Table of Contents Link to heading

• Software-Defined Access (SD-Access)
• SD-Access Architecture
  • Physical Layer
  • Network Layer
    • Underlay Network
      • Manual Underlay
      • Automatic Underlay
    • Overlay Network (Fabric)
      • Control Plane, based on Locator/ID Separation Protocol (LISP)
      • Data Plane, based on Virtual Extensible LAN (VXLAN)
      • Policy Plane, based on Cisco TrustSec (CTS)
  • Controller Layer
    • Network Control Platform (NCP)
    • Network Data Platform (NDP)
    • Identity Services Engine (ISE)
  • Management Layer

Software-Defined Access (SD-Access) Link to heading

Traditional NAC:

• Fixed VLANs, IP addresses, and ACLs.
• Users must connect to the physical port where they are assigned specific VLANs/subnets.

SD-Access NAC:

• Traffic flow security is based on user identity, not physical location and IP address.
• Users log in from and can move to any physical location in the network.

The campus fabric is an overlay solution that includes all of the features and protocols (control plane, data plane, management plane, and policy plane) to operate the network infrastructure.

When the campus fabric solution is managed via the Cisco DNA Centre, the solution is considered to be SD-Access,

SD-Access Architecture Link to heading

Physical Layer Link to heading

• The access layer switches become fabric edge nodes that connects endpoints into the SDA fabric.

Network Layer Link to heading

Underlay Network Link to heading

• Definition: The physical infrastructure — switches, routers, cabling, IP routing.
• Role: Provides basic connectivity between network devices.
• Protocols: Traditional routing protocols (OSPF, EIGRP, BGP) ensure reachability.

Manual Underlay Link to heading

• Configured and managed manually via CLI or API.
• Allow customisation (such as using OSPF rather than IS-IS).
• Allow legacy (or third-party) IP-based network.

Automatic Underlay Link to heading

• All aspects of the under lay network are configured and managed by the Cisco DNA Centre LAN Automation feature.
• The LAN Automation feature creates an IS-IS routed access campus design and uses the Cisco Network Plug and Play features to deploy both unicast and multicast routing configuration in the underlay to improve traffic delivery efficiency for SD-Access.

Overlay Network (Fabric) Link to heading

• Definition: A virtual, tunnelled network that virtually interconnects all of the network devices forming a fabric of interconnected nodes.
• Role: Creates a logical connections between devices, regardless of the physical topology.
• Protocols: VXLAN, LISP, CTS.
• Fully automated regardless of the underlay network model. However, if manually configure the overlay, the solution becomes a campus fabric, not SD-Access.

Control Plane, based on Locator/ID Separation Protocol (LISP) Link to heading

LISP separates identity (endpoint IP address) from location (network edge/border router IP address).

This is done by using a simple EID (Endpoint Identifier) to RLOC (Routing Locator) mapping system, stored in a centralised mapping database called LISP MS (map server).

Routers don’t need a full routing table. It only manages its local routes and queries the MS to locate destination EIDs.

Data Plane, based on Virtual Extensible LAN (VXLAN) Link to heading

VXLAN encapsulates L2 Ethernet frames inside L3 UDP packets (overlay over underlay).

• Overlay = the logical L2 network created by VXLAN. Hosts think they’re on the same LAN, even if they’re far apart.
• Underlay = the physical L3 IP network that transports VXLAN packets. It provides routing, forwarding, and connectivity between VTEPs.

VNI (VXLAN Network Identifier), a 24-bit identifier, supports up to 16 million VNIs (compared to 4096 VLANs).

VTEP (VXLAN Tunnel Endpoint) is a gateway that encapsulates and decapsulates VXLAN traffic.

Policy Plane, based on Cisco TrustSec (CTS) Link to heading

Cisco TrustSec (CTS) is a next-generation NAC solution performs network enforcement by using Security Group Tags (SGTs) instead of IP addresses and ports.

SGTs are assigned to authenticated groups of users or end devices. RBAC is enforced using SGACLs (Security Group ACLs), which match based on SGTs rather than IPs.

Controller Layer Link to heading

Network Control Platform (NCP) Link to heading

• Integrated into DNA Centre.
• Configures/manages devices using NETCONF/YANG, SNMP, SSH/Telnet.
• Reports automation status and network information to the management layer.

Network Data Platform (NDP) Link to heading

• Integrated into DNA Centre.
• Correlates events from sources like NetFlow, Syslogs, SPAN.
• Identifies historical trends and shares contextual info with NCP and ISE.
• Supplies operational status to the management layer.

Identity Services Engine (ISE) Link to heading

• Enforces NAC using 802.1X, MAC Authentication Bypass (MAB), Web Authentication (WebAuth).
• Uses contextual info from NDP/NCP and external systems (e.g., AD, AWS).
• Maps endpoints into scalable groups and host pools.
• Programs group‑based policies onto network devices.
• Enables the management layer to define and manage policies.

Management Layer Link to heading

Cisco DNA Centre workflows:

1. Design: Define the network hierarchy (sites, buildings, floors).
2. Policy: Create group‑based access policies (using SGT).
3. Provision: Discover devices automatically (via SNMP, NETCONF, CLI).
4. Assurance: Collect telemetry (NetFlow, SNMP, model‑driven telemetry).