In previous blog posts, I described how network implementation and maintenance can be simplified. I mostly focused on the capabilities of switch operating systems like Fabric Engine (formerly VOSS) and Switch Engine (formerly EXOS). I also mentioned management software called ExtremeCloud IQ – Site Engine several times. But what exactly is the role of this software? What’s nice about Site Engine is that it’s not required for all the fabric capabilities I’ve discussed. However, if you want complete automation from the network edge, then Site Engine is essential.
What is Site Engine?
Basically, Site Engine consists of three main modules:
Management: Monitoring, backups, firmware management, configuration, maps, automation, scripts, etc
Control: Network access control.
Analytics: Layer 7 visibility, similar to what’s found in NGFWs but applied to the access layer.
These three modules are tightly integrated, using the same databases to provide superb visibility. For example, you can easily check where a user is connected, locate them on either a wired or wireless map, and identify the applications they are using — providing complete visibility into your network.
Site Engine’s Role in Automation
Site Engine plays a key role in automation tasks. One of the tasks I’ve mentioned in previous posts is how, during the user authorization process, we can send information about VLAN to I-SID mapping to the switch. This allows us to automate VLAN creation, eliminating the need for manual configuration.
Another important role of Site Engine is network provisioning. There are plenty of tasks that need to be done initially, and of course, we don’t want to do anything manually. Let’s elaborate on an example: the core/distribution layer is already in place, and now I want to add a new switch to the network and provision it automatically, without any manual configuration.
A new switch, running Fabric Engine and in its factory-default state, is connected to the core/distribution fabric. Auto-Sense detects the new fabric switch, and the fabric configuration happens automatically. The new switch receives its IP address via DHCP in VLAN 4048 (the default onboarding VLAN). The DNS server resolves extremecontrol.domain to the Site Engine’s IP address, allowing the new switch to communicate with Site Engine. At this point, the switch becomes visible in the Network -> Discovered tab.
Once the switch is discovered, we can provision it and configure whatever is needed. The typical provisioning process includes tasks such as:
- Adding the switch to SiteIQ, maps, etc.
- Configuring syslog, SNMP, SSH credentials, NTP, DNS, RADIUS, etc.
- Adding the device to Control (NAC) and the policy domain.
At this stage, fabric services (like L2VSN, L3VSN), port settings, and many other configurations can be applied as well.
During the onboarding process, the switch gets its IP address via DHCP, but for production environments, switches should use static IP addresses. During provisioning, I run a custom script (Onboard Mgmt VLAN) that reconfigures the switch to use a static IP. The script assigns IP addresses to new switches based on a CSV file and their serial number
This is the sixth and final article in the series on Extreme Automated Campus. To summarize the solution: today’s automation is truly end-to-end. You can provision and maintain a network with minimal manual configuration. What I especially appreciate is the simplicity of the whole solution. Slides may make everything look perfect, but real life isn’t always so straightforward. However, with any solution, it’s easier to resolve issues when the underlying system is simple. That’s why I’m a fan of simple solutions. In fact, I would say that the Extreme Automated Campus is beautiful in its simplicity.