Architecture · Topic 4 of 5
Cisco SD-Access Fabric
Learn how Cisco SD-Access builds a campus fabric with a LISP control plane and VXLAN data plane, what fabric nodes do, and campus interworking.
- 5 min
- Includes a diagram
- SD-Access uses LISP for the control plane and VXLAN for the data plane.
- Catalyst Center is the controller, and ISE provides identity and policy.
- The edge node connects endpoints. The control plane node tracks endpoint locations.
What it is
Cisco SD-Access is a campus fabric that adds automation, segmentation and policy to a routed underlay.
It is managed from Cisco Catalyst Center, which was formerly called Cisco DNA Center. Cisco Identity Services Engine (ISE) supplies identity and policy. The goal is that a user gets the same network access and policy wherever they plug in.
How it works
SD-Access has an underlay, an overlay and a policy layer on top.
Underlay and overlay
The underlay is a routed network that connects the fabric switches. It is usually built with Layer 3 links and an IGP, and Catalyst Center can automate it. Every device needs only simple IP reachability to the others.
The overlay carries the user traffic. It uses two technologies.
- Control plane: LISP. Endpoints are registered by identity and location in a database, and devices ask it where to send traffic.
- Data plane: VXLAN. User packets are encapsulated in VXLAN between fabric nodes. The VXLAN header can also carry a Scalable Group Tag (SGT) for policy.
Fabric roles
| Role | What it does |
|---|---|
| Fabric edge node | Connects endpoints and registers them with the control plane node |
| Control plane node | Holds the database of endpoint locations, working as a LISP map server and resolver |
| Border node | Connects the fabric to the outside, such as the WAN, data centre or traditional campus |
| Intermediate node | A plain Layer 3 device in the underlay that links the other nodes |
| Fabric wireless controller | Joins wireless access points and clients into the fabric |
A single device can hold more than one role in a small deployment. The control plane node is critical, so you normally run two for redundancy.
Segmentation
SD-Access has two levels of segmentation.
- Macro segmentation uses virtual networks (VNs). A VN is a VRF in the fabric, so different VNs cannot reach each other unless you allow it.
- Micro segmentation uses scalable groups. Policy between groups is written as a rule such as group A may talk to group B, and the SGT in the VXLAN header makes this possible.
The fabric also provides an anycast gateway. Every edge node answers for the same default gateway address of a subnet, so a host can move between edges without changing its gateway.
Traditional campus interoperating with SD-Access
Few networks switch to a fabric in one step. Most run a traditional campus and a fabric side by side during migration.
The border node is the connection point. It translates between the fabric and the outside world. On the outside it speaks normal routing, so a traditional campus sees it as a router.
A few methods help with a gradual move.
- Use a Layer 3 handoff from the border node to the traditional network, one VRF at a time.
- Use a Layer 2 handoff, also called a Layer 2 border, so that a VLAN is stretched between the fabric and the old network while hosts move. This is intended as a temporary step.
- Keep the old campus unchanged and migrate one building at a time, since both parts use standard IP routing at the border.
Group tags do not cross a traditional network on their own. Policy at the outside may need another mechanism, such as inline tagging on supported links or SXP, which carries the mapping of addresses to tags. SXP is covered with TrustSec in the Security chapter.
What Catalyst Center adds
Catalyst Center provides design, policy, provisioning and assurance for the fabric. Its LAN automation feature can configure the underlay on new switches. You work with intent such as a VN and a group policy, and the controller creates the device configuration.
What to remember for the exam
Eight facts cover most questions on this topic.
- SD-Access uses LISP for the control plane and VXLAN for the data plane.
- Catalyst Center is the controller, and ISE provides identity and policy.
- The edge node connects endpoints. The control plane node tracks endpoint locations.
- The border node connects the fabric to the outside world.
- A virtual network is macro segmentation. A scalable group is micro segmentation.
- The anycast gateway gives every edge the same gateway for a subnet.
- A traditional campus connects through the border node with Layer 3 or Layer 2 handoff.
- The underlay is a routed network that needs only IP reachability.
Think of the control plane node as the phone book. Edges register endpoints in it and ask it where a destination is.
Common mistakes
These four mistakes appear often.
Calling the underlay the overlay. The underlay is the routed transport. The overlay is the VXLAN and LISP layer on top.
Confusing roles with devices. The roles are separate, even when one small device performs several of them.
Treating a Layer 2 handoff as the final design. It is a migration aid, and it has the risks of a stretched VLAN.
Forgetting that tags need support outside the fabric. A traditional campus does not understand the SGT unless something carries it.
Do not confuse SD-Access with SD-WAN. SD-Access is a campus fabric, and SD-WAN connects sites across a wide area.
Check yourself
Work through these three questions.
Which protocols does SD-Access use for the control plane and the data plane?
LISP is used for the control plane, and VXLAN is used for the data plane.
Which node connects the fabric to a traditional campus?
The border node connects the fabric to the outside, including a traditional campus.
What is the difference between macro and micro segmentation in SD-Access?
Macro segmentation uses virtual networks, which are VRFs, while micro segmentation uses scalable groups.
Topic 4 of 5 in Architecture
Test yourself on Architecture
The full Cisco CCNP 350-401 ENCOR question bank has 854 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.