Pass Your Cisco ENCOR 350-401 Exam Easy!

Cisco 350-401 Implementing Cisco Enterprise Network Core Technologies (ENCOR) exam dumps vce, practice test questions, study guide & video training course to study and pass quickly and easily. Cisco 350-401 Implementing Cisco Enterprise Network Core Technologies (ENCOR) exam dumps & practice test questions and answers. You need avanset vce exam simulator in order to study the Cisco ENCOR 350-401 certification exam dumps & Cisco ENCOR 350-401 practice test questions in vce format.

Architecture

17. 1.4 Cisco SDWAN

Let us continue our discussion and add more complexity to the design. So now we know that we can have interconnectivity between the private network and the public network. So here you can see that in your private network, you are creating an IPC tunnel. You have the IPsec IKE version 2 tunnel mode. You create a tunnel up to these VPN gateways, and you are reaching out to these routers. These routers are actually the gateways for these virtual private clouds. These are some of the compute resources where you have hosted your applications. So these applications have these gateways, and from here it is reaching this point. And here you might find your user. Okay, so this is one of the deployment models, but we have others as well. So let's see how DMVPN is taking part in this. Before coming to DMVPN. The diagram shows that there may be interconnectivity between clouds. So you can see that I have this VPN channel from AWS cloud to Google Cloud, and then maybe you have users here and service here, and so on. There may be chances, but these compute networks can communicate across the cloud as well. Now, if you want to make this arrangement a little more automated and much more meaningful, then Cisco has given you the solution. We can integrate with DMVPN's dynamic multi-point VPN. Now this dynamic multipoint VPN, or DMVPN, What you can do that, you can definethe hub and then you have this books. So here, you can see you have these books. So this will work as a "hub and spoke" methodology. And, depending on which phase of DMVPN you are using, it may also be how it is spoken and spoken. If you are using I think DMVPN phase three. Again, if you want to add much more redundancy as per your design requirement, Still, we have the option that we can add a primary and secondary hub, and then we have the spoke. So you can see that we have redundancy in terms of spokes, or even the primary spoke for a few of their spokes. We can do some sort of load balancing as well. And this will give us the perfect design-related option. Same thing here; you can see that he is or the first router is the gateway for one of the clouds. For other clouds, the other router is the gateway, but they are working as a primary and secondary. Now, at this point in time, you may be thinking, "Then what is the role of SDWAN when we are integrating our existing WAN with the cloud?" The rule here is that you should go right now and save Steven infrared as a service. In that case, even this is much more automated. You can go to V, manage your images. Obviously, you need the images to spin up, and even from here, we can manage the ISR as well. We have the virtual edge as well, and we have the ISR virtual as well, so you can manage the number of devices You can create the template for those devices, and then you can push the configuration from what we manage to the edge devices You can track not only on-premises devices, but also devices that will be installed in the cloud, okay, and that's the true power we have when we manage such a type of requirement, so it will give you great visibility, and the use of access or ease of access or the ease with which you can access the network and monitor the network is really amazing, so you can go and check that how we can achieve the same target with the help of Obviously, the way of doing things will be different, but we're going to achieve the same target in a much simpler way if we use this given and then integrate with the cloud.

18. SDWAN Architecture

Let us start with section one, where we have to understand the architecture and various components. What are the topics we have inside Section section one?First of all, we are going to discuss the architecture and components. Then we have to understandthe components of the controllers. We have the orchestration plane, management plane, controller plane, or control plane. Then we have the data plane devices. We have various things inside the data plane device, such as what is T lock, how they form the IP SEC tunnel, and what is with the Teller route. What is the BFT (bidirectional forward detection)? Now, there are some common terms that we are going to use. So in terms of data plane devices, we have V-edge or reptile-edge routers. We have a Ch that is nothing but a Cisco ISR ASR router. Those are nothing but SD-1 one router.Then we have the controller. We have a smart controller that is nothing but your control plane. We have the orchestrator plane, which is the V bond. The management then claims that there is nothing but V manage. Now, this small V is not virtual; this stands for Riptilla because we are still the parent company that has introduced SDWAN. Now the overall solution will look like this. although this diagram will seem a little bit busy. But once you understand all the components and the hierarchy, then it makes sense. Now starting from the orchestrated plane or the orchestration plane, you can see that you have a couple of V bonds, and those V bonds are identified as a DNS or a URL. They may be inside the DMZ zone. So one of the interfaces is towards the private datacenter, or one of the interfaces is towards the data center. Other interfaces are visible to the public. So you have the orchestration plane. Then you can see that you have a management plan that is nothing but us managing. It is recommended that you should havecluster of V manage means three manageor three service inside same cluster. Now it's actually very big, and here you can see in the slide that it can be in multi-tenant mode or dedicated, meaning dedicated to one customer or group of customers having multi-tenancy or maybe one company or organisation having multiple sub organizations.Any possibility will be there. But this is the management plane from where you can manage the entire fabric. This is the one common place from where you can manage everything. So you can see from this management plan that I am managing control plane devices as well as parallel devices. You can push the configuration template to all the devices to correct all the devices in the data plane. Not only in the data plane but in the control plane as well. So the usability of this is enormous, and we'll see some of the VManage use cases, but we manage. From there, you can configure monitoring and troubleshooting. In short, we can do everything from VManage, and then we have the control plane, which could be inside containers or VMs that you can spin up over the hypervisor. The control plane should also be in the group, according to the recommendation. So maybe you have two via Smart in one group and two others via Smart in another group, but they should have the same configuration. That is, these are my control plane devices; they should have the same configuration or the common configuration; otherwise, the network may be inconsistent. Now in terms of the control connection, whenever the data plane devices are forming the control connection, they can form the connection with one group of via Smart as a primary and another group of via Smart as a secondary. But in any case, all the viasmarts should have the same information. Then finally, you can see that you have the data plan devices at the bottom. Irrespective of transport, whether it's Internet, MPLS, or 4G, they have the IPC tunnel among other devices. By default, they have a full mesh setup, meaning all the devices have an IPsec tunnel with all the other data plan devices. Correct. They can be physical, or they can be virtual. So now here in the diagram you can see ifI draw it, let me try to draw the diagram. So you can understand here you can see thatthis link either this can be DTLs or TLSand here also it can be DTLs or TLSin Vivon also you have the control connections. So we want to be smart like that. I'm not doing all the connections but this isalways actually we want connections are always GTLS. Now, what are GTLS and TLS? TLS is nothing but your SSL secure socket layer plus TCP, TCP-based SSL, and DTLs are nothing but your SSL plus UDP, UDP-based SSL, which is nothing but your DTLs. Some space is there, but you can understand now that you have a control connection like that, and then you may have the data connection or the IPC connection. So, let me quickly draw the data connection and some other colours to see how it will look. So now, from device to device, you have the IPsec connection. By default, it will be full mesh. So here it's not in a bundle a single theyhave the IPsix connection, that is the data plane connection. So obviously the traffic will move one lead from one data plane device to the other data plane device, and from the control plane, which is your Vs Smart, you are sending the updates to the controller, which is the Vs Smart. They can send the update with the OMP protocol. That is the overlay management protocol they can use, or they can send different types of control messages related to routing updates. Security key exchange update related to policy exchange Okay, so that's actually the rule of the controller. Now, here you can see that this is the overall overview, or this is the summary of the architecture that we have inside the SDWAN. Now, it is very interesting and important because Cisco SDWAN can scale. So here you can see if I start from the bottom, any location, branch, colocation, cloud, any transport, satellite, Internet, MPLS, five GLTE, any service they can use, branch security, cloud-integrated services or security, application quality, experience for sales, application voice collaboration, cloud on RAM, means you can integrate with any type of service in the SDWAN. And then we have any deployment, any deploymentmeans onprem cloud marketing, even MSPs, like managedservice providers, they are also offering these services. So you can see that how open and secure our networkis open that we can go and we are very muchnear to the cloud integration or we are near to thecloud, then we can install everything over cloud as well. Whether it's a controller or data plane device, you can integrate with any service. It's so flexible, you can run the application over broadband or the internet as well, because anyway, they are forming very high-level secure tunnels between data plane devices. So, after adding all these points, you'll find that the SDWAN is a highly secure and desirable solution at the moment. And I believe that almost all customers are opting for SDWAN deployment. Now, again, you can see the SDWAN deployment architecture. You may have your branches spread across geography, you may have your physical branches, and you may have your virtual branches as well. And then you can see that you can use software as a service. You can use Dia directly for those services. The good thing about this is that wherever you have your services or applications, you can track each and everything from your dashboard. So you have a single GUI and a single dashboard. From there, you can manage or track all the applications. Okay? So not only can you track and manage the application, but you can do the configuration and changes, et cetera, et cetera.There's so much tuning tunnel options are there? So here you can see that software as a service, or as a VPC (virtual private cloud), or as enterprise controllers, or as a private cloud. everything, each and everything. We can go and integrate our fabric into that architecture.

19. SDWAN Components Controllers

Let us talk about the controllers. We have three different types of controller. One is the orchestration plane, which is nothing but the V-Bond management plane, which is nothing but the ManageWill plan, which is nothing but via Smart. So we manage V-bond via Smart, or we manage V-bond via Smart, etcetera. Et cetera. In the bracket, you can see that we are Bondand comma Net and Smart comma OMP. because these features are actually very important to understand. We should understand these features. So for example, via Smart, VSmart is your control plane. And among via Smart suppose ifyou have two, three via Smart. So via Smart, they are running OMP, and from Smart to edge devices or via Smart to branch edge devices, again, you have OMP. So we have an overlay management protocol that is nothing but your control plane. So for example, if your OMP is down, your control plane is down. So that's the significance we have; let's learn one by one what the basic features of these controllers are. So for example, we have the orchestration plane. What are the characteristics and what is the use of the orchestration plan? They are used to do the secure bring up.So to bring up your reptile of fabric, first of all, all those devices have to go, and they have to contact the orchestration plane, or the V Bond. So what is happening? Suppose there is zero deployment and you want to deploy one of your edge devices. What will happen is that these devicesand contact first of all the von. Now what we Bond will do, he will check what is theserial number, what is the chassis ID of the edge devices. And with this edge device, they will go and check the organisation name, org, and the name of the V Bond. Now, once this V-bond has been satisfied due to some sort of whitelist modeling, they will have a list of all the devices that will be part of the fabric. So once we are satisfied that the request I am getting is legitimate, They will form some kind of temporary DTLs, but never permanent internal temporary DTLs. Because remember, we want to understand only DTLs. So they will create temporary DTLs and then offer this Edge device the VA Manage and VA Smart IP addresses. Now next time these guys come, they will go and contact the V Manager and the VASmart, and the same process will happen. We'll go check the serial number and chassis ID of the V Edge. V Edge will check the organ; that's part of the certificate, and that's part of the licencing certificate. Then again, the VS Smart will go and check the serial number and the chassis ID. The V Edge will then check the.org name of the Vs Smart. And then what will happen? What will be the end result? The end result is that the edge devices are here. Let me try drawing with another color. So they will form the permanent TLS or DTL connection. They will form a permanent connection with V. Manage and V. Smart, destroying your temporary tunnel. Okay, so here you can see the notes. Let me try to read out the notes. Here we have the notes that are telling us that the orchestration plane is there to do all the component work securely, bringing up the devices in the fabric and orchestrating control and the management plane. Distribute a list of Vs. Smartand manage to the edge devices or routers that facilitatenet, require public IP, and could shift behind one-to-one net, be highly resilient, multi-tenant, or single tenant. So that's the purpose of the orchestration plan; their role is defined; and these are the main points. Now you can go and install this over the compute, over ESXi, or over a hypervisor. And here are some of the key points that should be accessible via the internet. They are doing the orchestration; they are securely bringing up the fabric. Now, the next very important piece we have is the management plan. This management plan will go and integrate with third-party APIs, and it is there to do. You can see what to do on day zero, day one, and day two All day, you have to bring up first and foremost you manage, and then you have to add V bond via Smart. You have to do at least the minimum configuration; you have to do the licencing process. Once your controllers are up and running, we can add the data plan devices. And for that, you have to start with what we manage. This is centralised provisioning. It can be multi-tenant or single-tenant, where you can build the policies and template. You can do troubleshooting monitoring,software, upgrade GUI with RBAC. It can be integrated with thirdparty tools for APIs and programming. This is also highly resilient. Now, this is also software. So you can go and install the cluster over the compute node using either ESXi or KVM for centralised management, API, configuration, monitoring, and management. These things can then be done via the view manager. Finally, in the controller section, you have the V Smart. That is the actual brain behind the scene. Now, with the help of this particular version of Vs. Smart, you can do that, and it will provide you with intelligence. So you can do apparatus policies, rental policies, any type of service, insertion chaining, whatever, all policies, IPsec exchange, overall routing, management—everything is done with the help of Smart. That's your policy engine. That's your brain, okay? And this is also software. And you want to operate this via Smart in a redundant manner within a group. So you can have a group of three or four devices; you can have another group in another datacenter with three or four devices. Only thing is important that all those viasmart in a single fabric, they should haveconsistency, they should have same database. That's the important thing. So here you can see routing information, encryptionkey propagation, policy management, service sharing, traffic engineeringand so many things that we can doand achieve with respect to via smart. All right? So that's the main thing we have in the absence of control.

20. SDWAN Data plan Devices

Next we have the data plane device, and you'll find so many interesting things inside the SDWAN data plane devices. Not only that they are doing the actual movement of data within the IP sector and L, but whatever existing van features we have, for example, we can do VRP, we can do OSPF, we can do BGP, we can do EIGRP, et cetera—all the traditional routing protocols they are supporting. We have advanced features as well, like zero-touch deployment or provisioning. They have both physical and virtual form factors. So these things are there; they are there in the existing van as well, except for this zero-touch provisioning or plug-and-play option. Even the plug-and-play option is there in the intelligent van or Ivan as well. But with the new things we have, it can do application recognition. It's a huge feature. Now, for example, Viptilla devices can go, and they can do the application recognition. They have something inbuilt DPI deep packet inspectionengine in Webtiller that is Cost Moss again I'll repeat the cost of Cisco devices. We know that's a very popular term for network-based application recognition. Now Cisco has introduced new VMs as well, and they have enhanced the NBA. We have something called AVC as well—an application visibility control enhanced version of NBA. You can see it in other words, but yeah, you have the application recognition engine. So your devices—the SDWAN devices—can now understand the application metadata, like Palo Alto Firewall or Firepower. Firewalls can do, or you can see that next-generation firewall; they have this capability to understand or recognise the application, and then take action based on policy. That's the same thing we have in the application, a routing feature, and that's a huge That's one of the major advantages we have. Not only we can do the apparel routing,we can do app aware Firewalling as well. Now apart from that, the edge devices and the control plane devices—that's the Vs. smart ones—are forming the OMP session, which means we have the routing pier with my control plane devices, and then I'm exchanging all my routes, whether it's a Whip Taylor route or T-lock route. Later on, we are going to discuss these things, like OMP, T-lock, etcetera. Etcetera. So either it's a security route or service route, a webtail route or OMP route, a T-lock route, or the Next Hop route. All these things you are sending to your controller Your controller, because we are dealing with the Stonesolution, is working as a route reflector, and once they receive the route from one of the branches, they will reflect it to the remaining branches, and that's the whole thing. When you compare this solution to others, such as ACI, Leaf, and Spine, what Leaf is doing is sending their endpoint registration or endpoint information to Spine. Spine is working as a route reflector. He can reflect on everyone. Similarly, you can see your leaves here as well. You think that these are your endpoints. These guys, whatever they are learning, are sending V-smart and Vi-smart signals to everyone in between. The underlying protocol is OMP, and again, it's a huge OMP that can carry so many things. But the overview of the top view is like that. Then obviously these are the data-plan devices. So let's go and see that. What are the variants we have within these data plan devices? You can see that there are a number of devices that are supporting SDWAN. We have an enterprise network compute system (ENC) 5100 where you can go and integrate or we can go and deploy the SDWAN images, the third-party firewall load, the balancer, et cetera, et cetera.It's a very capable device, and so many customers are using ESS devices. You can see overall throughput as well, at 252 to 50 to two GB as per your scale, which will increase your compute, your memory RAM, et cetera, et cetera increase.That means they will support more throughput. Now we have both the form factors. We have hardware; we have software. Here you can see the Viptilla devices. In Viptilla you have a small enddevices like V 802,000 very much. It is looking like a Cisco device. Cisco may use 1800- or 2800-type hardware. Then here, you can see that you have an iOS XE image. This is what I want to explain here because I noticed some confusion in the community. We have SDWAN, and you have two types of operating system. One, iOS XE with 1610 or more, possibly 1611. You can convert or upgrade the image of iOS XE. SDWAN code has been written inside the iOS XE image to support SDWAN features. But there is one native operating system that is nothing but Viptila OS. This VIP. Tiller OS. Actually, the evolution of this WebtellerOS was due to SDWAN. So SDWAN was the core in the brain, and then evolution happened. This Vipela operating system now includes V-Edge. But Cisco has introduced the same image. You can run, as you can see, on the next-generation ISR platform. You can use the Cisco ISR platform to run on Delaware OS as well. That's a huge advantage we have with Cisco. You have the best operating system for SD-WAN, and then you have the best hardware for branches. You can integrate both, and they will do all the features so that whatever features we have in the SDWAN and whatever features are going to come in the SDWAN, everything will be supported. So, that's the good thing we have. So apart from that, as per the scale, you can see we have the ISR. We have the ISR 4000 at up to 2 GB/s speed. Then there are the aggregator routers, such as Asus's, which can reach speeds of up to 200 Gbps. So if you're looking for speed and throughput, you can go and choose your branch devices. I have a few slides for edge devices. You can see 100,000 how, behind the scenes, Vedge looks very much like a Cisco device. You have the management interface, the serial console, USB LEDs, and the fixed eight-gigabit Ethernet SFP port. I have added this slide because I want to tell you one nice thing about this hardware. These hardware, they are coming with TPM chip. Now that this trusted platform module or chip has anti-counterfeit and secure authentication, the OEM in this case or they are putting the RSA keys inside this TPM chip, those preloaded certificates or CSR certificate signing requests are shipped to the customer. So what do customers have to do at the moment they connect their van interfaces to the van? Or should they? VPN Zero will talk about this later on. But at the moment you connect your interface to the van, they will do the autoauthentication, or automatically they will get authenticated from the controller devices because you have the preloaded certificate inside the TPM chip. Now, considering the fact that the edge devices are coming with the secure image or secure bootimage Cisco devices, which are also coming with secure image Cisco devices, they are using the TAM module, or trusted anchor module. I will show you this on the next slide. On the edge devices, they are using TPM. This TAM module is there in the UCS boxes as well. You can go and check. So how is it secure? You can see you have the anchor module that is very near the hardware anchor micro loader, then the micro loader, and then the boot loader. Check the operating system and the Oscar launch. So it's like the internal integrity is checked by the anchor module, and then it will load up. Likewise, you can see that you have common features between the Tam and the TPM. They are therefore total tamper protection, nonverted storage policy, and configuration. They have crypto services like Kia Store, random number generation, and crypto image. Now, all these features that you are seeing here belong to certificate plus and secure your hardware, and that's the power we have. And even the SDWAN provider considered all of these factors before installing or providing the SDWAN solution. So all these features are inside the data plane devices.

21. 1.4b Traditional WAN vs SDWAN

This is the last video in section one four.This is one of the four Bs: the traditional van and the SDWAN solution. Now what exactly inside SDWAN solution ist If this is your existing van, Whatever things you can't do in the existing van—and it's very difficult to do in the existing van—I can go and do inside the estimate. So the term is "simplified solution," "scalability inbuilt into secure fabric," and those things are by default inside the SD van. That is, although it's not there in the existing van, you can achieve it with a certain number of quotes. One of the major drawbacks we have with the existing van is that its visibility is not that great. And suppose you have to create an IPsec tunnel now if you use DMVPN. That is very much the case inside the SDWAN. It's still the DMVPN or any type of IPC VPN that we have in SDB; you will find that it is 100% optimized. So at the moment you bring up the control plane, Now the control plane now I'm seeing that most ofthe customer, they are taking the control plane from Cisco. So you may have control over the cloud control plane. So I have this cloud hosted, sayfor example cloud hosted control plane. So my control plane burden is gone now. Now I'm only worried about the data-plan devices. Now, with these data plan devices, what are the major things they will do? They will do routing, they will form IPsafe tunnel, they should do data plane policiesor they should do data policies, not dataplane policy but inside data plane policy. You have so many things. Actually you can refer my SDWAN course where Ihave explained this and we have so many thingsto consider when we are talking about policies. But in short, what I am telling that what are thecapabilities you have is the routing, you have the IPsec, youhave the app say for example, appears routing that is fallingunder data plane policy or data policy etc. Etc. So, for the sake of intellectual property, data policy, and cloud integration, These things are the nature of the van. They evolve with these capabilities. Although, on the other hand, if you go and check the existing van, you'll find that for everything, you have to write the code. So, for example, forming an IPsec tunnel requires planning, and DMVPN planning for habitually spoke and redundant DMVPN design is time-consuming and should be consistent across devices. "Correct" means you should use some sort of standardisation for the configuration. On the other hand, when you have theIGP and when you have the BGP, sothose configurations should also be good. Although the routing capability of Cisco devices is the bestand Cisco is very good in the routing, at leastthey are very good in other features as well. But routing is the fundamental core of Cisco networking. Even Cisco is very good at switching and then data centres and other domains as well. Alright, so the thing is that you can do all those things, but it's restrictive. You have to write n number of lineof codes, it's not that much scalable. You can integrate with APIs, which is very difficult. You must investigate what alternatives are available on the market. So you can use the Ancible Playbook, etcetera, etcetera. To do full automation for the existing one. And it's time-consuming; you don't have full visibility. And its evolution is not that by default it can scale in terms of routing, security, cloud integration, et cetera, et cetera.So that's the major difference between the existing one and the SDWAN. Still, if you go and complete the SDWAN course,you will get the complete picture of SDWAN. Because already at this point in time, we know whatever network we are working on is the van. One portion of that network is the van infrastructure. So we know about the van. And once you go and complete the SDWAN course,then you'll understand about the SDWAN course and thenyou will be at the better position to comparewith the SDWAN features, with the existing feature. Alright, so let's stop here.

Go to testing centre with ease on our mind when you use Cisco ENCOR 350-401 vce exam dumps, practice test questions and answers. Cisco 350-401 Implementing Cisco Enterprise Network Core Technologies (ENCOR) certification practice test questions and answers, study guide, exam dumps and video training course in vce format to help you study with ease. Prepare with confidence and study using Cisco ENCOR 350-401 exam dumps & practice test questions and answers vce from ExamCollection.