Unified Access Switching Cisco Expo 20.03 · Data or PoE Fixed 1G UplinksStackWise Single PSFixed LLW Catalyst 3560-XCatalyst 3750 Data / PoE(+) Modular 1G/10G Uplinks Dual PS Single

© 2012 Cisco and/or its affiliates. All rights reserved. 1

Unified Access Switching Cisco Expo – 20.03.2012

Juergen Braun

Consulting Systems Engineer

Core Team Central Europe


• Borderless Network Architecture for Unified Access Services

• Security

• High Availibility

• PoE Leadership

• Catalyst 2960S/3560X3750X/Compact Switches

• Catalyst 4500E

• Cisco Prime


Enterprise Megatrends THE NETWORK

MOBILITY

BYOD

IMMERSIVE

COLLABORATION

Pervasive Video

CLOUD

SaaS |

DC / V

GREEN, Energy Efficiency

IT PRODUCTIVITY, Service and Network Management

SECURITY, Accelerating Cyber-Threats


IT Consumerization

Device Border

Mobile Worker

Location Border

Video/Cloud

IaaS,SaaS

Application Border

External-Facing Applications

Internal Applications


Architecture for Agile Delivery of the Borderless Experience

BORDERLESS INFRASTRUCTURE

Application Networking/ Optimization

Switching Security Routing Wireless

BORDERLESS

NETWORK

SYSTEMS

BORDERLESS

NETWORK

SERVICES

BORDERLESS

END-POINT/

USER SERVICES Securely, Reliably, Seamlessly: AnyConnect

Mobility: Motion

App Performance: App Velocity

Energy Management: EnergyWise

Multimedia Optimization:

Medianet

Security: TrustSec

Cloud Intelligent Network

Unified Fabric

Unified Access

POLICY

MANAGEMENT

SMART PROFESSIONAL AND TECHNICAL SERVICES: Realize the Value of Borderless Networks Faster

APIs

Cisco Confidential © 2010 Cisco and/or its affiliates. All rights reserved. 6


Deliver End-to-End Iron-Clad Security

• Authorized Access

• Regulatory Compliance

• Network Protection and Monitoring

• Discover and profile end devices with IOS Sensor

• Identity-based access control with no impact using Monitor Mode

• Link layer encryption with policy enforcement via MACsec

• Network visibility to security vulnerabilities with Flexible NetFlow

• Attack forensics with Smart Logging and Telemetry

IT Challenges

Unique

Cisco

Benefits

Unified Management and Policy with

Identity Services Engine (ISE)


Manual Device Classification and Policy Enforcement

Multitude of devices

on the network, wired

and wireless

Need to have policy

control for each

device type

Need assurance that a

device conforms with

signature

The Challenge

Device proliferation

and identification for

policy enforcement

Typical Deployment Scenario

Access

Point

Switch

SIGNATURE ?

Port 1

Port 3

Port 4

Port 2


CDP

LLDP

DHCP

MAC

CDP

LLDP

DHCP

MAC

DEVICE CLASSIFICATION

PRINTER Video Phone

Printer Policy

[place on VLAN X]

Video Phone Policy

[restricted access]

ISE

POLICY

Profiling for both wired and wireless devices

Collection—Switch

collects device

related data and

sends report to ISE

Classification—ISE

classifies device, collects

flow information and provides

device usage report

Authorization—ISE

executes policy

based on user and

device

The Solution Deployment Scenario with Cisco IOS Sensor

Device Profiling

+ IOS Sensor

Device Profiling Automated with IOS Sensor

Access

Point


HELP

DESK

CORPORATE RESOURCES

!

FAILURE

802.1x

!

MAC Address

00:18:F8:46:53:D7

Productivity Loss

User Downtime

SiSi SiSi

SiSi SiSi

DENIED

Deployment Hurdles with 802.1X

Failed Access due to

non 802.1X client,

supplicant variation etc.

User contacts help

desk for assistance

Troubleshooting

problem results in

loss of productivity

Implement

Identity-Based

Access Control

Deploy Access

Control

The Challenge Typical Deployment Scenario


Zero Downtime When Implementing 802.1X with Monitor Mode

Discovery—Allows

connection regardless

of device types

Correct —View failed

reports on ACS or ISE;

troubleshoot and resolve

issues; ensure future

authorization

Add Authorization—

Block unauthorized

access; add policy for

restricted resources

Deploy

Access

Control

The Solution Deployment Scenario—Cisco Access Switch

Implement in

Monitor Mode

! !

FAILURE

MAC Address

00:18:F8:46:53:D7

802.1x

CONNECTED

MAC Address

00:18:F8:46:60:D7

802.1x

CORPORATE RESOURCES

REPORT ANALYSIS

ALLOW

ALLOW

ALLOW

ISE

ALLOWED

POLICY

SiSi

SiSi SiSi

SiSi



Branch

Office 1

Branch

Office 2

Headquarter

SiSi SiSi

WAN

IT

Flexible NetFlow Collects

Network Activity and Stats While

Forwarding Traffic

NetFlow Data

Export to

External

Collector/

Analyzer

NetFlow Data Analyzed

And Reported!

Maybe I need to upgrade

that 1G link, wait, why so

much SSH traffic? Who is

sending that?


DstlPadd Protocol TOS

10.0.227.12 11 80

10.0.227.12 6 40

10.0.227.12 11 80

10.0.227.12 6 40

Protocol TOS Flgs

11 80 10

6 40 0

11 80 10

6 40 0

Srclf SrclPadd Dstlf

Fa 1/0 173.100.21.2 Fa 0/0

Fa 1/0 173.100.3.2 Fa 0/0

Fa 1/0 173.100.20.2 Fa 0/0

Fa 1/0 173.100.6.2 Fa 0/0

Srclf SrclPadd Dstlf DstlPadd Protocol ScrPort DstPort

Fa 1/0 173.100.2 Fa 0/0 10.0.227.12 11 00A2 00A2

Fa 1/0 173.100.3 Fa 0/0 10.0.227.12 6 15 15

Fa 1/0 173.100.2 Fa 0/0 10.0.227.12 11 00A1 00A1

Fa 1/0 173.100.6 Fa 0/0 10.0.227.12 6 19 19

Flexible NetFlow

Traditional NetFlow

NetFlow Cache

Fixed 7 Keys

Flow cache 1

Flow Monitor 1

Flow Monitor 2

Flow Monitor 3

Flow cache 2

Flow cache 3

Export Only to One Collector Fixed Definition of Flow Record Globally

Ability to Export Flow Information to Multiple Collectors/Analyzers

Flexible Definition of Flow

Records Applied to Selected

Interface or VLAN

Export

Export

Export Destination

1

Destination 2

Destination 3

IT team#1

IT team#2

Security focused analyzer

Export


Key Differences New Benefits

• More selection of key/non-key fields • Higher visibility into application delivery enables more use cases

• User-defined flow monitors assigned

per-port, per-VLAN, or per-port-per-VLAN

• Customized flow data collection for different usage

• Multiple flow caches each with user-

configurable parameters

• Versatile flow data collection for multi-purpose

• Export to more than one collectors per

flow monitor

• Flow data can be analyzed by multiple collectors for different purposed

• Onboard integration with other features • Real-time event alarms or policy action when threshold met

Traditional Netflow is a Subset of Flexible Netflow


Catalist 4500E Capabilities Benefits

Control

With EEM

Integration

Unprecedented Application Visibility

• Lower CAPEX • Better insight for capacity planning,

network upgrade

• Lower OPEX • Better service and user experience

• Increased IT staff productivity

IP, Ports TCP

Flags

L2

MAC

L2

VLAN

UDP

Flags IPv6

IP

Options Multicast …

Day0 Attacks

Detect Anomaly

Compliance

SLA

App. M&T

Capacity Planning

Mobility, Unified Communications, Network Virtualization

Catalyst 4500E Flexible NetFlow

Campus

Branch

Collector Ecosystem

• Unprecedented visibility w/ new L2~7 fields

• Scalable, flexible flow monitors

• On-box Customizable policy action w/ EEM

• Broad collector partner ecosystem

Visibility


• Leveraging Hardware FnF to monitoring endpoint and application behavior

• L2 (MAC, VLAN) to L4 (TCP Flags) visibility

• On-box, customizable event correlation to detect anomalies

• Customizable policy actions upon anomaly detection:

• Alarm with Syslog, SNMP

• Action with ACL, QoS, etc

Traffic Anomaly, Malware Detection and Mitigation

SrcIf SrcIPadd DstIf DstIPadd MAC TCP

Flags Bytes

Fa1/0 173.1.1.2 Fa0/0 10.0.277.1 … …. 3465

Fa1/0 173.1.1.2 Fa0/0 10.0.277.1 …. …. 300

Fa1/0 173.1.1.2 Fa0/0 10.0.277.1 …. …. 1000

Customized

Syslog

Policy Action:

Shutdown Port

ACL, Qos

Anomalous

Traffic Rate !

EEM



Because the Business Depends on It

• Ensure non-stop communications and access to network resources

• Minimize planned and unplanned downtime

Catalyst 4K

• Upgrade software without disruption with In Service Software Upgrades

• Support chassis-level stateful failover with VSS - roadmap

Catalyst 3K-X

• Upgrade software with minimal disruption with Rolling Stack Upgrades

• Maximize power availability and flexibility with StackPower

IT Challenges

Unique Cisco

Benefits


Lin

e C

ard

Lin

e C

ard

Software Upgrades—Without Service Interruption

Seamless

Lin

e C

ard

Redundant Supervisors

STA

ND

BY

A

CT

IVE

STA

ND

BY

A

CT

IVE

• Comprehensive, non-intrusive software upgrade solution

• Transparent to end users—no loss of user sessions

• Upgrades can be scheduled at anytime—even during business hours


Achieving Highest Levels of Network Availability

Pools Two Catalyst 4500 Series Switches into One Virtual Switch

Increases Operational Efficiency

• Single point of management

• Eliminates dependency on Spanning Tree Protocol with Multichassis EtherChannel (MEC)

Increases Network Availability

• Inter-chassis stateful failover—utilizes NSF with SSO w/ virtual active & “hot” standby switches

• Sub-second virtual switch / uplink recovery

Improved Performance

• Twice system bandwidth—1696 Gbps

plan

Q4

CY2012

VSS

Campus

SiSi SiSi


Delivering Unprecedented Power Availability and Flexibility

StackPower

• Adaptable “pool of power” available to all stack members

• Provides “Zero-footprint” RPS i.e. power supply redundancy without an RPS

• Intelligent power shedding—turn off low priority PoE end devices in the event of a power supply failure



A Historical Perspective

2000

2003

2007 2009 2011

Industry

Standard:

IEEE 802.3af

(15W PoE)

Industry

Standard:

IEEE 802.3at

(30W PoE+)

7W

Inline Power

15W

(PoE)

30W

(PoE+)

60W

(UPOE)

All specifications subject to change without notice

Cisco Innovations Drive Industry Standards


Lower Operational Expense for End Points

• Quickly rollout new devices

• Reduce high installation costs and deployment time

Catalyst 4K

• Support next generation PoE devices at 60W per port using

Universal PoE

Catalyst 3K-X

• The highest PoE and PoE+ density solutions in the industry—

Full PoE and PoE+

IT Challenges

Unique Cisco

Benefits


Transforming Enterprise Networks

UPOE

Virtual

Desktop

Trading

Floor

Personal

Telepresence

Building

Management

Hospitality/

Retail



Catalyst 2960-S

Competitive feature set

at compelling prices

Soli

Traditional

Workspace

Voice Data

Catalyst 4500E Catalyst

3750-X 3560-X

Industry-leading

fixed switching

Innovative Services,

Lower TCO

Next-Generation Workspace

Any Device HD Video

Industry-leading

modular access

Catalyst Compact

Switches

Industrial

Automation

Great for secure, manageable ports

‘at the end of the wire’

Purpose-Built for

Industrial Applications

Right Sized,

No Compromise

Ruggedized

for Industrial

Applications

Outside the Wiring Closet

Manufacturing Oil and Gas VDI Retail


ADVANCED LAYER 2

(LAN Base) PORTFOLIO

Fast Ethernet Gigabit Ethernet

Catalyst 2960

1G Uplinks

Partial PoE

LLW

Catalyst 2960-S

10G/1G Uplinks

FlexStack

Full PoE, Partial PoE+

E-LLW

BASIC LAYER 2

(LAN Lite) PORTFOLIO


Catalyst 2960

1G Uplinks

Partial PoE

LLW

Catalyst 2960-S

1G Uplinks

Partial PoE/PoE+

E-LLW

FLEXSTACK MODULE

C2960S-STACK


StackWise Plus and StackPower

Flexible NetFlow

Hot-swappable power supplies & fans

Industry’s highest density PoE+

Rolling Stack Upgrades

MACsec

INNOVATION OPERATIONAL SIMPLICITY

Automation

Investment protection

Enhanced Limited Lifetime Warranty

Leading Stackable Unified Access Platform

WORLD’S MOST

POPULAR

STACKABLE

¼ BILLION

PORTS

OVER 7 MILLION

UNITS

INDUSTRY

LEADERSHIP

LOWER

TCO


Stand-Alone Switch Portfolio


Catalyst 3560 v2

Data or PoE

Fixed 1G Uplinks

Single PS

LLW

Catalyst 3560-X

Data / PoE(+)

Modular 1G/10G

Uplinks

Dual PS

E-LLW

Stackable Switch Portfolio


Catalyst 3750 v2

Data or PoE

StackWise

Fixed 1G Uplinks

Single PS

LLW

Catalyst 3750-X

Data / PoE(+)

StackWise Plus

StackPower

Modular 1G/10G

Uplinks

Dual PS

E-LLW

Network And Service Modules

C3KS-NM-1G C3KS-NM-10G C3KS-NM-10GT C3KS-SM-10G

Aggregation Switch

WS-C3750X-12S-S WS-C3750X-12S-E

WS-C3750X-24S-S WS-C3750X-24S-E


3560-C IP BASE PORTFOLIO

ADVANCED LAYER 2

(LAN Base) PORTFOLIO


IP Base

8 and 12 port FE

Data or PoE+

2 x 1G Uplinks

E- LLW

3560-C Portfolio

IP Base

8 port GE

Data or PoE+

2 x 1G Uplinks

E- LLW


LAN Base

8 and 12 port FE

Data or PoE

2 x 1G Uplinks

E- LLW

2960-C Portfolio

LAN Base

8 port GE

Data Only

2 x 1G Uplinks

E- LLW

PoE Pass Through Switch

WS-C3560CPD-8PT-S WS-C2906CPD-8PT-L



Lead Modular Access Platform

Price/Performance Distribution

100M+ Ports Sold

700K+ Systems

70% PoE/PoEP Port

share

70% Adoption by Top

Cisco Customers

(GET, Enterprise)

MARKET LEADERSHIP INDUSTRY LEADERSHIP

48G/slot

FNF

IOS-XE

ISSU

EEE/ Cisco UPOE

Strategic Campus Platform


• Wireshark provides a built-in packet

sniffer and decoder to enable remote

troubleshooting

• Wireshark removes the need to travel

onsite for packet captures and also

need for external equipment to be

connected on the path

• WireShark: Real-time capture and

decode on Sup7E (Lightweight Text

version “T-Shark”)

• Capture and Display Filters to

capture packets and/or decode and

display packets

• Captured packets can be stored on SD

card or USB.

• Ability to display packets in brief,

detailed or hexadecimal dump mode.

Features Components

Wireshark

Hosted Apps IOSd

Common Infrastructure / HA

Management Interface

Module Drivers

Kernel

SIMPLIFIED TROUBLESHOOTING


Leadership with Investment Protection

2:1 24G/ SLOT 1:1 48G/ SLOT

DATA

POE • 30W/ port (IEEE802.3at) on upto 24 ports

• PoE policing and monitoring

• EnergyWise

• Jumbo frame support


• Universal PoE (Intelligent 60W PoE/Port)

• IEEE 802.3az (Energy Efficient Ethernet)

• 30W/ port (IEEE802.3at) on all 48 ports

• PoE policing/ monitoring, EnergyWise,

Jumbo frames


• IEEE 802.3az (Energy Efficient Ethernet)

WS-X4748-RJ45-E WS-X4648-RJ45-E

WS-X4648-RJ45V+E WS-X4748-UPOE+E


Compact 10G Switch

Deployment Options

o 16 Port Configuration

o 32 Port Configuration

Upgradable OIR Uplink

o 8 port 10GE SFP+

o 2 port 40G QSFP*

o Scalability

o 256K Routes, 32MB Buffer

Innovations

o Flexible Netflow

o Hosted 3rd Party Applications

o High Availability

o VSS*

o N+1 Fan Redundancy

o 1+1 AC or DC* power supplies

Investment Protection

1G/10G flexibility

●PS1

●PS2

● ●Reset

Status

Catalyst 4940

40 port 10G configuration Removable Uplink

Target

April 2012

* Post FCS

1RU



Simplified

Automated

Integrated Best Practices

Unified management with optimized user experience

Integrated workflows and best practices speed operations

Borderless

Networks

Collaboration

Data Center

Design

Deploy

Assure

Optimize

Complete Lifecycle Management


Network

Network Services

Management Foundation Common Attributes

Simplified

Automated

Efficient

Predictable

Moving from Device Management

IT Teams

to Services Management

Architectures

Services

Innovative Product Portfolio Innovative Product Portfolio


Service/Network

Operator View across

all network layers

0

18

Mb

yte

s/s

ec

Time Line

video

voice

http

ssh

email

Users

Performance

Network

An end user is

experiencing issues

with the video display.

The problem is traced

through the service.

The source of the video

problem is located on the

infrastructure device.


Collaboration

Data Center Borderless

Networks

Assurance

Flows Probes

NBAR IPSLA

Wireless

Wired WAN

BN

Services Apps

NW

Compute Storage

Voice

TP

Video

Webex

End-to-end user / device

to application / service

visibility

User / endpoint access,

infrastructure-based

services

Orchestration of

virtualized services

Media Session

experience &

assurance


Prime

Collaboration

Prime

Data Center

Prime

Infrastructure

Prime

Security

Prime Assurance

NAM

PAM

WCS

NCS

LMS CE

CSM

SMX OD

VNMC

DCNM ANM

CUCMS

CM

End-to-end user / device

to application / service

visibility

User / endpoint access,

infrastructure-based

services

Orchestration of

virtualized services

INTEGRATED

Media Session

experience &

assurance


Prime

Collaboration

Prime

Data Center

Prime

Infrastructure

Prime

Security

Prime Assurance


• A bundled solution for complete wired and wireless lifecycle management

• Converged user and access management

• Configuration, change and compliance management

• Monitoring, troubleshooting and reporting

Simplified ordering and license management

Lower TCO with intuitive user experience and workflows

Speed troubleshooting, improve network availability

Cisco Prime LMS

Cisco Prime NCS


Conclusion

Architecture for Agile Delivery of the Borderless Experience

BORDERLESS INFRASTRUCTURE

Application Networking/ Optimization

Switching Security Routing Wireless

BORDERLESS

NETWORK

SYSTEMS

BORDERLESS

NETWORK

SERVICES

BORDERLESS

END-POINT/

USER SERVICES Securely, Reliably, Seamlessly: AnyConnect

Mobility: Motion

App Performance: App Velocity

Energy Management: EnergyWise

Multimedia Optimization:

Medianet

Security: TrustSec

Cloud Intelligent Network

Unified Fabric

Unified Access

POLICY

MANAGEMENT

SMART PROFESSIONAL AND TECHNICAL SERVICES: Realize the Value of Borderless Networks Faster

APIs

Thank you.


Prime

Collaboration

Data

Center (future)

Prime

Infrastructure

Prime Assurance Prime Infrastructure – a bundled solution for

complete wired and wireless lifecycle

management

Prime Collaboration – delivers products to

simplify the deployment and management of

voice, video and collaborative services

Prime Assurance – provides visibility across

architectures for effective troubleshooting of

performance, application, and end user

related issues


New Product Features Complete visibility into endpoint

connectivity – regardless of device network or location

Plan, deploy, monitor and troubleshoot, remediate and optimize wireless LANS

Flexible dashboard views, guided workflows and built-in diagnostic tools provide access to actionable information

Simplified branch router configuration and monitoring

Complete wireless lifecycle management

Converged User and Access Management for Wired and Wireless Networks

Customer Value Proposition Resolve access problems across wired and

wireless networks and get users back online faster

Integration with Cisco ISE enables visibility of user attributes, posture and profile

Visibility and diagnosis of access infrastructure includes Cisco Catalyst switches, Cisco wireless controllers, branch routers and Cisco Access Points

Allows IT to design and maintain optimal RF environments

Centrally manage Cisco branch and wireless services

Eliminates complexity, improves IT efficiency and minimizes staffing requirements

Sales Value Proposition Only solution with wired, wireless and

security user and access visibility in a single view

Update


New Product Features Medianet Work Center provides day-one

to day-N network support of Medianet services

Enhanced compliance reporting (EoX, PSIRT and other regulatory reports)

Smart Interactions for automated TAC Cases creation/management and real-time access to Cisco Support Community

Enhanced EnergyWise workflows and integration with Orchestrator

New virtualized appliance Complete wired lifecycle management

Simplified Management of Borderless Networks Platforms

Customer Value Proposition Simplify deployment and management of

Medianet end points and network services

Improved compliancy reporting with new rules and enhanced logic

Interact in real-time with the Cisco Support Community forum and contextually create TAC cases

Realize energy cost savings faster through new EnergyWise enhancements

Accelerate LMS set-up and improve ROI through new turn-key soft-appliance

Upgrade

Sales Value Proposition Up sell Cisco routing and switching platforms

and Borderless Networks services

Competitive differentiator to drive value of Borderless Networks and a Cisco end-to-end network


Documents

Unified Access Switching Cisco Expo 20.03 · Data or PoE Fixed 1G UplinksStackWise Single PSFixed LLW Catalyst 3560-XCatalyst 3750 Data / PoE(+) Modular 1G/10G Uplinks Dual PS Single