------------------------- Meraki Wireless - Subscription mandatory - License expiry = network stops working Catalyst Wireless - Smart licensing - APs continue working even if license expires ------------------------------- WHEN TO USE ------------------------------- Use Meraki Wireless when: - You want fast deployment - Minimal operational complexity - Cloud-first approach Use Catalyst Wireless when: - You need full control & customization - High-density or mission-critical WLAN - Large enterprise campus ------------------------------- ONE-LINE SUMMARY ------------------------------- Meraki Wireless is cloud-simple and fast to deploy, while Catalyst Wireless offers deep control, scalability, and enterprise-grade customization. ============================================= Configuration Commands =============================================== Router#config-transaction Router(config)# <<<<<<<<<<<<<< CATALYST WIRELESS (IOS-XE 9800 WLC) >>>>>>>>>>>>>> ============================ BASIC SYSTEM / PLATFORM ============================ show version show inventory show running-config show startup-config show clock show license summary ============================ INTERFACES & VLANs ============================ show ip interface brief show interfaces trunk show vlan brief show interface GigabitEthernet1/0/1 ============================ AP (ACCESS POINT) COMMANDS ============================ show ap summary show ap inventory all show ap config general show ap image all show ap join stats summary show wireless stats ap AP JOIN TROUBLESHOOTING: ---------------------------- show wireless management trustpoint show capwap client config show logging | include CAPWAP ============================ WLAN / SSID ============================ show wlan summary show wlan id show wireless profile policy summary show wireless tag policy summary ============================ CLIENT MONITORING ============================ show wireless client summary show wireless client mac show wireless client detail show wireless stats client ============================ RF / RADIO ============================ show ap dot11 5ghz summary show ap dot11 24ghz summary show wireless rf summary show wireless rrm summary ============================ DEBUG (USE CAREFULLY) ============================ debug wireless mac debug capwap events debug wireless errors enable <<<<<<<<<<<<<< CISCO VIPTELA SD-WAN (vEdge / cEdge) >>>>>>>>>>>>>> ============================ DEVICE / SYSTEM ============================ show version show system status show system uptime show control connections show certificate status ============================ OMP (CONTROL PLANE) ============================ show omp summary show omp peers show omp routes show omp tlocs show omp services ============================ CONTROL CONNECTIONS ============================ show control local-properties show control connections show control connections-history ============================ BFD / TUNNELS ============================ show bfd sessions show bfd sessions detail show tunnel statistics show tunnel statistics colors ============================ IPSEC ============================ show ipsec local-sa show ipsec remote-sa show ipsec statistics ============================ ROUTING ============================ show ip route show ip route vpn 10 show ip route vpn 0 show running-config vpn 10 ============================ INTERFACES ============================ show interface show interface statistics show interface queue ============================ APPLICATION / POLICY ============================ show app-route stats show policy from-vsmart show policy service-chain ============================ LOGS / EVENTS ============================ show log show alarms show events <<<<<<<<<<<<<< CISCO MERAKI SD-WAN (MX) >>>>>>>>>>>>>> NOTE: ---------------------------- - Meraki is DASHBOARD-FIRST - CLI is LIMITED and READ-ONLY - No full configuration via CLI Access: ---------------------------- - Local status page: http://setup.meraki.com - Appliance management IP ============================ LOCAL STATUS / BASIC INFO ============================ show version show interfaces show route show arp show ipsec status ============================ VPN / SD-WAN ============================ show vpn status show vpn peers show vpn routes ============================ UPLINK / WAN ============================ show uplink show uplink stats show cellular status ============================ PACKET CAPTURE (LOCAL) ============================ tcpdump -i any tcpdump -i wan0 tcpdump host ============================ PING / TROUBLESHOOT ============================ ping traceroute ============================ PRIMARY MONITORING (DASHBOARD) ============================ Dashboard → Security & SD-WAN: - VPN status - Uplink loss / latency / jitter - Application usage - Traffic shaping - Failover events IMPORTANT: ---------------------------- - Cloud NEVER forwards data traffic - If cloud is unreachable → traffic still flows - Configuration & monitoring mainly via dashboard <<<<<<<<<<<<<< QUICK INTERVIEW SUMMARY >>>>>>>>>>>>>> Catalyst Wireless: - Full CLI + GUI - Deep visibility (AP, RF, clients) Viptela SD-WAN: - Strong CLI for control, tunnels, routing - OMP, BFD, IPsec visibility Meraki SD-WAN: - Dashboard-centric - CLI only for local status & debugging <<<<<<<<<<<<<< CISCO ACI for Data Center >>>>>>>>>>>>>> # COMMAND DESCRIPTION show version # Show APIC software version show cluster status # Show APIC cluster health & membership show topology # Show fabric topology (leafs/spines) show fabric membership # List all nodes in the fabric show health # Show overall fabric health show health detail # Detailed health info per object show interface brief # Quick interface status summary show interface status # Detailed interface status show pod # Show pod information show node # Show node status and role show leaf # List all leaf switches show spine # List all spine switches show tenant # List all tenants show bridge-domain # Show all Bridge Domains (BDs) show vrf # Show VRFs per tenant show endpoint-group # Show all EPGs show endpoint # Show all endpoints (MAC/IP) show endpoint summary # Summary of endpoints per EPG show contract # List all contracts show filter # Show contract filters (rules) show l3extOut # Show external L3 connections show l3extInstP # Show external EPGs/L3Out associations show endpoint mac # Show endpoint details by MAC show endpoint ip # Show endpoint details by IP show endpoint interface # Show which leaf/interface hosts an endpoint show faults # List all fabric faults show events # Show fabric events log show interface counters errors # Show interface error counters show interface counters drops # Show interface drop counters show log # Show APIC system logs # ======================== CREATE TENANT ======================== # Create a tenant # Note: CLI config is mostly via REST/NX-API; this is a lab example using CLI-like structure # For lab demonstration, you can run API calls or use GUI echo "Create Tenant: Sales_Tenant" # Logical admin domain # ======================== CREATE VRF ======================== echo "Create VRF: Sales_VRF in Sales_Tenant" # Layer 3 isolation for tenant # ======================== CREATE BRIDGE DOMAIN (BD) ======================== echo "Create Bridge Domain: Sales_BD in Sales_Tenant" # L2 domain inside tenant echo "Assign subnet 10.1.1.0/24 to Sales_BD" # Subnet for BD echo "Associate Sales_BD with Sales_VRF" # Link BD to VRF # ======================== CREATE APPLICATION PROFILE ======================== echo "Create App Profile: Sales_App_Profile in Sales_Tenant" # Groups EPGs # ======================== CREATE ENDPOINT GROUP (EPG) ======================== echo "Create EPG: Sales_App_EPG under Sales_App_Profile" # Logical grouping of endpoints echo "Associate EPG with BD: Sales_BD" # Map to Bridge Domain # ======================== CREATE CONTRACT ======================== echo "Create Contract: Sales_Contract in Sales_Tenant" # Define allowed communication echo "Add Subject / Filter: Allow HTTP, HTTPS, ICMP" # Define rules echo "Provide/Consume contract for Sales_App_EPG" # Apply to EPGs # ======================== CREATE L3Out / EXTERNAL CONNECTIVITY ======================== echo "Create L3Out: Sales_L3Out in Sales_Tenant" # Connect fabric to external router/firewall echo "Assign external network/subnet 192.168.1.0/24" # External subnet echo "Associate L3Out with VRF: Sales_VRF" # Link to tenant VRF echo "Associate external EPGs with internal EPG via contract" # Apply contract # ======================== VERIFICATION COMMANDS ======================== show tenant # Verify tenant exists show vrf # Verify VRF show bridge-domain # Verify BD show endpoint-group # Verify EPG show contract # Verify contract show l3extOut # Verify L3Out show endpoint # Verify endpoints show endpoint summary # Endpoint summary per EPG show faults # Check for any configuration issues show health # Check overall fabric health