© Cisco Systems 2008
Catalyst 6500Platform Update – Australia East
Bradley Wong
Technical Marketing Engineer, CSSTG
May 2008
Catalyst 6500 Product Update
Strategic Product Direction…
Video
Peer to Peer
Power
Latest OS
Collaboration
Physical SecurityVideo on Demand
Telepresence
E-mail, Chat, and IM
Unified Messaging
Power Efficiency
On-Line Gaming
File Sharing
Bandwidth &Services
DPI / Policy
ePoE
IPv4 / IPv6
Security
Device Explosion Wired/Wireless
Power Management
WebEx
Video Conferencing
Linux
Apple OS XWindows Vista
Power Scalability
Laptops
Hand HeldsAPs & Surveillance
TrendsDriving New Network Challenges
Catalyst 6500 SeriesLifecycle
VSS
PISA
2007…. 2003 2006 2008 2009 2010 2011 2012 2020
Supervisor Engine 720 with MPLS, IPv6, GRE, NAT, and Bi-dir PIM in HW
40G/100G uplinks
Supervisor Engine 2T
PFC4 (Earl8)
40G interfaces
EARL9 – 150Mpps
DCE L2MP
VoQ
E-Series Chassis
“Big Bang”
720G VSS 1440 2T/ VSS 4T
2003 - 2007
C2
2003 - 2008
• 10GbE Switching
• ISSU Ph1
• Adv. IP Services (IPv6,
MPLS)
• Virtual Switching
• Cisco TrustSec Ph1
• IBNS / NAC Integration
• L4-7 Integration
(ACE, WISM, FWSM, NAM)
• Software Modularity
• Adv. Diagnostics
(GOLD, EEM, Smart Call
Home)
Integrated Services
• 384 GE Ports
• 128 10G Ports
Embedded Services &
Control
CX
2011 - 2012
• 150Mpps
• 40G/100G Uplinks
• Virtual Output Queuing
• DCE L2MP
• Embedded Application
Aware Port Security
and Services
C4
2009 - 2010
Intelligent Networks
• 2 Terabit; 80G/ slot
• 6513E Chassis
• 8p 10G card (CTS, 80G)
• VNET
• VPLS
• Role Based Access Control
• Cisco TrustSec Ph2
• Service Insertion Arch.
• Flexible Netflow
• ACL Dry-run
• Connectivity Mgmt
Processor (CMP)
• 528 GE Ports
• 180 10G Ports
• >40 40G Ports
Infrastructure
Virtualization
Security
Manageability
Application
Intelligence/
Services
Port Density (Chassis)
Campus Distribution/Core Flagship Catalyst 6500
• >500 GE Ports
• >250 10G Ports
• >40 40G Ports
• 100G
Catalyst 6500 IOS Software
Whitney1
12.2(33)SXH
Shipped – Aug’07
• Sup720-10GE
• 6509V-E
• 16 port 10GE linecard
• Virtual Switching
• CatOS transition Ph 1
- Address highest priority features
• Routing/MPLS features from 12.2(33)S
• LLDP-MED
• Lawful Intercept
• 50 new MIBs
Whitney2
12.2(33)SXI
EC – Q3CY08
• ISSU-Phase1 with Virtual Switching and Modular Software
• Virtual Switching Enhancements
• Cisco TrustSec software solution
• CatOS transition Ph 2
• Address some additional priority features
• Identity 4.0
• IPv6 Leadership: 6VPE, EIGRPv6, HSRPv6, IPv6 DHCP Relay, Syslog and SNMP over IPv6, IPsec for IPv6
Half Dome
12.2(50)SY
Target – 1HCY10
• New PFC4 and DFC4
• Flexible Netflow
• End-to-end L2 Encryption
• VPLS and H-VPLS in hardware
• New 80G/slot linecards
Cisco IOS Software Modularity
Cisco IOS
Whitney2.x
12.2(33)SX…
Target – 1HCY09
• IPv6/MPLS with VSS
• 4 Byte BGP ASN
• Enh. HSRP SSO
• BFD SSO
• CSM support
• PBR Set VRF
• REP
• SFP+ Adapter for X2 Slots
• Identity ACL assignment enh.
• Identity over Trunks
• Rollback confirmed change
Unified Network Services
Non-Stop Communication
Operational Manageability
Virtualization
Application Intelligence
Integrated Security
Wiring Closet Backbone Data Center EWAN Metro
SP
Network
Whitney 2
12.2(33)SXI
FCS–Q3CY08
�EIGRPv6
�CTS Infrastructure
�WiSM support on VSS
�IPv6 Support on VSS
�EIGRPv6
�Service advertisement
Framework
�FWSM, ACE, IDSM
support on VSS
�IPsec Leadership with Granikos�Static VTI�IPSec for IPv6
�VTPv3
�E-LMI
�ISSU support for SIP
modules, MPLS-TE, VSS.
�Call-Home Phase 2
�IPSLA integration with E-
OAM
�802.1ak (MRP)
� E-OAM 802.1ag
�802.1x, MAC Auth, Web Auth for Access Control�HSRPv6 on VRF
�HSRPv6 on VRF
�VRF-Lite Aware PBR
�PBR set VRF
� BFD support for HSRP
L2, L3 VPN Innovations
�VRF Aware PBR�6vPE
�OAM RFI link fault fast
recovery
�IPv6 DHCP relay �IPv6 DHCP relay •VSS support for 512
Ether-channels
�IPSec QoS
�Netflow for GRE/GRE-
IPSec
�802.1ad
�802.1x enhancement
�Multihop SXP
�CTS infrastructure
�PACL support on VSS
interface
�FWSM support on VSS
�Encrypt multicast over IPSec
�802.1ak (MRP)
�ISSU Phase-1 �VSS & ISSU�VSS & ISSU
�HSRP/GLBPv6
�Show health, Syslog
Granularity
�Mini-protocol analyzer
�SNMP, Syslog over IPv6
�Mini-protocol analyzer
�Netconf over SSH
�CTS Infrastructure
�Multihop SXP
�PACL support on VSS
interface
�SNMP, Syslog over IPv6
�LLDP-MIB
�Syslog Granularity
�ISSU support for
MPLS-TE
�Pseudowire
redundancy
Catalyst 6500 Product Update
Campus Core, Distribution & Data
Centre Innovations…
Catalyst 6500 SupervisorsSupervisor 720-10G VSS
The Supervisor 720-10G VSS is designed for deployment in the Core and Distribution Layers of
the Network - it is the highest performing Supervisor option available for the Catalyst 6500
platform coupled with the PFC3C/XL, enabling Virtual Switching System (VSS)…
Catalyst 6500 Supervisors PFC3 Comparison
Feature PFC3A PFC3B PFC3BXL PFC3C PFC3CXL
FIB TCAM 256K 256K 1M 256K 1M
Adjacency
Table
1M 1M 1M 1M 1M
Netflow
Table128K (64K) 128K (115K) 256K (230K) 128K (115K) 256K (230K)
MAC Table 64K (32K) 64K (32K) 64K (32K) 96K (80K) 96K(80K)
IPv6 128K 128K 500K 128K 500K
Bi-Dir PIM Hardware Hardware Hardware Hardware Hardware
Native MPLS No Yes Yes Yes Yes
EoMPLS No Yes Yes Yes Yes
VRF Lite Yes Yes Yes Yes Yes
TunnelsHardware Hardware + QoS
Policies
Hardware + QoS
Policies
Hardware + QoS
Policies
Hardware + QoS
Policies
NAT Hardware Hardware + UDP Hardware + UDP Hardware + UDP Hardware + UDP
VSS No No No Yes Yes
Catalyst 6500 WS-X6716-10G-3C/XL
Cisco TrustSec (CTS)
Cisco TrustSec (CTS) affects multiple areas of the network and comprises of improvements in
the following areas:
Confidentiality & Integrity
Centralized Attribute Based Access Control (ABAC) Policy Administration
1
2
3 Identification, Authentication and Authorization for all networked entities,
and classification into topology independent security groups
Cisco TrustSecEndpoint Access
Endpoint Access in Cisco TrustSec deals with how workstations and server resources alike are
able to authenticate into a CTS-enabled network, and are provided appropriate authorization
credentials, including a Security Group Tag (SGT)…
Cisco TrustSecNetwork Device Access
Network Device Access in Cisco TrustSec deals with how Network Devices (Routers &
Switches) are able to authenticate into a CTS-enabled network, and are provided appropriate
authorization credentials, including a Security Group Tag (SGT)…
Cisco TrustSecConfidentiality & Integrity
As part of the Cisco TrustSec architecture, Confidentiality and Integrity may also be provided
via hop-by-hop 802.1ae LinkSec encryption coupled with Replay Protection of each and every
frame, ensuring that each frame is uniquely authenticated…
Cisco TrustSecSGT Imposition
After Endpoint Admission where the endpoint is authenticated and authorized, an SGT will be
derived and associated. If the Access device hardware is capable of imposing an SGT, every
frame that is transmitted with also have an SGT appended as well…
Cisco TrustSecSGT Enforcement
Once the frame reaches a Hardware-capable CTS device that has RBACL enforcement enabled,
the SGT from the workstation will be compared with the DGT associated with the resource it
wishes to access and an enforcement decision will be made…
Service Insertion Architecture Before SIA…
- Modify topology to redirect via WCCP (Svc1)
- Check to ensure network still works
- Modify topology to redirect via PBR (Svc 2)
- Make sure network + WCCP still work
- Modify topology to create two VLANS and routes between them (Svc3)
- Make sure network + WCCP + PBR still work
- Modify topology to create two more VLANs and routes between them (Svc 4)
- Make sure network +WCCP + PBR + additional VLANs / routes still work
- Modify topology to create two more VLANs and routes between them
- Make sure network + WCCP + PBR + add. VLANs and routes still work (Svc 5)
- For redundancy, more configurations needed.
- For troubleshooting, more configurations needed
Service Insertion Architecture With SIA…
- Enable SIA Infrastructure / Service
- Configure “Service Path” on Service Directory
- Service Aware Infrastructure converges around configured service path
- Initiate SIA’ping’ / SIA’traceroute’ to validate service path
SIA SIMPLIFIES service deployment and implementation
X2 - SFP+ Converter ModuleCode Name “Prosciutto”
• Will convert any X2 slot into a SFP+ slot
• Offers flexibility for
long range (X2 - ER, ZR, DWDM),
campus (X2 - LX4, CX4, LR, SR, LRM) and
future
datacenter focused (SFP+ SR, LR, SFP+ direct
attached cable) connectivity options
• Provides seat for 1 x 10G SFP+ slot into a
single X2 10G port
• Available on 6500 with Whitney 2.x 1HCY09
SFP+ direct attachedCX1
• SFP+ copper twinax with direct attached
cables: two SFP+ and one cable in one part
number.
• Lowest cost 10G interconnect mainly
targeted at server-to-switch applications.
• Currently available in 1m, 3m, 5m; 10m
coming later this year.
• Will be available on C6k and C4k via
Prosciutto adapter
Product Type Product ID
10GBASE-CU SFP+ Cable 1 MeterSFP-H10GB-CU1M
10GBASE-CU SFP+ Cable 3 Meter SFP-H10GB-CU3M
10GBASE-CU SFP+ Cable 5 Meter SFP-H10GB-CU5M
Virtual Switching System
Virtual Switching System is a new technology break through for the Catalyst 6500 family…
Virtual Switching SystemVSL Hardware Considerations
“Cisco's virtual switch smashes throughput records”
“The results were impressive: VSS not only delivers a 20 fold improvement in failover times but also eliminates layer-2 and layer-3 redundancy protocols at the same time”
“The performance numbers are even more startling: A VSS-enabled virtual switch moved a
record 770 million frames per second in one test, and routed more than 5.6 billion unicast and
multicast flows in another”
“Cisco's VSS is a significant advancement in the state of the switching art. It dramatically
improves availability with much faster recovery times, while simultaneously providing a big
boost in bandwidth.”
http://www.networkworld.com/reviews/2008/010308-cisco-virtual-switching-test.html
4.65
Published Jan 7th 2008
• Selected “Best of Show” among 240 IT solution vendors, including Applications, Servers, Networks.
• Award was selected by Press and Writers from the 10 major IT magazines and News sites in Japan.
• VSS has received award for break trough technology for reducing TCO and also building Non-stop Networks.
• http://itpro.nikkeibp.co.jp/expo/introduction/index.html
• Selected “Best of Show” among 240 IT solution vendors, including Applications, Servers, Networks.
• Award was selected by Press and Writers from the 10 major IT magazines and News sites in Japan.
• VSS has received award for break trough technology for reducing TCO and also building Non-stop Networks.
• http://itpro.nikkeibp.co.jp/expo/introduction/index.html
*Valid through 2008 Jan 31 -2009 Jan 31
VSS wins “Best of Show”Network Category in Japan IT Pro Expo Trade Show
• 67xx Card with CFC/DFC3C
• Single Supervisor per Chassis
• Any 2 Chassis (E or Non-E )
• NAM 1 & 2
• Hitless IOS Patching1
• Sub200ms Failover
• 128 Multi-chassis Etherchannel (MEC)
12.2(33)SXH112.2(33)SXH1
• ISSU – Hitless Full IOS Upgrade
• ACE 10/20, FWSM, WiSM, IDSM
• PACL support
• VSL support on 6716-10GE
• ESE Campus SRND 3.0
• ESE Data Center SRND
• 512 MEC
• MPLS, IPv62
12.2(33)SXI12.2(33)SXI
1 Full IOS upgrade will require up to 1-2 minutes outage.2 First Rebuild 12.2(33)SXIx
• VSS Value-add features
• Dual Supervisor per System
• Dual Supervisor with “Intra and Inter” chassis SSO
• VPN SPA
• UNBL
• 4 chassis VSS
RadarRadar
VSS Blog ���� http://vsearch.cisco.com/?blog=7531New
• 50+ customers live with VSS in production Network
• External References: First American, Chicago Mercantile Exchange, T-Systems, Swisscom-
IT, Haier, HCL
First VSS Reference in Production
Virtual Switching System – RoadmapDeployment Consideration for VSS Mode Only
Catalyst 6500 Product Update
Campus Access & Wiring Closet
Innovations…
Catalyst 6500 Series Switches
Modular PoE upgradePoE upgradeability
WS-F6K-48-AF=
Modular PoE upgradePoE upgradeability
WS-F6K-48-AF=
EnginesSupervisor 32 8x1GE
Supervisor 32 2x10GE
Supervisor 32 PISA 8x1GE
Supervisor 32 PISA 2x10GE
EnginesSupervisor 32 8x1GE
Supervisor 32 2x10GE
Supervisor 32 PISA 8x1GE
Supervisor 32 PISA 2x10GE
Power SupplyIndustry leading PoE scalability
3000Watt
6000Watt
8700Watt
Power SupplyIndustry leading PoE scalability
3000Watt
6000Watt
8700Watt
Ethernet Line CardsLeading PoE density and scalability, ePoE Ready
TDR, Jumbo Frames, Deep per-port Buffers
WS-X6148A-GE-TX: 48 Port 10/100/1000 with PoE Option
WS-X6148A-RJ-45: 48 Port 10/100 with PoE Option
and others
PoEP Line Card in CY2009 (CC’d)
Ethernet Line CardsLeading PoE density and scalability, ePoE Ready
TDR, Jumbo Frames, Deep per-port Buffers
WS-X6148A-GE-TX: 48 Port 10/100/1000 with PoE Option
WS-X6148A-RJ-45: 48 Port 10/100 with PoE Option
and others
PoEP Line Card in CY2009 (CC’d)
PFC 3BConsistent feature set with
backbone
PFC 3BConsistent feature set with
backbone
Catalyst 6500 Campus AccessWhat to Sell…
Catalyst 6500PoEP Line Cards
6148B
61xx based 48 port
10/100/1000 RJ45 Line card
Feature/performance parity
with 6148A
New PoEP Daughter Card
Field upgradeable
Planned FCS: 1HCY09
All 48 ports 802.3af (15.4W)
All 48 ports Cisco enhanced POE (20W)
Any 32 ports 802.3at (~30W)
6148A 6148B
Today’s PoE DC Yes Not Supported
PoEP DC Not Supported Yes
High AvailabilityCurrent Innovations
Physical Redundancy
• Redundant supervisors, power supplies,
switch fabrics, and clocks
Non-Stop Forwarding /
Stateful Switch Over (NSF/SSO)• Traffic continues flowing after a
primary supervisor failure
• Sub-second recovery in
L2 and L3 networks
• No line card resetGeneric Online Diagnostics(GOLD)
• Proactively detect and address
potential hardware and software
faults in the switch before they
adversely impact network traffic
Catalyst 6500
Cisco IOS Software Modularity• Subsystem In-Service Software Upgrades (ISSU)
• Stateful Process Restarts
• Fault Containment, Memory Protection
High AvailabilityFuture Innovations
Enhanced FSU (EFSU)
• SSO Synchronization across
different Software releases
Full System ISSU with MDR• All of the EFSU capabilities
• Line Cards do not restart
4 Supervisors in VSS
• Allows 4 Supervisors in VSS together
with uplinks in forwarding state
• Active and Hot Standby Supervisors
in SSO state, Cold Standby
Supervisors in RPR state
Catalyst 6500
4 Supervisors with SSO in VSS• All of the previous innovations
• Cold Standby Supervisors are also brought into Hot
Standby State with 4 Supervisor SSO
802.1x with Default Access:
� Allows Bootstrapping a Device on a controlled port
� Allows customer the control to specify what app/protocols can communicate on controlled .1x & MAB ports
Flexible Authentication Sequence
� Simplified configuration
� One configuration addresses all use cases
� Per-user downloadable ACL enforcement
� Support 802.1x/MAB/Webauth on both single- or multi-auth port
Catalyst 6500Identity 4.0 Key Features – 12.2(33)SXI
Guest Access, NAC Solution Integration
� Guest Access Integration with Centralized Web Authentication
� NAC Profiler integration for better device profiling
� NAC Radius solution integration in progress
Enhanced IPT Support
� Multi-domain auth (MDA) to authenticate IP phones (Cisco or 3rd party) w/ 802.1x/MAB
� Solves “PC move” issue with MAB aging and new CDP “host presence” TLV
� Eliminate CAPEX/OPEX of having to upgrade or replace all phones
Catalyst 6500Identity 4.0 Key Features – 12.2(33)SXI
Catalyst 6500 and Cisco TrustSecSecurity eXchange Protocol (SXP)
The adoption of CTS into existing networks may be easier managed by not requiring the
network devices to be upgraded to hardware-capable components initially. SGT eXchange
Protocol (SXP) acts as a IP-to-SGT binding protocol from software-capable CTS devices to
hardware-capable devices…
Catalyst 6500 Supervisor 32 PISA
►►►► NBAR
Application awareness and intelligent classification
Supervisor Engine 32 PISA
2x10GE Uplinks + 1x 10/100/1000
Supervisor Engine 32 PISA
8x1GE Uplinks + 1x 10/100/1000
►►►► Flexible Packet Matching
Rapid Security Protection
Multigigabit Performance
Multigigabit Performance
►►►► Programmable architecture
Seamless new service adoption
►►►► Full Integration with
IPv4 & IPv6 in hardware
Advanced multicast & MPLS
Enhanced Manageability
HA with NSF/SSO and more
011111101010101011111101010101
Supervisor 32 PISA options
Arrowhead
12.2(33)SXJ
Target 1HCY09*
GlacierPark
12.2(18)ZYA
Target 1HCY08
12.2(18)ZY
Shipping
• Stateful Application
Intelligence (SAI)
• QoS Policy Manager
• Flexible Packet
Matching (FPM)
• Cisco Security
Manager
• FPM Filter Repository
• Identity based
application policies
• OER/ PfR
• Automatic malware detection
and mitigation
• ACT Integration
• Enhanced FPM policy actions
(QoS, PBR etc)
• DMVPNv3/GETVPN support for
VPN SPA
• L2 NBAR/FPM
• Intelligent Traffic Redirect
• NBAR / Netflow Integration
• New Applications
. IM (Yahoo, Lotus Notes etc)
. Cisco SoftPhone
. Exchange
. CIFS
. DICOM and HL7
. FIX
• FWSM & PISA Integration
• URL Filtering
• FPM support for fragmented packets
* - Not committed
Application Intelligence
Security
Catalyst 6500 PISAStrategic Roadmap
PFC – HW Data Plane (32
Gbps)
Selective Redirect
with user-defined
ACL
PISA – DPI Data Plane (2Gbps)
Intelligent Traffic Redirect – Ability to define a redirect ACL to allow only
interesting traffic goes through Sup32-PISA, resulting in a 32Gbps system with
multi-gigabit deep packet inspection capability
Intelligent Traffic Redirect – Ability to define a redirect ACL to allow only
interesting traffic goes through Sup32-PISA, resulting in a 32Gbps system with
multi-gigabit deep packet inspection capability
Supervisor 32 PISA OptimizationsIntelligent Traffic Redirect
Campus LAN
NetFlow/Co
llector
Corporate
Network
Internet
SIP DIP SP DP Proto IF Dir AppID10.1.1.10 10.10.1.10 1050 1494 TCP G1/1 IN Citrix
10.1.1.10 10.10.10.10 2001 110 TCP G1/1 IN Exchange
10.1.1.10 x.x.x.x 2050 80 TCP G1/1 IN HTTP
…. …. …. …. …. …. …. ….
PISA NBAR and NetFlow Integration
� NetFlow becomes application-aware with PISA intelligence
� NetFlow export of application classification information obtained from PISA
� Helps customers gain better L7 visibility of the network
NetFlow and NBAR IntegrationExporting Application-level Visibility