You must perform the following planning and information-gathering tasks before attempting to install, configure, and set up your Cisco DNA Center appliance. After you complete these tasks, you can continue by physically installing your appliance in the data center.

1. Review the recommended cabling and switching requirements for standalone and cluster installations. For more information, see Interface Cable Connections.

2. Gather the IP addressing, subnetting, and other IP traffic information that you will apply during appliance configuration. For more information, see Required IP Addresses and Subnets.

3. Prepare a solution for the required access to web-based resources. For more information, see Required Internet URLs and FQDNs and Provide Secure Access to the Internet.

4. Reconfigure your firewalls and security policies for Cisco DNA Center traffic. For more information, see Required Network Ports. If you are using Cisco DNA Center to manage a Cisco Software-Defined Access (SD-Access) network, also see Required SD-Access Ports and Protocols.

5. Gather the additional information used during appliance configuration and first-time setup. For more information, see Required Configuration Information and Required First-Time Setup Information.

You can use Cisco DNA Center to manage any type of network, including networks that employ the Cisco SD-Access fabric architecture. Cisco SD-Access transforms conventional networks into intent-based networks, where business logic becomes a physical part of the network, making it easy to automate day-to-day tasks such as configuration, provisioning, and troubleshooting. The Cisco SD-Access solution reduces the time taken to adapt the network to business needs, improves issue resolutions, and reduces security-breach impacts.

A complete discussion of the Cisco SD-Access solution is outside the scope of this guide. Network architects and administrators planning to implement a Cisco SD-Access fabric architecture for use with Cisco DNA Center can find additional information and guidance from the following resources:

• For more information on how Cisco DNA Center leverages Cisco SD-Access to automate solutions that are not possible with normal networking approaches and techniques, see Software Defined Access: Enabling Intent-Based Networking.

• For guidance in using Cisco SD-Access access segmentation to enhance network security, see the Software-Defined Access Segmentation Design Guide.

• For guidance on deploying SDA with Cisco DNA Center, see the Software-Defined Access Deployment Guide.

• For more information on the digital network architecture that is the foundation of Cisco DNA Center and the Cisco SD-Access solution, and the roles that other Cisco and third-party products and solutions play in this innovative architecture, see the Cisco DNA Design Zone.

Connect the ports on the appliance to switches providing the following types of network access. At a minimum, you must configure the Enterprise and Cluster port interfaces, as they are required for Cisco DNA Center functionality.

Note

During appliance configuration, the Maglev Configuration wizard does not let you proceed until you assign the Cluster Link option to an interface. For both single-node and three-node deployments in a production environment, designate port enp10s0 as the Cluster Link on the first-generation Cisco DNA Center appliance (Cisco part number DN1-HW-APL). Be aware that the interface marked as the Cluster Link cannot be changed after configuration completes. Later, if you must change the interface marked as the Cluster Link, you are required to reimage the appliance. (For a description of the tasks you need to complete in order to reimage your Cisco DNA Center appliance, see Reimage the Appliance.) With this in mind, we recommend that you set up the Cluster Port with an IP address, so as to allow for expansion to a three-node cluster in the future. Also, make sure that the cluster link interface is connected to a switch port and is in the UP state. If you plan to build multiple clusters, you must use a separate IP scheme for each cluster in order to prevent cross-cluster interaction (which might corrupt the clusters).

• (Required) 10-Gbps Enterprise Port (Port 1, enp9s0, Network Adapter 4): This is the right-hand port on the VIC 1227 card in the appliance mLOM slot. Its purpose is to enable Cisco DNA Center to communicate with and manage your network. Connect this port to a switch with connections to the enterprise network and configure one IP address with a subnet mask for the port.

• (Required) 10-Gbps Cluster Port (Port 2, enp10s0, Network Adapter 1): This is the left-hand port on the VIC 1227 card in the appliance mLOM slot. Its purpose is to enable communications among the primary and secondary nodes in a Cisco DNA Center cluster. Connect this port to a switch with connections to the other nodes in the cluster and configure one IP address with a subnet mask for the port.

• (Optional) 1-Gbps Cisco DNA Center GUI Port (1, enp1s0f0, Network Adapter 2): This port provides access to the Cisco DNA Center GUI. Its purpose is to enable users to use the software on the appliance. Connect this port to a switch with connections to your enterprise management network, and configure one IP address with a subnet mask for the port.

• (Optional) 1-Gbps Cloud Port (2, enp1s0f1, Network Adapter 3): This port is optional. Use it only if you cannot connect the appliance to the Internet (including to your Internet proxy server) using the 10-Gbps enterprise port (Port 1, enp9s0, Network Adapter 4). If you need to use the cloud port, connect it to a switch with connections to your Internet proxy server and configure an IP address with a subnet mask for the port.

• (Optional, but strongly recommended) 1-Gbps CIMC Port (M): This port provides browser access to the Cisco Integrated Management Controller (CIMC) out-of-band appliance management interface and its GUI. Its purpose is to allow you to manage the appliance and its hardware. Connect this port to a switch with connections to your enterprise management network and configure an IP address with a subnet mask for the port.

The following figure shows the recommended connections for a single-node Cisco DNA Center cluster:

The following figure shows the recommended connections for a three-node Cisco DNA Center cluster. All but one of the connections for each node in the three-node cluster are the same as those for the single-node cluster, and use the same ports. The exception is the Cluster Port (Port 2, enp10s0, Network Adapter 1), which is required so that each host in the three-node cluster can communicate with the other hosts.

For a short video presentation about the rear-panel ports and how they are used, see the first five minutes of Unboxing Cisco DNA Center Appliance for Assurance and SD-Access (under the section "Get Started").

For more details on each of the ports, see the rear panel diagram and accompanying descriptions for your appliance in Front and Rear Panels.

Note	Multinode cluster deployments require all the member nodes to be in the same network and at the same site. The appliance does not support distribution of nodes across multiple networks or sites.

When cabling the 10-Gbps enterprise and cluster ports, please note that both ports support only the following media types:

• SFP-10G-LR (Long range, SMF)

• SFP-H10GB-CU1M (Twinax cable, passive, 1 Meter)

• SFP-H10GB-CU3M (Twinax cable, passive, 3 Meters)

• SFP-H10GB-CU5M (Twinax cable, passive, 5 Meters)

• SFP-H10GB-ACU7M (Twinax cable, active, 7 Meters)

Before beginning the installation, you must ensure that your network has sufficient IP addresses available to assign to each of the appliance ports that you plan on using. Depending on whether you are installing the appliance as a single-node cluster or as a primary or secondary node in a three-node cluster, you will need the following appliance port (NIC) addresses:

• Enterprise Port Address (Required): One IP address with a subnet mask.

• Cluster Port Address (Required): One IP address with a subnet mask.

• Management Port Address (Optional): One IP address with a subnet mask.

• Cloud Port Address (Optional): One IP address with a subnet mask. This is an optional port, used only when you cannot connect to the cloud using the Enterprise port. You do not need an IP address for the Cloud port unless you must use it for this purpose.

• CIMC Port Address (Optional, but strongly recommended): One IP address with a subnet mask.

Note	All of the IP addresses called for in these requirements must be valid IPv4 addresses with valid IPv4 netmasks. Ensure that the addresses and their corresponding subnets do not overlap. Service communication issues can result if they do.

You will also need the following additional IP addresses and dedicated IP subnets, which are prompted for and applied during configuration of the appliance:

1. Cluster Virtual IP Addresses: One virtual IP (VIP) address per configured network interface per cluster. This requirement applies to three-node clusters and single-node clusters that are likely to be converted into a three-node cluster in the future. You must supply a VIP for each network interface you configure. Each VIP should be from the same subnet as the IP address of the corresponding configured interface. There are four interfaces on each appliance: Enterprise, Cluster, Management, and Cloud. At a minimum, you must configure the Enterprise and Cluster port interfaces, as they are required for Cisco DNA Center functionality. An interface is considered configured if you supply an IP address for that interface, along with a subnet mask and one or more associated gateways or static routes. If you skip an interface entirely during configuration, that interface is considered as not configured.

   Note the following:

   • If you have a single-node setup and do not plan to convert it into a three-node cluster in the future, you are not required to specify a virtual IP address. However, if you decide to do so, you must specify a virtual IP address for every configured network interface (just as you would for a three-node cluster).

   • If the intracluster link for a single-node cluster goes down, the VIP addresses associated with the Management and Enterprise interfaces also go down. When this happens, Cisco DNA Center is unusable until the intracluster link is restored (because the Software Image Management [SWIM] and Cisco Identity Services Engine [ISE] integration is not operational and Cisco DNA Assurance data is not displayed because information cannot be gathered from Network Data Platform [NDP] collectors).

   • Do not use a link-local or nonroutable IP address for the Enterprise or Management interface.

2. Default Gateway IP Address: The IP address for your network's preferred default gateway. If no other routes match the traffic, traffic will be routed through this IP address. Typically, you should assign the default gateway to the interface in your network configuration that accesses the internet. For information on security considerations to keep in mind when deploying Cisco DNA Center, see the Cisco Digital Network Architecture Center Security Best Practices Guide.

3. DNS Server IP Addresses: The IP address for one or more of your network's preferred DNS servers. During configuration, you can specify multiple DNS server IP addresses by entering them as a space-separated list.

4. (Optional) Static Route Addresses: The IP addresses, subnet masks, and gateways for one or more static routes. During configuration, you can specify multiple static-route IP addresses, netmasks, and gateways by entering them as a space-separated list.

   You can set one or more static routes for any interface on the appliance. You should supply static routes when you want to route traffic in a specific direction other than the default gateway. Each of the interfaces with static routes will be set as the device the traffic will be routed through in the IP route command table. For this reason, it is important to match the static route directions with the interface though which the traffic will be sent.

   Static routes are not recommended in network device routing tables such as those used by switches and routers. Dynamic routing protocols are better for this. However, you should add them where needed to allow the appliance access to particular parts of the network that can be reached no other way.

5. NTP Server IP Addresses: The DNS-resolvable hostname, or IP address, for at least one Network Time Protocol (NTP) server.

   During configuration, you can specify multiple NTP server IP addresses/masks or hostnames by entering them as a space-separated list. For a production deployment, we recommend that you configure a minimum of three NTP servers.

   You will specify these servers during pre-flight hardware synchronization and again during configuration of the software on each appliance in the cluster. Time synchronization is critical to the accuracy of data and coordination of processing across a multi-host cluster. Before deploying the appliance in production, make sure that the time on the appliance system clock is current and that the Network Time Protocol (NTP) servers you specified are keeping accurate time. If you are planning to integrate the appliance with Cisco Identity Services Engine (ISE), you should also ensure that ISE is synchronizing with the same NTP servers as the appliance.

6. Container Subnet: Identifies one dedicated IP subnet for the appliance to use in managing and getting IP addresses for communications among its internal application services, such as Assurance, inventory collection, and so on. By default, Cisco DNA Center configures a link-local subnet (169.254.32.0/20) for this parameter, and we recommend that you use this subnet. If you choose to enter another subnet, ensure that it does not conflict with or overlap any other subnet used by Cisco DNA Center's internal network or any external network. Also ensure that the minimum size of the subnet is 21 bits. The subnet you specify must conform with the IETF RFC 1918 and RFC 6598 specifications for private networks, which support the following address ranges:

   • 10.0.0.0/8

   • 172.16.0.0/12

   • 192.168.0.0/16

   • 100.64.0.0/10

   For details, see RFC 1918, Address Allocation for Private Internets, and RFC 6598, IANA-Reserved IPv4 Prefix for Shared Address Space.

   Important

   Ensure that you specify a valid CIDR subnet. Otherwise, incorrect bits will be present in the 172.17.1.0/20 and 172.17.61.0/20 subnets. After configuration of your Cisco DNA Center appliance is completed, you cannot assign a different subnet without first reimaging the appliance (see the "Reimage the Appliance" topic in the "Configure the Appliance" chapter for more information).

7. Cluster Subnet: Identifies one dedicated IP subnet for the appliance to use in managing and getting IPs for communications among its infrastructure services, such as database access, the message bus, and so on. By default, Cisco DNA Center configures a link-local subnet (169.254.48.0/20) for this parameter, and we recommend that you use this subnet. If you choose to enter another subnet, ensure that it does not conflict with or overlap any other subnet used by Cisco DNA Center's internal network or any external network. Also ensure that the minimum size of the subnet is 21 bits. The subnet you specify must conform with the IETF RFC 1918 and RFC 6598 specifications for private networks, which support the following address ranges:

   • 10.0.0.0/8

   • 172.16.0.0/12

   • 192.168.0.0/16

   • 100.64.0.0/10

   For details, see RFC 1918, Address Allocation for Private Internets, and RFC 6598, IANA-Reserved IPv4 Prefix for Shared Address Space.

   If you were to specify 10.10.10.0/21 as your Container subnet, you could also specify a Cluster subnet of 10.0.8.0/21 since these two subnets do not overlap. Also note that the configuration wizard detects overlaps (if any) between these subnets and prompts you to correct the overlap.

   Important

   Ensure that you specify a valid CIDR subnet. Otherwise, incorrect bits will be present in the 172.17.1.0/20 and 172.17.61.0/20 subnets. After configuration of your Cisco DNA Center appliance is completed, you cannot assign a different subnet without first reimaging the appliance (see the "Reimage the Appliance" topic in the "Configure the Appliance" chapter for more information).

The recommended total IP address space for the two Container and Cluster subnets contains 4,096 addresses, broken down into two /21 subnets of 2,048 addresses each. The two /21 subnets must not overlap. Cisco DNA Center's internal services require a dedicated set of IP addresses to operate (a requirement of the Cisco DNA Center microservice architecture. To accommodate this requirement, you must allocate two dedicated subnets per Cisco DNA Center system.

One reason the appliance requires this amount of address space is to maintain system performance. Because it uses internal routing and tunneling technologies for east-west (inter-node) communications, using overlapping address spaces would force the appliance to run Virtual Routing and Forwarding FIBs internally. This would lead to multiple encaps/decaps for packets going from one service to another, causing high internal latency at a very low level, with cascading impacts at higher layers.

Another reason is the Cisco DNA Center Kubernetes-based service containerization architecture. Each appliance uses the IP addresses in this space per Kubernetes K8 node. Multiple nodes can make up a single service. Currently, Cisco DNA Center supports more than 100 services, each requiring several IP addresses, and new features and corresponding services are being added all the time. The address space requirement is purposely kept large at the start to ensure that Cisco can add new services and features without either running out of IPs or requiring customers to reallocate contiguous address spaces simply to upgrade their systems.

The services supported over these subnets are also enabled at Layer 3. The Cluster space, in particular, carries data between application and infrastructure services, and is heavily used.

The RFC 1918 and RFC 6598 requirement is because of the requirement by Cisco DNA Center to download packages and updates from the cloud. If the selected IP address ranges do not conform with RFC 1918 and RFC 6598, this can quickly lead to problems with public IP address overlaps.

The appliance requires secure access to the following table of URLs and Fully Qualified Domain Names (FQDNs).

The table describes the features that make use of each URL and FQDN. You must configure either your network firewall or a proxy server so that IP traffic can travel to and from the appliance and these resources. If you cannot provide this access for any listed URL and FQDN, the associated features will be impaired or inoperable.

For more on requirements for proxy access to the internet, see Provide Secure Access to the Internet.

By default, the appliance is configured to access the internet in order to download software updates, licenses, and device software, as well as provide up-to-date map information, user feedback, and so on. Providing internet connections for these purposes is a mandatory requirement.

Using an HTTPS proxy server is a reliable way to access remote URLs securely. We recommend that you use an HTTPS proxy server to provide the appliance with the access it needs to the URLs listed in Required Internet URLs and Fully Qualified Domain Names. During appliance installation, you are prompted to enter the URL and port number of the proxy server you want to use for this purpose, along with the proxy's login credentials (if the proxy requires them).

As of this release, the appliance supports communication with proxy servers over HTTP only. You can place the HTTPS proxy server anywhere within your network. The proxy server communicates with the internet using HTTPS, while the appliance communicates with the proxy server via HTTP. Therefore, we recommend that you specify the proxy's HTTP port when configuring the proxy during appliance configuration.

If you need to change the proxy setting after configuration, you can do so using the GUI.

During appliance configuration, you will be prompted for the following information, in addition to the Required IP Addresses and Subnets:

• Linux User Name: This is maglev. This user name is the same on all the appliances in a cluster, including the primary node and secondary nodes, and cannot be changed.

• Linux Password: Identifies the password for the Linux user name maglev. This password ensures secure access to each appliance using the Linux command line. If required, you can assign a different Linux password for each maglev Linux user name on each appliance in a cluster.

  You must create the Linux password because there is no default. The password must meet the following requirements:

  • Minimum length of eight characters.

  • Cannot contain a tab or a line break.

  • Contains characters from at least three of the following categories:

    • Uppercase letters (A–Z)

    • Lowercase letters (a–z)

    • Numbers (0–9)

    • Special characters (for example, ! or #)

  The Linux password is encrypted and hashed in the Cisco DNA Center database. If you are deploying a multinode cluster, you will also be prompted to enter the primary node's Linux password on each of the secondary nodes.

• Password Generation Seed (Optional): Instead of creating a Linux password, you can enter a seed phrase and click Generate Password. The Maglev Configuration wizard generates a random and secure password using this seed phrase. You can further edit the generated password by using the Auto Generated Password field.

• Administrator Passphrase: Identifies the password used for web access to Cisco DNA Center in a cluster. This is the password for the superuser account admin, which you use to log in to Cisco DNA Center for the first time (see ). You are prompted to change this password when you log in for the first time.

  You must create this password because there is no default. The Administrator Passphrase must meet the same requirements as the Linux password, described earlier.

• CIMC User Password: Identifies the password used for access to the CIMC GUI. The factory default is password, but you are prompted to change it when you first set up CIMC for access using a web browser (see Enable Browser Access to Cisco Integrated Management Controller).

  The CIMC user password must meet the same requirements as the Linux password described earlier. It can be changed back to password only by a reset to factory defaults.

• Primary Node IP Address: Required only when you are installing secondary nodes in a cluster. This is the IP address of the cluster port on the primary node (see Interface Cable Connections).

After you have configured your appliances, log in to Cisco DNA Center and complete the essential setup tasks. During this first-time setup, you should have the following information:

• New Admin Superuser Password: You will be prompted to enter a new password for the Cisco DNA Center admin super user. Resetting the super user password enhances operational security. This is especially important if, for example, the enterprise staff who installed and configured the Cisco DNA Center appliance is not a Cisco DNA Center user or administrator.

• Cisco.com Credentials: The Cisco.com user ID and password that your organization uses to register software downloads and receive system communications through email.

• Cisco Smart Account Credentials: The Cisco.com Smart Account user ID and password your organization uses for managing your device and software licenses.

• IP Address Manager URL and Credentials: The host name, URL, admin user name, and admin password of the third-party IP address manager (IPAM) server you plan to use with Cisco DNA Center. This release supports InfoBlox and Bluecat.

• Proxy URL, Port, and Credentials: The URL (host name or IP address), port number, user name, and user password of the proxy server you plan to use with Cisco DNA Center in order to get updates to the Cisco DNA Center software, manage device licenses, and retrieve other downloadable content.

• Cisco DNA Center Users: User names, passwords, and privilege settings for the new Cisco DNA Center users you will be creating. We recommend that you always use one of these new user accounts for all your normal Cisco DNA Center operations. Avoid using the admin super user account for activities, except reconfiguring Cisco DNA Center and operations where super user privileges are explicitly required.

For details about how to launch and respond to the first-time setup wizard that prompts you for this information, see Complete the Quick Start Workflow.

You will also need the following information to complete the remaining setup tasks, which can be done after your first login:

• ISE Server IP and Credentials: You will need the Cisco ISE server IP address and credentials, administrative user name, and password. These are needed to log in to and configure your organization's ISE server to share data with Cisco DNA Center, as explained in Integrate Cisco ISE With Cisco DNA Center.

  Installation of or upgrade to Cisco DNA Center checks to see if Cisco ISE is configured as an authentication and policy (AAA) server. If the correct version of Cisco ISE is already configured, you can start migrating group policy data from Cisco ISE to Cisco DNA Center.

  If Cisco ISE is not configured, or if the required version of Cisco ISE is not present, Cisco DNA Center installs, but Group Based Policy is disabled. You must install or upgrade Cisco ISE and connect it to Cisco DNA Center. You can then start the data migration.

  Cisco DNA Center data present in the previous version is preserved when you upgrade. The data migration operation merges data from Cisco DNA Center and Cisco ISE. If the migration encounters a conflict, preference is given to data from Cisco ISE.

  If Cisco DNA Center becomes unavailable, and it is imperative to manage policies before Cisco DNA Center becomes available once more, there is an option in Cisco ISE to override the Read-Only setting. This allows you to make policy changes directly in Cisco ISE. After Cisco DNA Center is available again, you must disable the Read-Only override on Cisco ISE, and re-synchronize the policy data on Cisco DNA Center Group Based Access Control Settings page. Only use this option when absolutely necessary, since changes made directly in Cisco ISE are not propagated to Cisco DNA Center.

• Authorization and Policy Server Information: If you are using Cisco ISE as your authentication and policy server, you will need the same information listed in the previous bullet, plus the ISE CLI user name, CLI password, server FQDN, a subscriber name (such as cdnac ), the ISE SSH key (optional), the protocol choice (RADIUS or TACACS), the authentication port, the accounting port, and retry and timeout settings.

  If you are using an authorization and policy server that is not Cisco ISE, you will need the server's IP address, protocol choice (RADIUS or TACACS), authentication port, accounting port, and retry and timeout settings.

  This information is required to integrate Cisco DNA Center with your chosen authentication and policy server, as explained in Configure Authentication and Policy Servers.

• SNMP Retry and Timeout Values: This is required to set up device polling and monitoring, as explained in Configure SNMP Properties.