I led the migration of a multi-campus enterprise network, built on Cisco Catalyst 9300 access and 9500 core switches, from box-by-box CLI management to centralized management under Cisco Catalyst Center (the platform formerly known as DNA Center). The wireless side ran on a pair of Catalyst 9800 controllers in high availability. This post is about what actually changed for the operations team, because that is the part vendor slides consistently undersell or oversell.

From per-device configs to managed intent

Before the migration, every switch was a hand-maintained artifact. Same intent, slightly different implementation on every box, and drift accumulating with every emergency change.

After migration, device configuration is generated and deployed from Catalyst Center. Standard settings (AAA, DNS, NTP, syslog, SNMP) are defined once per site in the design hierarchy, and everything device-specific flows through provisioning and configuration templates: parameterized Jinja2-style templates in Catalyst Center’s template system, bound to device roles and sites. A new access switch gets racked, discovered or onboarded through plug and play, assigned to its site, and receives the same configuration every one of its peers received.

Two operational consequences matter more than the automation itself. Consistency became structural rather than aspirational, since deviation now requires effort instead of being the default. And changes became reviewable: modify the template, preview the diff, push during the window, with the same result everywhere.

Assurance: the actual killer feature

The strongest reason to run Catalyst Center is Assurance. Every managed device streams telemetry to the controller, and the 9800 wireless controllers stream detailed client-level data. The platform continuously computes health scores for devices, clients, and applications.

Suddenly the team could see things that used to be invisible or reconstructable only after the fact:

  • Client onboarding health, broken into the phases where wireless problems actually live: association, authentication, and IP addressing. Excessive DHCP times and DHCP failures show up as named issues, not as mystery complaints.
  • Per-client performance on both wired and wireless: RSSI and SNR, retries, roaming behavior, throughput.
  • Network-wide patterns, like an authentication server that has started answering slowly for one building, or a spike in onboarding failures on one floor after a change.

The operational shift is from reactive to proactive. Service degradation becomes visible while it is still degradation, and the team can act on it before it matures into an outage and a ticket queue. Service-desk volume on network categories dropped noticeably after the migration, not because problems vanished, but because a meaningful share got fixed before users felt them or had answers waiting when they called.

Troubleshooting with data instead of anecdotes

The other half of the win is time to resolution. A user complaint used to start a scavenger hunt across the WLC GUI, switch CLIs, DHCP server logs, and RADIUS logs. Now the client’s timeline in Assurance already shows its journey: where it associated, how the authentication went, how long DHCP took, what its signal looked like, whether it roamed, and what issues the platform detected along the way. Catalyst Center pairs detected issues with suggested remediation actions and can run guided diagnostics, which is genuinely useful triage, and the timeline data alone routinely turns a forty-minute investigation into a five-minute confirmation.

My honest read after living with it: the assurance data is the product. Automation saves engineering hours, but telemetry changes outcomes for users. If you are building the business case for a migration like this, weigh the visibility, and treat the ticket-deflection effect as real budgetable value.

Lessons for anyone planning the same move

  • Clean up drift before you migrate. Templates standardize whatever you feed them, so audit and normalize the existing configs first, or you will encode today’s inconsistencies as tomorrow’s standard.
  • Migrate in waves by site and building, with unmigrated switches running untouched next to managed ones. Big-bang campus cutovers are how résumés get updated.
  • Put real effort into template and site-design structure early. It is your new source of truth, and sloppy hierarchy design haunts every later change.
  • Budget time for the team to learn the assurance workflows. The data only shortens incidents when reaching for it is muscle memory, so make the dashboard the first tab, not the last resort.

The endpoint fleet, the templates, and the telemetry all keep evolving, but the core trade held: we exchanged artisanal per-device configuration for managed intent plus visibility, and the network got easier to run every month after.