Hvad betyder automatisering for dit netværk?€¦ · PoC 2b –SDN Software CMC Complete Novo...

© 2018 Cisco and/or its affiliates. All rights reserved.

Hvad betyder automatisering for dit netvæ[email protected] #3671, CCDE #20180020

mailto:[email protected]


Automation

DNA Center+ ISE

7


DNA Center

8

Non-Fabric mode

• Onboarding• Manage software• Manage licenses • Full configuration -> templates

Templates manualPolicy configuration manualProcess automated

DEMO

Fabric mode - SDA

• Onboarding• Manage software• Manage licenses • Full configuration –> SDA

SDA is full configurationPolicy built-in (VN=segmentering, SGT=micropolicy)Focus on INTENT


Demo

9

Non-Fabric mode

• Switch from fabric• Preparation, focus DNA Center• PnP onboarding• Push full configuration template

Result – switch working in production


Demo

10


What about further automation through programming ?

11

DNA Center has API’s (REST)

Python script who do exactly what we have seen in one automated process

• Onboarding• Day-N template• Inform in a Webex Teams

room


Demo

12


Guest speaker, Jakob Lilholt, NOVO NORDISK

13

Non-Fabric mode

• Onboarding• Manage software• Manage licenses • Full configuration -> templates

Templates manualPolicy configuration manualProcess automated

DEMO

Fabric mode - SDA

• Onboarding• Manage software• Manage licenses • Full configuration –> SDA

SDA is full configurationPolicy built-in (VN=segmentering, SGT=micropolicy)Focus on INTENT

GLOBAL SOFTWARE DEFINED NETWORK

PROJECT (GSDN)

Cisco Connect 2019

IT Infrastructure, Global IT

Jakob Lilholt, JLHT

14April 2019Global Software Defined Network – Cisco Connect

NOVO NORDISK LOCATIONS

Network Impact Assessment Januar 2018 15

16

A SOFTWARE DEFINED NETWORKMOVING FROM A FLAT TO A CONTROLLED AND MANAGED NETWORK

Flat and physical segregated• All devices and applications can reach each other unhindered once

on the network• Segregation is created through physical firewalls

Manual and complex• Changes are made manually network device-to-network device• Large range of devices, applications, users and touchpoints

Security not embedded• Security is mainly achieved on the outside of Novo Nordisk

network, not on the inside

Uncontrolled with limited monitoring• Low ability to limit network access • Monitoring is passive and not real-time

WHAT WE HAVE TODAY:

Manual Operation

Modern Network HardwareNetwork Hardware Lan Refresh Network Hardware

Network Management Platform

WHAT GSDN WILL PROVIDE:

GSDN

Segmentation and virtualization• New virtual networks created in matter of minutes• Segmented networks to suit business needs and increase security

Automated and simplified• Changes distributed to network hardware by the click of button• All devices, access and applications managed from one application

Highly secure• Security policies can be issued in matter of minutes• Proactive response to threats and abnormalities

Analytics and assurance• Access is granted based users identity• Real-time monitoring on performance tuning

Global Software Defined Network – Cisco Connect April 2019

17

BENEFITSHIGH LEVEL BENEFITS ACHIEVED FROM GLOBAL SDN IMPLEMENTATION

Avoid the Mærsk cyber attack by having proactive reactions to threats

Create R&D Virtual networks where external partnerships have controlled access to Novo Nordisk network

Establishing a Global Software Defined Network will deliver the following high level benefits:

Example of impact

• Secure devices out of support• Real time response to threats• Contain suspicious devices and users

• Create new networks in matter of minutes• Control network access for externals

• Automatic device configuration• Analytics on network performance• Manage increasing complexity

• Reduce need for third party vendor as network operator

• Remove need for procuring further network hardware to secure network

Mærsk:

R&D:

Automation:

Network as a service:

Automated configuration of network devices and analytics of network performance to improve end user experience

Deploy virtual networks in matter of minutes and without reliance on hardware delivery or third party configurations

Enhanced Security

Increase Control

Operational Excellence

Cost Avoidance

1

2

3

4

April 2019Global Software Defined Network – Cisco Connect

18

Sco

pe

PoC 1 – SDN HardwareComplete

PoC 2a – SDN SoftwareOxfordComplete

Pilot – Migration of SDN

9 OPQR

Implemented

ü Proved SDN hardware can integrate with NN architecture and segment legacy OS

ü Security approve commencing work on SDN as compensating controls

• Novo Nordisk network policies can be configured and deployed through the DNA center

• Possible to manage and configure Novo Nordisk network devices as well as deploy virtual networks through the DNA center

• Define time and resources needed for migration

• Verify benefits• Develop high level

migration method• Verify daily operation is

not affected by SDN• Verify network

segmentation and virtualisation capabilities

(Exp

ecte

d)

outc

ome

GSDN PROOF OF CONCEPT AND PILOTPLANNED ACTIVITIES IN INITIATE AND ANALYSE PHASE

PoC 2b – SDN SoftwareCMC

Complete

• Novo Nordisk network policies can be configured and deployed through the DNA center

• Possible to manage and configure Novo Nordisk network devices as well as deploy virtual networks through the DNA center

INITIATE ANALYSEG14 JUN

G2/G314 NOV

Prove SDN hardware integration to Novo Nordisk

network infrastructure

Prove SDN software integration with new HW and applications

in Oxford

Test roll-out methodology of SDN on

a production site

Prove SDN software integration to legacy HW and applications

in CMC

Greenfield migration on a production site

Pilot – Migration of SDN

DAPI US

Planning

• Implementing GSDN at greenfield site

• Local savings in operational costs

• Test of assumptions• DAPI cover hardware,

licenses and local PM• Covered by GSDN

qualification • Rollout will be low risk

(slow ramp up)

üü

üü


Global Connectivity – Local Infrastructure 05/04/2019 19

28 switches100 AP250ms

1500 EP

7 switches30 AP155ms500 EP


2000 EP

350 switc.2200 AP

20ms10000 EP


2000 EP30 switches100 AP140ms

4000 EP

GSDN 2019PLANNED SCOPE

20

HANDOVERTESTMIGRATEPREPAREPLAN

1 2 3 4 5

• Assessment of devices

• Assessment of users

• Assessment of needed access

• Planning and coordination of migration in accordance to closing windows etc.

• Develop roll-out plan

Outcome• Roll-out plan

• Engage stakeholders and employees

• Procure non-compatible HW

• Engage supporting functions in case of incident

• Develop fall-back procedure

• Develop test plan

Outcome• Fall-back procedure• Test plan

• Install new HW • Install

management software on all network devices

• Configure network management software

Outcome• All HW upgraded to

SDN

• Run test• Verify that all

devices, applications and users have needed network access

• Ensure management software sends needed data to control center

Outcome• SDN management

software is installed• Operation is not

affected

• Handover of operation to GCS

• Continuous business value

IMPLEMENTATION APPROACHDELIVERING BUSINESS VALUE THROUGH RAPID EXECUTION

Prepare for Agile roll-out methodology

Agile roll-out principles are applied for each site, ensuring continuous business value is generated through each sprint

SITE MIGRATION SPRINT


LearningsNetwork Impact Assessment Januar 2018 21

CISCO AS DESIGN RECOMMENDATIONGlobal scalability learnings

DESIGN HIGHLIGHTS

• Latency limitations demand that regional DNA-C controllers must be installed

• Scalability considerations demand that the EU controller HW upgrade to XL

• New ISE needs to be installed

• Need to upgrade DNA-C to version 1.3 to support interdependency with ISE

• Rebuild global DNA-C platform on version 1.3 due to new appliance

PAN

MnT

PSN

CPH

AMS

• In case it is necessary, possible additional PSNs in SouthAmerica and South Africa

REGIONAL ISE DISTRIBUTIONEXISTING HW IS NOT UPGRADEABLE TO FUTURE ISE RELEASES

APACDNA-C

EMEA DNA-C

AMERDNA-C

120ms

140ms

140ms

170ms

125ms

235ms

REGIONAL DNA-C DISTRIBUTIONLATENCY NUMBERS

March 2019 22Global Software Defined Network – StC

23

TECHNICAL DECISIONSHighlights


No “Cisco” brownfield migrations

SDA when implementing SDN

WAN Not Included (Use SXP)

SGT used for Segmentation

IP Address changes on endpoints

Template all configurationsC9800 Cloud (UCS-E)

LAN Automation on all Edge Devices

24

MISSING FUNCTIONALITYFeedback to Cisco BU


Security Best Practice

Approval flow when making changes Simpler border configuration

SGT Integration to Public Cloud

Assurance data from ISE in DNA

SGT Integration to VMWARE

25April 2019Global Software Defined Network – Cisco Connect


Q&A

Hvad betyder automatisering for dit netværk?€¦ · PoC 2b –SDN Software CMC Complete Novo...

Documents

Transcript of Hvad betyder automatisering for dit netværk?€¦ · PoC 2b –SDN Software CMC Complete Novo...