Building Hybrid Clouds with CSR 1000v
Steven Carter, Solutions Architect
Chris Hocker, Consulting Systems Engineer
BRKARC-2023
• CSR Deployment in AWS
• On-Prem Deployment Options in VMware & OpenStack
• Building Scalable Overlay Networks
• Deploying CSR Features
Agenda
CSR Deployment in AWS
Virtualized IOS XE
• Generalized to work on any x86 system
• Hardware specifics abstracted through a virtualization layer
• Forwarding (ESP) and Control (RP) mapped to vCPUs
• Bootflash: NVRAM: are mapped into memory from hard dis
• No dedicated crypto engine – we leverage the Intel AES-NI instruction set to provide hardware crypto assist.
CSR 1000V Architecture – Virtualized ASR 1001
Forwarding Plane (FP)
vNICvCPU vMemory vDisk
Physical Hardware
CPU Memory Disk NIC
Hypervisor (VMware / Citrix / KVM)
Forwarding Mgr.
FFP Client / Driver
FFP code
Control Plane
Chassis Mgr.
Forwarding Mgr.
IOS
Linux Container
• Runs as a process under the Guest Linux Kernel
• IOS timing is governed by Linux Kernel scheduling
• Provides virtualized management ports
• Since these are managed by their respective software processes
• No direct hardware component access!
• Communicates with other software processes via IPC
• Runs Control plane features
• CLI and configuration processing
• SNMP handling, routing protocols, session mgmt.
CSR 1000V Architecture - IOSdControl PlaneForwarding Plane
vNICvCPU vMemory vDisk
Physical Hardware
CPU Memory Disk NIC
Hypervisor (VMware / Citrix / KVM)
Chassis Mgr.
Forwarding Mgr.Chassis Mgr.
Forwarding Mgr.
FFP Client / Driver
FFP code
IOS
Q: Where can I find the CSR on AWS?A: In the AWS marketplace!
1. Search for “Cisco”
2. Pick a flavor
CSR 1000V Licensing for AWS
AWS Marketplace Billing
• Provision hourly billed CSR instances from AWS Marketplace
• Pay AWS for basic instance-type usage AND fees for CSR usage
• AWS pays Cisco for CSR usage fees they collect. You pay Cisco nothing directly.
• No license file to manage or install
Bring Your Own License “BYOL”
• Provision “BYOL” CSR instances from AWS Marketplace
• Only pay AWS for basic instance-type fees
• Purchase desired license from Cisco or Cisco Partner
• Install purchased license onto “BYOL” version of CSR you provisioned from the AWS Marketplace
Two Options…
CSR 1000V Licensing Structure
Technology Package(See next slide for details)
Throughput License Type
Pick one option from each column…
Example:
IP Base
250 Mbps
1-Year
IP Base10 Mbps
50 Mbps
100 Mbps
250 Mbps
500 Mbps
1 Gbps
2.5 Gbps
5 Gbps
Perpetual
Subscription
(1-year or 3-year)
Usage
(target date Q1 CY15)10 Gbps
SEC
AppX
AX
* CSR add-on license options not shown above
CSR 1000V Features Per Technology Package
Technology
PackageIOS-XE Features
IPBase(formerly Standard)
Basic Networking: BGP, OSPF, EIGRP, RIP, ISIS, IPv6, GRE, VRF-LITE, NTP, QoS
Multicast: IGMP, PIM
High Availability: HSRP, VRRP, GLBP
Addressing: 802.1Q VLAN, EVC, NAT, DHCP, DNS
Basic Security: ACL, AAA, RADIUS, TACACS+
Management: IOS-XE CLI, SSH, Flexible NetFlow, SNMP, EEM, NETCONF
SEC(formerly Advanced)
IPBase Plus…
Advanced Security: Zone Based Firewall, IPSec VPN, EZVPN, DMVPN, FlexVPN,
SSLVPN, GETVPN
AppX
IPBase Plus…
Advanced Networking: L2TPv3, BFD, MPLS, VRF, VXLAN
Application Experience: WCCPv2, AppXNAV, NBAR2, AVC, IP SLA
Hybrid Cloud Connectivity: LISP, OTV, VPLS, EoMPLS
AX(formerly Premium)
ALL FEATURES
Features in Red will not work in Amazon – infrastructure issues (lack of L2 support, Multicast not supported)
What are all the different CSR 1000V types listed? 1. Cloud Services Router 1000V BYOL
• Can be any tech package and throughput level depending on license purchased from Cisco and installed on CSR (not all throughputs supported)
2. Cloud Services Router 1000V Security Tech Package
• Includes features from the Security technology package. Performance based on AWS instance type selected (more or less vCPU/vMemory)
3. Cloud Services Router 1000V AX Tech Package
• Includes features from the AX technology package. Performance based on AWS instance type selected (more or less vCPU/vMemory)
4. “Maximum Performance” versions of the above three
• Enables SR-IOV enhanced networking for higher performance
5. CSR Direct Connect 1 Gig and Multi-Gig
• Instances used for securing AWS Direct Connect circuits
Available in Azure Marketplace (End of June):
http://azure.microsoft.com/en-us/marketplace/
Search for “Cisco”
CSR 1000V product page will contain pricing, support, and deployment information
CSR 1000V in Microsoft Azure
CSR with InterCloud Fabric
VM VM Trunk
InterCloudExtender
InterCloudSwitch VM VM
VM VM
Secure L2 Extension
On-Prem AWS
VLAN A
VLAN B
VLAN A
VLAN B
InterCloud
CSR
VM VM
Cisco ASAv Firewall and Management Features
Cisco® ASA Feature Set
Cisco
ASAv
in AWS
Removed clustering and
multiple-context mode
VLAN tagging
Virtualization displaces multiple-context and clustering
Parity with all other Cisco ASA platform features
Traditional (Cisco ASDM and CSM) management tools
Dynamic routing includes OSPF, EIGRP, and BGP
IPv6 inspection support, NAT66, and NAT46/NAT64
REST API for programmed configuration and monitoring
Cisco TrustSec® PEP with SGT-based ACLs
Zone-based firewall, Equal-Cost Multipath
Policy Based Routing, VxLAN Support (VTEP)
Failover Active/Standby HA model
Subset of ASAv features are
not supported in AWS
VPC 101
• Logically isolated network with its own IP range, routes, security, etc.
• IP ranges can be overlapping
• Internet gateway routes outside and between VPCs
• Public IP or NAT for egress
• VPC peering needed to route between VPCs
• Security:
• Network ACLs at the border of VPC
• Security Groups within the VPC
• Subnet “router” routes within the VPC
• Subnet “router” is really an encap/decap device b/w hypervisors
Maps to AWS Elastic IP
Internet IP 54.x.x.x
CSR placement in the AWS network
• NAT at the Internet GW
• Will break services that do not work over NAT, such as GET-VPN
• Tunnel source will be a private address
• Tunnel destination from the perspective of VPN peers will be a public address
• Assign EC2 elastic IP address so that address does not change if the CSR1K is shutdown
• Other VPCs see Elastic IP address unless using VPC peering
• CSR should be the default gateway for the application VMs
10.1.1.10
10.1.1.11
10.1.2.10
Gi2 Gi1
Maps to AWS Elastic IP
Internet IP 54.x.x.x
10.2.1.10
10.2.1.11
10.2.2.10
Gi2 Gi1
No Link Local Broadcast in the VPC
• No Link local multicast or broadcast
• Affected Services Include:
• IGPs
• HSRP/VRRP
• BFD
• Proxy ARP, Gratuitous ARP > LISP-VM Mobility
• GRE as work-around for some services
• FHRP difficult b/c of AWS Routing
10.1.1.12
10.1.1.11
10.1.1.10NAT
10.1.1.10 54.x.x.x
Multiple Ways to Insert CSR as Gateway
• Two Armed Mode
• CSR has one interface in each network
• Instances have default gateway changed to point to CSR IP or change AWS Route Table default route
• Limitation on # of interfaces for CSR imposed by AWS
• One Armed Mode
• CSR has single interface and a default gateway pointed towards AWS Internet Gateway
• Other subnets have route added to their route table, pointing to the CSR as gateway
• Instances in other subnets don’t need their default gateway manually changed. Continue to use AWS Route Table.
172.24.2.0/24
172.24.2.0/25 172.24.2.128/25
g1 g2
AWS IGW
172.24.2.0/24
g1AWS IGW VPC
Router
Management and Front Door VRF
• Management and remote access of the CSR will happens over a public interface (i.e. Floating IP)
• No interactive console on AWS
• Cisco VPN designs recommend front-door VRF
• Simplifies routing: send a default route over the tunnel
• Improves security: isolating the LAN from the public internet
• Configuring VRF causes loss of connectivity
• EEM script used to work around.
• Internet access required for other AWS services (e.g. S3)
• Can not use front-door VRFs in these scenarios
CSR Advantages over…
• Scalability
• Continuity of Operations
• Spoke-to-spoke routing
• Richer routing features
• Security/Application Visibility
Virtual Private Gateway: VPC Peering:
• Overlapping CIDR blocks
• Peering between regions
• Transitive peering relationships
• Multiple peerings per VPC
• Unicast Reverse Path Forwarding
• Spoke-to-spoke routing
Multi-Site, Full Mesh Hybrid Cloud
Full Tunnel Mesh
East Coast RegionWest Coast Region
Corporate Network
On-Prem Anchored Overlay:
• Traditional physical enterprise with good connectivity at HQ
• Redundant DM-VPN at HQ
• Extends enterprise network to other sites, field offices, teleworkers,
and public clouds
Cloud Anchored Overlay:
• Traditional physical enterprise with less-good connectivity or wanting geographic redundancy
• Virtual-only enterprise with Cloud-based DC
• Redundant DM-VPN in Cloud
• Extends enterprise to other sites, field offices, teleworkers, and public clouds
Overlay Options
AWS
West
AWS
East
HQ
Home Branch
Head-End
AWS
WestAWS
East
HQ
Home Branch
Head-End
East
Head-End
West
On-Prem Deployment Options in VMware &
OpenStack
On-Prem Termination
Hardware vs. Virtual
• Hardware: Performance, Determinism
• Virtual: Flexibility
Places in the Network
• Border for Entire Organization
• Hardware: ASR/ISR
• Data Center for Individual Tenants:
• Software: CSR
Data Center
Campus
Border
CSR 1000V
ASR
1000/ISR
4400
CSR 1000V
Tenant Gateway
Hypervisor Hypervisor
Tenant VLANs
CSR in Private Cloud
• Tenant Router, Head-End, or NFV
• Supported on Multiple Hypervisors
• Managed by tenant or network team
• Manual or orchestrated deployment
• Dedicated hosts or distributed with tenant workloads
CSR Images for On-Prem Deployment
• Deploy as OVA
• Chose performance
Virtual Interfaces = Router Interfaces
Deployment in VMware
g0 g1
g2
Deployment in OpenStack
CSR1kv
Routing-aaSservice plugin
CfgAgent
…
Notifications
Hosting devices
Neutron server
Some server
Compute server
Driver specific
communication
Firewall-aaSservice plugin
VPN-aaSservice plugin
Hosting Device
ManagerPlugging Driver
Scheduler
What is supported today – April 2015.
Openstack “I” Release “J” release “K” release
CSR as Tenant VM Supported
Routing-aaSCSR as replacement of Neutron router
- Merged
VPN-aaSCSR for site-to-site IPsec VPN
CSR out of band bring up Merged
FW-aaS pluginCSR as FW enabled by ACLs
- - Merged
Building Scalable Overlay Networks
Enterprise VPN Termination into AWS
• Connect one or many physical locations into an Amazon VPC. IPSec, DMVPN, FlexVPN, EZVPN, etc…
• Up to 1,000 concurrent VPN tunnels per CSR, and no per-tunnel charges from Amazon.
• Familiar configuration, familiar troubleshooting, not a black box.
virtual private cloud
AWS cloud corporate office/branch
Corporate Data Center
Internet
Back-End Corporate Access
Corporate Users
Site to Site VPN connection
(Data & management)
Private
Public
Subnet 1Subnet 1
Internet Users
Corporate Data Center
Internet
Remote Access and Site-to-Site VPN to AWS
Internet Users
connecting via
VPN (ikev2 and
IPSec/L2TP)
Corporate Users
Site to Site VPN connection
(Data & management)
Private
Public
Subnet 1Subnet 1
Interconnecting AWS VPCs Using the CSR 1000V
• Easily integrate multiple AWS regions into existing VPN topology as new sites
• Can be leveraged for hierarchical designs with in regions.
• Distribute applications across the globe, and keep the network simple
virtual private cloud
AWS cloud
US west region
virtual private cloud
US east region
DMVPN Design Model 1Full Tunnel for AWS Application VMs
• DMVPN sites have access to AWS-hosted applications through IPSec tunnels to CSR
• Uses front-door VRF for VPN termination
• AWS application VMs run in the global routing table
• AWS application VMs do not have local internet access or local access to AWS public services*
• Requires EEM Script
G1 G2
AWS IGW
DMVPN
Tun0
Default
Route
Default
G1 – VRF INET
G2, Tun0 - Global
*New feature called VPC endpoints for S3 service
Embedded Event Manager
• Provides real-time network event detection and onboard automation.
• Adapt the behavior of your network devices to network conditions
• More than 20 event detectors
• Simple applets and more complex scripts
Create the Cisco EEM Applet:event manager applet fvrf
event none
action 1.0 cli command "enable”
action 1.1 cli command "conf t”
action 1.2 cli command "interface gig1”
action 1.3 cli command "vrf forwarding
internet-vrf”
action 1.4 cli command "ip address dhcp”
action 2.0 cli command "end”
Run the Cisco EEM Applet:event manager run fvrf
DMVPN Design Model 2Direct Internet Access for AWS Application VMs
• DMVPN sites have direct access to AWS-hosted applications
• VPN and AWS application VMs run in global routing table
• Leverage NAT overload to the Elastic IP address
• AWS application VMs have local internet access and local access to AWS public services
G1 G2
AWS IGW
DMVPN
Tun0
Specific
Routes
Default
G1, G2, Tun0 - Global
CSR VPN High Availability
• No virtual IP as with HSRP, since AWS doesn’t allow multicast
• AWS Route Tables for app subnets are re-pointed to opposite CSR
• Failure detection is automatic
• CSR itself calls AWS API to adjust AWS Route Table routes
VPC
CSR Subnet
App Subnet A
App Subnet B
Before HA Failover
After HA FailoverAWS REST API
CSR VPN HA ConfigurationCreate IAM ChangeRouteRole
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:AssociateRouteTable",
"ec2:CreateRoute",
"ec2:CreateRouteTable",
"ec2:DeleteRoute",
"ec2:DeleteRouteTable",
"ec2:DescribeRouteTables",
"ec2:DescribeVpcs",
"ec2:ReplaceRoute",
"ec2:DisassociateRouteTable",
"ec2:ReplaceRouteTableAssociation"
],
"Resource": "*"
}
] }
CSR VPN HA ConfigurationDeploy CSR and Assign IAM Role
interface Tunnel1
ip address 172.16.1.1 255.255.255.252
bfd interval 500 min_rx 500 multiplier 3
tunnel source GigabitEthernet1
tunnel destination 54.200.190.64
!
router eigrp 1
bfd interface Tunnel1
network 172.16.0.0
passive-interface GigabitEthernet1
CSR VPN HA ConfigurationConfigure GRE Tunnel, BFD, and EIGRP
VPC
CSR Subnet
App Subnet A
App Subnet B
Tunnel1
event manager environment CIDR 0.0.0.0/0
event manager environment ENI eni-d679128f
event manager environment RTB rtb-631bda06
event manager environment REGION us-west-2/172.24.1.2
event manager applet replace-route2
event syslog pattern "\(Tunnel1\) is down: BFD peer down notified"
action 1.0 publish-event sub-system 55 type 55 arg1 "$RTB" arg2 "$CIDR" arg3 "$ENI" arg4 "$REGION"
CSR VPN HA ConfigurationConfigure EEM
Direct Connect With CSR 1000V
• Remove existing BGP configuration from customer router
• Create new BGP neighbor relationship between tunnel interface addresses (to ensure routes are learned via tunnel)
• Advertise prefixes from campus/data center and AWS VPC
Virtual Private Cloud
172.16.0.0/16
Virtual Private
Gateway (VGW)
10.10.10.2/30
Customer
Router
(Cisco
ISR/ASR)
Direct Connect
CircuitVLAN
Sub-Interface:
Gig1.100
10.10.10.1/30
Corporate HQ
172.17.1.0/24
CSR 1000V
IP:172.16.1.10
EIP:54.1.2.3
IPSec Tunnel
Interface Tunnel 1
IP: 169.254.1.1
Destination: 54.1.2.3
Interface Tunnel 1
IP: 169.254.1.2
Destination: 10.10.10.1
BGP Advertisements:
172.17.1.0/24
BGP Advertisements:
172.16.0.0/16
BGP
Deploying CSR Features
Firewall and Application Visibility in the AWS Cloud
• Stateful firewall between AWS regions and physical locations
• Familiar Zone-Based Firewall configuration
• Application Visibility and Control (AVC)
• Uses NBAR2 to identify over 1,000 different applications
• Monitor and control application usage
• Track packet loss, latency, jitter, and response time of your cloud.
virtual private cloud
AWS cloud corporate office/branch
Flexible NetFlow Records
Internet Users
Internet
Edge Router and Firewall
Internet users accessing AWS
resources using translated IPs
Private
Public
Subnet 1Subnet 1
Zone Based Firewall Configuration Example (1/2)class-map type inspect match-any tunnel-
inside
match protocol icmp
match protocol http
match protocol https
match protocol ssh
match access-group name tunnel-inside
ip access-list extended tunnel-inside
permit tcp any host 172.24.2.200 eq 3389
policy-map type inspect tunnel-inside
class type inspect tunnel-inside
inspect
class class-default
drop log
Inside
g1 g2
Outside
Tunnel
Zone Based Firewall Configuration Example (2/2)zone security outside
zone security inside
zone security tunnel
zone-pair security tunnel-inside source
tunnel destination inside
service-policy type inspect tunnel-inside
interface Tunnel0
zone-member security tunnel
interface GigabitEthernet1
zone-member security outside
interface GigabitEthernet2
zone-member security inside
Inside
g1 g2
Outside
Tunnel
NAT
interface GigabitEthernet1
ip nat outside
interface GigabitEthernet2
ip nat inside
ip nat inside source list nat interface GigabitEthernet1 overload
ip nat inside source static tcp 172.24.2.200 80 172.24.2.17 80 extendable
ip access-list standard nat
permit 172.24.2.128 0.0.1.255
Floating IP:
55.128.99.23
172.24.2.0/25 172.24.2.128/25
g1 g2
Needs to be the Internal Address
Enterprise-Wide Application Visibility
• Uses Netflow and IP SLA
• GUI for application visibility
• IP SLA configuration and monitoring
• Extends application visibility to your cloud border
Enterprise-Wide Security Visibility
• Uses Netflow
• GUI for security visibility
• Extends application visibility to your cloud:
• Detecting Sophisticated and Persistent Threats
• Identifying BotNet Command & Control Activity
• Uncovering Network Reconnaissance
• Finding Internally Spread Malware
• Revealing Data Loss
StealthWatch FlowCollector
StealthWatch Management
Console
NetFlow
https
IP SLA
• Actively monitor and measure performance
• Includes data about response time, one-way latency, jitter, packet loss, voice-quality scoring, network resource availability, application performance, and server response time
• Performance data can be used in routing decisions and EEM
• Detect Partner Failover
ip sla 1
icmp-echo 172.24.0.5 source-ip 172.24.0.4
tag DMVPN_SLA
ip sla 2
icmp-echo 172.24.0.1 source-ip 172.24.0.4
tag DMVPN_SLA
ip sla group schedule 1 1-3 schedule-
period 60 frequency 60 start-time now life
forever
ip sla responder
Remote Worker VPN Access into AWS
• IPSec and SSLVPN access via AnyConnect for teleworkers and remote users
• AAA server options for user database
• Easily host copies of your apps in regions close to your remote users
• No similar service offered natively by AWS
virtual private cloud
AWS cloud
SSL VPN Configuration Example (1/3)
• A self-signed certificated is generated by default when the CSR is launched.
• Can generate a new self-signed certificate or provision a certificate from an Enterprise CA
Create a Server Certificate
crypto key generate rsa label sslvpn-key
modulus 2048
!
crypto pki trustpoint sslvpn-self-signed
enrollment selfsigned
subject-name cn=csr-aws-sslvpn
revocation-check none
rsakeypair sslvpn-key
!
crypto pki enroll sslvpn-self-signed
virtual private
cloudAWS cloud
SSL VPN Configuration Example (2/3)
• User database can be on AAA server or defined locally
Configure User Database and Address Pool
aaa new-model
aaa authentication login sslvpn local
aaa authorization exec default local
aaa authorization network sslvpn local
!
username chocker privilege 15 secret 5
$1$VHFK$5jHUYC/Sy.0yCaexJs6xo1
!
ip local pool pool1 10.10.10.50
10.10.10.100
virtual private
cloudAWS cloud
SSL VPN Configuration Example (3/3)
crypto ssl proposal proposal1
protection rsa-aes128-sha1
!
crypto ssl authorization policy auth-
policy1
netmask 255.255.255.0
pool pool1
!
crypto ssl policy policy1
ssl proposal proposal1
pki trustpoint sslvpn-self-signed sign
ip interface GigabitEthernet1 port 443
!
Configure Crypto
crypto ssl profile profile1
match policy policy1
aaa authentication list sslvpn
aaa authorization group list sslvpn auth-
policy1
authentication remote user-credentials
!
crypto vpn anyconnect
bootflash:/webvpn/anyconnect-macosx-i386-
3.1.05187-k9.pkg sequence 1
CSR REST API REST is Representational State Transfer
Based on HTTP. Client-Server model. Stateless.
Identify resources through URIs - /api/v1/global/ntp/servers
Request & Response type: JSON (Javascript Object Notation)
Common Methods: PUT, POST, GET, DELETE
PUT /api/v1/global/host-name
Content-Type: application/json
Accept: application/json
{
“host-name”: “eng-router”
}
200 Ok
Content-Type: application/json
{
“host-name”: “eng-router”
}
GET /license/UDI
Accept: application/json
200 Ok
Content-Type: application/json
{
“link: “/license/UDI”,
“UDI”: “ACRPSJAE9486R”
}
http://www.cisco.com/c/en/us/td/docs/routers/csr1000/softw
are/restapi/restapi/RESTAPIintro.html
Summary
Cisco CSR 1000v Summary
• Extends enterprise network to public cloud
• Normalize operations across multiple public clouds
• Hybrid cloud designs using CSR in the public cloud and ASR1K/ISR/CSR1K on-premise
• Primary use case - secure connectivity using IPSec, DMVPN, SSL VPN, etc.
• Enterprise-class networking services including Routing, FW, and NAT
• Rich telemetry for security and performance monitoring with Netflow/AVC
• Used with AWS Direct Connect for encryption and overlay routing
• HSRP-like High Availability for AWS VPCs
CSR 1000v in AWS Design Guide
http://www.cisco.com/c/en/us/td
/docs/solutions/Hybrid_Cloud/In
tercloud/CSR/AWS/CSRAWS.p
df
Evaluation Licenses• Only BYOL instances need an evaluation license, since non-BYOL instances
are pre-licensed as part of the hourly cost.
• By default BYOL instances boot with all features and 100 Kbps throughput.
• 60-day evaluation licenses are self-serve at:• http://www.cisco.com/go/license
• Router# show license udi
Resources
• AWS VPC Presentations• https://www.youtube.com/user/AmazonWebServices/search?query=VPC
• CSR in AWS CVD• http://www.cisco.com/c/en/us/td/docs/solutions/Hybrid_Cloud/Intercloud/CSR/AWS/CSRAWS.pdf
• CSR in AWS Support Forum• https://supportforums.cisco.com/community/csr-amazon
• CSR in AWS Test Drive• https://csrtestdrive.com/
• CSR in AWS Marketplace• https://aws.amazon.com/marketplace/seller-profile?id=e201de70-32a9-47fe-8746-09fa08dd334f
• Evalulation Licenses
Thank you
Participate in the “My Favorite Speaker” Contest
• Promote your favorite speaker through Twitter and you could win $200 of Cisco Press products (@CiscoPress)
• Send a tweet and include
• Your favorite speaker’s Twitter handle @ciscocloudguy
• Two hashtags: #CLUS #MyFavoriteSpeaker
• You can submit an entry for more than one of your “favorite” speakers
• Don’t forget to follow @CiscoLive and @CiscoPress
• View the official rules at http://bit.ly/CLUSwin
Promote Your Favorite Speaker and You Could be a Winner
Complete Your Online Session Evaluation
Don’t forget: Cisco Live sessions will be available for viewing on-demand after the event at CiscoLive.com/Online
• Give us your feedback to be entered into a Daily Survey Drawing. A daily winner will receive a $750 Amazon gift card.
• Complete your session surveys though the Cisco Live mobile app or your computer on Cisco Live Connect.
Continue Your Education
• Demos in the Cisco campus
• Walk-in Self-Paced Labs
• Table Topics
• Meet the Engineer 1:1 meetings
• Related sessions