內(nèi)容課件教程aci4x dec

ACIProductManagement

ApplicationCentricInfrastructure

Release4.0,4.1UpdateLegalDISCLAIMERAnyinformationprovidedinthisdocumentregardingfuturefunctionalitiesisforinformationalpurposesonlyandissubjecttochangeincludingceasinganyfurtherdevelopmentofsuchfunctionality.Manyofthesefuturefunctionalitiesremaininvaryingstagesofdevelopmentandwillbeofferedonawhen-and-ifavailablebasis,andCiscomakesnocommitmentastothefinaldeliveryofanyofsuchfuturefunctionalities.CiscowillhavenoliabilityforCisco’sfailuretodeliveranyorallfuturefunctionalitiesandanysuchfailurewouldnotinanywayimplytherighttoreturnanypreviouslypurchasedCiscoproducts.RemoteLeaf/VirtualPoDAPIC/Multi-SiteMulti-CloudExtensionsACIAnywhere-Vision

AnyWorkload,AnyLocation,AnyCloudACIAnywhereIPWANIPWANRemoteLocationPublicCloudOnPremiseSecurityEverywherePolicyEverywhereAnalyticsEverywhereACISoftwareReleaseTimelineQ42016Q22017Q32017Q42017Q12018Q12017ACI2.1ACI2.2LongLivedReleasesACI3.2(x)ACI2.1(x)ACI2.3ACI3.0ACI3.1MaintenanceReleases=>Target–OneReleaseEveryFourMonths.ACI2.0(2)ACI2.1(2)ACI2.2(2)ACI2.3(2)ACI3.0(2)ACI2.2(x)ACI3.1(2)Q22018ACI3.2ACI4.0Q32018Q12019ACI3.2(2)ACI4.0(2)ACI4.1MajorReleases=>LongLivedReleasesTwoLongLivedReleasesAtAnyGivenPointofTime1ActiveMaintenanceWillBePrimarilyFocusedOnLongLivedRelease2TargetDurationOfLongLivedReleaseSupport:Upto18MonthsFromFCSDirectUpgradeFromOneLongLivedToNextLongLivedReleaseWillBeSupportedLongLivedReleasesAreRecommendedForNetworksThatWillNotbeUpgradedFrequently345ACISoftwareReleaseGuidelineShortLivedReleasesNoActiveMaintenanceBeyondSixMonthsFromFCS1Extends‘ACIAnywhere’OptimizedFootprintOperationalSimplicityCloudAutomationSecurity4.0ApplicationCentricInfrastructureBuildingan

Intent-BasedDataCenterSMARTLicensingNetworkingInfrastructure:Nexus9000SeriesPlatforms

ACISoftwareEnablementACILeaf:N9K-C93240YC-FX2

48p1/10/25GSFP28,12p40/100GQSFP28ACIAccessLeafFlexibleSpeed1/10/25/40/100GPortsLine-rateMACSECEncryption40MBBuffer(10MBPerSlice,20MBShared)WithSmartBufferFeature1:1OversubscriptionforHighBandwidthApplicationsFEXSupportTelemetry–FT,FTEandSSXFlexibleTCAMTemplatesN9K-C93240YC-FX2ACI4.0ACISpine:N9K-C9332C

32p40/100GQSFP281RUFormFactorToSupportSmallScaleACIFabricDeploymentsTelemetry–SSXSupportEncryptionSupportOnTheLast8Ports10GSupportWithQSAAtFCSSupportForAC/DC/HVDCPSUAtFCSOnPort-sideExhaustAndPort-sideIntakeOpticsSupportParityWithExistingProductsTransition1stGenNexus9336PQProductN9K-C9332CACI4.0ACISoftwareEnablement

Nexus9000&APICHardwareNexusFoundation:CloudScalePlatformsNexus9300Nexus9500ACI

FuturesNexusC93216TC-FX296p10GT12p100GQSFP28ACI

4.0APIC-CLUSTER-M3(<1200LeafPorts)NexusC93240YC-FX248p1/10/25GSFP28,12p40/100GQSFP28ACI

3.1(2x)Nexus9336C-FX236-port40/100GQSFP28ACI

3.1NexusN2K-C2348TQ-E48p1/10G+6p40GQSFP+ACI

4.0Nexus9332C–

FixedSpine32p40/100GQSFP28,2p10GAPIC-CLUSTER-L3(>=1200LeafPorts)ACI

4.0ACI

FuturesNexusC93360YC-FX296p25GSFP2812p100GQSFP28ACI

4.0ACIMulti-SiteVMVMVMSiteASiteBSiteCSiteDVMVMVMMulti-SiteOrchestratorVMVMVMVMVMVMPolicyConsistencySinglePointOfOrchestrationAvailabilityFaultIsolationScaleShippingSinceACI3.0(Q3CY17)ConsistentPolicyacrosssitesSinglePointofOrchestrationFaultIsolationScaleACI3.2ReleaseMulti-Site+Multi-PodL4-L7ServicesSupportSpine-Spine(DarkFiber)ConsistencyChecker(Multi-Site,APIC,HW)UCS-DOrchestration(6.6)UpTo10Sites,1200LeafsACI3.1ReleaseNexus9364C(FixedSpine)Multi-SiteHealthCheckExternalAuthenticationAudit/AccountingLogsSharedGolfUpTo8Sites,800LeafsACI4.0ReleaseCloudSecL3Multicast2-NodeServiceGraphs(FW+SLB)N9K-9332CSpineUpTo12Sites,1200LeafsACI:Multi-Site

RoadmapACI4.1ReleaseInter-siteL3outMultisite+RemoteLeafL1/L2PBRServiceGraphsPhysicalAppliancePatchAPI,SwaggerACIMiniSupportNewACIRelease4.1MSC2.1181,8004001,0004,0004,0004,000500400NumberOfSitesMaxLeafs(acrosssites)TenantsVRFBDEPGsContractsL3Out(ExternalEPGs)IsolatedEPGsACIRelease3.1MSC1.188002004002,0002,0002,000500400ACIRelease3.2MSC1.2101,2003008003,0003,0003,000500400ACIRelease4.0MSC2.0121,2004001,0004,0004,0004,000500400ACIMulti-Site

ContinuousScaleImprovementsNewACIRemoteLeafSatelliteDCBrownfieldRemoteLocationAVMVMVMVMVMVMVMVMAnyRoutedIPNetworkTelco/Co-loVMVMVMVMVMVMVMRemoteLocationBVMVMVMVMVMVMVMRemoteLocationCVMVMVMVMVMVMVMZeroTouchAutoDiscoveryofRemoteLeaf<=300msRTT,100M+BWUpto20RemoteLocationsSinglecentralmanagementAutomatedL2VXLANextensionRLRLRLPod1ACI3.2ReleaseFEXSupportACIVirtualEdgeOpenStack,KubernetesAtomicCountersACI3.1ReleaseEXandFXModelsvMotionToRemoteLocationVMwareDVS,Hyper-VLocalServiceIntegrationACI4.1ReleaseMACSECInter-VRFLocalSwitchingEPTracker&TrafficMapRemoteLeaf+Multi-SiteRLtoRLdirectswitching64ToRsACI4.0Release128ToRsACI:RemoteLeaf

RoadmapNewACIInfrastructureEnhancementsACI4.0DeploymentNetworkingOperationsAppDIntegration(AppCenter)NetworkInsightResourcesApp(AppCenter)NewTroubleshootingWizardFCNPVInter-VRFL3MulticastAVEEnhancementsDot1xforIPPhonePolicyIndirectionHostRouteOnBorderLeafRoCEv2

NewACIFabricScaleACI3.0503K2565122561610244k2508kMax.NumberofEPs#ofVRFPerTenantMax.#ofVRFMax.#ofBDsperVRFMax.#OfSubnets/BDCommonPervasiveGateway/BDvzAnyContracts/VRF#ofIP’sperMACIP-basedEPGExternalEPG/L3Out#ofMulticastGroupsACI3.1128*3K1k*1k*2561610244k2508kACI3.21283K1k*1k*256164K4k2508kACI4.01283K1k*1k*256164K4k25032kDependsOnProfile-SeeVerifiedScalabilityGuideCiscoACIVerifiedScalabilityGuide:

NewTileProfiles:ACI4.0DefaultProfilePolicyHeavyL2-OnlyModeMulticastScaleFlexibilityToChoosetileProfileBasedOnYourInfrastructureNeedsTile(Total=Local+Remote)ScaleEPMAC64kEPIPv464kIPv4Hostroute+EPIPv4+Multicast96kEPIPv648kLPM38kPolicy128kMulticast32kHighDual-Stack(FX–LeafSwitchesOnly)ACI:FCoENPVandFCNPVSupportFCoENPVFCNPVFCSwitchingN9k-93180YC-EXShippingN/AN/AN9k-93180-LC-EXShippingN/AN/AN9k-93180-YC-FXShippingACI3.2(Q2-CY18)FCNPV8/16GUplinkSANSwitchsupportFutureN9k-93180-YC-FXShippingACI4.0(Q3CY18)FCNPVHostportsupportTrunkingandPortChannelsupportonFCUplinkSanBootFutureN9K-C93360YC-FX2FutureFutureFutureNewACI:MiniACIFabricCloudOptimizedPhysicalFootprint–5RUSystemACIFabricForSmallScaleDeploymentsVMLeaf1–48portsLeaf2–48portsSpine1Spine2APICVMACI4.0No.ofEPGsNo.ofTenantsNo.ofSpinesNo.ofLeafsNo.ofBDsNo.ofEPsNo.ofVRFs10002522-4100020,00025VirtualAPICPhysicalAPIC21PromotionPIDListPriceStep1:SpinesPLUSControllerKitsACI-C9332-VAPIC-B1(Consistsof2xN9K-C9332C+1xAPIC-CLUSTER-XS*)20%discount$83,600Step2:N9300StarterKits(2–pack)Ex:N9K-C93180-EX-B24C(Consistsof2xN9K-C93180YC-EX+8x100GOptics)10%discount$55,000Step3:ACILeafLicense2xACI-ES-XF$30,000Total$168,60014%discountACI:MiniACIFabricFabricScope(4.0)SinglePodandSingleSite200EdgePortsperAPIC-CLUSTER-XSNosupportforRemoteLeaf,GOLFandvPodvAPICConfigESXi6.58vCPU32GMemoryHDD300G&SDD100GlocalstorageACI4.1EnhancementsMiniACIwithMultiSiteSupportACI:Multi-TierArchitecturesSeamlessMigrationFromLegacy3-TierArchitecturesThreeTierACIFabricVerticalExpansionOfACIPolicyDomainInvestmentProtection:ReuseExistingCablePlanReplaceFEXArchitectureWith2ndTierLeaf:BetterVisibility&PolicyEnforcement123VMVMVMVMVMVMVM2ndTierLeaf1stTierLeafSpineACI4.1SimplifyN2/N5/N7kMigrationtoACI4NetworkInsightResourcesGUIEnhancementsUpgradeEnhancementsCapacityDashboard23RootCause?Prevention?Evidence?CapacityPlanning?Uptime?Remediation?NetworkAdminOperationalChallengesEventAnalyticsPresentationID25ACI:IntroducingNetworkInsights-Resources

UnderstandWhat’sRunningInYourNetworkFlowAnalyticsResourceAnalyticsACINetworkInsightsResourcesNetworkInsightResourcesDeepInsightsIntoNetworkHealth(ControlPlane,DataPlane,Capacity,UtilizationandEnvironmentalHealth)LimitedAvailabilityACI:NetworkInsights-Resources

UnderstandWhat’sRunningInYourNetworkResourceAnalyticsDataCollectionAnomalyDetectionRemediationEventAnalyticsDashboardDisplaysFaults,Events,AndAuditLogsInATimeSeriesFashion.EventAnalyticsDashboardNetworkInsightResourcesLimitedAvailabilityACI:NetworkInsights-Resources

UnderstandWhat’sRunningInYourNetworkFlowAnalyticsDashboardDisplaysKeyIndicatorsOfInfrastructureDataPlaneHealth.FlowAnalyticsDashboardFlowAnomaliesPacketDropsLatencyEndPointMoveNetworkInsightResourcesLimitedAvailabilityACI4.0GUIEnhancementsConfigurationFabricMembershipSimplificationL3outSimplificationAdminModuleSimplificationvPod,Multi-podWorkflowSimplificationServiceParameterConsolidationAPICUpgradeimprovementsApplicationTab:ContextSavingOperationsShowUserActivityConfigurableCapacityDashboardTechSupportSimplificationTWSUsabilityImprovements

UsabilityNewAPICAlertsShareSessionAcrossMultipleTabsEnhancedCapacityDashboardAPICUpgrade.ACI4.0Virtualization&CloudAutomationACIVirtualEdgeMaintainExistingOperationalModelsSimpleTransition/MigrationAVS=>AVEPolicyConsistencyAcrossMultipleHypervisorsAVS/AVEFeatureParityQ1CY18ShippingSinceACI3.1(Q1CY18)VMVMVMVMVMVMVMACIVirtualEdge(AVE)ACIVirtualEdgeHypervisorDependentVMVMVMVMVMVMHypervisorBareMetalServerAVSHypervisorAgnosticACIVirtualEdgeVMVMVMHypervisorBareMetalServerNativeSwitchACI3.2ReleaseL4-L7ServicesHealthMonitoringRemotePhysicalLeafSupportRemoteStorageSupportACI3.1ReleaseVLAN,VxLANMicro-SegmentationDistributedFirewallMigrationfromAVSACIFutureVirtualPod(vPod)ProactiveHAVxLANLoadBalancingLocalSwitchingandPolicyContainerL4-L7ServicesMultiNICsupportACI4.0ReleaseTetrationSensorACI:VirtualEdge(AVE)

RoadmapNewIPNetworkCiscoACIVirtualPod

ExtendACItoBareMetalCloudsandRemoteDataCentersBareMetalClouds(IBM,OVH,etc.)RemoteDataCentersCo-locationFacilities(Equinix,CoreSiteetc.)BrownfieldDeploymentsRemotelocationLogicalconnectiontoSpine(BGP-EVPN)On-premisesACIDataCenterVMVMVMVMVMVMVMVMVMVMVMVMVMVMHypervisorPolicyextensionfromOn-premiseDCLimitedAvailabilityACIvPodRequirements

Hardware&SoftwareComponentsSupportedSpinesFixedSpineN9364CN9332CModularSpine(C9504/C9508/C9516)N9732C-EXwithN9K-C950x-FM-E(2)N9736C-FXwithN9K-C950x-FM-E(2)APICControllerSoftwareACI4.0+onwardreleaseVMwarevCenterrunning6.0orlater2hostsforManagementclusterrecommendedManagement&PayloadCanCo-existESXi6.0or6.5EachvSpine(x2)&vLeaf(x2)VMconsumes2vCPU,8GBRAMand80GBstorageEachAVE(oneperESXihost)VMconsumes2vCPU,8GBRAMand8GBstorage*FootprintofVMsmightchangeatFCS.vPodDataCenterOn-PremisesDataCenterLimitedAvailabilityACIvPodLicenseElementsCiscoACIVirtualEdge

(vPodMode-perWorkloadServer)

ACIVirtualEdgeManagementCluster–pervPod

AVE(vPodMode)–perServerAVE(vPodMode)–perServerUpTo6vPodsInFCSReleaseSingleLicensePerManagementClusterUpto64AVEpervPod(@LA–UpTo8)(@GA-32=target)SoftwareLicensePerAVE(AVEisNOTLicensedifNotInvPod)AVE(vPodMode)–perServerLimitedAvailability2SMARTAccountIsRequiredAtOrderTimeACISoftware-onlySKUs-CustomerSuppliesServerHWACIvPodSoftwareLicensingSKUsSubscriptionOf1,3,5YearLicensesWillBeOfferedACISoftware-onlySKUSCustomerSuppliesHWACI-VPOD-MGMT=ACIvPodRedundantManagementClusterSoftware(vSpine&vLeaf)X2$0(NoCost)ACI-VPOD-AVE=ACIvPodVirtualEdgeSoftware(PerServer)$2,500(perServer)1LimitedAvailabilityNodeNodeIndependentOpenstackVMMdomainandOpenshiftContainerDomainOpenshiftNodesrunasOpenstackinstancesconnectedtoaspecialNeutronnetworkwithAPICextensionsOpflexmanagedKVM-OVSandOpenshift-OVSwithoutdoubleencapsulation.BothOpenshiftPODsandKVMinstancesarefirstclasscitizens.SupportedwithRedHatOSP10orhigherandOpenshift3.9.OpenShiftonOpenStackintegrationwithACINodeOpFlexOVSACIPoliciesNetworkPolicyNodeOpFlexOVSFeaturesACI4.0OpFlexOVSOpFlexOVSNovaServersKVMVMNeutronPolicySupportedContainerApplicationPlatformsBaremetalESXiKVM/OpenStackOpensourceKubernetesFutureOpenshiftR4.0PivotalCloudFoundryn/aFutureDockerEE(Kubernetes)FutureFutureFutureMesosphereFutureFutureFutureRefertotheACIvirtualizationsupportmatrixfordetails:

VMVMVMSiteASiteBSiteCSiteDVMVMVMACIExtensionsToMulti-CloudACIMulti-SiteApplianceConsistentNetworkandPolicyacrosscloudsSeamlessWorkloadMigrationSinglePointofOrchestrationSecureAutomatedConnectivityACIAnywhere

Multi-CloudSite1Site2IPNetworkMultisiteOrchestratorAutomatedInter-connectprovisioningSimplifiedOperationswithend-to-endvisibilityConsistentPolicyEnforcementon-Premise&PublicCloudTrialsQ4CY18IP

NetworkAWSRegionEPGWebEPGAPPContractContractEPGDBSGWebSGAPPSGRuleSGRuleSGDBOn-PremiseDCVMVMVMPublicCloudMonitoring&TroubleshootingCommonGovernanceOperationalConsistencySinglePointOfOrchestrationDiscovery&VisibilityPolicyTranslationMulti-SiteACIExtensionstoAWSSite1Site2GAQ1CY19AWSRegionOn-PremisesVMVMVMPublicCloudSiteASiteBMulti-SiteInfraVPCAWSDirectConnectRoutersCSR1000VDXLocationColocationCustomerRouterAmazonVGWCustomerPremiseRouterUserVPC-1AWSInstancesCSR1000VUserVPC-2AWSInstancesCSR1000VBGPEVPNControlPlaneVXLANTUNNEL(DATAPLANE)OVERLAYACIAnywhere:On-PremConnectivityToAWSVPCWithDirectConnect+VPNACI4.1ACISecurityACI2-FactorAuthenticationOptionsVMVMVMVMVMVMVMExternalAuthenticationviaSAMLandIDPssupportedOkta&MSFTADFSLocalAuthenticationTOTPusingGoogleAuthenticatorfor2ndfactorpin/barcodeRSASecureIDPingFederateSSOPingID2-FAFederalCommonAccessCard(CAC)ACI3.0ACI3.0ACI3.1ACI3.2ACI4.0NewACIStretchFabricSpineLeafIPN/WANDCI(N7k/ASR9k)N7k/ASR9kGenerateKeysforEveryLinkSegmentBorderLeafVmwareAVS3.Multi-PODorGOLF1.FabricLinks2.StretchFabric2.BorderLeaftoDCI1.FabricLinksMACSECLinkEncryptionMKAKeyExchangeAPICCentralizedKeyManagementMACSECforFixedSpinesShippingSinceACI3.1SupportForFixedSpines:N9k-9364CN9k-9332CNewCertificationACICertifiedCertifiedCertifiedCertifiedVulnerabilityScannersNessus,Fuzzing,etc…PortScan,AppScanCertified(Raneveryrelease)SecurityCertificationsACI4.0ACIHardeningEveryMajorandMinorSWReleaseFloodingAttacksSYN-FLOOD:RemainstableduringSYNfloodingattackEST-FLOOD:RemainstableduringESTABLISHEDfloodingattackLASTACK-FLOOD:RemainstableduringLASTACKfloodingattackFINWAIT-FLOOD:RemainstableduringFINWAITfloodingattackCLOSING-FLOOD:RemainstableduringCLOSINGfloodingattackPortandServiceScansDEF-CRED:NodefaultauthenticationcredentialsRECON-PORT-TCP:RemainstableduringTCPportscanRECON-PORT-UDP:RemainstableduringUDPportscanRECON-OSID:RemainstableduringOSFingerprintingRECON-IP-PROT:RemainstableduringIPprotocolscanNESSUS-SCAN:Knownvulnerabilityscanner-NessusWEB-DEFECT:KnownwebserverandapplicationdefectsWEB-ID:RemainstableduringwebfingerprintingFuzzingESIC:UUTmustenduremalformedEthernetpacketsICMPSIC:UUTmustenduremalformedICMPpacketsISIC:UUTmustenduremalformedIPv4packetsTCPSIC:UUTmustenduremalformedTCPpacketsUDPSIC:UUTmustenduremalformedUDPpacketsICMPSIC6:UUTmustenduremalformedICMPv6packetsISIC6:UUTmustenduremalformedIPv6packetsTCPSIC6:UUTmustenduremalformedTCPoverIPv6packetsUDPSIC6:UUTmustenduremalformedUDPoverIPv6packetsWebScanNexposeIBMAppScanOpenVasPlatformHardeningAPIC+N9k

ACIMultisite

AVE

VirtualAPIC

vPod

Telemetry

ACI4.0SoftwareHardeningMulti-SiteIP/WANSiteASiteBVMVMVMSiteCMACSECMACSECCloudSecTodayFutureACIAnywhere

EncryptedDCIConnectivityACI4.0NewMulti-SiteIP/WANSite1MACSECMACSECMACSECSite2SiteNtx_keyrx_keyrx_keyrx_keytx_keyrx_keyACI:CloudSec

AutomatedKeyDistribution&Re-KeyACI4.0NewMulti-siteControllerDrivenReliableAndSecureKeyTransportNonDisruptiveRe-keyAlwaysEncryptedACIIntegrations100SGT,64KBindingsonBorderLeafwithISE2.4andACI3.2onwardsTrustSecandACIBorderLeafLeveragingIPBasedEPGShippingSinceACI2.3MappingApplicationAndServiceComponentsToACI(StandaloneApp)[Beta]MappingApplicationAndServiceComponentsToACI(StandaloneApp)[GA]CrossLaunchAppDynamicsandAPICToCorrelateNetworkAndApplicationDataBaselineApplicationHealthStatusInAppDynamicsByCorrelatingACIMOHealthAndFaultsMicro-segmentationBasedOnApplicationTiersACI4.0ACI4.1ACI4.1FutureFutureNetwork&ApplicationHealthCorrelationVMVMVMVMVMVMVMAPPDYNAMICSACI:AppDynamicsIntegrationIdentifyProblemsFasterByCorrelatingApplications&NetworkDataHardwareSensorSupportOnNexus9000EXandFXLeafs&FXSpineLineCardsTetrationNPMDSupportForACIFabric(SingleFaultDomain)TetrationNPMDSupportForMulti-Site,Multi-Pod,RemoteLeafHardwareSensorSupportOnNexus9000EXSpineLineCardsStandaloneApplicationToGenerateACIPolicyFromTetrationADMOutputShippingShippingFutureACI4.1ACI4.1ACI:TetrationIntegrationCaptureIntent&TranslateToACIPolicyTenantandApplicationPolicyRequirements(ADM)RichTelemetryDatafromHardware(Nexus9000)CiscoTetration?PlatformCiscoACIFabricSanFranciscoDataCenterMulti-SiteNewYorkDataCentervEdgevEdgeSD-WANFabricRegionEastRegionWestLosAngelesBranchChicagoBranchACI:SDWAN(Viptela)IntegrationExtendOperationalDomainAndPolicyToBranch&PublicCloudvManageMPLSInternetFWWebserverAppserverDBserverSubnet/24FWWebserverAppserverDBserverSubnet10.121.0/241AppPolicyDeterminesRoutingPathBetweenBranchAndDataCenterToMeetSLA122OptimalPathSelectionBetweenOn-PremAppsandServicesHostedInMulti-RegionAWSACI4.1SecurityEnforcementSecurityManagementApplication

DeliveryControlL4-7Integrations:Integrate,Automate,andInteroperateDataCenterNetworkingRichEcosystemCiscoACIConfigManagementSupportforPuppetandAnsibleAnsibleTenant,FabricAccess,L3Out,AAAPolicies55ACIModulesPuppetNewTenantPolicies-11NewTypesandProvidersAvailabilityAnsible–AnsibleCore(2.4and2.5)Puppet–GitHubnow;PuppetForgesoon

NewIdentifyProblemsFasterbyCorrelating

Applications&Netwo