Introduction |
|
xxvii | |
|
Chapter 1 Cisco C9800 Series |
|
|
1 | (24) |
|
|
2 | (5) |
|
Intent-Based Networking (IBN) |
|
|
3 | (1) |
|
|
4 | (1) |
|
|
5 | (2) |
|
The Role of the Wireless Controller in a Cloud Era |
|
|
7 | (3) |
|
|
10 | (12) |
|
Traditional Management Tools |
|
|
11 | (1) |
|
|
11 | (5) |
|
Cisco Prime Infrastructure |
|
|
16 | (3) |
|
|
19 | (1) |
|
C9800 Prerequisites for Cisco DNA Center |
|
|
20 | (1) |
|
|
21 | (1) |
|
|
21 | (1) |
|
Cisco Next-Generation Wireless Stack |
|
|
22 | (1) |
|
|
23 | (1) |
|
|
23 | (2) |
|
Chapter 2 Hardware and Software Architecture of the C9800 |
|
|
25 | (18) |
|
General CAPWAP Split MAC Architecture |
|
|
25 | (2) |
|
The Controller Control Plane Architecture Elasticity |
|
|
27 | (4) |
|
IOS-XE Software Architecture |
|
|
27 | (1) |
|
WNCd: The Heart of the Wireless Controller Control Plane |
|
|
28 | (3) |
|
|
31 | (1) |
|
Wireless Client State Machine |
|
|
31 | (4) |
|
One Dataplane to Rule Them All (or Three at the Maximum) |
|
|
35 | (3) |
|
|
38 | (4) |
|
|
38 | (2) |
|
|
40 | (1) |
|
|
41 | (1) |
|
|
42 | (1) |
|
Chapter 3 C9800 Configuration Model |
|
|
43 | (22) |
|
C9800 New Configuration Model |
|
|
43 | (5) |
|
What Does My AireOS AP Group Migrate To? |
|
|
46 | (1) |
|
|
47 | (1) |
|
Cisco C9800 Series Profile and Tag Considerations |
|
|
48 | (16) |
|
|
48 | (6) |
|
Moving APs Between Wireless Controllers and Preserving Tags |
|
|
54 | (1) |
|
Roaming Between Policy Tags |
|
|
55 | (2) |
|
Designing with Site Tags in Mind (Local Mode APs) |
|
|
57 | (6) |
|
Designing with Site Tags in Mind (FlexConnect Mode APs) |
|
|
63 | (1) |
|
|
64 | (1) |
|
|
64 | (1) |
|
Chapter 4 C9800 Deployment and Installation |
|
|
65 | (24) |
|
|
65 | (14) |
|
|
65 | (1) |
|
|
66 | (4) |
|
|
70 | (4) |
|
Embedded Wireless Controller on Catalyst AP and Switch |
|
|
74 | (1) |
|
|
75 | (4) |
|
Setting Up Your First Catalyst Wireless Network |
|
|
79 | (8) |
|
|
80 | (3) |
|
|
83 | (2) |
|
Configuring WLAN and Connecting a Client |
|
|
85 | (2) |
|
|
87 | (1) |
|
|
87 | (2) |
|
|
89 | (70) |
|
Network Security Fundamentals |
|
|
89 | (27) |
|
Access Control Lists (ACLs) |
|
|
89 | (1) |
|
|
90 | (1) |
|
|
91 | (2) |
|
Applying Wireless ACLs on the WLC |
|
|
93 | (1) |
|
Flex Connect ACLs on the AP |
|
|
94 | (1) |
|
The Case of Downloadable ACLs (DACLs) |
|
|
95 | (1) |
|
URL Filters (a.k.a. DNS-Based ACLs) |
|
|
96 | (1) |
|
Certificates and Trustpoints |
|
|
97 | (1) |
|
|
98 | (1) |
|
How to Add a Certificate on the Controller |
|
|
98 | (5) |
|
|
103 | (1) |
|
|
104 | (1) |
|
|
105 | (1) |
|
|
106 | (1) |
|
RADIUS Change of Authorization (CoA) |
|
|
107 | (1) |
|
RADIUS Configuration and Load Balancing |
|
|
108 | (1) |
|
Configuring RADIUS Servers |
|
|
108 | (1) |
|
Configuring RADIUS Server Groups |
|
|
108 | (2) |
|
|
110 | (1) |
|
|
111 | (1) |
|
|
111 | (1) |
|
|
112 | (1) |
|
|
113 | (1) |
|
|
114 | (2) |
|
|
116 | (1) |
|
Wireless Security Fundamentals |
|
|
116 | (12) |
|
Wired Equivalent Privacy (WEP) |
|
|
116 | (1) |
|
Wi-Fi Protected Access (WPA) |
|
|
116 | (3) |
|
802.1X for WPA Enterprise |
|
|
119 | (1) |
|
|
119 | (1) |
|
|
120 | (1) |
|
|
121 | (3) |
|
|
124 | (1) |
|
Preshared Key for WPA Personal |
|
|
124 | (1) |
|
|
125 | (1) |
|
|
126 | (1) |
|
|
127 | (1) |
|
|
127 | (1) |
|
|
128 | (1) |
|
|
128 | (20) |
|
|
129 | (1) |
|
|
130 | (2) |
|
|
132 | (6) |
|
|
138 | (2) |
|
(Local) Web Authentication |
|
|
140 | (3) |
|
Central Web Authentication |
|
|
143 | (2) |
|
Web Authentication Best Practices |
|
|
145 | (1) |
|
|
145 | (1) |
|
|
146 | (1) |
|
Web Authentication Takeaways |
|
|
147 | (1) |
|
|
148 | (1) |
|
Securing Your Access Points |
|
|
148 | (3) |
|
|
148 | (1) |
|
|
149 | (1) |
|
Securing the AP Join Process Using Locally Significant Certificates |
|
|
150 | (1) |
|
Securing Your Wireless Controller |
|
|
151 | (3) |
|
Securing Administrator Access |
|
|
151 | (1) |
|
|
151 | (2) |
|
|
153 | (1) |
|
|
153 | (1) |
|
The Lobby Ambassador Type of User |
|
|
153 | (1) |
|
|
153 | (1) |
|
Granularity of WebUI Access |
|
|
154 | (1) |
|
Connect to the WebUI Using Certificates |
|
|
154 | (1) |
|
|
154 | (1) |
|
Encrypted Traffic Analytics |
|
|
154 | (1) |
|
|
155 | (2) |
|
Cisco Secure Development Lifecycle (CSDL) |
|
|
157 | (1) |
|
|
157 | (1) |
|
|
157 | (2) |
|
Chapter 6 Mobility and Client Roaming |
|
|
159 | (36) |
|
|
160 | (21) |
|
Full-Auth Roaming (or Slow Roam) |
|
|
161 | (2) |
|
|
163 | (1) |
|
PMKID Caching (Sticky Key Caching) |
|
|
164 | (1) |
|
|
165 | (2) |
|
|
167 | (2) |
|
Fast Transition (802.11r) |
|
|
169 | (8) |
|
|
177 | (1) |
|
|
177 | (2) |
|
|
179 | (2) |
|
|
181 | (10) |
|
|
181 | (1) |
|
Intra-WNCd Roaming (Same Site Tag, Same Policy Profile) |
|
|
181 | (1) |
|
Inter-WNCd Roam (Different Site Tags, Same Policy Profile) |
|
|
182 | (1) |
|
Intra-WLC Roam (Same Site Tag, Different Policy Profile) |
|
|
183 | (2) |
|
|
185 | (1) |
|
|
185 | (1) |
|
|
185 | (2) |
|
Static IP Client Mobility |
|
|
187 | (1) |
|
Auto-Anchor Mobility (Guest Tunnel) |
|
|
187 | (1) |
|
Configuring Secure Mobility Tunneling on a C9800 |
|
|
188 | (3) |
|
C9800 to AireOS Inter-Release Controller Mobility (IRCM) |
|
|
191 | (1) |
|
|
192 | (1) |
|
|
193 | (2) |
|
Chapter 7 RF Deployment and Guidelines |
|
|
195 | (52) |
|
Radio Resources Management (RRM) Concepts and Components |
|
|
195 | (4) |
|
Antennas and Signal Propagation |
|
|
195 | (2) |
|
|
197 | (2) |
|
Challenging RF Environments |
|
|
199 | (4) |
|
|
200 | (1) |
|
|
200 | (1) |
|
Shielded Doors and Sudden Turns |
|
|
201 | (1) |
|
|
201 | (1) |
|
|
202 | (1) |
|
Radio Resources Management (RRM) |
|
|
203 | (8) |
|
|
203 | (3) |
|
|
206 | (1) |
|
|
207 | (1) |
|
|
208 | (1) |
|
|
208 | (1) |
|
|
209 | (1) |
|
|
210 | (1) |
|
|
211 | (4) |
|
Overlapping Basic Service Set (BSS) |
|
|
213 | (2) |
|
|
215 | (1) |
|
|
215 | (4) |
|
Spectrum Intelligence and CleanAir |
|
|
219 | (5) |
|
|
222 | (1) |
|
Monitoring the Spectrum Live |
|
|
222 | (1) |
|
Interferer Location Tracking |
|
|
223 | (1) |
|
|
224 | (1) |
|
|
224 | (4) |
|
|
225 | (1) |
|
Aggressive Client Load Balancing |
|
|
226 | (1) |
|
Off-Channel Scanning Defer |
|
|
227 | (1) |
|
|
228 | (4) |
|
|
228 | (1) |
|
|
229 | (1) |
|
Multi User-Multiple Input Multiple Output (MU-MIMO) |
|
|
229 | (1) |
|
|
229 | (2) |
|
|
231 | (1) |
|
|
232 | (1) |
|
Dynamic Frequency Selection (DFS) |
|
|
232 | (3) |
|
|
233 | (1) |
|
|
234 | (1) |
|
Flexible Radio Assignment (FRA) |
|
|
235 | (3) |
|
|
236 | (2) |
|
Wireless Intrusion Prevention System (WIPS) and Rogue Detection |
|
|
238 | (8) |
|
Rogue AP Detection and Classification |
|
|
238 | (1) |
|
Detecting a Rogue Access Point |
|
|
238 | (2) |
|
Classifying Rogue Access Points |
|
|
240 | (1) |
|
Understanding the Danger of a Rogue Access Point |
|
|
241 | (1) |
|
Containing Rogue Access Points |
|
|
241 | (3) |
|
|
244 | (1) |
|
|
245 | (1) |
|
|
246 | (1) |
|
|
246 | (1) |
|
Chapter 8 Multicast and Multicast Domain Name System (mDNS) |
|
|
247 | (38) |
|
|
250 | (13) |
|
Multicast Packet Flow in Wireless |
|
|
250 | (1) |
|
Multicast in a Centralized Wireless Deployment |
|
|
250 | (1) |
|
|
251 | (1) |
|
|
251 | (1) |
|
How to Configure Multicast on the C9800 |
|
|
251 | (2) |
|
IGMP and MLD on the C9800 |
|
|
253 | (1) |
|
|
254 | (1) |
|
Multicast over Unicast (MoU) |
|
|
254 | (2) |
|
Multicast over Multicast (MoM) |
|
|
256 | (3) |
|
|
259 | (1) |
|
Wireless Broadcast and Non-IP Multicast |
|
|
260 | (2) |
|
Multicast in Client Roaming Scenarios |
|
|
262 | (1) |
|
|
263 | (9) |
|
|
264 | (1) |
|
Components of VideoStream |
|
|
264 | (3) |
|
How to Configure Media Stream |
|
|
267 | (5) |
|
|
272 | (11) |
|
|
273 | (1) |
|
|
274 | (1) |
|
How to Configure mDNS Gateway |
|
|
274 | (2) |
|
|
276 | (1) |
|
MDNS Service Policy on Policy Profile |
|
|
277 | (1) |
|
|
277 | (3) |
|
MDNS Service Policy on VLAN SVI |
|
|
280 | (1) |
|
MDNS Service Policy via AAA Override |
|
|
281 | (1) |
|
|
281 | (1) |
|
MDNS Gateway in FlexConnect Deployment |
|
|
282 | (1) |
|
MDNS Gateway with Guest Anchor |
|
|
283 | (1) |
|
|
283 | (1) |
|
|
283 | (2) |
|
Chapter 9 Quality of Service (QoS) |
|
|
285 | (38) |
|
Wi-Fi Quality of Service (QoS) |
|
|
286 | (1) |
|
Wi-Fi (802.11) QoS Fundamentals |
|
|
287 | (13) |
|
|
289 | (1) |
|
|
290 | (5) |
|
|
295 | (3) |
|
Wireless Call Admission Control (CAC) |
|
|
298 | (2) |
|
Implementing Wireless QoS on the C9800 |
|
|
300 | (4) |
|
|
300 | (1) |
|
|
301 | (1) |
|
|
302 | (2) |
|
Designing and Deploying Catalyst C9800 QoS |
|
|
304 | (16) |
|
|
304 | (6) |
|
|
310 | (3) |
|
QoS Profiles (a.k.a. Metal QoS Profiles) |
|
|
313 | (3) |
|
Application Visibility and Control (AVC) |
|
|
316 | (3) |
|
Deployment Verification and Restrictions |
|
|
319 | (1) |
|
|
319 | (1) |
|
|
320 | (2) |
|
|
322 | (1) |
|
|
322 | (1) |
|
Chapter 10 C9800 High Availability |
|
|
323 | (38) |
|
|
324 | (25) |
|
|
325 | (2) |
|
|
327 | (1) |
|
Redundancy Management Interface (RMI) |
|
|
327 | (1) |
|
|
328 | (2) |
|
|
330 | (1) |
|
|
330 | (1) |
|
Out-of-Band Management/Service Port (SP) |
|
|
330 | (1) |
|
RP+RMI Supported Topologies |
|
|
331 | (1) |
|
Building an RP+RMI HA Pair |
|
|
331 | (1) |
|
|
332 | (3) |
|
Active-Standby Election Process |
|
|
335 | (1) |
|
|
335 | (1) |
|
|
336 | (2) |
|
|
338 | (1) |
|
System and Network Error Handling |
|
|
339 | (5) |
|
|
344 | (1) |
|
Monitoring an HA Pair via the CLI |
|
|
344 | (3) |
|
Monitoring an HA Pair via the GUI |
|
|
347 | (1) |
|
Monitoring an HA Pair via SNMP |
|
|
348 | (1) |
|
Monitoring an HA Pair via Programmatic Interfaces |
|
|
348 | (1) |
|
RP Only to RP+RMI HA Migration |
|
|
349 | (1) |
|
|
349 | (1) |
|
SSO Deployment: Impact on Features |
|
|
350 | (2) |
|
|
350 | (1) |
|
Link Aggregation Group (LAG) |
|
|
351 | (1) |
|
|
352 | (1) |
|
|
352 | (5) |
|
|
353 | (1) |
|
Configuration on the AP Join Profile |
|
|
354 | (1) |
|
|
355 | (1) |
|
Preserving AP-to-Tag Mapping across N+1 Failovers |
|
|
356 | (1) |
|
|
357 | (1) |
|
N+1 vs. SSO High Availability |
|
|
357 | (1) |
|
|
358 | (1) |
|
|
359 | (1) |
|
|
359 | (1) |
|
|
360 | (1) |
|
Chapter 11 Cisco DNA Spaces Integration and IoT |
|
|
361 | (32) |
|
Value-Added Wireless Services |
|
|
361 | (11) |
|
|
361 | (1) |
|
|
362 | (1) |
|
Location Update Frequency |
|
|
363 | (1) |
|
|
364 | (1) |
|
The Impact of Privacy MAC Addresses |
|
|
364 | (1) |
|
Location Deployment Guidelines |
|
|
364 | (1) |
|
|
365 | (1) |
|
|
366 | (1) |
|
|
366 | (1) |
|
|
366 | (1) |
|
|
367 | (1) |
|
|
368 | (3) |
|
Bluetooth Location Tracking |
|
|
371 | (1) |
|
Connected Mobile Experiences (CMX) |
|
|
372 | (1) |
|
|
372 | (7) |
|
|
374 | (1) |
|
|
374 | (1) |
|
Cisco DNA Spaces Connector |
|
|
375 | (4) |
|
|
379 | (1) |
|
Specific Service Examples |
|
|
379 | (13) |
|
|
379 | (1) |
|
What Problem Is OpenRoaming Trying to Solve? |
|
|
379 | (1) |
|
|
379 | (2) |
|
OpenRoaming Configuration |
|
|
381 | (5) |
|
|
386 | (2) |
|
Advantages of a Portal on Cisco DNA Spaces |
|
|
388 | (1) |
|
|
389 | (1) |
|
BLE Gateway on Cisco DNA Spaces |
|
|
389 | (3) |
|
|
392 | (1) |
|
|
392 | (1) |
|
Chapter 12 Network Programmability |
|
|
393 | (44) |
|
What Is Network Programmability? |
|
|
393 | (1) |
|
Why Is Network Programmability Needed? |
|
|
393 | (3) |
|
Is Network Programmability a New Concept? |
|
|
396 | (1) |
|
Orchestration of the Entire Network |
|
|
396 | (1) |
|
Configuration Repeatability |
|
|
396 | (1) |
|
|
397 | (1) |
|
Imperative vs. Declarative Models |
|
|
397 | (3) |
|
Infrastructure as Code (IaC) |
|
|
400 | (1) |
|
Network Programmability in the C9800 |
|
|
401 | (1) |
|
|
402 | (1) |
|
|
403 | (3) |
|
|
406 | (2) |
|
|
406 | (1) |
|
|
407 | (1) |
|
|
408 | (1) |
|
|
408 | (4) |
|
|
409 | (1) |
|
|
409 | (1) |
|
|
409 | (2) |
|
|
411 | (1) |
|
|
411 | (1) |
|
|
411 | (1) |
|
|
412 | (1) |
|
Tools to Examine YANG Models |
|
|
412 | (7) |
|
|
412 | (1) |
|
Using pyang in a Docker Container |
|
|
413 | (1) |
|
|
414 | (5) |
|
How to Examine Data Using NETCONF and YANG Suite |
|
|
419 | (2) |
|
How to Examine Data Using RESTCONF and POSTMAN |
|
|
421 | (8) |
|
|
422 | (1) |
|
|
422 | (1) |
|
|
422 | (1) |
|
|
423 | (1) |
|
|
423 | (2) |
|
|
425 | (1) |
|
Updating the Configuration |
|
|
426 | (3) |
|
Python and Network Programmability |
|
|
429 | (7) |
|
Assigning Tags to APs Based on Serial Number |
|
|
429 | (2) |
|
|
431 | (5) |
|
|
436 | (1) |
|
|
436 | (1) |
|
Chapter 13 Model-Driven Telemetry |
|
|
437 | (32) |
|
What Is Model-Driven Telemetry? |
|
|
437 | (1) |
|
How to Enable Model-Driven Telemetry |
|
|
438 | (3) |
|
|
439 | (1) |
|
|
439 | (1) |
|
|
440 | (1) |
|
Operational Data and KPIs |
|
|
441 | (6) |
|
|
447 | (1) |
|
|
448 | (1) |
|
|
448 | (1) |
|
|
448 | (1) |
|
How to Identify Subtrees in YANG Models |
|
|
449 | (1) |
|
|
450 | (10) |
|
|
450 | (1) |
|
|
451 | (2) |
|
Creating Dial-in Subscriptions |
|
|
453 | (7) |
|
|
460 | (7) |
|
|
460 | (1) |
|
TIG (Telegraf, Influx, Grafana) |
|
|
461 | (2) |
|
|
463 | (4) |
|
|
467 | (1) |
|
|
467 | (2) |
|
Chapter 14 Cisco DNA Center/Assurance Integration |
|
|
469 | (24) |
|
|
469 | (3) |
|
Cisco DNA Center Assurance Architecture |
|
|
471 | (1) |
|
Managing the C9800 with Cisco DNA Center |
|
|
472 | (20) |
|
|
473 | (2) |
|
|
475 | (2) |
|
Network Services Analytics |
|
|
477 | (2) |
|
|
479 | (1) |
|
|
479 | (2) |
|
|
481 | (1) |
|
|
481 | (2) |
|
|
483 | (5) |
|
|
488 | (1) |
|
Sensor Provisioning and Onboarding |
|
|
489 | (1) |
|
|
489 | (2) |
|
Troubleshooting the Assurance Application |
|
|
491 | (1) |
|
|
492 | (1) |
|
|
492 | (1) |
|
Chapter 15 Backing Up, Restoring, and Upgrading Your C9800 |
|
|
493 | (14) |
|
Saving and Restoring the Configuration for Disaster Recovery |
|
|
493 | (7) |
|
Saving the Configuration Changes |
|
|
494 | (1) |
|
Backing Up the Configuration and Restoring It |
|
|
494 | (1) |
|
Backing Up Everything for Restoring on Another Controller |
|
|
495 | (1) |
|
The Advantage of Backing Up Using the WebUI |
|
|
496 | (1) |
|
The Case of Configuration Encryption |
|
|
496 | (1) |
|
Backing Up Using Cisco Prime Infrastructure |
|
|
497 | (1) |
|
Backing Up Using Cisco DNA Center |
|
|
498 | (2) |
|
Running IOS-XE in Install or Bundle Mode |
|
|
500 | (1) |
|
|
500 | (1) |
|
|
500 | (1) |
|
Upgrading (and Downgrading) the Controller Safely |
|
|
501 | (5) |
|
|
501 | (2) |
|
|
503 | (2) |
|
|
505 | (1) |
|
Rolling AP Upgrade (for N+1) |
|
|
505 | (1) |
|
In-Service Software Upgrade (ISSU) |
|
|
506 | (1) |
|
|
506 | (1) |
|
|
506 | (1) |
|
Chapter 16 Troubleshooting |
|
|
507 | (72) |
|
|
509 | (16) |
|
|
509 | (2) |
|
|
511 | (4) |
|
|
515 | (5) |
|
|
520 | (1) |
|
|
521 | (4) |
|
Embedded Packet Capture (EPC) |
|
|
525 | (6) |
|
|
531 | (5) |
|
Troubleshooting Dashboard |
|
|
536 | (4) |
|
Core Dump and System Report |
|
|
536 | (3) |
|
|
539 | (1) |
|
|
539 | (1) |
|
Other On-the-Box Tools on the C9800 GUI |
|
|
540 | (5) |
|
|
540 | (1) |
|
|
541 | (1) |
|
|
542 | (1) |
|
Walk-Me Integrated with the C9800 GUI |
|
|
542 | (1) |
|
|
543 | (2) |
|
Offline Tools for the C9800 |
|
|
545 | (3) |
|
Wireless Configuration Convertor |
|
|
545 | (1) |
|
|
546 | (1) |
|
|
547 | (1) |
|
|
548 | (1) |
|
Health and KPI Monitoring |
|
|
548 | (29) |
|
|
549 | (1) |
|
|
550 | (7) |
|
|
557 | (1) |
|
|
557 | (1) |
|
|
558 | (1) |
|
|
558 | (1) |
|
|
559 | (4) |
|
|
563 | (7) |
|
|
570 | (5) |
|
|
575 | (1) |
|
|
576 | (1) |
|
|
577 | (1) |
|
|
578 | (1) |
Appendix A Setting Up a Development Environment |
|
579 | (28) |
Index |
|
607 | |