1.3.a SD-Access control and data planes elements

What this objective means

SD-Access uses different planes for different jobs. The exam usually tests whether you can separate endpoint mapping, packet forwarding, policy, and automation.

Control plane

The SD-Access control plane uses LISP. Fabric edge nodes register endpoint reachability. Control plane nodes act as map servers and map resolvers. Instead of flooding everywhere to find an endpoint, the fabric can ask where that endpoint lives.

Useful way to think about it:

Endpoint ID: 10.20.30.40
Location:    Fabric Edge 2 loopback/RLOC
Question:    Where is this endpoint now?
Answer:      Send overlay traffic to Edge 2

Verification shape:

show lisp instance-id 101 ipv4 database
show lisp instance-id 101 ipv4 map-cache
show lisp site summary

Data plane

The data plane uses VXLAN encapsulation between fabric nodes. The original endpoint packet is carried across the underlay inside an overlay header. This lets the campus route the underlay while preserving logical segmentation and endpoint mobility in the overlay.

The underlay must still route correctly. VXLAN does not save a broken underlay.

Policy plane

SD-Access policy is commonly described with Security Group Tags. Instead of writing every policy as source IP to destination IP, you can express policy as group to group: employees to printers, contractors to internet, guests to nothing internal.

Recognition commands:

show cts role-based permissions
show cts role-based sgt-map all

Management and automation

Catalyst Center provides automation, assurance, inventory, and workflow. ISE supplies identity and group policy. They are not the same component. Catalyst Center automates the fabric; ISE helps decide who the endpoint is and what policy applies.

Lab: map the planes

For a packet from User-A on Edge1 to Server-B on Edge2, write one line for each plane.

• Control: how Edge1 learns where Server-B is.
• Data: how the packet crosses the fabric.
• Policy: which group-to-group rule allows or denies the traffic.
• Management: which tool pushed and monitors the fabric configuration.

Then attach a command to each line. If you cannot attach a command, you are still thinking at slide level.

Pass check

LISP answers where endpoints are. VXLAN carries traffic across the fabric. SGT policy answers who may talk. Catalyst Center and ISE make the system operable at scale.