Pass the Cisco Architecture Systems Engineer 500-470 Questions and answers with ExamsMirror

 Fabric overlay concepts are related to the creation of a virtual network topology on top of a physical network infrastructure. The overlay network is usually designed to provide services or features that are not directly supported by the underlay network, such as network segmentation, mobility, or security. Some of the fabric overlay concepts are:

An overlay is a logical topology: An overlay network is a network that is built on top of another network using software or hardware devices that encapsulate and decapsulate packets. The overlay network creates a logical topology that is independent of the physical topology of the underlay network. The overlay network can span multiple Layer 2 or Layer 3 domains and provide end-to-end connectivity for the overlay endpoints. An example of an overlay network is a VPN that connects remote sites over the Internet.

GRE is a type of overlay: Generic Routing Encapsulation (GRE) is a protocol that encapsulates packets of one protocol type within another protocol type. GRE is used to create tunnels between devices that can carry different types of traffic, such as IP, IPv6, MPLS, or Ethernet. GRE is a type of overlay network that can be used to extend Layer 2 or Layer 3 connectivity across different networks or to provide a secure and private communication channel. An example of a GRE overlay network is a DMVPN that uses GRE tunnels to connect branch offices to a central hub over the Internet.

An overlay uses alternate forwarding attributes: An overlay network uses different attributes or identifiers to forward packets than the underlay network. The overlay network adds specific headers or tags to the packets that contain information about the overlay endpoints, such as their logical addresses, group memberships, or policies. The overlay devices use these attributes to forward packets based on the overlay topology and services, rather than the underlay topology and protocols. The underlay devices are unaware of the overlay attributes and forward packets based on the underlay headers. An example of an overlay network that uses alternate forwarding attributes is a VXLAN network that uses VNIs to segment traffic and provide Layer 2 connectivity over a Layer 3 network.

The other options, Intermediate System to Intermediate System (IS-IS), a virtual Local Area Network (VLAN), and a link state routing protocol like OSPF, are not fabric overlay concepts. IS-IS and OSPF are routing protocols that are used to exchange routing information and build the routing table of the underlay network. A VLAN is a Layer 2 segmentation technique that divides a physical network into logical subnets based on the switch port membership. A VLAN is not an overlay network, but it can be part of the underlay network or the overlay network, depending on the design. References := : Fabric Technologies and Overlays - Cisco Learning Network1, What Is a Network Fabric? - Cisco2

According to the Cisco DNA Center Compatibility Matrix1, the current DNA-C 1.1 release supports the following wireless product families:

WLC 8540: This is a high-performance wireless controller that can support up to 6000 access points and 64,000 clients. It is designed for large-scale wireless deployments and offers advanced features such as application visibility and control, flexible radio assignment, and software-defined access2.

AP 3800: This is a high-performance access point that can support up to 5.2 Gbps data rates and 4x4 MIMO with four spatial streams. It is designed for high-density environments and offers features such as flexible radio assignment, CleanAir, ClientLink, and Smart Antenna Connector3.

WLC 3504: This is a compact wireless controller that can support up to 150 access points and 3000 clients. It is designed for small to medium-sized wireless deployments and offers features such as application visibility and control, software-defined access, and TrustSec4.

The other wireless product families, such as AP 1260 and WLC 5508, are not supported in the current DNA-C 1.1 release.

References:

: Cisco DNA Center Compatibility Matrix

: Cisco 8540 Wireless Controller Data Sheet - Cisco

: Cisco Aironet 3800 Series Access Points Data Sheet - Cisco

: Cisco 3504 Wireless Controller Data Sheet - Cisco

The current DNA-C 1.1 release supports the following wireless product families:

WLC 3504: This is a wireless LAN controller that provides centralized control, management, and troubleshooting for small to medium-sized enterprises and branch offices. It supports up to 150 access points and 3,000 clients, and offers high availability, scalability, and security features. It is compatible with Cisco DNA Center 1.1 and later releases1.

WLC 8540: This is a wireless LAN controller that provides centralized control, management, and troubleshooting for large enterprises and service providers. It supports up to 6,000 access points and 64,000 clients, and offers high performance, reliability, and flexibility. It is compatible with Cisco DNA Center 1.1 and later releases2.

AP 3800: This is an access point that delivers high-performance wireless connectivity for indoor and outdoor environments. It supports 802.11ac Wave 2 technology, multiuser multiple-input multiple-output (MU-MIMO), flexible radio assignment, and modular design. It is compatible with Cisco DNA Center 1.1 and later releases3.

References:

 1: [Cisco Wireless LAN Controller 3504 Data Sheet - Cisco] : 2: [Cisco 8540 Wireless Controller Data Sheet - Cisco] : 3: [Cisco Aironet 3800 Series Access Points Data Sheet - Cisco]

https://www.ciscolive.com/c/dam/r/ciscolive/latam/docs/2017/pdf/BRKEWN-2032.pdf

Cisco ISE integrates with more than 60 third-party solutions that span across security and network portfolios. These solutions include network access devices, firewalls, threat detection and prevention systems, vulnerability scanners, endpoint management platforms, cloud services, and more. By integrating with these solutions, Cisco ISE can leverage the information and capabilities of these solutions to enhance the identity and access management, network visibility and segmentation, threat detection and response, and policy enforcement of the network. Some of the examples of third-party solutions that integrate with Cisco ISE are:

Fortinet: Fortinet integrates with Cisco ISE through pxGrid to share user and device information, security group tags, and endpoint posture status. This enables Fortinet to apply granular and dynamic firewall policies based on the identity and context of the endpoints1.

Tripwire: Tripwire integrates with Cisco ISE through pxGrid to share vulnerability and compliance data of the endpoints. This enables Cisco ISE to apply appropriate network access policies based on the risk and compliance level of the endpoints2.

Splunk: Splunk integrates with Cisco ISE through REST APIs to collect and analyze the logs and events generated by Cisco ISE. This enables Splunk to provide network and security insights, dashboards, reports, and alerts based on the Cisco ISE data3.

References := : Cisco Identity Services Engine Administrator Guide, Release 2.7 - ISE Security Ecosystem Integration Guides [Cisco Identity Services Engine] - Cisco4, Solved: ISE Integration with 3rd party solution - Cisco Community1, ISE Security Ecosystem Integration Guides - Cisco Community5, Cisco Identity Services Engine Administrator Guide, Release 2.7 - Splunk Integration [Cisco Identity Services Engine] - Cisco3, Cisco Identity Services Engine Administrator Guide, Release 2.7 - Tripwire Integration [Cisco Identity Services Engine] - Cisco2

https://www.ciscolive.com/c/dam/r/ciscolive/apjc/docs/2017/pdf/BRKSEC-2141.pdf slide 9

Device Sensor is a feature that enables Cisco devices to collect and report information about the endpoints connected to them. This information can be used by ISE to identify and classify the endpoints, and apply appropriate policies based on their attributes. Device Sensor can collect information from various sources, such as DHCP, CDP, LLDP, and HTTP User-Agent. Among the options given, only DHCP and CDP are valid sources of information for Device Sensor. References := : Cisco Identity Services Engine Administrator Guide, Release 2.7 - Device Sensor [Cisco Identity Services Engine]- Cisco (https://learningnetworkstore.cisco.com/c/en/us/td/docs/security/ise/2-7/admin_guide/b_ise_admin_guide_27/b_ise_admin_guide_27_chapter_010100.html)

2of30

 Identity management is the practice of making sure that people and entities with digital identities have the right level of access to enterprise resources like networks and databases. User roles and access privileges are defined and managed through an identity management system, such as Cisco Identity Services Engine (ISE)1. Identity management solves two customer problems:

Provides network visibility and security: Identity management allows customers to see who and what is on their network, and to control their access based on policies and context. Identity management also integrates with other security solutions, such as Cisco Firepower, Cisco Stealthwatch, or Cisco Umbrella, to detect and respond to threats, and to enforce adaptive network access policies based on the threat level of the endpoints2.

Achieves dynamic and adaptive network segmentation: Identity management enables customers to segment their network based on the identity and context of the users and devices, rather than the IP addresses and VLANs. This allows customers to implement a zero-trust model, where only trusted users and devices can access the resources they need, and where the access policies can be dynamically updated based on the changing conditions and requirements. Identity management also supports Cisco TrustSec, which is a technology that assigns scalable group tags (SGTs) to endpoints and enforces group-based policies (contracts) across the network3.

References:

 1: [What Is Identity Access Management (IAM)? - Cisco

https://www.arista.com/assets/data/pdf/Whitepapers/Arista_Networks_VXLAN_White_Paper.pdf

A VxLAN header adds 50 bytes to an original Ethernet frame. This is because a VxLAN header consists of the following components:

8-byte outer UDP header for VxLAN: The default VxLAN destination UDP port number is 47891

20-byte outer IP header: Valid addresses of VTEPs or VxLAN multicast groups on the transport network. Devices in the transport network forward VxLAN packets based on the outer IP header1

8-byte VxLAN header: VxLAN information for the frame. It includes a 24-bit VxLAN Network Identifier (VNI) that identifies the VxLAN of the frame, and an 8-bit flags field that indicates the validity of the VNI1

14-byte inner Ethernet header: The original Ethernet header of the encapsulated frame. It includes the source and destination MAC addresses, the EtherType, and optionally a 4-byte VLAN tag2

The total size of these components is 8 + 20 + 8 + 14 = 50 bytes. Therefore, a VxLAN header adds 50 bytes to an original Ethernet frame.

References :=

VXLAN packet format - Aruba

MTU Considerations for VXLAN | Matt Oswalt

 SD-Access Fabric is a network architecture that uses three key technologies to create a virtual overlay network on top of the physical underlay network. These technologies are:

VXLAN: Virtual Extensible LAN is a tunneling protocol that encapsulates Layer 2 frames in UDP packets and transports them over an IP network. VXLAN enables the creation of large-scale virtual networks that span multiple Layer 3 domains. VXLAN is used in SD-Access Fabric to carry user traffic between different fabric nodes and to provide network segmentation based on virtual network identifiers (VNIs).

TrustSec: Cisco TrustSec is a security framework that uses software-defined segmentation to enforce granular access policies based on the identity and context of users, devices, and applications. TrustSec uses scalable group tags (SGTs) to classify endpoints into logical groups and applies security policies based on the source and destination SGTs. TrustSec is integrated with SD-Access Fabric to provide micro-segmentation within a virtual network and to simplify policy management across the fabric.

LISP: Locator/ID Separation Protocol is a routing protocol that decouples the endpoint identity (EID) from its location (RLOC) in the network. LISP uses two types of devices: ingress tunnel routers (ITRs) and egress tunnel routers (ETRs) to map EIDs to RLOCs and to encapsulate and decapsulate packets. LISP is used in SD-Access Fabric to provide control plane functions, such as endpoint registration, discovery, and mobility. LISP also enables seamless integration of SD-Access Fabric with external networks, such as the Internet, WAN, or data center.

The other options, OTV, RSVP, and MPLS, are not used in SD-Access Fabric. OTV is another tunneling protocol that extends Layer 2 connectivity across Layer 3 domains, but it is not compatible with VXLAN. RSVP is a signaling protocol that reserves network resources for quality of service (QoS), but it is not required for SD-Access Fabric. MPLS is a packet-switching technology that labels packets and forwards them based on label switching routers (LSRs), but it is not involved in SD-Access Fabric. References := : Cisco SD-Access Solution Design Guide (CVD) - Cisco1, Cisco Software-Defined Access - Cisco Software-Defined Access Solution Overview2

The maximum number of concurrent endpoints with a distributed deployment depends on the type of deployment and the hardware used. According to the Cisco documentation1, there are two types of distributed deployments: hybrid and dedicated.

A hybrid deployment is where the Policy Administration Node (PAN) and the Monitoring Node (MnT) personas are co-located on the same node, and the Policy Service Node (PSN) persona is distributed across multiple nodes. A hybrid deployment can support up to 20,000 concurrent endpoints with a maximum of 5 PSNs on SNS-36xx or SNS-35xx hardware.

A dedicated deployment is where the PAN, MnT, and PSN personas are separated on different nodes. A dedicated deployment can support up to 500,000 concurrent endpoints with a maximum of 50 PSNs on SNS-36xx or SNS-35xx hardware.

The main difference between the hybrid and dedicated deployments is the scalability and redundancy of the MnT persona, which collects and stores the logs and sessions from the PSNs. By breaking the PAN and MnT roles out on to their own servers, the dedicated deployment can handle more concurrent endpoints and PSNs, as well as provide failover and load balancing for the MnT persona2

References :=

Performance and Scalability Guide for Cisco Identity Services Engine

Solved: ISE concurrent connections query - Cisco Community