1 to 100
Master All Steps of Deployment, Integration,
and Migration of Large SDA and SD-WAN Networks
Dhrumil Prajapati - Principal Architect
Jennifer Bowman - Principal Architect
BRKENS-3834
-
Webex App
Questions?
Use the Webex app to chat with the speaker
after the session
How
1 Find this session in the Cisco Events mobile app
2 Click “Join the Discussion”
3 Install the Webex app or go directly to the Webex space
4 Enter messages/questions in the Webex space
Webex spaces will be moderated
by the speaker until February 28, 2025.
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 2
Agenda
• Introduction
• Design and Deployment Best Practices
• SDA & SDWAN Integration
• 100,000ft view on Multi-Domain Design
• Deployment and Migration Lessons Learned from Large Scale Deployments
• Having a solid Foundation
• What is the migration process?
• Lessons Learnt
• Conclusion
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 3
Who are we?
Dhrumil Prajapati
Principal Architect
GES Architectures - CX
10+ Years @ Cisco
CCIE #28071 (R/S, SP)
CCDE #20210002
Specialized in: SD-Access, SD-WAN,
MPLS, Multi-Domain Networks, Cloud,
Automation
@DhruPrajapati
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 4
Who are we?
Jennifer Bowman
Sr. Delivery Architect
Cisco CX
10+ Years @ Cisco
CCIE #51241 (Security, R/S)
CCDE #2018::16
Specialized in: Full Enterprise IBN
with Security and Automation
@ibnsrevenge
jdb1@[Link]
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 5
Design and
Deployment
Best Practices
-
Why Multi-Domain?
• Individual architectures introduce
• Segmentation
• Automation
• Within a single enterprise domain
• Multi-Domain Architectures
• Extend Segmentation
• Utilize orchestration
• Make the entire enterprise one IBN enclave
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 7
What Is Involved In SDA & SDWAN Integration?
• Steps
• Catalyst Center and Manager integration
• SDWAN Manager owns each cEdge and assigns to
Catalyst Center
• Provision SDA specific changes through Catalyst Center,
SDWAN specific changes via Manager
• Results
• SDA VNs and SDWAN Service VPNs tied together
• SDA SGT information propagated via SDWAN
• cEdge participates in both fabric domains
• Consistent application and security policy
• API based communication between Catalyst Center and
Manager
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 8
Really Really High-Level View
SD-Access SD-WAN ACI
Catalyst Center Catalyst Manager APIC Controller
Campus Branch & Cloud &
and IOT WAN Data Center
Users and Devices Hybrid Cloud Data & Applications
Deliver Great Application Experience Automate Resource and Workflows
Identify and Onboard Everything
Secure Internet and Cloud Access Prevent Data Breaches
Authenticate and Authorize Access
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 9
• SDA
• Endpoints dynamically assigned
SGTs and placed into VNs
• Macro and Micro-segmentation
• Unified wired and wireless
networks
SDWAN
100,000 ft view •
• Extends and bridges
segmentation
• Applies Catalyst Center per-
VPN security and application
policy.
• Enables end-to-end
segmentation
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 10
What did we
learn from Large
Deployments?
-
SD-Access and SDWAN Deployments
• Today available in partly manual “two-box” solution
• Two-box solution (non-integrated solution)
• Clear demarcation between SDA and SDWAN architectures
• SDA BNs can be ISR4K, ASR1K or Cat9K switches, SDWAN edges can
be ISR4K, Cat8k or ASR1K series routers
• SD-Access and SDWAN designs can be implemented at a different pace
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 12
SD-Access and SDWAN Deployments
• Majority of customers have employed two-box solution for
modularity of deployment and flexibility in operations
• Mapping of VNs and VPNs is crucial
• Inter-site traffic flow greatly depends on SDWAN tunnel design and
SDWAN underlay.
• For Multi-Regional (Global) networks, consistency across multiple
Catalyst Center clusters is key.
• Special consideration for inter-VN routing within the site
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 13
SDA to SDWAN Integration (Two-Box)
MANAGEMENT Cisco Catalyst
Center
ISE
Manager
MANAGEMENT
Validator Controller
SD-Access SD-Access
SD-WAN Fabric
Fabric Site Fabric Site
WAN Edge WAN Edge
BGP BGP
LISP VRF-lite OMP VRF-lite LISP CONTROL PLANE
802.1Q 802.1Q
SGT (16 bits) SGT (16 bits)
VXLAN SGT (16 bits) IPSec CMD SGT MPLS VPN SGT (16 bits) VXLAN DATA PLANE
Header Header Header (16 bits) Labels (20 bits) Header
VNID (24 bits) VLAN ID (12 bits) VLAN ID (12 bits) VNID (24 bits)
Inline Tagging Inline Tagging
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 14
Migrating the
Beast!
-
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 16
Having a Solid
Foundation
-
5 Pillars and a Bedrock
PDI/AMO PMO Migration Customer Partner
Team
Automation
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 18
Plan Design Implementation / AMO
Testing & Validation
Design & Drive Testing XL,L,M+,SM,XS Design
CC ISE Integration Snowflakes Validation
AAA Certificates Fabric Domain L2BN functionality
SGT VN Policy Profiling
KT and Pilot Sites
Templates & Tools
Golden SDWAN Templates Post MW Hypercare
Endpoint Discovery First 24hr hypercare support
Delta & Underlay Configs
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 19
Setting realistic schedules
Bringing stakeholders together
PMO : Build The City
Bridging the gap and ensuring good
Chase timelines and engineer requests customer sentiment
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 20
Migration Team
Site Readiness Pre-Migration Window Migration Window
Network Design Document Catalyst Center Discover & Provision
Configuration
BoM Preparation Add to Fabric – L2/L3
Staging of Devices
MoP Preparation External Networks
UAT
Target Design Host Onboarding & Post Check
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 21
Customer
Site Readiness Tasks Migration Window
✓ Circuit ID and Handoff Type ✓ User Acceptance Testing
✓ Site Technical POC ✓ Circuit Provider Ticket if required
✓ Site Survey Information ✓ Correct DNS on DHCP Scopes
✓ Decommission of Old Circuit
Pre-Migration Post-Migration
✓ Site Remediation Completed ✓ Post Migration UAT
✓ Adequate Power & Connectors ✓ Coordination with Cisco
✓ Rack space & unmanaged for wireless/wired Testing
devices
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 22
Partner
Staging MW & Post MW
• Code Upgrade
• Cable Moves as per MoP
• License & eWLC package • AP mounting
• Load Bootstrap • Device Cleanup &
• Manager Reachability Decommission
Pre-MW Readiness
• SFP : Copper & Fiber
• Verify on-site inventory • Cables: Console, Patch
• Rack, Stack, Power Cord
• Cable all Devices • Fibers: SMF, MMF
• Equipment: Label Marker
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 23
Automation In SDA/SDWAN
Automation Possibilities
Why is it needed?
Large Site can have over 15000 endpoints Legacy Hardware Readiness &
100% Assessment Tools
Validation & UAT can miss a lot of endpoints
Endpoint Discovery & Site Overview
CC Site Hierarchy Push
How Automation Helps
Fabric Fusion Config Generator
Underlay Config generator reduced MOP time
Reduced Migration Time with Fabric Config Generator Pre & Post Ping Sweep and Routing
Delta
Site Snapshot & Overview of endpoints
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 24
What is the
Migration
Process?
-
Migration Pit Stops/Checkpoints
1 Site Survey & Predictive Model Review 2 BOM Creation 3 BOM Approval & Remediation
5 Site Staging (Bootstrap) 4 MOP Preparation
6 Site Services Readiness 7 Pre-MW Checks 8 Rack, Stack, UAT
10 ISE & NAD Group Update 9 Push SD-WAN Template & Core SD-Access
11 External Connectivity with SD-Access 12 Host Onboarding & endpoint 13 UAT & Handover
validation
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 26
Migration Approaches
Single Step Multiple Step
• Move from current state to end • Move from current to end state in
state in 1 Maintenance Window multiple Maintenance Windows
• Suited for Small Sites • Suited for Medium to Large sites
• Process: • Process:
• Move to SD-WAN • Day 1: SDWAN, Fusion and BN/CPs
• Replace and/or upgrade LAN • Day 2+:Replace and/or upgrade
switches to SD-Access targeted LAN closets to SD-Access
• Migrate SD-Access Wireless • Migrate SD-Access Wireless
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 27
Migration Approach – Single Step
CNF/DC with WLC CNF/DC CNF/DC
Internet
MPLS Internet
MPLS/SDWAN Internet MPLS/SDWAN
SDWAN SDWAN
OR
Fabric
Broadcast new
fabric enabled SSID
Broadcast new
Broadcast Legacy SSID
fabric enabled SSID
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 28
Migration Approach – Multiple Step
MPLS Internet MPLS Internet
SDWAN
SDWAN
Fusion Fusion
Legacy Site
Legacy Site
Fabric Fabric
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 29
Multi Step Migration with L2BN Traffic Flow
MPLS Internet
• Any migrated subnet traffic between Legacy and
Fabric will traverse through Layer 2 Border Node SDWAN
(L2BN)
• Any migrated subnet traffic between legacy and
remote location will traverse through L2BN > BN/CP
Fusion
> Fusion > SDWAN
Legacy Site
• Any migrated subnet traffic from legacy to non-
migrated subnet in legacy network will traverse
through L2BN > BN/CP > Fusion > Legacy site
Fabric
• Any non-migrated subnet traffic from legacy to
remote location will traverse directly through Fusion Flow 1
> SDWAN Flow 2
Flow 3
Flow 4
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 30
CNF DC
Migration Approach – Final Step Internet
MPLS SDWAN
• SDA Capable devices will be on SDWAN
boarded into the fabric
• Any temporary configurations will be Fusion
cleaned
• Local C9800 WLC will be enabled for
fabric mode and re-provisioned with
fabric SSIDs
• All the APs will be provisioned to Fabric
broadcast the fabric enabled SSIDs.
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 31
SD-Access & SD-WAN Migration Steps
1 2 3 4
Configure SDA
Push SD-WAN Turn on routing
Discover BNs Site specific tasks
Pre-SD-Access between wEdge
from CC and BN External
template and BNs
Handoff
5 6 7 8
Confirm all BGP
Push SD-WAN Final
peers are up and Any configuration
Post-SD-Access infrastructure and
reachability to all cleanup
template UAT testing
networks and VNs
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 32
Lessons
Learned From
Large Scale
Migrations
-
Technical Learnings
Before
After
75%
55%
Extensive UAT Presence of Hubs Automation Catalyst Center Reusable VLANS
Site Location
Interface & Tunnel GUEST Portal Login Static Endpoints External Fabric Zones
Mismatch (SDWAN) Connectivity
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 34
Technical Learnings Continued…
Circuit Tagging Fusion & Legacy Core ISE and Catalyst Manager GUI L2BN VLAN 1
Center Sync
SDWAN Template Issue DHCP Option 43 wEdge in CLI mode Bandwidth Shaping 9600X SUP-2
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 35
Operational Issues
On-Site Ad-Hoc Limitations Others
Circuit Testing, Circuit Project Milestones & Cross Team
Platform Limitation
Handoff & labelling RACI Dependency
Rack, Stack,
Snowflakes per Request High burnout rate Hardware Upgrades
Mount APs in Advance
BoM Lead Time Scoping & Resourcing Accountability Staging Facility
Site Variations &
Spare SFPs, Cables Endpoint Visibility Compliance
Consolidation changes
Travel & Security
Unknown devices Unmanaged Switches Timely Approvals
Guideline
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 36
Conclusion
-
Key Takeaways
• Order of operations is key!
• Underlay of SDA and Trusted VN needs to be bridged to overlay of
SDWAN
• DC first approach – get those cEdge headends built first
• At branch, install SDWAN first, test it and then proceed with SDA
• Infrastructure and UAT testing is very critical
• TrustSec needs to be configured on SDWAN first and then SDA BN
• For sub-interfaces, TrustSec must be enabled on physical and all
sub-interfaces
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 38
Key Takeaways
• SD-Access and SD-WAN migrations can be done at rapid pace
• Consistency in design is key for at-scale migrations
• You are getting one chance to re-do the network – take that
opportunity!
• Remember those 5 pillars
• Automation is crucial for efficiency and accuracy
• BEAST is not as scary as it seems!
• Cisco CX is always there to work with you and accomplish success
together.
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 39
Webex App
Questions?
Use the Webex app to chat with the speaker
after the session
How
1 Find this session in the Cisco Events mobile app
2 Click “Join the Discussion”
3 Install the Webex app or go directly to the Webex space
4 Enter messages/questions in the Webex space
Webex spaces will be moderated
by the speaker until February 28, 2025.
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 40
Fill Out Your Session Surveys
Participants who fill out a minimum of 4 session
surveys and the overall event survey will get a
unique Cisco Live t-shirt.
(from 11:30 on Thursday, while supplies last)
All surveys can be taken in the Cisco Events
mobile app or by logging into the Session Catalog
and clicking the ‘Participant Dashboard’ link at
[Link]
[Link].
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 41
• Visit the Cisco Showcase
for related demos
• Book your one-on-one
Meet the Engineer meeting
• Attend the interactive education
Continue with DevNet, Capture the Flag,
and Walk-in Labs
your education
• Visit the On-Demand Library
for more sessions at
[Link]/on-demand.
Sessions from this event will be
available from March 3.
Contact me at: dhprajap@[Link],
jenbowma@[Link]
-
BRKENS-3834 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 42
Thank you
-
-