Skip to content
Study CCNP

1.3.b Traditional campus interoperating with SD-Access

3 min read ENCOR 350-401 v1.2 Updated

Aligned to Cisco's 350-401 ENCOR v1.2 exam topics.

On this page

What this objective tests

Real campuses rarely become a full fabric at once. SD-Access must connect to traditional routing, firewalls, data centers, WANs, and shared services. Interoperability separates a lab design from a production design.

Note: ENCOR v1.2 has no wireless study domain. Keep this objective on border nodes, fusion routers, shared services, and the fabric boundary.

The main handoff points

  • Fabric edge nodes connect endpoints inside the fabric.
  • Border nodes connect the fabric to outside networks.
  • Control plane nodes hold endpoint mappings.
  • Fusion or external routers connect fabric virtual networks to shared services, firewalls, the WAN, or the data center.

Keep the fabric boundary explicit. Know where overlay traffic ends and normal routing begins.

Common interoperation patterns

PatternHandoff deviceWatch for
Fabric to WANBorder nodeRoute advertisement and summarization
Fabric to data centerBorder node, often through a firewallInspection and policy handoff
Fabric to shared servicesFusion router with route leakingDNS, DHCP, identity, and management reachability
Fabric to legacy campusRouted handoffStretched Layer 2 without a strong reason

Example: external VRF handoff

This traditional router example shows the handoff between a segmented fabric network and normal routing. You do not build SD-Access by hand this way. The skill is to trace the path across the fabric boundary.

vrf definition USERS
 rd 65000:10
 address-family ipv4
  route-target export 65000:10
  route-target import 65000:10

interface GigabitEthernet0/0/1.10
 description USERS handoff from fabric border
 encapsulation dot1Q 10
 vrf forwarding USERS
 ip address 10.255.10.2 255.255.255.252

router ospf 10 vrf USERS
 router-id 10.255.10.2
 network 10.255.10.0 0.0.0.3 area 0

Verify the handoff:

show ip route vrf USERS
show ip ospf neighbor vrf USERS
traceroute vrf USERS 10.50.50.10

The output of show ip route vrf USERS must contain the fabric user subnets and the shared-service subnets. A missing shared-service route means the route leaking is incomplete.

Lab: migration thinking

Draw a traditional campus with VLAN 10 users, VLAN 20 voice, a firewall, and a WAN edge. Migrate only VLAN 10 into SD-Access. Keep voice traditional.

Do these steps:

  1. Write the route path from a fabric user to DNS.
  2. Write the route path from a fabric user to the Internet.
  3. Write the route path from a fabric user to a legacy printer in VLAN 20.
  4. Name the border, the external routing table, the policy point, and the proof command for each path.

Exam traps

  • Fabric endpoints do not reach outside networks automatically. Border design matters.
  • Do not stretch every legacy VLAN into the fabric. Prefer routed handoffs.
  • Do not forget shared services. DHCP, DNS, identity, and logging must be reachable before users see value.

Pass check

You are ready when you can trace any path across the fabric boundary and name the routing table, the policy point, and the proof command at each hop.

Related objectives