Skip to content
Log in Sign up My account

1.3 Cisco SD-Access

Blueprint 1.3: Explain the working principles of the Cisco SD-Access solution

  • 1.3.a SD-Access control and data planes elements
  • 1.3.b Traditional campus interoperating with SD-Access

The idea in one paragraph

SD-Access builds a campus fabric managed by Catalyst Center (formerly DNA Center) with identity from ISE. A routed underlay gives every switch IP reachability to every other switch's loopback. An overlay of VXLAN tunnels carries user traffic between switches, so any user's subnet can be available on any switch without stretching VLANs or running spanning tree across the campus. Policy follows the user's identity (a Scalable Group Tag), not their IP address.

The three planes

Plane Protocol What it does
Control plane LISP A mapping database: which endpoint (EID) sits behind which fabric switch (RLOC)
Data plane VXLAN (VXLAN-GPO) Encapsulates the original frame and carries the VN (VRF) and the SGT in the header
Policy plane Cisco TrustSec SGTs classify traffic; SGACLs enforce group-to-group policy
Management Catalyst Center + ISE Automation, assurance, identity and policy definition

Must memorise

LISP = control plane. VXLAN = data plane. TrustSec (SGT) = policy plane. Catalyst Center = management. IS-IS is the routing protocol LAN Automation builds for the underlay.

Fabric roles

graph TB
  CP[Control plane node<br/>LISP map server / resolver]
  B[Border node<br/>exit to outside networks]
  E1[Edge node<br/>endpoints attach here]
  E2[Edge node]
  I[Intermediate node<br/>underlay only]
  WLC[Fabric WLC]
  F[Fusion router / firewall<br/>shared services]
  E1 --- I --- B
  E2 --- I
  CP -.- E1 & E2 & B
  B --- F
  WLC -.- CP
Role Job
Control plane node LISP Map-Server and Map-Resolver. Holds the host tracking database of EID-to-RLOC mappings. Edges register their endpoints here and query it to find destinations.
Edge node Access switch where endpoints connect. Authenticates them (802.1X/MAB), assigns VN and SGT, registers them with the control plane, encapsulates and decapsulates VXLAN. Acts as the anycast default gateway, the same gateway IP and MAC on every edge.
Border node Connects the fabric to everything outside it. Internal border: known internal networks (data centre, shared services). External border: default route, internet. Anywhere border: both.
Intermediate node Underlay-only routers or switches between edges and borders. Just routes IP; not aware of the fabric.
Fabric WLC Wireless controller integrated into the fabric; APs tunnel VXLAN to the edge, so wireless and wired share the same policy.
Extended node Small switches (industrial or compact) that extend the fabric to places an edge can't go, connected to an edge by a trunk.

How a packet crosses the fabric

  1. Host A connects to Edge 1. Edge 1 authenticates it, places it in a VN and assigns SGT 10.
  2. Edge 1 registers Host A's EID (IP and MAC) with the control plane node, mapped to Edge 1's loopback (RLOC).
  3. Host A sends to Host B. Edge 1 queries the control plane node (LISP Map-Request) for Host B.
  4. The control plane replies: Host B is behind Edge 2's RLOC.
  5. Edge 1 encapsulates the frame in VXLAN, carrying the VN ID and SGT, and routes it across the underlay to Edge 2.
  6. Edge 2 decapsulates, checks the SGACL (SGT 10 to Host B's SGT), and delivers or drops.

If the control plane has no entry (the destination is outside the fabric), the edge sends traffic to the border node by default.

Underlay and overlay

Underlay Overlay
Purpose Loopback-to-loopback reachability between fabric nodes User traffic, segmented by VN
Built by LAN Automation (IS-IS) or manually (any IGP) Catalyst Center
Design Routed access, point-to-point L3 links, no STP, ECMP VXLAN tunnels, LISP lookups
MTU Must allow VXLAN overhead: jumbo frames (9100) recommended, at least 1550

Segmentation is two-level: macro-segmentation with Virtual Networks (VRFs, complete isolation) and micro-segmentation with SGTs inside a VN (group-to-group rules).

Interoperating with a traditional campus (1.3.b)

Most networks migrate building by building, so the fabric and the existing campus must talk.

  • L3 handoff at the border: the border node hands off each VN as a VRF-Lite sub-interface (802.1Q, one VLAN per VN) running BGP to a fusion router or firewall. The fusion device leaks routes between VNs and shared services (DHCP, DNS, ISE, Catalyst Center), because those usually live in the global table or a separate VRF.
  • L2 handoff (Layer 2 border): extends a fabric subnet onto a traditional VLAN so hosts on both sides share one subnet during migration. The gateway moves into the fabric; the traditional VLAN must stop using its old gateway.
  • SD-Access transit vs IP transit: between multiple fabric sites, SD-Access transit keeps VXLAN and the SGT end to end (needs a transit control plane node); IP transit hands off to a normal IP network (for example a WAN), and the SGT must be carried another way (SXP or inline tagging) if policy should survive.
  • Shared services: DHCP must support option 82 so replies come back to the right edge; ISE and Catalyst Center are reached through the border.

Exam trap

The fusion router is outside the fabric and isn't managed as a fabric role. If a question asks how fabric VNs reach a DHCP server in the global routing table, the answer is route leaking on the fusion device (or the border's handoff), not "the control plane node".

Lab

SD-Access needs Catalyst Center and physical Catalyst 9000 switches, so it isn't practical at home. Two substitutes:

  • DevNet Sandbox: the Catalyst Center always-on sandbox. Explore Inventory, the Provision > Fabric view (if populated), and the Assurance health pages. This is also preparation for 4.5 and 6.4.
  • Build the mechanism by hand in CML (optional, week 2): Two Catalyst 8000v as "edges" and one as "map server" with LISP and a VXLAN overlay. It is beyond the exam, but doing it once makes the control/data plane split stick. A walkthrough will be added with the 2.3 LISP and VXLAN module.

Quick check

An edge node gets traffic for a host it has never seen. What does it do first?

It sends a LISP Map-Request to the control plane node to find the RLOC (the edge switch's loopback) for that EID.

Which header carries the SGT across the fabric?

The VXLAN header. SD-Access uses VXLAN-GPO (Group Policy Option), which has a field for the 16-bit group ID.

References