How to Select Your Cisco Products? More Questions…

Before buying a network hardware product, it’s necessary to know about the business requirements of the network. Then, you can select the appropriate products like the Cisco hardware.

Today, WAN technologies most often take advantage of high-speed connections, such as T-1 and E-1. Additional WAN technologies exist, including Frame Relay, ISDN, and dial-up asynchronous connections. ISDN or dial-up is used if infrequent connection is made. If a connection is used for more than two to four hours, you should use a Frame Relay or a leased line. Based on the different services available through the service provider; you can select Cisco products that can fulfill your office requirements.

Selecting Hubs

Cisco has various hub products. You can select hubs according to the type of connection required. Higher-end hubs offer network management port and console connections, middle-end hubs offer both 10 Mbps and 100 Mbps auto-sensing connections, and the lower-end hubs offer only 10 Mbps connections. Examples of fast hub series of Cisco are Cisco Fh100, Cisco Fh200, Cisco Fh300, and Cisco Fh400. Examples of micro hub series are Cisco MH1500 and Cisco MH1528.

Selecting Routers

Routers are the most popular Cisco products. To select a router, you must first know the port density and the interface speed required based on the LAN or WAN technologies used. In addition, you must identify the capacity and performance requirements of your business. The cost of the router varies according to the features you select.

Selecting Switches

A switch can be used instead of a hub in newer networks. Most switches are configured to limit collision domains, which often provides a limited security feature because users will not be able to sniff traffic as easily as in a standard hub-based network. This feature can cause confusion when using a network sniffer to analyze traffic. It is possible, however, to analyze packets on a switched network by enabling mirroring on the switch, or by using a dedicated port that allows authorized users to view all network traffic. It is important to consider whether you need 10, 100, or 1000 Mbps for each desktop or to connect between switches. To select a switch, you must consider various issues, such as business requirements, requirements for inter-switch links and trunking, port density, and type of user interface.

…

Product Selection Criteria, More Questions

• Will the device be used as a core device, distribution device, or access device?
• Does the device provide the functions that your business requires?
• Does the device have adequate number of ports and the right mix of interfaces as required by your business?
• Do you have to pay a lot for installing the device or can it be easily installed?
• Can the device be centrally managed from an SNMP Management station or do you have to physically access the device to manage it?
• Is the migration path easy?
• How well does the device handle redundancy requirements?
• Do you have to change your existing infrastructure, such as cabling or existing devices, to install the new device?

If you want to know more Cisco products and its updates, you can visit its web site http://www.cisco.com to see more. If you want to buy some Cisco products, such as Cisco 1900, 2900, 3900 series router, Cisco Catalyst 2960-X, 3750-X and 3560-X series, Cisco ASA 5500 series, Cisco wireless AP and so on. More Cisco’s new products you can see at http://www.router-switch.com/

More Cisco hardware guides and tips you can visit: http://blog.router-switch.com/

Cisco ACI Components, Features & Benefits

Cisco ACI uses a holistic systems-based approach, with tight integration between physical and virtual elements, an open ecosystem model, and innovation-spanning application-specific integrated circuits (ASICs), hardware, and software. This unique approach uses a common policy-based operating model across ACI-ready network, and security elements (computing, storage in future), overcoming IT silos and drastically reducing costs and complexity.

Cisco ACI redefines the power of IT, enabling IT to be more responsive to changing business and application needs, enhancing agility, and adding business value. As an innovative architecture, Cisco ACI radically simplifies, optimizes, and accelerates the entire application deployment lifecycle.

Problems Addressed by Cisco ACI

Cloud, mobility, and big data applications are causing a shift in the data center model. New applications are placing demands on the infrastructure in new ways. Distributed applications (for example, Big Data and Hadoop), database applications (such as those from Oracle and SAP) that run on bare metal, virtualized applications running in multi-hypervisor environments, and cloud-based applications that are available on demand all impose different demands on infrastructure.These demands include:

•Infrastructure must become application aware and more agile to support dynamic application instantiation and removal

•The non-virtual nature of new emerging applications means that the infrastructure must support physical, virtual, and cloud integration with full visibility

•Infrastructure-independent applications treat the data center as a dynamic shared resource pool

•Scale-out models promote more east-west traffic, with a need for greater network performance and scalability

•Multi-cloud models require the infrastructure to be secure and multitenant aware

These changes are increasing operation complexity and limiting business agility and responsiveness. Cisco ACI delivers an agile data center with simplified operations and increased application responsiveness to support a new generation of distributed applications while accommodating existing virtualized and non-virtualized environments.

Cisco ACI Solution

Cisco ACI delivers a transformational operating model for next-generation data center and cloud applications.

In the Cisco ACI framework, applications guide networking behavior, not the other way around. Predefined application requirements and descriptions (policy profiles) automate the provisioning of the network, application services, security policies, tenant subnets, and workload placement. By automating the provisioning of the complete application network, Cisco ACI helps lower IT costs, reduce errors, accelerate deployment, and make the business more agile.

The new Cisco ACI model uses a fabric-based approach that is designed from the foundation to 

support emerging industry demands while maintaining a migration path for architectures already in place. This focus allows both traditional enterprise applications and internally developed applications to run side by side on a network infrastructure designed to support them in a dynamic and scalable way. Network policies and logical topologies, which traditionally have dictated application design, are instead applied based on the application needs. The fabric is designed to support the move to management automation, programmatically defined policy, and dynamic workloads on any device anywhere. Cisco ACI accomplishes this with a combination of hardware and software tightly coupled to provide advantages not possible in other models.

Cisco Application Policy Infrastructure Controller, Application Network Profile and Fabric That Supports Cisco ACI

Main Cisco ACI Components

Cisco Application Policy Infrastructure Controller

The Cisco Application Policy Infrastructure Controller (APIC) is the main architectural component of the Cisco ACI solution. It is the unified point of automation and management for the Cisco ACI fabric, policy enforcement, and health monitoring. The Cisco APIC is a centralized clustered controller that optimizes performance, supports any application anywhere, and unifies operation of physical and virtual environments. The controller manages and operates a scalable multitenant Cisco ACI fabric.

The Cisco APIC is responsible for tasks ranging from fabric activation, maintenance of switch firmware, network policy configuration and instantiation. Cisco APIC is completely removed from the data path. This means that the fabric can still forward traffic even when communication with the APIC is lost. The APIC itself is delivered as an appliance and will typically be run as three or more appliances for performance and availability.

The Cisco APIC is designed from the foundation for programmability and centralized management. The Cisco APIC exposes a northbound API through XML and JSON and provides both a command-line interface (CLI) and GUI that use this API to manage the fabric. The system also provides an open source southbound API that allows third-party network service vendors to implement policy control of supplied devices through the Cisco APIC.

Application Network Profiles

An Application Network Profile within the fabric is a collection of the endpoint groups (a logical grouping of similar endpoints representing an application tier or set of services that require a similar policy), their connections, and the policies that define those connections. Application Network Profile is the logical representation of all components of the application and its interdependencies on the application fabric.

Application Network Profiles are designed to be modeled in a logical way that matches the way that applications are designed and deployed. The configuration and enforcement of policies and connectivity are then handled by the system through the Cisco APIC rather than an administrator.

Cisco ACI Fabric: Cisco Nexus Portfolio

Cisco is expanding the Cisco Nexus switching portfolio with the introduction of the Cisco Nexus 9000 Series Switches for both traditional and Cisco ACI data center deployments. The Cisco Nexus 9000 Series offers modular and fixed 1/10/40 Gigabit Ethernet switch configurations that are designed to operate either in Cisco NX-OS mode for compatibility and consistency with the current Cisco Nexus switches or in Cisco ACI mode to take full advantage of Cisco ACI application policy–based services and infrastructure automation features. This dual-function capability provides customers with investment protection and ease of migration to Cisco ACI through a software upgrade.

Benefits of Cisco ACI

Cisco ACI helps dissolve IT silos for application deployment, security, network services, and network configuration personnel by enabling all of them to collaborate through a common platform. The main benefits include:

²  Application velocity - any application, anywhere

²  Systems architecture that enables a holistic view of applications, with centralized application-level integrated visibility and real-time application health monitoring across physical and virtual environments

²  Common platform for managing physical, virtual, and cloud-based environments

²  Secure multi-tenancy with detailed control for applications and tenants

²  Scalable performance combining software flexibility and hardware performance

²  Superior application performance, improving application flow completion time by up to 80 percent

²  Operation simplicity, with common policy, management, and operation models across application, network, and security resources (and computing and storage resources in the future)

²  Open APIs, open standards, and open source elements enable software flexibility for development and operations (DevOps) teams and ecosystem partner integration

Cisco Services for ACI

“Is my data center ready for transformation?”  

“How do I know my initiative will have the desired impact?”  

“How do I get started?” Cisco Services can help you with the answers. Cisco offers a range of professional services to support your transition to ACI and to secure your infrastructure, including:

Cisco Business Strategy capabilities help you articulate the strategy and develop the business case and an architectural-led master plan for ACI. We assess the specific benefits of ACI for your environment, and identify and prioritize business-impacting scenarios into an overall plan, using tools and frameworks that we have developed and tested internally and with others.

Cisco Readiness Planning capabilities help transform your data center networks to an ACI by identifying risks and opportunities; analyzing operational elements; and recommending detailed migration plans to enable a smooth and successful transition to ACI.

Cisco Data Center Services for Operations Enablement are existing services which can prepare your environment for ACI while addressing all stages of the operations lifecycle.

Cisco Services to Secure the Data Center Infrastructure

Cisco Data Center Security Design Assessment Service helps you understand your security infrastructure design and how it aligns with your security policy. The resulting comprehensive assessment report includes risk analysis and recommendations based on industry best practices.

Cisco Data Center Security ASA Migration Service helps you migrate your third party or Cisco Adaptive Security Appliance (ASA) platform—including configurations and firewall rules—to a virtualized environment.

Cisco Data Center Optimization Service improves, supports, and maintains your overall data center, including security support in data center devices.

Cisco Security Optimization Services address specific security needs, such as an annual data center security posture assessment or data center security design development support. 

More Cisco ACI Topics

Cisco ACI, Whatis It?

Cisco Servicesfor ACI & Nexus 9000 Series

VSS Configuration on Cisco 6500

The Virtual Switching System (VSS) allows two Cisco Catalyst 6500 or 4500 chassis to bond together so that is seen as a single virtual switch to the rest of the network. Other devices will see the VSS configured 6500 as a single device which means it’s possible to use multi chassis ether channel and protocols like spanning-tree will only see a single switch. This article provides configuration that will allow you to easily enable VSS on these switches.

While a similar technology (Multi-Chassis Etherchannel, MEC) exists in Nexus datacenter switches known as vPC, the Nexus switches only appear to other adjacent switches as one switch across L2 links while maintaining two separate control planes and management points. VSS actually does a better job of emulating a single switch with one active, and one (or more) standby control plane allowing it to fully support a dual-homed L3 routed link. If you are familiar with Cisco Stackwise technology in 3750/3850 switches, VSS is probably more comparable to those except VSS only supports up to two switches and instead of using Stackwise cables, it uses multiple 10G links for interconnecting switches (i.e. VSL).

Requirements

• Virtual Switching Supervisor 720-10GE (VS-S720-10GE-3C and VS-S720-10GE-3CXL) with IOS 12.2(33)SXH1 and IP Base
• or Supervisor 2T (VS-S2T-10G and VS-S2T-10G-XL) with IOS 12.2(50) SY and IP Base

Note: Please check Cisco documentation for more detail

Cabling Between Chassis

• Minimum of two 10Gbps links with at least one on the Supervisor
• Minimum of one (more is recommended) 1Gbps or 10Gbps links for dual-active detection 

Dual Active Detection Method

There are three available options; BFD, Fast Hello, Enhanced PAgP. EPAgP requires a downstream switch that is EPAgP-capable, which is sometime hard to find. BFD requires an IP address to be configured on the interface. Here we choose to use Fast Hello, although more than one method can be configured.

Configuration Steps:

Make sure all cabling between two switches are completed before proceeding

On Switch 1

1. Set switch number to 1

!

switch set switch_num 1 local

switch read switch_num local ! confirm 1 is returned

!

2. Configure virtual domain then save config

!

configure terminal

switch virtual domain 1

 switch 1

 mac-address use-virtual  ! optional but recommended

!

do wr mem

!

3. Configure VSL links. 

!

interface Port-channel 1

 desc --- To Switch 2 VSL ---

 switchport

 switch virtual link 1

 no shut

!

interface range TenGigabitEthernetx/x-y ! modify as necessary

 channel-group 1 mode on

 no shutdown

!

do wr mem

exit

!

4. Convert switch to VSS mode. Confirm and switch will reload

!

switch convert mode virtual

!

On Switch 2

1. Set switch number to 2

!

switch set switch_num 2 local

switch read switch_num local ! confirm 2 is returned

!

2. Configure virtual domain then save config

! configure terminal switch virtual domain 1  switch 2  mac-address use-virtual  ! optional but recommended ! do wr mem !

3. Configure VSL links. 

! interface Port-channel 2 ! must be different number from switch 1  desc --- To Switch 1 VSL ---  switchport  switch virtual link 2  no shut ! interface range TenGigabitEthernetx/x-y ! modify as necessary  channel-group 2 mode on  no shutdown ! do wr mem exit !

4. Convert switch to VSS mode. Confirm and switch will reload

! switch convert mode virtual !

• Wait until switch 2 comes back and join VSS
• You can only make config changes on the active supervisor now

On the active switch

1. Adjust switch priority

! configure terminal switch virtual domain 1  switch 1 priority 110  switch 2 priority 100 !

2. Configure dual-active detection

! switch virtual domain 1  dual-active detection fast-hello ! interface ra GigabitEthernet1/x/x ! modify as necessary  desc --- VSL Fast Hello ---  dual-active fast-hello  no shutdown ! interface ra GigabitEthernet2/x/x ! modify as necessary  desc --- VSL Fast Hello ---  dual-active fast-hello  no shutdown exit ! show switch virtual dual-active fast-hello ! verify !

Reference from http://www.labminutes.com/blog/2013/09/cisco-4500-4500x-6500-vss-configuration

More Related VSS Configuration on Cisco Switches

VSS on Cisco4500/4500X Switches

Cisco 4500 VSSRequirement-Software, Hardware and Licensing

A Sample VSSConfiguration for 2x Cisco Cat6500 with Supervisor 720

Cisco ASA SSL VPN Licensing

Cisco ASA users who bought the right Cisco ASA hardware in their network may be frustrated by getting the hardware working with proper license and functionality that requires one to navigate a maze of confusing choices with different bundles, rules, and restrictions. Some of them has put their questions when they need Cisco asa license or upgrading. Some questions are raised like this:

“Can someone clarify for me the SSL VPN/AnyConnect licensing for the ASA 5520?  Specifically, the differences between the AnyConnect Essentials and AnyConnect Premium. …I'd like to add 25 or perhaps 50 SSL VPN Licenses and be able to use a combination of clientless, thin client and full client AnyConnect groups.  Would the "ASA5500-SSL-25" (or 50) be the correct license I need to purchase?”

“Our ASA 5505 with BASE license by default allowing only 10 concurrent vpn sessions (including 2 Anyconnect+IPsec). attached TXT file with license information. this firewal is use only for vpn access, and we have  IPSec L2L vpn tunnel, anyconnect, client less SSL vpn and IPSec client access vpn configurations up and running, we are in plan to upgrade vpn license to archive 10 IPSec and 10 Anyconnect and 1 anyconect mobile VPN sessions at time. so my questions are;

1. can I buy "ASA5500-SSL-10=" license and upgrade our ASA 5505 without buying "L-ASA5505-SEC-PL="  security pus license.

2. Does asa Support to upgrade only SSL Anyconnect vpn license while keeping 10 IPSec vpn comes with base license.”

  

There are some typical questions we get asked by customers on a daily basis regarding how ASA licensing works?

Q: If we buy a new ASA (the same model) to replace our old ASA, do we need a new license? Can we transfer?
A: Typically, licenses are non-transferable. Unless the old ASA is covered by SMARTNet, and that the new replacement ASA is a RMA issued directly by Cisco. That’s the only way to keep them.

Q: What license will I need for the new replacement ASA?
A: This depends on the ASA’s topology and function in the network.

-If the ASA is to replace the main Shared Licensing Server, then it’ll need the Shared Licensing Server license which will act as the license issuing server for the participant licenses.
-If the ASA is to replace the Fail-over Server, it’ll only need a Participant License. This server will act as a back-up licensing server in case the primary server is unreachable. However, the Shared Licensing Server license is only good for ONE fail-over server.
-If the ASA is to be used as a participant, only a Participant License is required.

If you are interested in the Cisco Adaptive Security Appliances as an option for your network and don’t know where to start, you can contact our excellent sales team who can get you started right away.

http://www.router-switch.com/

For more about router-switch.com, you can visit here.

cisco@router-switch.com (Sales Inquiries)
ccie-support@router-switch.com (CCIE Technical Support)

http://www.router-switch.com/contact_us.html

*Note: ASA with IOS version prior to 8.3 and after 8.3 have different licensing options in regards to different active/standby configurations.

More Cisco ASA License Topics

General Features of Cisco ASA Licensing

How to Activate a Cisco License?