Cisco DNA Center SD-Access and Zero Trust

Cisco DNA Center
SD-Access and
Zero Trust

Software-Defined Access
(SD-Access)

Multisite remote border

This feature provides policies for connecting to an external network (such as a DMZ) through specific exit points (borders) in the SD-Access fabric. A virtual network (VN) is available across more than one site. The same subnet associated with that VN is spread across sites. A multisite remote border/
control plane can be assigned for terminating all traffic in the VN, regardless of the originating site.

VLAN-based L2VNI

VLAN-based Layer 2 virtual network instance (L2VNI) provides a Layer 2 channel from the edge to the firewall or any other node that acts as a gateway. The firewall can be used as a gateway if there are strict security compliance rules for intra-VLAN and inter-VLAN traffic inspection.

Overlapping IPv4 pool for LAN automation

Optimize the IPv4 addressing in the underlay network by allowing overlapping /31 IP addresses for a multisite deployment. Network devices in different sites will now be able to get duplicate IP addresses on the point-to-point links.

IPv6 for SD-Access Wireless – Catalyst 9800, 9800-CL, Embedded Wireless Controller

IPv6 support with SD-Access for wired and wireless clients was introduced with Cisco DNA Center Release 1.3 but only for Cisco AireOS wireless controllers. With this release, IPv6 is supported on the Catalyst 9800 Series, eWLC, and in embedded wireless solutions. Supported platforms (besides AireOS WLC): Catalyst 9800 (16.9.2+), eWLC (16.10+), embedded wireless platforms (16.10+).

Zero Trust

AI Endpoint Analytics

AI Endpoint Analytics enables new capabilities for Cisco DNA Center to identify and classify endpoint devices on a campus network. Using various profiling methods, including deep packet inspection (DPI), machine learning, and manufacturer usage description, AI Endpoint Analytics establishes visibility into what is on the network so that new endpoints can be authenticated and assigned an appropriate policy for network usage, security, and segmentation.

Group-based policy analytics

New capabilities enable visualization of communication patterns between critical assets, making it easier to assess the impact of new access controls. Administrators can quickly identify the protocols to allow in access control policies.

Stealthwatch Security Analytics

Support is added for Encrypted Traffic Analytics with Application
Visibility and Control for improved threat detection.

User Defined Network

Give end users the ability to install personal endpoint devices, such as TV streaming boxes, video game consoles, video doorbells, etc. in their very own user private networks within a large campus network, such as students in a dorm or residents in a care facility. With a companion mobile application, end users can quickly create their very own wireless network partition, remotely and securely deploy their private devices on this network and invite others to participate in their private partition.

Table of Contents