1.3 Explain the working principles of the Cisco SD-Access solution

What to learn

Cisco SD-Access is a campus fabric architecture. It separates endpoint identity and policy from the physical place where a user plugs in. The main idea is simple: build a routed underlay, run an overlay for endpoint reachability, and apply policy based on identity and group membership.

The pieces

• Catalyst Center automates and manages the fabric.
• Cisco ISE provides identity and policy information.
• Fabric edge nodes connect endpoints to the fabric.
• Control plane nodes track endpoint reachability with LISP.
• Border nodes connect the fabric to outside networks.
• VXLAN carries the overlay data plane.
• SGT-based policy controls who can talk to whom.

User -> Fabric Edge -> VXLAN overlay -> Fabric Edge -> Server
          |              ^                    |
          +-- LISP registers location -------+
          +-- ISE/Catalyst Center assign SGT -+-- SGACL at enforcement
Border node only when traffic leaves the fabric

The clean version

A user plugs into a fabric edge. The edge learns the endpoint and registers its location. Another edge can find that endpoint through the control plane. Traffic crosses the fabric in VXLAN. Policy follows the endpoint because the policy is tied to identity, not just the access switch port.

Recognition commands

show lisp site summary
show lisp instance-id <id> ipv4 database
show lisp instance-id <id> ipv4 map-cache
show cts role-based permissions
show cts role-based sgt-map all
show ip route

Lab: draw the fabric

Draw one fabric with two edge nodes, one control plane node, one border node, ISE, and Catalyst Center. Put a user on Edge1 and a printer on Edge2. Then explain each step:

• how the fabric learns the user location,
• how Edge1 finds the printer location,
• how the packet is encapsulated,
• how policy is applied,
• how traffic exits to a traditional network.

You do not pass this topic by memorizing product names. You pass it by knowing what job each node does.