1.3 Explain the working principles of the Cisco SD-Access solution

What this section tests

Cisco Software-Defined Access (SD-Access) is a campus fabric architecture. It separates endpoint identity and policy from the physical port. The idea is direct: build a routed underlay, run an overlay for endpoint reachability, and apply policy by identity and group membership.

The pieces

User -> Fabric Edge -> VXLAN overlay -> Fabric Edge -> Server
          |              ^                   |
          +-- LISP registers location ------+
          +-- ISE assigns SGT --+-- SGACL enforces policy
Border node only when traffic leaves the fabric

The packet story

A user plugs into a fabric edge. The edge learns the endpoint and registers its location with the control plane node. Another edge asks the control plane node where the endpoint lives. Traffic crosses the fabric inside Virtual Extensible LAN (VXLAN). Policy follows the endpoint because the policy binds to identity, not to a switch port.

LISP is the Locator/ID Separation Protocol. It maps an endpoint identifier to a location. SGT is the Scalable Group Tag. It carries the group identity inside the fabric.

Recognition commands

show lisp site summary
show lisp instance-id <id> ipv4 database
show lisp instance-id <id> ipv4 map-cache
show cts role-based permissions
show cts role-based sgt-map all
show ip route

Lab: draw the fabric

Draw one fabric with two edge nodes, one control plane node, one border node, ISE, and Catalyst Center. Put a user on Edge1 and a printer on Edge2.

Explain each step:

1. How does the fabric learn the user location?
2. How does Edge1 find the printer location?
3. How is the packet encapsulated?
4. Where is policy applied?
5. How does traffic exit to a traditional network?

The lab passes when each answer names a node and a command.

Pass check

You do not pass this topic with product names alone. You pass when you can name the job of each node and the command that proves it.