The solution is used for enterprise and NAC connectivity.
This kind of technology has the advantage of being very flexible to any size organization. It is a cornerstone as a part of the basic network infrastructure.
It can be used as a simple switch to connect your network devices with security features embedded - such as port security, for example. This allows companies to limit to a fixed address per port, avoiding external or malicious assets for accessing the network.
For example, if you have a retail business, and you have a lot of small stores spread nationwide, you just need to connect some cameras and sales points to the network. iOS security solutions allow you to have a secure LAN and you could add a secure WAN connection through your Internet provider with LTE links as backups. You can set up on-demand VPN connections from store to store for voice/video calls, or do inventory queries direct to the HQ database.
As a Cisco partner/reseller, security has been a concern for many years. Cisco has a security concept that begins right when you try to connect to the network. Security is a complete system and is not just put on security devices at the perimeter or between tiers inside a data center.
iOS on routers is a mature solution, allowing easy setup of a traditional ISAKMP V1 or V2 VPN, and a very mature proprietary VPN flavor called DMVPN. DMVPN allows on-demand VPN establishment with minimal setup configuration and creates a pseudo full mesh avoiding bottlenecks.
Cisco Technical Assistance Center works on a follow-the-sun concept and gives real 24x7 customer support, which is a great advantage when you have a service contract with them.
The best features include the Auto Secure script, port security, spanning-tree root and loop guard, 802.1x, DMVPN, GET VPN, SD-Access, and Secure SD-WAN.
The software offers plenty of security solutions that can work in the most sophisticated enterprise but also works well for small/mid-range enterprises.
A simple switch is able to run basic security as port security, limiting the MAC addresses allowed on a port, or by running a script you can set up ACL and some control plane policies to protect control and management planes and basic DoS protection.
The same software is able to work with sophisticated security options going from the basic 802.1x to MACSEC, NAC, and trustsec, and can be integrated with automation tools in order to do auto onboarding tasks (for wired devices), profiling, and more interesting security tasks.
It allows for easy traditional ISAKMP V1 or V2 VPN setups and has a very mature proprietary VPN flavor called DMVPN. DMVPN allows on-demand VPN establishment with minimal setup configuration involved and creates a pseudo full mesh (avoiding bottlenecks as a hub-spoke topology does). Dynamic VPN establishment allows spoke-to-spoke traffic flow on-demand, optimizing VoIP/SIP calls setting up direct tunnels among spokes, reducing latency compared with a hub/spoke topology.
Switch and router iOS can be automated and orchestrated with secure SD-WAN and SD-Access Cisco solutions. Having the iOS software is relevant for small and large enterprises; it works fine for all size networks.
There are the usual bugs that are inherent to some software upgrades. Sometimes this provides some unexpected issues, however, it happens with all brands all the time.
Some additional features could be improved. For example, the licensing for DNA environments could be better. In some countries, the end-user does not want to go to orchestration/automation environments. They just want to have a small network for their small budget and they never will go to these environments. They consider it unfair that they have to pay for a license/subscription that will never be used.
I've used the solution for ten or more years.
The product is very scalable.
Technical support is great.
My customers have used other brands that just gave connectivity and did not offer security over LAN switches. The VPN scheme was limited to site-to-site over hub-and-spoke topologies.
The initial setup is straightforward.
We are the vendor team that handles implementations.
Cisco is not a cost-effective brand, however, in the end, you get what you pay for. Regarding licensing, some customers will not use automation/orchestration environments and do not like to pay a subscription for something they will never use.