Date post: | 28-Jan-2018 |
Category: |
Technology |
Upload: | robb-boyd |
View: | 297 times |
Download: | 0 times |
Programmable ASICs:Why Hardware Mattersin the Age of SDN and VirtualizationSpecial Guests:
September 13th, 2017
PeterJones|PrincipalEngineer,EnterpriseNetworks
DaveZacks |DistinguishedEngineer,EnterpriseNetworks
Dave is a Distinguished System Engineer, and has been with Cisco for 17 years.
As a DSE within the Enterprise Networks Architecture team, Dave works primarilyon capabilities and solutions that are anywhere from 12 to 36+ months out,helping to define these projects and then assisting as they progresstowards and through design, development, and solution introduction.
Dave has a strong background in, and focus on, customer requirements,and integrating these into the products and solutions Cisco builds.Dave has a special interest in Flexible Hardware and Fabric architectures.
[email protected] @DaveZacks
By Way of Introduction …
[email protected] @petergjones
By Way of Introduction …
PeterisaSoftwarePrincipalEngineer,andhasbeenwithCiscoforover10years.
PeterworksonSystemArchitecture(ASIC,hardware&software)forCiscoCampusswitching,withextensiveexperiencewiththeCatalyst3850/3650platformaswellastheUADPASIC.Aswell,Peterisheavilyinvolvedinthestandardizationof2.5G/5GBASE-TEthernetasNBASE-TAlliancechair andinIEEE802.3.
CiscoDNAandtheImportanceofNetworkInnovation
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Innovationinthenetwork
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Source:Forrester Source:OpenComputeProject
TimeITspendsonoperations80% CEOsareworriedaboutITstrategynotsupportingbusinessgrowth57%
NetworkExpenses DeploymentSpeed
0 10 100 1000
Computing Networking
Seconds0
100%
CAPEX OPEX
33% 67%
TheNeedforAgilityChangingEnterpriseRequirements
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
AdvancedPersistentThreats
DevicesperPerson3.64
Mobileworldrequiresaccesstoeverythingeverywhere
Mobility
DevicesperAdmin100K
AgilityandNewConsumptionModels
Cloud
IoTThingsConnected7.5BUnmanneddevices
growingatrapidpace
EnterpriseTrendsDrivingDigitalTransformation
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Users,DeviceandIOTSegmentation
EnablingSeamlessMobility
SecureConnectivitytotheCloud
SettingUpEnd-EndSecurity
VLAN1 VLAN2 VLAN3
WAN
BranchA
VLAN1 BranchA VLAN3
RemoteVLAN2
HQ
ACL1 ACL2
ACL2 ACL3
TraditionalNetworksCannotMeettheDemand
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Security
Automation Analytics
Virtualization
Cloud Service Management
Programmable Physical and Virtual infrastructure
Principles
Insights and Experiences
Automation and Assurance
Security and Compliance
Open
API Driven
ProgrammableSD-Access and Assurance
Catalyst 9000
DNA Center
Encrypted Traffic AnalyticsSoftware Subscription Licensing | DNA Advisory, Technical, Support Services
CiscoDigitalNetworkArchitectureOverview
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
YouNeedaNetworkthatDrivesYourDigitalBusiness
HardwareCentric FlexibleHardware,SoftwareDriven
Manual Automated
PiecemealSecurity IntegratedSecurity
NetworkMonitoring Analytics&Insights
TraditionalNetwork Digital-ReadyNetwork
CiscoisRewritingtheNetworkPlaybook
Visibility into traffic and threat patternsWho, What, When,
Where, How
Translate Business Intent to Network PolicyAutomate the management and provisioning millions of devices instantly
NETWORK. INTUITIVE.THE
Machine learning at scale to provide increasing intelligencePredictive performance and assurance
The more you use, the wiser it gets
Built on Cisco DNA
CiscoDNAandtheImportanceofNetworkHardware
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
EISGArchitecture TeamDavidGoeckeler
CiscoSVP,SecurityandNetworkingCiscoLiveLasVegas2016
Innovationinthenetwork
ASICsareapillarofCiscoinnovation…
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Let’sTalkAbout
ASICs
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
WhatisanASIC?
“AnApplicationSpecificIntegratedCircuit isanintegratedcircuitcustomizedforaparticularuse,ratherthanintended
forgeneralpurposeuse…”
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
WhytalkASICs?
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Created and Worn byTAM DELL’ORO@DellOrorGroup
CLUS 2017
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Advanced,Multi-Core,Feature-RichRoutingSilicon
QFPQuantumFlow Processor
FullyProgrammable
Scalable
Advancedon-chipQoS
Secure
ExtensibleArchitecture
OperationalUniformity
NewFoundationalCapabilities
SpeedofInnovationVelocity
FoundationforVirtualization
PlatformfortheFuture
IOS-XETheEvolutionofIOS
TakingtheProvenStrengthsofIOStotheNextLevel
UADPUnifiedAccessDataPlane
Flexible,Programmable,High-PerformanceSwitchingSilicon
FullyProgrammable
Scalable
Advancedon-chipQoS
Secure
ExtensibleArchitecture
“Peoplethatarereallyseriousaboutsoftwareshouldbuildtheirownhardware”100%Cisco-developedFlexibleSilicon– UnlockingthePowerofDNAatHardwareSpeeds
HardwareandSoftwareBuildingonaStrongFoundation
QuickPrimer–HowNetworkingSiliconisDesignedandBuilt
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
HowisanASICbuilt?
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Then, it starts with coding…
VerilogVHDL
Synthesis ProcessConverts code into
logical gate constructs (Netlist)
ASICs– FromDefinitiontoDeployment
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Then, it starts with coding…
VerilogVHDL
Synthesis ProcessConverts code into
logical gate constructs (Netlist)
Floor planning
Floor Planning& Placement
Arrange and interconnect constructs,connect power, minimize crosstalk, etc…
ASICs– FromDefinitiontoDeployment
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Imprint design on Silicon Wafer
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Discretetransistor MOSFET(metaloxidesemiconductor
fieldeffecttransistor)
FinFET(finfieldeffecttransistor)
NANDgate
NORGate
UniversalGates
XORGateANDGate
ORGate NOTGate
XNORGate
… whichcanbeusedtobuildanyoftheotherlogicgates…
… mostlyused@22nmandabove
… mostlyused@16nmandbelow
…which,whenweputmillionsofthemtogetheronasilicondie,produceachip!
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Discretetransistor MOSFET(metaloxidesemiconductor
fieldeffecttransistor)
FinFET(finfieldeffecttransistor)
NANDgate
NORGate
UniversalGates
XORGateANDGate
ORGate NOTGate
XNORGate
… whichcanbeusedtobuildanyoftheotherlogicgates…
… mostlyused@28nmandabove
… mostlyused@22nmandbelow
UADP1.1191Mgates
UADP2.0270Mgates
Catalyst3850mGig
Catalyst9300,9400,9500
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Weputamanhere…
… usingthis …
ApolloGuidanceComputer
… whichwasbuiltfromnothingbutthat …
4100ICs,eachofwhichcontainedasingle3-inputNORgate
Inotherwords…weputamanonthemoonwithlessthan10,000transistors…
Ittakes7.46billiontransistorstorouteyourpackets!
Withtheappropriatesecurity,segmentation,QoS,encryption,fragmentation,etc,etc …
FunFact!
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Wearetalkingtransistors…
andhowmanywecanpackinanASICdie…
“Thenumberoftransistorsincorporatedintoachipwillapproximatelydoubleevery18- 24months…”
“Moore’sLaw”- 1975
TransistorWidthmeasuredinNanometers
Nanometer=OneBillionthofaMeter
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Ahumanhairis
~100,000nanometers
inwidth
APerspective
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Redbloodcell(7,000nm)risesto10th floor
EmpireStateBuilding =1454feettotip=443meters
ONENANOMETER–lessthan1/4th ofaninch!
… aboutthesamethicknessasthreepenniesonthisscale…
… andwebuildtransistorsmeasuredinnanometers…
HowSMALLis SMALL?
Singlehum
anhair
~100,000nm
… andthenwecometothislittlepinprickoverhere…
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Useofsmallertechnologyleadstobenefits… LowerPrice
LowerPower
HigherPerformance
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
ASICRe-Spin(ifneeded)
Overview–TheImportanceofFlexibleSilicon
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
WhyDoesCiscoDevelop
OurOwnSilicon?
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
WhyDoesCiscoDevelop
OurOwnSilicon?
Simpler DeploymentOptionsBetterInsightandOptimization
IncreasedSecurityMostAppropriateScalability
FlexibilityandInvestmentProtectionviaProgrammability
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
TraditionallytheASICprocessingpipelineis
FIXEDIPv4
IPv6
TraditionalFixedASICProcessingPipeline
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
… andhaschallengeshandlingNEW
PROTOCOLS…MPLS
TraditionalFixedASICProcessingPipeline
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
FlexibilityinNetworking…
… disconnectwithtraditionalfixedASICprocessing….
EvolutionofBusiness
IndustryTrends– SDN
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
SowherecanFlexibleASICshelpus?
TheBigQuestion…
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
DNAFlexibleInfrastructure– ProgrammableASICSilicon
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
FlexRewrite
ProgrammableASICsdeliver
FLEXIBILITY…
FlexParser
Flexible,ProgrammableProcessingPipeline
GRE
IfIPv7wereinvented
tomorrow…
...wecouldprobablyhandleitviatheProgrammable
Pipeline!
FlexCounters
Stage1
Stage2
Stage3
Stagen
IPv4
IPv6
VXLAN
MPLS
IPv7
FlexibleASICProcessingPipeline
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
FlexRewrite
FlexParser
ProgrammableASICsprovidesupportforTUNNELLING…IPv4
… ataskatwhichCisco’sProgrammable,FlexibleASICsexcel!
TunnelledtrafficrequiresRECIRCULATION…
IPv4VXLAN
High-performance,low-latencyrecirculationpath…FlexCounters
Flexible,ProgrammableProcessingPipeline
Stage1
Stage2
Stage3
Stagen
FlexibleASICProcessingPipeline
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Catalyst3550Circa2003
60Mtransistors47,226linesofcode
Catalyst3750Circa2008
210Mtransistors86,220linesofcode
Catalyst3850Circa2013
1300Mtransistors(Latestversion:3BILLLIONtransistors)
1,490,000linesofcode
Catalyst9300/9400/9500 – 2017
New!
UADP2.0:7.46Btransistors!2,160,000 linesofcode
AllCisco-developedsiliconDrivingthebenefitsofverticalintegration–Hardwareandsoftwareworkingtogether!
Justlikesomeotherfamousexamples…
ASICs– FromDefinitiontoDeployment
NetworkInnovation–FlexibleSwitchingSilicon…UADP– UnifiedAccessDataPlane
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Latestversion–7.46BILLIONtransistors
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Parsedepthof256Bytes
15programmablestages
Upto250framesacrossstagesatonetime…Abilitytohandlecurrentand
futureprotocols– extremelyflexibleandcapable
Excellentforencapsulations,whichoftenneedrecirculation
UADPprovidesan
unparalleleddegreeofFlexibility
inanAccessSwitch
UADPDesignedforFlexibility
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Parsedepthof256Bytes
15programmablestages
Upto250framesacrossstagesatonetime…
Underla
y
Outer,IP,Header
Outer,MAC,Header
UDP$Header
VXLAN$Header
Overlay
Inner,(Original),IP,Header
Original,Payload
Inner,(Original),MAC,Header
14#Bytes(4#Bytes#Optional)
Ether# Type0x0800
VLAN#ID
VLAN#Type0x8100
Source'MAC
Dest.'MAC 48
48
16
16
16
Src VTEP MAC Address
Next6Hop MAC Address
20#Bytes
Dest.&IP
Source&IP
Header#Checksum
Protocol#0x11#(UDP)
IP#HeaderMisc.#Data 72
8
16
32
32Dst RLOC IP Address
Src RLOC IP Address
8"Bytes
Checksum"0x0000
UDP"Length
VXLAN&Port
Source&Port 16
16
16
16 UDP&4789
Hash"of" inner"L2/L3/L4" headers"of"original"frame."Enables"entropy"for"ECMP"load"balancing.
8"Bytes
Reserved
VN#ID
Segment#ID
VXLAN"Flags"RRRRIRRR 8
16
24
8
Allows#16M#possible# VRFs
Allows#64K#possible# SGTs
VXLANasaprotocolhadnotevenbeeninventedwhenUADP1.0wasdesigned…
YetUADPforwardsVXLANinhardware,athighperformance
inIOS-XE16.3+…thankstoFlexibility!
in
VXLANisacomplexprotocol…
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
UADPUnparalleledFunctionality
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
GREERSPANCAPWAPMPLSVXLAN
VXLAN-GPE*,NSH*,andmore…
Current,andPossibleFuture,UADPUseCases
*NotCommitted
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Catalyst9300/9400/9500
Enabledby
UADP2.0
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
UADP1.0
First GenerationofUADPASIC
Catalyst3850Copper
Catalyst3650 CatalystSFPFiber
1G/10GEthernet
240GStackingCapacity
6MBPacketBuffer
128BitEncryption
24KNetflow Records
56GBandwidth
FirstFlexible,ProgrammableASICdesigned forCampus
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Catalyst3850Multigigabit Catalyst3850
SFP+Catalyst3650Multigigabit
1G/10G/40GEthernet
240GStackingCapacity
6MBx2PacketBuffer
256BitMACSECEncryption
24Kx2Netflow Records
160GEBandwidth
Catalyst3650Mini
Dual CoreRunning@500MHz
1588IEEE
EnhancedPerformance, Capabilities&Security
UADP1.1
First GenerationofUADPASICwithEnhancements
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
UADP1.01.3BTransistors
1G/10GEthernet
240GStacking
24KNetflow
56GBandwidth
UADP1.13BTransistors
1G/10G/40GEthernet
160GEBandwidth
Dual Core500MHz
1588IEEE
UADP2.07.46BTransistors
Upto64Kx2Netflow Records
SharedLookup
Upto240GEBandwidth
Upto2Xto4XTables
UADP– ProgrammableASICFamily
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
UADP1.01.3BTransistors
UADP1.13BTransistors
UADP2.07.46BTransistors
Onetransistorforeveryonein
India…Onetransistorforeveryonein
India,China,US&Canada…
Onetransistorfor
Everyoneintheworld!
OrLookedAtAnotherWay…
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Catalyst9300
Catalyst9400
Catalyst9500
StackableAccess ModularAccess FixedAggregation
BuiltonCisco’sInnovativeUADPASIC&OpenIOS-XE
Catalyst9000FamilyOverview
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Upto32MBPacketBuffer
Upto64Kx2Netflow RecordsEmbedded
Microcontrollers
SharedLookup
Upto240GEBandwidth
Upto384KFlexCounters
Upto2Xto4X
forwarding+TCAM
UniversalDeploymentsAdaptableTables
EnhancedScale/BufferingMulticoreresourceshare
InvestmentProtectionFlexiblePipeline
UADP2.0NextGenerationofASICInnovation
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Stage#17
FlexParser
IGR
Stage#..
Stage#..
Stage#2
Stage#1
LookupTable
LookupTable
LookupTable
LookupTable
LookupTable
LookupTable
LookupTable
LookupTable
LookupTable
LookupTable
LookupTable
LookupTable
LookupTable
LookupTable
LookupTable
LookupTable
LookupTable
LookupTable
LookupTable
LookupTable
Stage#8
FlexParser
EGR
Stage#..
Stage#..
Stage#2
Stage#1
TCAM/SRAM
17IngressStages
8EgressStages
FlexParser256B
FlexParser256B
FinalDecisiononPacket’sFuture
FinalDecisiononPacket’sFuture
Ingress Programmable
Pipeline
Egress Programmable
Pipeline
At each stage, 2simultaneous lookups
UADP2.0– IngressandEgressProcessingStages,Detail
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Ingress Programmable
Pipeline
Punt
Flex Parser
IGR
NF
SPAN
VXLAN
L3/L2
FIB
LookupTable
LookupTable
LookupTable
ACL
MCast
LookupTable
LookupTable
LookupTable
QOS
LookupTable
LookupTable
LookupTable
LookupTable
LookupTable
LookupTable
LookupTable
LookupTable
LookupTable
LookupTable
SPAN
Flex Parser
EGR
Stage#..
Sec
MPLS
Policy
Egress Programmable
Pipeline
TCAM/ SRAM
FlexibleLook up Tables
(SharedAcross Cores)
Programmed to understand
VXLAN
Programmed to understand
MPLS
ASIC
Micro Code
Software Features
VXLAN MPLSNG
Protocol
UADP2.0– MicrocodeProgramsthePipelines
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
64 B Line Rate
(Upto 240 Gbps)
Up to 300 Mpps
Switching Capacity
Minimal added latency with Recirculation (1/2 us)
Downlinks + Uplinks
64 B Frame BW – 56G/ASIC
CPU
Recirculation
Expandable Recirculation BW
UADP2.0– Performance
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco PublicTableSizesCanbeTailoredtoSupportMultipleUseCases
CollapsedCore-WANTemplate
AggregationTemplate
Core-BorderTemplate
L3&NATMixofL2/L3Capabilities
L3&CrossDomainPolicy
FlexibleASICTemplatesSRAM/TCAM
§ MAC
§ IPv4/IPv6
§ VACL
§ PACL
§ RACL
§ SGACL
§ QoS
§ NAT
§ SPAN
§ CoPP
Customizedtablesizeforeachfunctionbasedontheplaceinthenetwork
ClientScale
Access-EdgeTemplate
SRAM
FIB(48K)
SGT(16K)
IGMP(32K)
Host(32K)
MCAST(16K)
MAC(80K)
InternalResources
TCAM
SECACL(18K)
Tunnels(1K)
NAT(2K)
QoSACL(18K)
Others
InternalResourcesLISP
(1K)
SRAM TCAM
FIB(64K)
SGT(32K)
IGMP(16K)
Host(32K)
MCAST(48K)
MAC(32K)
InternalResources
SECACL(18K)
Tunnels(1K)
NAT(16K)
QoSACL(3K) Others
InternalResources
LISP(1K)
Core-BorderTemplate
64K
16K
32K
32K
48K
8K
64K
Access-EdgeTemplate
UADP2.0TurnsCatalyst9000intoaSwissArmyKnifeFlexibleASICTableAllocations
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Whatdoesallofthismeanforme?
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
CiscoProgrammableHardwareequals
FLEXIBILITYADAPTABILITY
Enabling NetworkEvolution–acritical requirement
forDNA
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Wanttodouble-click?
BRKARC-3467CiscoLiveUS2017,LasVegas
90minutesofawesomesilicongeekery withDaveandPeter–
thissession,++
NetworkInnovation–LeveragingFlexibleSiliconforEncryptedTrafficAnalytics(ETA)
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
NetworkThreatsareEvolvingtoLeverageEncryption
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Providing Security While Maintaining Privacy!
Encrypted Traffic
Non-Encrypted Traffic
How do you Analyze threats without decrypting traffic flows?
CanWeActuallySolveThis?
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
• End to end confidentiality• Channel integrity during inspection• Adapts with encryption standards
MalwareinEncryptedTrafficIs the payload withinthe TLS session malicious?
Malware Detection and Visibility without Decryption
• Audit for TLS policy violations • Passive detection of Ciphersuite vulnerabilities
CryptographicComplianceHow much of my digital businessuses strong encryption?
EncryptedTrafficAnalytics
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Initial Data Packet
IP HeaderTCP Header
TLS Header
Ciphersuites
TLS versionSNI (Server Name)
Initial Data Packet(s)
CertificateOrganization
Issuer
Issued
Expires
TLS field (in ClientHello) Inference
Offered Cyphersuites Browsers prefer heavy weight and more secure encryption
algorithms,Mobile applications prefer
efficient encryptionExtensions
Client: I support crypto!
Server: I support thatcrypto, and I’m me!
Client: Take this secretand let’s encrypt!
Server: Your secret looksgood; let’s encrypt!
Client/Server: encrypteddata!
InitialDataPacket(IDP)
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
TimeFlowStart
Sequence of Packet Lengths and Times
Malware Behavior Network Behavior
Communication with command control server
Sequence of packet lengths
Write to the disk Time interval between packet
SequenceofPacketLengthsandTimes(SPLT)
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Bestafera
Self-Signed Certificate
Data Exfiltration
C2 Message
Google Search
Initial Page LoadPage Refresh
Autocomplete
DetectingMalwarebyBehaviorIDP,SPLT,andMachineLearning
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Wanttodouble-click?
BRKCRS-1560CiscoLiveUS2017,LasVegas
DeepdiveintowhatmakesETAtick– withSarav Radhakrishnan,DE
NetworkInnovation–LeveragingFlexibleSiliconforSoftware-DefinedAccess
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Separationofthe ForwardingandServicesPlanes
Overlay encapsulation
FabricUnderlayisthe ForwardingPlane• ConnectsNetworkDevices• Leveragesexistingtopologies• Simple,best-practicedeployment
FabricOverlayistheServicesPlane• ConnectsUsersandDevices• Leveragesstandardtechnologies• AddressIndependentEnd-to-EndPolicy
Overlay control plane
Underlay
Overlay
Employee
Supplier
Devices
CiscoFlexibleSiliconallowsforFlexibility–KeytoSupportingtheEvolutiontoNetwork
Fabrics
DNAFlexibleInfrastructureSupportingFabricEvolution– andSoftware-DefinedAccess
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
1. Control-PlanebasedonLISP2. Data-PlanebasedonVXLAN3. Policy-PlanebasedonTrustSec
Key Differences• L2 + L3 Overlay -vs- L2 or L3 Only• Host Mobility with Anycast Gateway• Adds VRF + SGT into Data-Plane• Virtual Tunnel Endpoints (No Static)• No Topology Limitations (Basic IP)
SD-AccessComponentsQuickRecap
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
AutomationAppPolicyInfraControl
(APIC-EM)
Identity&PolicyIdentityServicesEngine
(ISE)
AssuranceNetworkDataPlatform
(NDP)
EmployeesVirtualNetwork
Group1 Group2
IoTVirtualNetwork
Group3 Group4
ContextualVisibilityandTroubleshooting
PolicyMobilitywithnoTopology
Dependence
SD-AccessFabric
StretchedSubnets
SD-AccessSolutionAt-a-Glance
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
APIC-EM
ISE NDP
§ Control-Plane Nodes – Map System that manages Endpoint to Device relationships
§ Fabric Edge Nodes – A Fabric device (e.g. Access or Distribution) that connects Wired Endpoints to the SDA Fabric
§ Identity Services – External ID Systems (e.g. ISE) are leveraged for dynamic Endpoint to Group mapping and Policy definition
§ Fabric Border Nodes – A Fabric device (e.g. Core) that connects External L3 network(s) to the SDA Fabric
Identity Services
Intermediate Nodes (Underlay)
Fabric Border Nodes
Fabric Edge Nodes
§ DNA Controller – Enterprise SDN Controller provides GUI management and abstraction via Service Apps, that share information
DNA Controller
§ Analytics Engine – External Data Collectors (e.g. NDP) are leveraged to analyze Endpoint to App flows and monitor fabric status
Analytics Engine
CControl-Plane
Nodes
BB
§ Fabric Wireless Controller – A Fabric device (WLC) that connects Wireless Endpoints to the SDA Fabric
Fabric WirelessController
CampusFabric
AStrongFoundation,EnabledbyCiscoFlexibleSilicon!
SD-AccessRoles– SupportedbyFlexibleSilicon
Monday (June 26) Tuesday (June 27) Wednesday (June 28) Thursday (June 29)
8:00–10:00 AM 1:30 - 3:30 PM 4:00 - 5:30 PM 8:00–10:00 AM 1:30 - 3:30 PM 4:00 - 5:30 PM 8:00–10:00 AM 1:30 - 3:30 PM 4:00 - 5:30 PM 8:00–10:00 AM 1:00 - 2:30 PM 4:00 - 5:30 PM
TECCRS-2700 (1)Solution
TECCRS-2700 (2)Solution
BRKCRS-2811 (1)External Connect
BRKCRS-2811 (2)External Connect
BRKEWN-2020Wireless
BRKCRS-3811Policy
BRKCRS-2812Migration
BRKDCN-2489DC Integration
BRKCRS-2813Monitor & T’shoot
BRKCRS-2814Assurance
TECCRS-2700 80
SD-AccessCiscoLiveUS2017– SessionsMap
https://www.ciscolive.com/online/connect/search.ww
Summary–CiscoFlexibleSilicon,AStrongFoundationforDNA
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
CriticalRoleofFlexibleSilicon
FromtheHardware…
…totheSoftware andProtocols,withIntegratedSecurity…
totheWholeSolution…
CiscoInnovations– InHardware,Software,andSolutions– TieItAllTogether
“FromtheGates– totheGUI”
Hardware,Software,andSolutionsInnovationAlltheWayUptheStack
IntegratedSecurity
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
https://vimeo.com/155635184
https://vimeo.com/205048279
CiscoEnterpriseASICsDiscussionwithDaveZacks andPeterJones
CiscoLiveBerlin2016
ProgrammableASICsforCiscoCatalystSwitcheswithMuhammadImam
CiscoLiveBerlin2017http://www.cisco.com/c/m/en_us/training-events/events-webinars/webinars/techwise-tv/214-programmable-asics.html
CiscoFlexibleSiliconWanttoKnowMore?
Thank you for watching!