Skip to content
Log in Sign up My account

4.5 Catalyst Center Workflows

Blueprint 4.5: Describe Cisco Catalyst Center workflows to apply network configuration, monitoring, and management

  • What Catalyst Center (formerly DNA Center) is and how it differs from box-by-box management
  • The workflow areas: Design, Policy, Provision, Assurance, plus Platform
  • Day 0 to Day N: discovery, Plug and Play, inventory, templates, software image management
  • Assurance: health scores, issues, Device 360, Client 360, Path Trace
  • How Catalyst Center talks to devices (southbound) and to other systems (northbound)

The verb is describe. You will not configure Catalyst Center in the exam. Expect "which area of Catalyst Center would you use to..." questions, and comparisons with traditional management.

From box-by-box to controller-based management

Catalyst Center is Cisco's enterprise controller and management platform for campus and branch networks. It was called APIC-EM, then DNA Center, and was renamed Catalyst Center in 2023. It runs as an appliance (physical or virtual) and manages Catalyst switches, routers and wireless controllers. It is also the controller for SD-Access (see 1.3 SD-Access).

Traditional management Catalyst Center
Unit of work One device at a time, by CLI A site, a profile or an intent applied to many devices
Configuration consistency Depends on the engineer Templates and network settings applied the same way everywhere
Software upgrades Manual, per device Golden image per device family and site, with pre- and post-checks
Monitoring SNMP polling, syslog, separate tools Correlated telemetry, health scores, guided remediation
Troubleshooting Hop-by-hop show and debug Path Trace, Device 360, Client 360, historical data ("time travel")
Integration Scripts against each device One northbound REST API (Intent API)

The workflow areas

The main menu is organised around the lifecycle of the network. The order matters: you define the network before you push it, and you push it before you measure it.

graph LR
  D["Design<br/>what the network looks like"] --> P["Policy<br/>what is allowed"]
  P --> V["Provision<br/>push it to devices"]
  V --> A["Assurance<br/>is it working"]
  A -.->|"insights feed changes"| D
  PL["Platform<br/>APIs, integrations, bundles"] -.- V
Area What you do there Examples
Design Model the network and its shared settings Site hierarchy (area, building, floor), floor maps, network settings (AAA, DHCP, DNS, NTP, syslog, SNMP and NetFlow collector servers, time zone, banner), device credentials, IP address pools, image repository and golden images, network profiles, configuration templates
Policy Define intent for access and traffic Group-based access policy (Security Group Tags), virtual networks for SD-Access, IP-based access control, application policy (QoS intent)
Provision Apply the design and policy to devices Inventory, assign devices to sites, provision devices (push network settings and templates), Plug and Play onboarding, software image upgrades, SD-Access fabric sites
Assurance Measure the result and fix problems Health dashboards, issues and suggested actions, Device 360, Client 360, Application health, Path Trace, sensor tests, Intelligent Capture
Platform Extend and integrate Developer toolkit (Intent API catalog), integration bundles (ITSM such as ServiceNow, IPAM), event notifications, webhooks

Discovery, topology and the command runner sit under Tools in the menu.

Exam trap

"Where do you define the DHCP, DNS, NTP and syslog servers for a building?" is Design (network settings), not Provision. Design defines the values; Provision is the step that pushes them to devices assigned to that site.

Day 0 to Day N workflow

graph TB
  A["Design: sites, settings, credentials, golden image"] --> B["Discovery: CDP, LLDP or IP range<br/>or Plug and Play for new devices"]
  B --> C["Inventory: device managed and reachable"]
  C --> D["Provision: assign to site, push settings and templates"]
  D --> E["SWIM: upgrade to golden image"]
  E --> F["Assurance: health, issues, compliance"]
  F --> G["Day N change: edit template or setting, re-provision"]
  G --> F

Bringing devices under management

Method Use How it works
Discovery Existing (brownfield) devices Catalyst Center crawls with CDP or LLDP from a seed device, or scans an IP range. It logs in with the CLI credentials (SSH) and SNMP credentials defined for the discovery, and adds each device to Inventory.
Plug and Play (PnP) New (greenfield) devices An unconfigured device boots, finds Catalyst Center (DHCP option 43, a DNS lookup of pnpserver in its domain, or the Cisco PnP Connect cloud service), and is claimed to a site. Catalyst Center then pushes an image and a Day 0 template.
LAN Automation SD-Access underlay Uses PnP to discover and build a routed IS-IS underlay automatically.

Once in inventory, a device is usually assigned to a site and provisioned. Provisioning pushes the site's network settings (for example ntp server, logging host, snmp-server and AAA configuration) plus any templates attached to the network profile.

Templates

Templates hold CLI configuration with variables. They are written in Velocity or Jinja2 in the Template Editor (Template Hub in newer releases), attached to a network profile, and the profile is attached to sites. Day 0 templates are used during PnP onboarding; Day N templates push ongoing changes.

hostname $hostname
interface $uplink
 description Uplink to $dist_switch
 ip address $ip $mask

Catalyst Center keeps a record of what it pushed and can run configuration compliance checks that flag devices whose running configuration drifted from intent.

Software Image Management (SWIM)

  1. Images are imported into the image repository (Design).
  2. One image per device family is marked as golden, optionally per site.
  3. Devices running a different image are flagged as non-compliant.
  4. An upgrade is scheduled from Provision: the image is distributed, then activated, with pre-checks (flash space, configuration register, startup config) and post-checks.

Assurance

Assurance is the monitoring half of the 4.5 objective. Catalyst Center collects telemetry from many sources, correlates it, and presents it as health scores and issues.

Telemetry source Gives Assurance
SNMP Interface counters, CPU, memory, environmental data
Syslog Events and state changes
NetFlow Application traffic and performance
Model-driven (streaming) telemetry High-frequency device and wireless data
Wireless controllers and APs RF, client onboarding and roaming events
AAA (ISE) and DHCP/DNS Client onboarding steps

Health scores

Health is scored from 1 to 10 for the overall network, each device, each client and each application. In the dashboards, scores of 1 to 3 are poor (red), 4 to 7 fair (orange), and 8 to 10 good (green).

View Shows
Overall health Network, client and application health on one page, by site
Device 360 One device: health over time, issues, interfaces, neighbours, events, physical topology
Client 360 One client: onboarding timeline (association, authentication, DHCP), the device and port it uses, its applications, issues
Application health Application latency, loss and jitter where NetFlow or application visibility data exists
Issues Detected problems with impact, root cause, and suggested actions (guided remediation commands)

Path Trace

Path Trace takes a source and destination (IP addresses, optionally ports and protocol) and draws the path the traffic takes through managed devices. It combines routing and switching tables, ACLs, and device state, and highlights where traffic would be dropped, for example by an ACL. It is the Catalyst Center answer to "a user cannot reach a server".

Other assurance tools

Tool Purpose
Time travel Move the view back in time to see the network state when the user complained
Sensors Dedicated wireless sensors (or APs in sensor mode) that run synthetic tests
Intelligent Capture On-demand packet capture and RF statistics for a wireless client
AI-driven analytics Baselines and anomaly detection (cloud-assisted features, depending on licensing)

Exam trap

Health scores, Client 360, Device 360, issues and Path Trace all live in Assurance. A question describing a slow user and asking where to look first expects Assurance, not Provision or Design.

How Catalyst Center communicates

graph TB
  APPS["Scripts, ITSM, IPAM, Ansible"] -->|"Northbound: Intent API, REST and JSON"| CC["Catalyst Center"]
  CC -->|"Southbound: SSH CLI, SNMP, NETCONF"| DEV["Switches, routers, WLCs"]
  DEV -->|"syslog, SNMP traps, NetFlow, telemetry"| CC
  CC -->|"Events: webhooks, email, syslog"| EXT["External systems"]
Direction Interface
Northbound Intent API: REST with JSON over HTTPS. A client posts credentials to /dna/system/api/v1/auth/token, receives a token, and sends it in the X-Auth-Token header on later calls. Many write calls are asynchronous and return a task ID.
Southbound CLI over SSH, SNMP, and NETCONF for supported devices
Eastbound Event and notification services toward external systems
Westbound Integration with IT service management and IP address management systems

The API details belong to 6.0 Automation and AI (objectives 6.4 and 6.5), but you should know the direction words for 4.5.

Lab: walk the workflow in a sandbox

Catalyst Center needs a large appliance, so it is not practical in CML. Use the Cisco DevNet Sandbox catalog on developer.cisco.com and look for a Catalyst Center sandbox (an always-on read-only instance has historically been available). The credentials are shown on the sandbox page.

  1. Log in and open Design > Network Hierarchy. Record the areas, buildings and floors.
  2. Open Design > Network Settings. Note which servers (DHCP, DNS, NTP, syslog, SNMP, NetFlow collector) are set at Global and which are overridden at a site. Settings are inherited down the hierarchy.
  3. Open Design > Image Repository and identify the golden image for one switch family.
  4. Open Provision > Inventory. Pick a device and note its site, reachability, image and compliance status.
  5. Open Assurance > Health. Find the device with the lowest health score and open its Device 360. List the issues and the suggested actions.
  6. Open a client in Client 360 and read its onboarding timeline.
  7. Run a Path Trace between two hosts and note every hop and any ACL on the path.
  8. Optional, from a Linux host or the DevNet sandbox shell, call the Intent API:
$ curl -sk -X POST -u USER:PASSWORD https://SANDBOX-HOST/dna/system/api/v1/auth/token
{"Token":"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."}

$ curl -sk -H "X-Auth-Token: eyJhbGciOi..." \
       https://SANDBOX-HOST/dna/intent/api/v1/network-device
{"response":[{"hostname":"spine1.abc.inc","managementIpAddress":"10.10.20.80",
  "platformId":"C9300-24U","softwareVersion":"17.9.4a","reachabilityStatus":"Reachable", ...}],
 "version":"1.0"}

The hostnames and versions you see depend on the sandbox. The point is the pattern: get a token, then call an Intent API resource with the token in the header.

Expected outcome: you can say, for any task in the table at the top of this page, which menu area it lives in, and you have seen how Assurance turns telemetry into a health score with a suggested action.

Quick check

A network engineer wants every new switch in a branch to boot, download the standard image and receive a base configuration without anyone typing at the console. Which Catalyst Center feature does this?

Plug and Play (PnP) onboarding, using a Day 0 template and the golden image, with the device claimed to the branch site in Provision.

In which area do you mark an IOS XE release as the golden image?

Design, in the Image Repository. The upgrade itself is run from Provision (SWIM).

What health score range is shown as poor?

1 to 3. Fair is 4 to 7, and good is 8 to 10.

References