Integrating Traditional Campus Networks with SD-Access

Integrating traditional campus networks with SD-Access presents unique challenges that go beyond simple overlay deployment. As enterprises migrate from legacy three-tier architectures to software-defined fabrics, the transition period requires careful orchestration of both technologies. This integration isn't just about technical compatibility, it's about maintaining business continuity while transforming your network infrastructure.

Understanding the Integration Challenge

Traditional campus networks rely on VLAN-based segmentation and hierarchical routing, while SD-Access operates on VXLAN overlays with policy-driven segmentation. The fundamental difference lies in how traffic flows and policies are enforced. Legacy networks use hop-by-hop forwarding with distributed policy enforcement, whereas SD-Access centralizes policy through DNA Center and uses LISP for endpoint identification.

The integration challenge becomes apparent when considering that most enterprises can't perform a forklift replacement. Critical applications, compliance requirements, and budget constraints necessitate a phased approach where both architectures coexist and interoperate seamlessly.

Border Integration Strategies

The SD-Access border node serves as the critical integration point between fabric and traditional networks. Configure border functionality using the device-role border command within the SD-Access fabric configuration. The border node maintains both fabric membership and traditional routing adjacencies.

fabric border
 border priority 100
 fabric-enabled interfaces
  interface TenGigabitEthernet1/0/1
  interface TenGigabitEthernet1/0/2
 legacy interfaces  
  interface TenGigabitEthernet1/0/3
   external-connectivity

For routing protocol integration, configure mutual redistribution between the fabric's LISP domain and traditional routing protocols. Enable selective route advertisement to prevent routing loops while ensuring reachability between domains.

router lisp
 eid-table vrf blue instance-id 4097
  database-mapping 10.1.0.0/16 locator-set fabric-rlocs
  exit-eid-table
 route-import database preserve-source
 
router ospf 100
 redistribute lisp subnets route-map LISP-TO-OSPF
 
route-map LISP-TO-OSPF permit 10
 match tag 100
 set tag 200

VLAN Extension Considerations

When extending VLANs from traditional networks into the fabric, careful planning prevents subnet overlap and ensures proper anycast gateway operation. The fabric's distributed anycast gateway must coordinate with traditional SVI configurations to avoid MAC address conflicts.

Configure VLAN extension through the border node using explicit VLAN-to-VNI mapping. This approach provides granular control over which traditional VLANs participate in fabric forwarding:

vlan configuration 100
 member vni 8100100
 member evpn-instance 100 vni 8100100
 
interface vlan 100
 ip address 10.100.1.1 255.255.255.0
 ip helper-address 10.10.10.10
 no ip redirects
 fabric forwarding mode anycast-gateway

Policy Alignment and Translation

One of the most complex aspects of SD-Access integration involves aligning traditional ACL-based policies with fabric scalable group tags (SGTs). DNA Center's policy framework must translate existing security policies into fabric-native constructs while maintaining enforcement consistency.

Traditional networks typically implement security through interface-based ACLs and VLAN isolation. SD-Access shifts this paradigm to identity-based microsegmentation using SGTs. The integration process requires mapping existing security zones to scalable groups and ensuring policy continuity across the boundary.

Configure policy translation through DNA Center's group-based policy interface, establishing trust relationships between fabric SGTs and traditional security zones. Use trustsec interfaces on border nodes to tag traffic entering the fabric from traditional segments:

interface TenGigabitEthernet1/0/3
 cts manual
  policy static sgt 10 trusted
  sap pmk cisco123 mode-list gcm-encrypt

Identity Service Integration

Successful SD-Access interoperability requires unified identity services across both architectures. ISE must maintain consistent policy enforcement whether users connect through traditional access switches or fabric edge nodes. Configure ISE authorization policies to assign appropriate SGTs regardless of the underlying infrastructure.

The challenge lies in ensuring that traditional 802.1X authentications receive the same SGT assignments as fabric-connected endpoints. This requires careful ISE policy configuration and may require deploying the SGT Exchange Protocol (SXP)to propagate SGT information to traditional network devices.

Data Plane Interoperability

Traffic flowing between traditional networks and SD-Access requires careful attention to MTU considerations and encapsulation overhead. VXLAN encapsulation adds 50 bytes of overhead, potentially causing fragmentation issues with traditional infrastructure that doesn't account for larger frame sizes.

Configure appropriate MTU settings throughout the network path, particularly on inter-domain links. The border node must handle MTU discovery and fragmentation for traffic transitioning between domains:

interface TenGigabitEthernet1/0/1
 mtu 9100
 ip mtu 9000
 
system mtu jumbo 9000

For multicast traffic integration, configure PIM sparse mode on border interfaces connecting to traditional networks, while ensuring proper RPF check operation across the fabric boundary. The border node acts as a multicast gateway, translating between traditional PIM and fabric-native multicast forwarding.

Monitoring and Troubleshooting Integration

Effective monitoring of integrated deployments requires visibility into both traditional and fabric domains. DNA Center's assurance capabilities must extend to border node performance and inter-domain traffic flows. Configure SPAN sessions and packet captures at strategic integration points to troubleshoot connectivity issues.

Common integration issues include routing loops, policy mismatches, and authentication failures. Use the show fabric ap summary and show lisp instance-id commands to verify fabric operation, while traditional show ip route and show spanning-tree commands validate legacy network behavior.

The key to successful troubleshooting lies in understanding the traffic flow across the integration boundary and identifying where traditional forwarding transitions to fabric behavior.

What's Next

With traditional campus integration strategies established, the next critical component involves implementing campus fabric security through advanced threat detection and automated response mechanisms. This builds upon the policy framework established during integration to provide comprehensive security across both traditional and fabric domains.

Tools and resources for this topic

• CCNP ENCOR 350-401 Official Cert Guide — The definitive ENCOR study resource by Brad Edgeworth. Covers enterprise infrastructure, virtualisation, and automation.