Key Elements of SD-Access Control and Data Planes

SD-Access fundamentally transforms traditional campus networking by abstracting the physical topology into logical overlay constructs. Understanding the distinct roles and configurations of the control and data planes is essential for any engineer designing or troubleshooting SD-Access deployments at scale.

Control Plane Architecture and Components

The SD-Access control plane operates as a centralized intelligence layer that maintains network state information and policy enforcement decisions. The primary control plane components work together to create a unified fabric control system.

Cisco Catalyst Center as Policy Controller

Cisco Catalyst Center (formerly Cisco DNA Center) functions as the northbound policy orchestrator, translating business intent into network configurations. It maintains the authoritative source for group-based policies, VLAN-to-VN mappings, and fabric-wide security policies. The controller pushes policy through RESTCONF APIs to the control plane nodes.

Key control plane configuration begins with fabric enablement:

catalyst-center# configure terminal
catalyst-center(config)# fabric-wireless enable
catalyst-center(config)# fabric site-hierarchy
catalyst-center(config-fabric)# site campus/building/floor
catalyst-center(config-fabric)# authentication-template default

LISP Control Plane Nodes

LISP Map Servers and Map Resolvers form the distributed control plane infrastructure. These nodes maintain the mapping database that correlates endpoint identity information with location data. In production deployments, you'll typically deploy multiple control plane nodes for high availability.

Control plane node configuration requires specific LISP parameters:

router lisp
 locator-set RLOC_SET_FABRIC
  172.16.1.1 priority 10 weight 100
 exit
 service ipv4
  map-server
  map-resolver
  database-mapping 192.168.100.0/24 RLOC_SET_FABRIC
 exit

Border Node Control Functions

Border nodes maintain dual roles in SD-Access control plane operations. They participate in the LISP control plane for internal fabric communication while simultaneously running traditional routing protocols (BGP, OSPF) for external connectivity. This dual-homed approach requires careful route redistribution policies to prevent loops while maintaining reachability.

Data Plane Implementation and Traffic Flow

The SD-Access data plane implements VXLAN encapsulation with LISP location services to create the overlay fabric. Understanding data plane packet flow is crucial for troubleshooting connectivity issues and optimizing performance.

Edge Node Data Plane Functions

Edge nodes perform the critical function of mapping endpoints to Virtual Networks (VNs) and applying appropriate segmentation policies. Each edge node maintains local endpoint tables and performs VXLAN encapsulation for traffic entering the fabric.

Verify edge node data plane operations:

show lisp instance-id 4097 ipv4 database
show platform software fed active fnf record-count
show platform hardware fed active fwd-asic drops exceptions

Edge nodes also implement SGT (Security Group Tag) assignment and enforcement. When an endpoint authenticates, the edge node applies the appropriate SGT based on authentication results and pushes this information into the VXLAN header for downstream policy enforcement.

VXLAN Encapsulation and VNI Mapping

The data plane uses VXLAN Network Identifiers (VNIs) to maintain L2 and L3 isolation across the fabric. Each Virtual Network receives a unique VNI, typically in the 4097+ range to avoid conflicts with traditional VLAN IDs. The VXLAN header carries both the VNI for segmentation and SGT information for policy enforcement.

Data plane roles extend to traffic optimization through anycast gateway functionality. All edge nodes in a fabric site can respond to ARP requests for the same gateway IP, enabling optimal traffic forwarding without requiring traffic to traverse the entire fabric unnecessarily.

Border Node Data Plane Integration

Border nodes perform VRF-to-VN translation, enabling communication between fabric Virtual Networks and external networks. This translation process requires careful attention to route leaking policies and NAT requirements when integrating with legacy network segments.

Monitor border node data plane performance:

show platform software fed active punt cause summary
show platform hardware fed active qos queue stats interface TenGigabitEthernet1/0/1
show lisp instance-id 0 ipv4 away RLOC-table

Control and Data Plane Interactions

The control and data planes work in concert to enable dynamic fabric operations. When an endpoint moves within the fabric, the control plane updates LISP mappings while the data plane adjusts forwarding tables accordingly. This dynamic behavior eliminates the need for manual VLAN spanning and reduces broadcast domain sizes.

Policy enforcement occurs through the interaction between control plane policy distribution and data plane SGT enforcement. The control plane pushes Security Group Access Control Lists (SGACLs) to enforcement points, while the data plane applies these policies based on SGT markings in traffic flows.

Troubleshooting requires understanding both planes. Control plane issues typically manifest as endpoint learning problems or policy distribution failures, while data plane issues appear as forwarding failures or performance degradation.

What's Next

With a solid understanding of SD-Access control and data plane fundamentals, the next logical step is examining SD-Access fabric roles and responsibilities. We'll explore how different node types (control, border, edge) implement these plane functions and their specific configuration requirements for enterprise deployments.