+ All Categories
Home > Technology > Cisco Cloud Networking Workshop

Cisco Cloud Networking Workshop

Date post: 20-Jul-2015
Author: cisco-canada
View: 358 times
Download: 7 times
Share this document with a friend
Embed Size (px)
of 39 /39
Cisco Cloud Networking Workshop Presenter: Jay Bradford CNG SE
  • Cisco Cloud Networking Workshop Presenter: Jay Bradford CNG SE

  • 2

    Housekeeping Notes May 13, 2015

  • 3

    Thank you for attending Cisco Connect Toronto 2015, here are a few housekeeping notes to ensure we all enjoy the session today.

    Please ensure your cellphones / laptops are set on silent to ensure no one is disturbed during the session

    A power bar is available under each desk in case you need to charge your laptop (Labs only)

    House Keeping Notes

  • 4

    Cisco dCloud is a self-service platform that can be accessed via a browser, a high-speed Internet connection, and a cisco.com account

    Customers will have direct access to a subset of dCloud demos and labs

    Restricted content must be brokered by an authorized user (Cisco or Partner) and then shared with the customers (cisco.com user).

    Go to dcloud.cisco.com, select the location closest to you, and log in with your cisco.com credentials

    Review the getting started videos and try Cisco dCloud today: https://dcloud-cms.cisco.com/help


    Customers now get full dCloud experience!

  • 5

    20 min Welcome and Introduction

    30 min Dashboard Demo

    5 min Local MX, MS and MR configuration

    30 min MX | Security Appliances Lab

    45 min MS | Access Switches Lab

    30 min MR | Wireless Access Points Lab

    15 min SM | System Manager Demo

    5 min Q&A and Wrap-Up


  • 6

    Complete cloud-managed networking solution Wireless, switching, security, WAN optimization, and MDM, centrally managed over the web Built from the ground up for cloud management Integrated hardware, software, and cloud services

    Cloud Networking Leader Ciscos fastest-growing acquisition ever: over 100% annual growth 300,000+ customer networks in 147 countries Tens of millions of devices connected worldwide

    Recognized for innovation Gartner Magic Quadrant InfoWorld Technology of the Year TechWorld Mobility product of the year CRN Coolest Technologies

    About Cisco cloud-managed networking

  • 7

    Bringing the cloud to enterprise networks

    Meraki MS Ethernet Switches

    Meraki SM Mobile Device Management

    Meraki MR Wireless LAN

    Meraki MX Security


  • 8

    Scalable Unlimited throughput, no bottlenecks Add devices or sites in minutes

    Reliable Highly available cloud with multiple datacenters Network functions even if connection to cloud is interrupted 99.99% uptime SLA

    Secure No user traffic passes through cloud Fully HIPAA / PCI DSS 3.0 compliant (level 1 certified) 3rd party security audits, daily penetration testing Automatic firmware and security updates (user-scheduled)

    Reliability and security information at meraki.cisco.com/trust

    Management data (1 kb/s) WAN

    Out-of-band management in every product

  • 9

    Cloud Licensing Model is Simple

    Simple Cloud Licensing model No per-feature or per-user licenses Licensing options: 1 Year, 3 Year, 5 Year, 7 Year & 10 Year

    Cloud License price is all inclusive Cloud Management UI 24 x 7 phone support Automated software updates Advanced hardware replacement All features built on the platform All new features

  • 10

    Dashboard Demo

  • 11

    Hands-on Labs

  • 12

    Go to dashboard.meraki.com and login with: username: [email protected] password: meraki123 X is your station ID Please select your network # on the top pull-down menu

  • 13

    Your lab gear lives in our SF office

  • 14

    Network Topology Firewall Configuration: VLAN1 (Default) Subnet: 192.168.(200+x).0/24 Interface: 192.168.(200+x).1 Switch Configuration: VLAN1 (Route to MX) Subnet: 192.168.(200+x).0/24 Interface: 192.168.(200+x).2 VLAN100 (Student) Subnet: 10.0.(100+x).0/24 Interface: 10.0.(100+x).1 VLAN200 (Staff) Subnet: 10.0.(200+x).0/24 Interface: 10.0.(200+x).1 VLAN600 (OSPF) Subnet: Interface: 192.168.0.x X is your lab station number


    L3 Switch


  • 15

    MX Security Appliance

  • 16

    A Complete Unified Thread Management Solution

    Application Control WAN Optimization, Traffic Shaping, Content Filtering

    Security NG Firewall, Client VPN, Site to Site VPN, IDS/IPS, Anti-Malware, Geo-Firewall

    Networking NAT/DHCP, 3G/4G Cellular, Static Routing, Link Balancing

  • 17

    Choosing the right MX for your environment







    Small branches (~50 users)

    Where FW Throughput

    200 Mbps

    Large branch/campus (~10,000 users)

    Large branch/campus (~2,000 users)

    Mid-size branches (~100 users)

    Mid-size branches (~500 users)

    Unique Features

    802.11ac Wireless (MX64W)

    8 x GbE Gigabit uplinks Built-in redundancy 8 x GbE (SPF), 4 x 10GbE (SPF+) Built-in redundancy

    250 Mbps 5 x GbE Gigabit uplinks (up to 2 WAN)

    750 Mbps 8 x GbE Gigabit uplinks (up to 2 WAN) 2 x GbE (SPF)

    1 Gbps

    2 Gbps

    8 x GbE Gigabit uplinks (up to 2 WAN) 8 x GbE (SPF), 4 x 10GbE (SPF+) Built-in redundancy

    For teleworkers (1-5 users) Dual-radio wireless FW throughput: 50 Mbps

    All devices support 3G/4G

  • 18

    Automated site-to-site VPN

    Site-to-site IPsec VPN in just two clicks in the Dashboard

    Simple Creates L3 site-to-site VPN tunnels with just 2 clicks in the dashboard

    Automatic Comparable to Cisco DMVPN, it creates a mesh or hub-and-spoke VPN tunnel between all peers and adjusts to IP changes

    Resilient Automatic failover over to secondary WAN link or 3G/4G USB modem

  • 19

    Ironclad security

    Best IPS SOURCEfire IDS / IPS, updated every day

    Content Filtering

    4+ billions URLS, updated in real-time

    Geo-based security

    Block attackers from rogue countries

    AV / anti-phishing

    Kaspersky AV, updated every hour

    PCI compliance

    PCI L1 certified cloud-based management

  • 20

    MX Configuration Enable VLANs under Configure / Addressing and change the address per the diagram.

    Ensure that non-tagged traffic will be part of VLAN1 (native VLAN) Reserve IP addresses .1 through .10 under DHCP Settings

    Enable site-to-site VPN with following settings: mesh site-to-site VPN, check VPN health & status

    Split tunnel mode, Hub-and-spoke topology (the SEVT Security Appliance as the Hub) Advertise the default subnet to your neighbors Check the Route Table and VPN Status under Monitoring

    Apply the following global default policies (Hint: Below section does not use group policies)

    Completely block BitTorrent For Netflix and Pandora, shape traffic to 100K down, 50 K up. Ensure they are low priority and are marked appropriately. For all voice and video conferencing, remove all bandwidth restrictions and apply priority/marking as needed. Apply content filtering for adult websites Restrict traffic to and from North Korea (hint: this is a L7 firewall policy)

  • 21

    Complete Campus Switching Portfolio

    14 models scaling from access to campus aggregation

    Enterprise-class performance and reliability including non-blocking Gigabit performance, 802.3af/at PoE/PoE+ on all ports, 10GbE uplinks, and voice and video QoS

    Voice and video QoS

    Dynamic Routing

    Layer 7 app visibility

    Virtual stacking

    Enterprise security, ACLs

    Remote packet capture, cable testing

    Feature highlights

  • 22

    MS Switching: Models

    MS220 MS320 MS420 Features

    8, 24, 48 port models Layer 2 Gigabit SFP uplinks Supports rack-mounted RPS

    23001 Integrated fans

    24, 48 port models Layer 3 10Gb SFP+ uplinks Hot-swappable, redundant PSU

    (with integrated fans)

    24, 48 port models Layer 3 10Gb SFP+ interfaces Hot-swappable, redundant PSUs Field-replacement fans Management port

    Ideal scenarios

    Access switching at branch sites Deep visibility into clients,

    applications Energy savings (PoE/PoE+


    Mission critical access switching Fast uplink requirements High availability environments Next-generation 802.11ac wireless

    (MR34) Deep visibility into clients,

    applications Energy savings (PoE/PoE+


    Campus aggregation switching Unified management from access

    to aggregation layer Space-constrained locations

    1 except 8-port models

  • 23

    2014 Release Mission critical features OSPF Dynamic routing with intuitive, browser-based configuration

    IPv6 visibility and tracking Usage statistics for IPv6 address now in Dashboard

    DHCP server Integrated DHCP service to help prevent single points of network failure

    IPv4 Access Control Lists (ACLs) Granular security boundaries configurable by subnet, protocol, port range, or host.

    Virtual Router Redundancy Protocol (VRRP) with DHCP Failover support High availability via a warm spare with automatic failover and DHCP failover support

    Addressing evolving customer needs around redundancy, campus connectivity, and reducing complexity

  • 24

    MS Configuration Part 1 Verify that your switch is operational under Monitoring page (green status, passing traffic) Click on Initialize layer 3 features link to add following SVIs:

    Name: Route to MX, Subnet: 192.168.(200+X).0/24 Interface IP: 192.168.(200+X).2 Gateway: 192.168.(200+X).1 Name: Student, Subnet: 10.0.(100+X).0/24, Interface IP: 10.0.(100+X).1, VLAN: 100 Name: Staff, Subnet: 10.0.(200+X).0/24, Interface IP: 10.0.(200+X).1, VLAN: 200 Name: OSPF, Subnet:, Interface IP: 192.168.0.X, VLAN: 600

    Enable DHCP Server for the Student and Staff subnets Go back to MX Appliance and create static routes for the Student and Staff subnets with gateway IP address to your L3 switch SVI. Also In VPN option checked. Configure OSPF with following settings:

    First configure switch port 25 to be access VLAN 600 Enable OSPF with default Area 0 Edit Student, Staff and OSPF interfaces to use the default Area 0 Below make sure that statically assigned routes override OSPF

    Verify the OSPF neighbors and routes on the switch Monitoring page Start a ping to and try again with port 25 disabled (wait about 30 sec).

  • 25

    So what is going on?

  • 26

    MS Configuration Part 2 Configure VOIP:

    Under Configure / Switch Ports, select ports 5-10 and hit Edit on top Update the tag field with the word Phone Change the type to Access and update the VLANs to 100 and 600 for data and voice respectively Save the changes

    Create a new port schedule Name energy-saving Select 8 to 5 on weekdays only template Save the changes

    Go back to port configuration and apply the port schedule to all the ports with the tag phone (Optional) Cable test and packet capture:

    Go to Switch monitoring page and click on port 1 Run a cable test by clicking on the little arrow next to it When thats successful, click on the run a packet capture on this port link Change the output Stream to CloudShark and duration to 10 sec Wait for the link to CloudShark appear under the capture button and click on it to view

  • 27

    Wireless Access Points

    7 models including indoor / outdoor, high performance and value-priced Enterprise-class silicon including RF optimization, PoE, voice / video support Lifetime warranty on indoor APs

    BYOD policies

    Application traffic shaping

    Guest access

    Enterprise security

    Location analytics

    WIPS 3rd Security Radio

    Feature highlights

  • 28

    Outdoor APs

    3 Stream Triple-Radio 802.11ac 1.75 Gbit/s

    MR18 MR26 2 Stream Triple-Radio 802.11a/b/g/n 600 Mbit/s

    3 Stream Triple-Radio 802.11a/b/g/n 900 Mbit/s


    Making room for new MRs

    2 Stream Triple-Radio 802.11ac 1.2 Gbit/s


    2 Stream Triple-Radio 802.11ac 1.2 Gbit/s




    Indoor APs

    MR66 Dual-Radio 802.11a/b/g/n 600 Mbit/s

    MR62 Single-Radio 802.11b/g/n 300 Mbit/s

  • 29

    Third radio tames hostile RF environments

    Radio dedicated to scanning and protecting RF environment Instantly detects and mitigates interference, vulnerabilities, and attacks on all channels Third radio enables full-time scanning with full-performance client access on 2.4 GHz and 5 GHz radios

    Deeply-integrated with cloud-based software solutions: Air Marshal (security), Auto RF (performance)

    No added cost or complexity Typical deployments: radio operates in background (zero-config) Power users: rich tools available for security and RF management No added cost: no extra hardware, software, or licenses

  • 30

    Bluetooth and Beacons

    Bluetooth & BLE integrated in many consumer devices already

    Beacons use BLE for location services like asset tracking, mobile commerce, and nav iBeacon is Apples BLE trademark

    Gaining traction as an opt-in alternative to WiFi-based location services

    MR32, MR72: Integrated Bluetooth to drive location trends

  • 31

    Use Case: Location Engagement with Beacons

    Seamless site-wide deployment by integrating

    Beacons into the AP

    Better consumer experience with opt-in mobile app integration

    Increased customer visibility with both WiFi and Bluetooth analytics


  • 32

    Use Case: Asset Tracking with Bluetooth

    Seamless site-wide deployment with

    Bluetooth integrated into the AP

    Track Beacon-tagged assets with Bluetooth scanning and location


    Increased administrative visibility with both WiFi and Bluetooth inventory


  • 33

    MR Configuration (APs have been turned off) Verify that your AP is operational under Monitoring page (green status, passing traffic) Rename existing SSID under Configuration to LAB X - Student and enable two additional SSIDs for Staff and Guest On your Staff SSID, use WPA2-Enterprise for authentication and add a RADIUS server with IP address, port 1812 and shared key meraki123. Change client IP assignment to Bridge Mode and VLAN tagging to 200 On your Student SSID, leave association Open but change the splash page to Sign on with my AD server and add the same IP address as above with any admin credentials. Change client IP assignment to Bridge Mode and VLAN tagging to 100 On the guest SSID, ensure the users sign on with a simple click-through splash page that refreshes every half hour (hint: customize it under Configure / Splash Page). Select NAT Mode for client IP assignment to use the Meraki AP as DHCP Server. Under Configure / Firewall & Traffic Shaping, select the guest SSID and create L7 firewall rules to block P2P File Sharing and Gaming on this SSID. Also, limit the per-client bandwidth to 1 Mbps

  • 34

    Cloud-managed Device Mobility

    Flexible, easy provisioning

    Centrally scale 100,000s devices worldwide

    Auto-tagging, dynamic security compliance

    Integrate seamlessly with the rest of your Cisco Meraki network

  • 35

    Deployment & Rollout One-step Enrollment

    Browser: m.meraki.com with NetworkID SM app: NetworkID or QR code Email/SMS: enrollment link

    Automatic Enrollment Meraki integrates directly with Apples DEP portal Supervise devices, disable profile removal, skip setup

    Secure Enrollment by user/group Authenticate device enrollment Automatically inventory devices Automatically license and push apps Automatically configure email, network access

  • 36

    Software & App Management Grant and revoke VPP licenses directly from the Meraki Dashboard

    Remotely install and inventory MSI and PKG files across devices

    Auto push and remove apps by department/student/class/school using AD groups and bulk tagging

    Blacklist/monitor for inappropriate apps and automatically restrict/lock-down

  • 37

    SM Demo

  • 38

    Bonus Lab Demonstration Onboarding:

    Clients will download System Manager upon joining. Firewall blocks everything else. More Security with MDM:

    Only allow clients with SM installed on this SSID. Use MR as DHCP server. Just for Fun: Try wishing for konami code

  • Thank you.