Integrating Cisco DNA Center

[gschramm]

We are a big Cisco customer for network equipment, all of it is managed via the Cisco DNA Center.
I got contacted by a colleague who is part of our corporate network operations team regarding log analysis.
Currently they are using Splunk for logs analysis. As it happens there is pretty nice Addon Application for the DNA Center integration in Splunk. My colleagues don't really care about the logs themselves, but the are heavily depending on the app to visualize the current network /device status.

Has anyone tried to integrate the DNA Center in dynatrace via an extension? Building something from scratch will be to much work for our small team.

[Krzysztof_Ziemi · Accepted solution]

Hello.

This question comes at the right time. Currently we are working on the Cisco DNA extension, leveraging expertise of one of our extension development partners. We'd be glad to see you as an early adopter hear your feedback. We should be ready in a few weeks. Are you interested?

Best regards, 

[Sennen]

Hello,

We are currently also onboarding Cisco Catalyst Center (New name for DNAC), if possible we would also be intrested to test the extension. We are not full live yet with CATC, so we can run some tests.

[gschramm]

Hello,

what a great coincidence. Yes, we are interested in checking out the extension. I'll let my colleagues know.

Thanks

[y_buccellato]

Hello, grateful for the update.
Include us as well please.

[Krzysztof_Ziemi]

Hello. Catalyst Center (f.k.a. DNA) extension is out. https://www.dynatrace.com/hub/detail/cisco-catalyst-center-dna-center/?query=cisco&filter=all It's 1.0 release, with all the consequences:-) Please start using it and provide feedback, preferably through Community, i.e. here. Thanks!

[gschramm]

Hello,

I've installed the extension now and connected it to our DNA center. Unfortunately it's barely usable in our environment, I assume it's simply to much data. Most of the charts in corresponding dashboard stay empty and show an error that the measures don't exist.

I'm not allowed to share the number of sites, devices and interfaces so please reach out to me directly.

[Krzysztof_Ziemi]

Please open a Support call and our support folks will involve the extension developers to assist in resolution. It might be a sizing issue, but it might be DNAC version, or permissions - too many degreed of freedom to solve it on Community. Thanks!

[gschramm]

Done. The version we are using is DNA Center Version we are using 2.3.5.5

[gschramm]

Hello,

support confirmed that it's a compatibility issue with the DNA center version we have in use. Anyway, I had to deactivate the extension due to the costs. In our environment it's pulling ~21mill metrics / day. That would sum up to over 10.000€ / year, by far too much for a nice-to-have integration.

[Krzysztof_Ziemi]

Thanks for closing the loop on it. Regarding monitoring scope, there are options to limit the number of monitored entities, and thus number of metric data points ingested - by disabling some feature sets. Naturally, it's a balance between usage cost and benefit from having specific DNAC signals in the Dynatrace platform. It won't drive usage costs to zero though.

[Sennen]

Hello, 

Should there be a problem creation for the events created in Catalyst Center?

I played around with the "Ingest issues as log messages". I see the event now under  "loglevel": "ERROR" &  "issue.priority": "P1", but no problem created. 
I think it might be handy to have problem creation on those issues by default.

[MartinMarko]

Hi,

There is a planned Opt-In feature to report Catalyst Issues as Events too.

[MartinMarko]

[gschramm]

Hi again,

I've just reactivated the extension to check how well it playes together with the Infrastructure & Operations app.

What we really like is that all the network devices are automatically listed in the network section of the app (8.9k devices, 6 digit network interfaces). 

What we are looking for is to use that list to also get the snmp/cisco metrics for the devices.. that would be great step towards actionable network monitoring. 

[MartinMarko]

Hi @gschramm ,

You can navigate from the I&O visualization to the extension’s metrics visualization by clicking the Extension button in the device detail view.

Hope this helps.

[gschramm]

Those metrics are empty. I assume you have configured the SNMP extension to query these devices, right? I only got 20 devices in SNMP, for those I see all the metrics you screenshotted.

[gschramm]

According to the FAQ there is 100k interface limit, we far beyond that. I'll contact support to increase the limit as suggested in the doc.

[MartinMarko]

Please make sure you are using Cisco Catalyst Center API version 2.3.7.6 or 2.3.7.9.

Unfortunately, with older versions only the interface administrative and operational status can be reported. Detailed interface metrics are not available due to API limitations.

[gschramm]

We are running v 2.3.7.9, so that should be good there.

However I'm constantly getting error from the extension, queries timing out. I've increased the interval from default 1, to 2, to 3 and 5min.. no improvement, it not finishing properly. I'll give it another try with 10min interval. 

[MartinMarko]

Practical tests suggest the following rule of thumb: ~1000 devices per 1-minute monitoring interval
(see: https://docs.dynatrace.com/docs/shortlink/cisco-catalyst-center-dna-center-extension#expand--How-man...
).

So for 8.9k devices, I would recommend configuring at least a 10-minute data collection interval.
(You may see ~+20s monitor execution times in the error log because the extension internally drops queries once the configured interval is exceeded.)

Also, please review this Q&A entry:
https://docs.dynatrace.com/docs/shortlink/cisco-catalyst-center-dna-center-extension#expand--The-Dyn..."Memory-threshold-exceeded"-in-the-ruxitagent_extensionmodule-log.--11

[MartinMarko]

Please note that scaling estimates must be based on the real number of devices in the monitored system.
Filters configured in the extension are applied only after all device and interface data has already been polled (due to REST API limitations).

[gschramm]

Support has increase the interface limit now. Unfortunately that didn't help us enough, we are still not seeing reliable data. I assume our network I simply to large, queries take too long (I'm at 15min interval now). I tried using multiple configurations for different devices types to increase the parallelism.. that did very little.

Biggest issue remains, the interfaces which are not always showing up. Also with a 15min interval I can't use this for actual monitoring.

What is VERY convenient that I can "import" all the devices from the Catalyst center. That something that has a lot of potential for us. I couldn't achieve this via the SNMP extension, there are simly too many networks and IP ranges (requires hundreds of configs.. no way).

I'm trying to solve two problems:
1. Get our network devices into dynatrace. Catalyst center is the single source of truth for our network devices. If it's running somewhere in our network, it's configured via the CC. (8.8k devices, 200k+ interfaces, global network spanning 350 sites).

2. Monitor the most important devices. These would include devices installed in datacenters or the core infrastructure of a site.

I guess what I'm looking for would be a combination of both extensions:

- catalyst center integration is a perfect way to get the up2date list of devices

- snmp/cisco extension allows capturing the timeseries for devices, however I can't"reuse" the device list provided by the catalyst center right now.

Is anyone facing a similar situation?

[MartinMarko]

Hi @gschramm 

You can configure the Cisco Catalyst Center (DNA) extension to use an older API version. Even if you are running version 2.3.7.9, you can specify an earlier API version (for example, 2.3.5.3 – prior to 2.3.7.6) in the extension configuration.

In this case, the extension will not collect detailed interface statistics from Catalyst Center and report related metrics. Only the administrative and operational status will be reported as metrics. Interface entities will still be created, but no detailed interface metrics will be collected.

By doing this, you may be able to decrease the data collection interval, as the extension will no longer execute 200+ paginated data queries.

---

The Cisco Catalyst Center (DNA) extension and, for example, the Generic Cisco Device extension (which uses SNMP to feed Dynatrace with metrics and alerts) both follow the concept described here: https://docs.dynatrace.com/docs/shortlink/network-topology

Both extensions create entities of type dt.entity.network:device and establish a same_as relationship between their extension-specific device entities (such as dt.entity.cisco_cc:device and dt.entity.snmp:com_dynatrace_extension_snmp_generic_device) and the generic network device entities.

By leveraging these relationships, I believe you should be able to “reuse” the device list provided by Cisco Catalyst Center and metrics provided by SNMP based extension.

[MartinMarko]

Please review the attached images showing the generic network device entity in the Infrastructure & Operations application, along with its entity relationships.

[gschramm]

Hi Marco,

I am aware of the generic network devices and the cisco devices. The problem I am facing is getting them configured in a convenient way. We got 8.8k such devices, using IP ranges I would still require ~3500 configurations for those extensions. Those ranges are also subject to changes, that happens rather frequently. Maintaining an accurate list is therfore rather labour intense and that's impossible to maintain.

The Catalyst Center however got the accurate list at all times. I could use those devices to create configurations for all the devices via API, but I would still end up with a 4 digit long list of configurations.. extremely inconvenient to maintain.
My thoughts were: get the devices from the Catalyst Center, then query them via the cisco extension, but without configurating them all separately. Other extensions provide options to configure something for a host, hostgroup, management zone, tags, whole environment.. what I am looking for is something like:

- "get devices from Catalyst Center" for the generic / cisco extension
- in the catalyst extension a convenient way to "hand over" to the cisco extension

[Julius_Loman]

Hi @gschramm ,

Thank you for the feedback. We appreciate it. I've discussed it with @MartinMarko, and we think this could be doable by the following approach already:

• Cisco DNA extension already propagates the Smartscape with Cisco device entities and their Site IDs and other metadata.
• I assume you have a set of ActiveGates which can poll the nearest SNMP devices using the Generic SNMP extension (one AG group can probably poll multiple defined sites).
• Have a lookup table defined in Dynatrace to look up ActiveGate group by the Cisco Site ID (so you can actively control which AG group will be used) - that's the only "manual" configuration you need to maintain and will be mostly static unless you configure new sites or firewall clearances change
• Define a Dynatrace workflow which will run maybe once a day and will:
  1. Get the Cisco device entities and metadata from Smartscape populated by Cisco DNA extension. If there is any data missing in the entities, we can add it to the DNA extension and populate it.
  2. Lookup the ActiveGate groups by the Site IDs for those devices.
  3. Add or update Generic SNMP Extension configurations to poll the metrics using the Settings API.
• This will basically automate the configuration of the Generic SNMP extension for Cisco devices known to Cisco DNA.

We will be happy to assist you with prototyping this solution.  What needs to be double-checked is the number of configurations. You can still have up to 20k devices per Generic SNMP extension configuration or Generic Cisco extension. How many configurations do you need ? This would be determined by the number of ActiveGate groups being able to poll sites. You have 350 sites. How many ActiveGate groups do you have? Is this one ActiveGate group per site?

[gschramm]

This is an interesting approach!

Right now the devices are configured in 3.3k sites inside the catalyst center. To this point we didn't need many AG groups, we are only running 3 right now. They are currently setup in central locations in our infrastructure (on prem datacenter, Azure and AWS, currently all in europe), so they are independed from our corporations locations. These groups can be easily expanded or more groups added if latency / bandwidth become a problem.

I assume that adding some AG groups in the right places in our network (eg. in the US, in Brazil, Asia and Australia) would be sufficient.

I need to doublecheck your approch with the network team. They got the 8.8k devices organised into 3.3k sites in the catalyst center. Typically multiple catalyst sites map to one actual location (IT and OT networks, guest networks, multiple WAN uplinks, multiple subnets...). Maintaining the lookup table would be their job, also the costs for the extra AGs would come out of their budget.