Cisco DNA Service for Bonjour Configuration Guide, Cisco IOS XE Bengaluru 17.5.x (Catalyst 9600 Switches)
Bias-Free Language
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
The Apple Bonjour protocol is a zero-configuration solution that simplifies network configuration and enables communication
between connected devices, services, and applications. Using Bonjour, you can discover and use shared services with minimal
intervention and configuration. Bonjour is designed for single Layer 2 domains that are ideal for small, flat, single-domain
setups, such as home networks. The Cisco Wide Area Bonjour solution eliminates the single Layer 2 domain constraint and expands the scope to enterprise-grade traditional wired and
wireless networks, including overlay networks such as Cisco Software-Defined Access (SD-Access) and industry-standard BGP
EVPN with VXLAN. The Cisco Catalyst 9000 series LAN switches and wireless LAN controllers follow the industry standard, RFC
6762-based multicast DNS (mDNS) specification to support interoperability with various compatible wired and wireless consumer
products in enterprise networks.
The Wide Area Bonjour application is a software-defined, controller-based solution that enables devices to advertise and discover Bonjour services
across Layer 2 domains, making these services applicable to a wide variety of wired and wireless enterprise networks. The
Wide Area Bonjour application also addresses problems relating to security, policy enforcement, and services administration on a large scale.
The new distributed architecture is designed to eliminate mDNS flood boundaries and transition to unicast-based service routing,
providing policy enforcement points and enabling the management of Bonjour services. With the Wide Area Bonjour application, you can seamlessly introduce new services into the existing enterprise environment without modifying the existing
network design or configuration.
The enhanced intuitive GUI provides you with centralized access control and monitoring capabilities, combined with the scalability
and performance required for large-scale Bonjour services deployments for various supporting enterprise network types.
The following figure illustrates how the Cisco Wide Area Bonjour application operates across two integrated domain networks with end-to-end unicast-based service routing.
Figure 1. Cisco Wide Area Bonjour Solution
Local-Area Service Discovery Gateway Domain - Multicast DNS Mode: The classic Layer 2 multicast flood-n-learn-based deployment model. The service provider and receiver can discover and browse
within the common VLAN or broadcast domain without any security and location-based policy enforcement. The Cisco Catalyst
switches at the Layer 3 boundary function as the Service Discovery Gateway (SDG) to discover and distribute services between
local wired or wireless VLANs based on applied policies. The inter-VLAN service routing at a single gateway is known as Local
Area Bonjour.
Local Area Service Discovery Gateway Domain - Unicast Mode: The new enhanced Layer 2 unicast policy-based deployment model. The new mDNS service discovery and distribution using Layer
2 unicast address enables flood-free LAN and wireless networks. Cisco Catalyst switches and Cisco Catalyst 9800 series wireless
LAN controllers in Layer 2 mode introduce a new service-peer role, replacing classic flood-n-learn, for new unicast-based
service routing support in the network. The service-peer switch and wireless LAN controller also replace mDNS flood-n-learn
with unicast-based communication with any RFC 6762 mDNS-compatible wired and wireless endpoints.
Wide-Area Service Discovery Gateway Domain: The Wide Area Bonjour domain is a controller-based solution. The Bonjour gateway role and responsibilities of Cisco Catalyst switches are extended
from a single SDG switch to an SDG agent, enabling Wide Area Bonjour service routing beyond a single IP gateway. The network-wide distributed SDG agent devices establish a lightweight, stateful,
and reliable communication channel with a centralized Cisco DNA Center controller running the Wide Area Bonjour application. Service routing between the SDG agents and the controller operates over regular IP networks using TCP port 9991.
The SDG agents route locally discovered services based on the export policy.
Solution Components
The Cisco DNA Service for Bonjour solution is an end-to-end solution that includes the following key components and system roles to enable unicast-based service
routing across the local area and Wide Area Bonjour domain:
Cisco Service peer: A Cisco Catalyst switch and Catalyst Wireless LAN Controller (WLC) in Layer 2 access function in service peer mode to support
unicast-based communication with local attached endpoints and export service information to the upstream Cisco SDG agent in
the distribution layer.
Cisco SDG agent: A Cisco Catalyst switch functions as an SDG agent and communicates with the Bonjour service endpoints in Layer 3 access
mode. At the distribution layer, the SDG agent aggregates information from the downstream Cisco service peer switch and WLC,
and exports information to the central Cisco DNA controller.
Cisco DNA controller: The Cisco DNA controller builds the Wide Area Bonjour domain with network-wide and distributed trusted SDG agents using a secure communication channel for centralized services
management and controlled service routing.
Endpoints: A Bonjour endpoint is any device that advertises or queries Bonjour services conforming to RFC 6762. The Bonjour endpoints
can be in either LANs or WLANs. The Wide Area Bonjour application is designed to integrate with RFC 6762-compliant Bonjour services, including AirPlay, Google Chrome cast, AirPrint,
and so on.
Supported Platforms
The following table lists the supported controllers, along with the supported hardware and software versions.
Table 1. Supported Controllers with Supported Hardware and Software Versions
Supported Controller
Hardware
Software Version
Cisco DNA Center appliance
DN2-HW-APL
DN2-HW-APL-L
DN2-HW-APL-XL
Cisco DNA Center, Release 2.2.2
Cisco Wide Area Bonjour application
—
2.4.264.12003
The following table lists the supported SDG agents along with their licenses and software
requirements.
Table 2. Supported SDG Agents with Supported Licenses and Software Requirements
Supported Platform
Supported Role
Local Area SDG
Wide Area SDG
Minimum Software
Cisco Catalyst 9200 Series Switches
SDG
Cisco DNA Advantage
Unsupported
Cisco IOS XE Amsterdam 17.3.3
Cisco Catalyst 9200L Series Switches
—
Unsupported
Unsupported
—
Cisco Catalyst 9300 Series Switches
Service peer
SDG agent
Cisco DNA Advantage
Cisco DNA Advantage
Cisco IOS XE Amsterdam 17.3.3
Cisco Catalyst 9400 Series Switches
Service peer
SDG agent
Cisco DNA Advantage
Cisco DNA Advantage
Cisco IOS XE Amsterdam 17.3.3
Cisco Catalyst 9500 Series Switches
Service peer
SDG agent
Cisco DNA Advantage
Cisco DNA Advantage
Cisco IOS XE Amsterdam 17.3.3
Cisco Catalyst 9500 High Performance Series Switches
Service peer
SDG agent
Cisco DNA Advantage
Cisco DNA Advantage
Cisco IOS XE Amsterdam 17.3.3
Cisco Catalyst 9600 Series Switches
Service peer
SDG agent
Cisco DNA Advantage
Cisco DNA Advantage
Cisco IOS XE Amsterdam 17.3.3
Cisco Catalyst 9800 WLC
Service peer
Cisco DNA Advantage
Unsupported
Cisco IOS XE Amsterdam 17.3.3
Cisco Catalyst 9800-L WLC
Service peer
Cisco DNA Advantage
Unsupported
Cisco IOS XE Amsterdam 17.3.3
Cisco Wide Area Bonjour Supported Network Design
The Cisco DNA Service for Bonjour supports a broad range of enterprise-grade networks. The end-to-end unicast-based Bonjour service routing is supported on
traditional, Cisco SD-Access, and BGP EVPN-enabled wired and wireless networks.
Traditional Wired and Wireless Networks
Traditional networks are classic wired and wireless modes deployed in enterprise networks. Cisco DNA Service for Bonjour supports a broad range of network designs to enable end-to-end service routing.
The following figure illustrates traditional LAN network designs that are commonly deployed in an enterprise.
Figure 2. Enterprise Traditional LAN Network Design
Wired Networks
The following figure shows the supported LAN network designs that are commonly deployed in an enterprise.
Figure 3. Enterprise Multilayer and Routed Access Network Design
The SDG agent that provides Bonjour gateway functions is typically an IP gateway for wired endpoints that could reside in
the distribution layer in multilayer network designs, or in the access layer in routed access network designs.
Multilayer LAN: In this deployment mode, the Layer 2 access switch provides the first-hop Bonjour gateway function to locally attached wired
endpoints. The Bonjour services and global discovery request are routed to the distribution layer systems that act as the
IP gateway or SDG agent. There's no additional configuration or new requirement to modify the existing Layer 2 trunk settings
between the access and distribution layers of the Cisco Catalyst switches. The policy-based service routing between the Layer
2 service-peer switches is performed by the SDG agent. The policy-based service routing between the SDG agents is performed
by the Cisco DNA Center controller.
Routed Access: In this deployment mode, the first-hop switch is an IP gateway boundary and, therefore, it must also perform the SDG agent
role. The policy-based service routing between the SDG agents is performed by the Cisco DNA Center controller.
Wireless Networks
The Cisco DNA Service for Bonjour also supports various wireless LAN network designs that are commonly deployed in an enterprise. The Cisco Catalyst 9800 Series
Wireless LAN Controller (WLC) can be deployed in a service-peer role supporting the mDNS gateway and paired with an upstream
gateway switch for end-to-end service routing.
The following figure shows the supported wireless LAN network designs that are commonly deployed in an enterprise.
Figure 4. Enterprise Traditional Wireless LAN Network Design
Local Mode: In this central switching wireless deployment mode, the Bonjour traffic is encapsulated within the CAPWAP tunnel from the
Cisco access points to the centrally deployed Cisco Wireless LAN Controller. The Cisco access points are configured to be
in local mode (central switching also allows the access point to be configured in FlexConnect mode). With central switching,
the Cisco Catalyst 9800 Series Wireless LAN Controller provides the mDNS gateway function of Bonjour services in the service-peer
role. The WLC can discover and distribute services to local wireless users and perform unicast service routing over a wireless
management interface to the Cisco Catalyst switch in the distribution layer, which acts as the IP gateway and the SDG agent.
There's no additional configuration or requirement to modify the existing Layer 2 trunk settings between the Cisco Wireless
LAN Controller and the distribution layer of the Cisco Catalyst switch. The Cisco Wireless LAN Controller must be configured
with Global Multicast and AP Multicast in Multicast mode. Unless the access point joins the wireless LAN controller-announced
multicast group, communication to and from Bonjour endpoints is not enabled for the wireless user group.
FlexConnect: In FlexConnect local switching mode, both wired and wireless users share the same gateway in the access layer. The Layer
2 access switch provides the policy-based mDNS gateway function to locally attached wired and wireless users. The Cisco Catalyst
switches in the distribution layer function as SDG agents for the LAN and wireless LAN user groups.
Embedded Wireless Controller - Switch: The Cisco Embedded Wireless Controller solution enables the lightweight integrated wireless LAN controller function within
the Cisco Catalyst 9300 series switch. The Cisco Catalyst switches in the distribution layer function as SDG agents to the
LAN and wireless LAN user groups. The SDG agent in the distribution layer provides unicast service routing across all wireless
access point and Layer 2 service-peer switches without any mDNS flooding. The embedded Cisco Wireless LAN Controller switch
must be configured with Global Multicast and AP Multicast in Multicast mode and mDNS must be set in bridging mode.
Embedded Wireless Controller - Access Point: The Cisco Embedded Wireless Controller solution enables the lightweight integrated wireless LAN controller function within
the Cisco access points configured in the primary role. The wireless users share the same Bonjour gateway in the access layer
as the wired endpoints. The Cisco Catalyst switches in the access layer function as service peers to the LAN and wireless
LAN user groups. The SDG agent in the distribution layer provides unicast service routing across all Layer 2 service-peer
switches in the Layer 2 network block without any mDNS flooding. AP multicast is required for Embedded Wireless mode AP, and
mDNS must be set in bridging mode.
Note
The Cisco AireOS-based WLC can be deployed as an mDNS pass-through network device between the wireless endpoints. The upstream
SDG agent provides consistent Bonjour gateway functions for wireless endpoints, as for wired networks. In general, the IP
gateway of wireless clients is also a Bonjour gateway. However, the placement of the SDG agent may vary depending on the wireless
LAN deployment mode.
Cisco SD-Access Wired and Wireless Networks
Cisco SD-Access-enabled wired and wireless networks support Cisco DNA Service for Bonjour. Starting with Cisco IOS-XE Release 17.4.1, the VRF-aware Cisco Wide Area Bonjour service routing provides secure and segmented mDNS service discovery and distribution management for fabric-enabled wired
and wireless networks. It eliminates the need for Layer 2 flooding. The Layer 3 Fabric Edge switch in the access layer must
be configured as the SDG agent and paired with the central Cisco DNA Center for end-to-end service routing. Wide Area Bonjour policies must be aligned with the SD-Access network policies for virtual networks and SGT policies, if any.
Fabric-Enabled Wired and Wireless Networks
The following figure shows Cisco SD-Access-enabled wired and wireless networks without extending the Layer 2 network boundaries.
Figure 5. Cisco SD-Access Network Design
The Cisco DNA Service for Bonjour for SD-Access-enabled wired and wireless networks uses two logical components:
SDG agent: The Layer 3 Fabric Edge switch in the access layer network is configured as the SDG agent. The VRF-aware mDNS gateway and
Wide Area Bonjour service routing configuration is added only after SD-Access is configured.
Cisco DNA controller: The Wide Area Bonjour application on Cisco DNA Center acts as the controller supporting policy and location-based service discovery and distribution between network-wide distributed
Fabric Edge switches.
The Wide Area Bonjour communication between the SDG agent and the controller takes place through the network underlay. The SDG agent forwards the
endpoint announcements or queries to the controller through the fabric underlay based on policies. After discovering a service,
a Bonjour-enabled application establishes direct unicast communication between endpoints through the fabric overlay. This
communication is subject to configured overlay IP routing and SGT policies, if any.
The Cisco Wireless LAN Controller must be configured with Global Multicast and AP Multicast in Multicast mode. The network
administrator must enable IP Multicast in the underlay and ensure all fabric-enabled Cisco wireless access points have successfully
joined the multicast group. The mDNS snooping configuration on the Cisco Wireless LAN Controller is ineffective and must remain
in disabled mode.
Fabric-Enabled Policy Extended Node
Figure 6. Fabric-Enabled Policy Extended Node
The security policy can be extended to Cisco Catalyst 9000 Series Switches at Layer 2 access with the Policy Extended Node
(PEN) function in a Cisco SD-Access fabric network. The network security and mDNS service policy can be combined at the Layer 2 access PEN switch in a service-peer
role combined with Fabric Edge supporting SDG agent mode in Layer 2/3 distribution layer for Wide Area Bonjour service routing with Cisco DNA Center.
BGP EVPN Networks
The BGP EVPN-based enterprise network provides a flexible Layer 3 segmentation and Layer 2 extension overlay network. Starting
with Cisco IOS-XE Release 17.4.1, the VRF-aware Cisco Wide Area Bonjour service routing provides secure and segmented mDNS service discovery and distribution management for all common VXLAN overlay
deployment models, eliminating mDNS flooding over Layer 2 extended EVPN VXLAN networks (symmetric and asymmetric IRB) and
service reachability challenges for Layer 3 segmented EVPN VXLAN networks in the fabric.
The following figure shows the BGP EVPN leaf switch in Layer 3 access mode supporting overlay Bonjour service routing for
a BGP EVPN-enabled wired and wireless enterprise network over various types of Layer 2 networks and Layer 3 segmented VRF-enabled
networks.
Figure 7. Overlay Bonjour Service for a BGP EVPN-Enabled Enterprise Network
Cisco DNA Service for Bonjour supports Wide Area Bonjour service routing for BGP EVPN networks extended with Layer 2 service-peer network devices, such as a Cisco Catalyst switch
or 9800 series WLC. The BGP EVPN leaf device in the distribution layer supports the SDG agent role for overlay service routing.
The Cisco DNA Service for Bonjour solution for BGP EVPN networks enables policy-based end-to-end service routing for virtual network environments. The solution
helps protect enterprise network scale and performance by eliminating the Layer 2 mDNS flood over the VXLAN across the IP
core network.
The following figure shows mDNS endpoints connecting the Layer 2 access switch in service-peer mode to the upstream BGP EVPN
leaf switch in the Layer 2/3 distribution layer supporting overlay Bonjour service routing for a BGP EVPN-enabled wired and
wireless enterprise network over various types of Layer 2 networks and Layer 3 segmented VRF-enabled networks.
Figure 8. mDNS Endpoints Connecting an L2 Switch to the Upstream BGP EVPN Leaf Switch