Sign in Subscribe
CCNP-ENCOR

Understanding Cisco SD-Access Solution Architecture

Explores Cisco SD-Access solution architecture, covering its fabric-based design with LISP control plane, IS-IS underlay, and key network components including Control, Border, Edge, and Intermediate nodes. Details the policy framework using SGTs and DNA Center integration for automated provisioning

Jay Whale

• 4 min read
Understanding Cisco SD-Access Solution Architecture

SD-Access: The Fabric-Based Network Revolution

Cisco SD-Access represents a fundamental shift from traditional hierarchical networks to a fabric-based architecture that abstracts the physical infrastructure from policy enforcement. Understanding its architecture is crucial for network engineers implementing Intent-Based Networking (IBN) solutions in enterprise environments.

At its core, SD-Access creates an overlay network using VXLAN encapsulation over an IS-IS underlay fabric, enabling micro-segmentation and automated provisioning through centralized policy management. This architecture eliminates the need for traditional VLANs to stretch across the network while maintaining complete traffic isolation.

Control and Data Plane Separation

The SD-Access architecture implements a clean separation between control and data planes through the Locator/ID Separation Protocol (LISP). This separation allows the network to scale horizontally while maintaining optimal forwarding behavior.

The control plane consists of LISP Map Servers and Map Resolvers that maintain endpoint-to-location mappings. When an endpoint moves within the fabric, only the control-plane mapping updates; the data-plane forwarding continues uninterrupted. This dramatically reduces convergence times compared to traditional spanning tree environments.

The data plane uses VXLAN to encapsulate traffic between fabric nodes. Each endpoint receives a unique Endpoint Identifier (EID) that remains constant regardless of physical location, while Routing Locators (RLOCs) identify the fabric edge node where the endpoint currently resides.

LISP Implementation in SD-Access

LISP serves as the control plane protocol that enables host mobility and optimal forwarding. The key components include:

  • Ingress Tunnel Router (ITR): Encapsulates traffic from endpoints into LISP packets
  • Egress Tunnel Router (ETR): Decapsulates LISP packets and delivers to destination endpoints
  • Map Server (MS): Stores EID-to-RLOC mappings for the domain
  • Map Resolver (MR): Resolves EID locations for ITRs requesting mappings

When an endpoint sends its first packet to a destination, the ITR queries the Map Resolver for the destination's RLOC. This creates a mapping cache entry that enables direct tunnel establishment for subsequent packets.

Underlay Network: IS-IS-Based Fabric

The underlay network provides the physical connectivity foundation using IS-IS as the routing protocol. This choice offers several advantages over traditional routing protocols in fabric environments:

router isis 
 net 49.0001.0000.0000.0001.00
 is-type level-2-only
 metric-style wide
 log-adjacency-changes all
 segment-routing mpls
 address-family ipv4 unicast
  metric-style wide
  segment-routing mpls sr-prefer

The IS-IS configuration enables segment routing, which SD-Access uses for traffic engineering and fast reroute capabilities. Each fabric node receives a unique Node-SID that identifies it within the segment routing domain.

The underlay uses a simple /31 point-to-point addressing scheme between fabric nodes, with loopback interfaces providing the stable RLOCs for LISP tunnel endpoints. This design eliminates the need for complex VLAN management across the infrastructure.

SD-Access Network Components

The SD-Access solution architecture comprises several critical network components, each serving specific roles within the fabric:

Control Node

The Control Node hosts the LISP Map Server/Map Resolver functions and serves as the central repository for all endpoint location information. It also runs the Route Reflector for the fabric's BGP control plane, distributing host routes throughout the overlay.

device-role control-node
interface Loopback0
 description Control Node RLOC
 ip address 192.168.1.1 255.255.255.255
 ip lisp source-locator Loopback0

Border Node

Border Nodes provide connectivity between the SD-Access fabric and external networks. They perform LISP proxy functions, translating between the fabric's EID space and external routing domains. Border Nodes also enforce security policies at the fabric boundary.

There are two types of Border Nodes:

  • Internal Border Node: Connects to other enterprise networks (data centers, WAN)
  • External Border Node: Connects to the internet or service provider networks

Edge Node

Edge Nodes connect endpoints to the fabric and serve as the ITR/ETR for traffic entering or leaving the overlay. They maintain the endpoint database and enforce micro-segmentation policies through Scalable Group Tags (SGTs).

device-role edge-node
ip lisp
ip lisp locator-set RLOC-SET
 IPv4-interface Loopback0 priority 10 weight 10
exit
ip lisp instance-id 0
 service ipv4
  eid-table default
  map-cache site self
  database-mapping 192.168.100.0/24 locator-set RLOC-SET

Intermediate Nodes

Intermediate Nodes provide transit functionality within the fabric underlay. They participate in IS-IS routing and forward VXLAN-encapsulated traffic between Edge and Border Nodes but do not connect endpoints directly.

Policy and Segmentation Framework

SD-Access implements micro-segmentation through Scalable Group Tags (SGTs) that travel with traffic throughout the fabric. This approach enables consistent policy enforcement regardless of endpoint location within the network.

The policy framework operates through three key elements:

  • Virtual Networks (VNs): Layer 3 segmentation boundaries equivalent to VRFs
  • Scalable Group Tags: Layer 2/3 classification applied to endpoints
  • Security Group ACLs: Policies defining communication rules between SGTs

DNA Center serves as the policy orchestration platform, translating business intent into network-wide configurations. When an administrator creates a policy allowing HR systems to communicate with payroll databases, DNA Center automatically generates the corresponding SGACL entries and distributes them to all fabric nodes.

Integration with DNA Center

DNA Center provides the management and orchestration layer for SD-Access fabrics. It automates device discovery, fabric provisioning, and policy deployment while providing visibility into network behavior and endpoint connectivity.

The integration enables zero-touch provisioning where new devices automatically receive appropriate configurations based on their role and location within the fabric. This dramatically reduces deployment time and eliminates configuration errors common in manual provisioning processes.

What's Next

Now that you understand the SD-Access solution architecture and its core components, the next step is diving deep into LISP implementation and its role in providing host mobility and optimal forwarding within the fabric. We'll explore the detailed packet flows and mapping processes that make SD-Access possible.

CCNP ENCOR study resources