1.3.b Traditional campus interoperating with SD-Access

What this objective means

Real campuses rarely become full fabric overnight. SD-Access must connect to traditional routing, firewalls, data centers, WANs, shared services, and sometimes legacy Layer 2 segments. Interoperability is the difference between a design that works in a lab and one that survives production.

Fabric wireless exists in real Catalyst Center deployments, but ENCOR v1.2 no longer has a wireless study domain. Do not turn this objective into a WLAN, RF, or client-roaming study block. Keep the target on border nodes, fusion or external routers, shared services, firewalls, WAN and data center handoff, route leaking, policy handoff, and where the overlay ends.

The main handoff points

Fabric edge nodes connect endpoints inside the fabric. Border nodes connect the fabric to networks outside the fabric. Control plane nodes know endpoint mappings. Fusion or external routers often connect fabric virtual networks to shared services, firewalls, WAN, or data center networks.

The clean rule: keep the fabric boundary explicit. Know where overlay traffic ends and normal routing begins.

Common interop patterns

• Fabric to WAN: border nodes advertise fabric routes or summaries toward the WAN.
• Fabric to data center: traffic leaves through border nodes, often through firewalls or fusion routers.
• Fabric to shared services: route leaking may be used so multiple virtual networks can reach DNS, DHCP, identity, or management services.
• Fabric to legacy campus: use routed handoffs where possible. Avoid stretching Layer 2 unless there is a strong reason and a clear risk plan.
• Optional production context: if a real deployment includes fabric wireless, wireless clients may participate in the same policy model, but that is context here, not a core ENCOR v1.2 wireless objective.

Example: external VRF handoff

This is a simplified traditional router example for the outside edge. The point is not that you manually build SD-Access this way; the point is to recognize the handoff between segmented fabric networks and normal routing.

Do not over-rotate into MPLS VPN or MP-BGP route-target implementation unless your lab requires it. The blueprint verb is interoperability. The high-value skill is tracing the path across the fabric boundary and identifying which routing table, policy point, and handoff device is responsible.

vrf definition USERS
 rd 65000:10
 address-family ipv4
  route-target export 65000:10
  route-target import 65000:10

interface GigabitEthernet0/0/1.10
 description USERS handoff from fabric border
 encapsulation dot1Q 10
 vrf forwarding USERS
 ip address 10.255.10.2 255.255.255.252

router ospf 10 vrf USERS
 router-id 10.255.10.2
 network 10.255.10.0 0.0.0.3 area 0

Verify the handoff:

show ip route vrf USERS
show ip ospf neighbor vrf USERS
show access-lists
traceroute vrf USERS 10.50.50.10

Lab: migration thinking

Draw a traditional campus with VLAN 10 users, VLAN 20 voice, a firewall, and a WAN edge. Now migrate only VLAN 10 into SD-Access. Keep voice traditional. Write the route path from a fabric user to DNS, to the internet, and to a legacy printer.

The winning answer names the border, the external routing table, the policy point, and the verification command.

Exam traps

Do not assume fabric endpoints can reach outside networks automatically. Border design matters. Do not assume every legacy VLAN should be stretched. Do not forget shared services. DHCP, DNS, identity, logging, and management access must be reachable before users care that the fabric is elegant.