1.3.a SD-Access control and data planes elements

What this objective tests

SD-Access uses a different plane for each job. The exam tests whether you can separate endpoint mapping, packet forwarding, policy, and automation.

Control plane: LISP

The SD-Access control plane uses the Locator/ID Separation Protocol (LISP). Fabric edge nodes register endpoint reachability. Control plane nodes act as the map server and map resolver. The fabric asks where an endpoint lives instead of flooding to find it.

Endpoint ID:  10.20.30.40
Location:     Fabric Edge 2 (RLOC)
Question:     Where is this endpoint now?
Answer:       Send overlay traffic to Edge 2

Verification:

show lisp instance-id 101 ipv4 database
show lisp instance-id 101 ipv4 map-cache
show lisp site summary

• The database on an edge node shows the endpoints that edge node registered.
• The map-cache shows the mappings an edge node learned from the control plane node.

Data plane: VXLAN

The data plane uses Virtual Extensible LAN (VXLAN) between fabric nodes. The original endpoint packet travels inside an overlay header. The underlay routes the outer packet. The overlay keeps segmentation and endpoint mobility.

Note: VXLAN does not repair a broken underlay. The underlay must route and converge first.

Policy plane: SGT

SD-Access policy uses Scalable Group Tags (SGTs). You write policy as group to group, not address to address. For example: employees to printers permitted, guests to internal networks denied.

Recognition commands:

show cts role-based permissions
show cts role-based sgt-map all

Management and automation

Catalyst Center automates, monitors, and provisions the fabric. Cisco Identity Services Engine (ISE) decides who the endpoint is and which policy applies. They are different components.

Lab: map the planes

Trace a packet from User-A on Edge1 to Server-B on Edge2.

Do these steps:

1. Control: write how Edge1 learns where Server-B is.
2. Data: write how the packet crosses the fabric.
3. Policy: write the group-to-group rule that permits or denies the traffic.
4. Management: name the tool that pushed and monitors the configuration.
5. Attach one command to each line.

The lab passes when every line has a command. A line without a command is still slide-level knowledge.

Pass check

• LISP answers where endpoints are.
• VXLAN carries traffic across the fabric.
• SGT policy answers who may communicate.
• Catalyst Center and ISE make the system operable at scale.