Table of Contents Link to heading
- SD-Access vs Traditional Network Access Control
- SD-Access Architecture Overview
- Physical Layer: Fabric Nodes
- Network Layer: Underlay and Overlay
- Controller Layer: DNA Centre and ISE
- Management Layer: DNA Centre Workflows
SD-Access vs Traditional Network Access Control Link to heading
Traditional campus NAC is location-dependent: a user’s network access is determined by which physical port they connect to, which VLAN that port belongs to, and what IP subnet that VLAN maps to. Moving a user to a different location requires VLAN and ACL reconfiguration. Scaling this model to thousands of users across multiple buildings becomes operationally expensive.
SD-Access decouples identity from location:
- A user’s network access policy follows their credentials, not their physical port
- Users can connect from any fabric edge node and receive the same policy
- Security is enforced based on Security Group Tags (SGTs) assigned at authentication, not based on IP addresses or VLANs
SD-Access Architecture Overview Link to heading
SD-Access is organised into four layers:
| Layer | Function | Key Components |
|---|---|---|
| Physical | Hardware devices in the fabric | Switches, routers, WLCs, APs |
| Network | Underlay routing + overlay (fabric) operation | OSPF/IS-IS, LISP, VXLAN, TrustSec |
| Controller | Automation, analytics, identity, policy | DNA Centre (NCP + NDP), Cisco ISE |
| Management | User interface for design, policy, and assurance | DNA Centre GUI/API |
Physical Layer: Fabric Nodes Link to heading
Each physical device in an SD-Access deployment takes on a specific fabric role:
| Role | Function |
|---|---|
| Fabric Edge Node | Access-layer switch connecting endpoints into the fabric |
| Fabric Border Node | Connects the fabric to external networks (internet, data centre, WAN) |
| Fabric Control Plane Node | Runs the LISP Map Server/Map Resolver (MS/MR) |
| Intermediate Node | Underlay-only device providing routing between fabric nodes |
| Wireless Controller | Provides fabric-mode AP registration and wireless client onboarding |
Access-layer switches become fabric edge nodes — they authenticate connecting endpoints via 802.1X/MAB, assign SGTs, and encapsulate traffic in VXLAN before forwarding it into the fabric.
Network Layer: Underlay and Overlay Link to heading
Underlay Network Link to heading
The underlay is the physical IP transport network — routed, loopback-addressed, with each device having a unique loopback reachable from every other fabric node.
Manual underlay: Configured via CLI or API. Allows custom routing protocols (OSPF is common), supports legacy and third-party hardware.
Automatic underlay (LAN Automation): DNA Centre deploys an IS-IS routed access design using Plug and Play (PnP) for zero-touch device onboarding. IS-IS is used rather than OSPF because it runs directly on the loopback-to-loopback links without requiring IP addressing on every transit link.
Overlay Network: Control Plane with LISP Link to heading
In traditional routing, the IP address serves as both the identity and the location of a host. LISP separates these concepts:
- EID (Endpoint Identifier): The endpoint’s IP address — stable regardless of where the endpoint connects
- RLOC (Routing Locator): The IP address of the fabric edge node where the endpoint is currently connected — changes when the endpoint moves
EID-to-RLOC mappings are stored in the LISP Map Server/Map Resolver (MS/MR), which runs on the fabric control plane nodes. Fabric edge nodes do not maintain full routing tables for all endpoints — they query the MS/MR on demand.
LISP Resolution Flow:
- Host A (EID: 10.1.1.10) is connected to Fabric Edge 1 (RLOC: 192.0.2.1)
- Host B wants to reach Host A and sends traffic toward 10.1.1.10
- Host B’s fabric edge node queries the Map Server: “Where is 10.1.1.10?”
- Map Server replies: “10.1.1.10 is reachable at RLOC 192.0.2.1”
- Host B’s edge node encapsulates the packet with the RLOC as the destination
- The packet traverses the underlay to Fabric Edge 1
- Fabric Edge 1 decapsulates and delivers the original packet to Host A
If Host A moves to Fabric Edge 2 (RLOC: 192.0.2.5), the Map Server is updated and subsequent queries return the new RLOC. Host B’s mapping cache eventually expires and the new location is discovered — Host A’s EID never changes.
Overlay Network: Data Plane with VXLAN Link to heading
VXLAN encapsulates Layer 2 Ethernet frames inside Layer 3 UDP packets (UDP port 4789), creating a logical L2 network that spans the physical L3 underlay:
| Feature | VLAN | VXLAN |
|---|---|---|
| ID size | 12 bits (4,096 VLANs) | 24-bit VNI (16 million+ segments) |
| Scope | Single broadcast domain | Spans any L3 network |
| Tunnel | No | L2 over L3 UDP tunnel |
VTEP (VXLAN Tunnel Endpoint): The fabric edge node that performs VXLAN encapsulation (egress) and decapsulation (ingress). From the endpoint’s perspective, all fabric-connected hosts appear to be on the same Layer 2 segment.
VXLAN Packet Flow:
- Host A sends a normal Ethernet frame destined for Host B
- Fabric Edge 1 (VTEP) receives the frame and encapsulates it:
- Original Ethernet frame → VXLAN payload
- Adds VXLAN header with VNI (identifies the logical network segment)
- Adds UDP header (destination port 4789)
- Adds outer IP header with RLOC as destination (for underlay routing)
- The encapsulated packet traverses the underlay — intermediate routers only see the outer IP header
- Fabric Edge 2 (VTEP) receives the packet, strips VXLAN/UDP/IP headers
- Host B receives the original Ethernet frame — unaware of the VXLAN encapsulation
Policy Plane with Cisco TrustSec (CTS) Link to heading
SGT-based policy (enforced via SGACLs — Security Group ACLs) scales far better than IP-based ACLs: instead of maintaining per-IP permit/deny rules, you define policy between groups. “Finance group can access Finance servers but not HR servers” is a two-line SGACL regardless of how many endpoints are in each group.
Controller Layer: DNA Centre and ISE Link to heading
Network Control Platform (NCP) Link to heading
NCP is the automation and orchestration engine integrated into DNA Centre:
- Automates underlay provisioning via LAN Automation
- Orchestrates overlay (fabric) configuration across all nodes
- Communicates with devices using NETCONF/YANG, SNMP, and SSH
- Reports automation status to the management layer
Network Data Platform (NDP) Link to heading
NDP is the analytics and assurance engine integrated into DNA Centre:
- Collects telemetry from NetFlow, syslog, SNMP, and SPAN
- Correlates events across the fabric to identify trends and anomalies
- Provides contextual information to NCP and ISE for policy decisions
- Feeds the DNA Centre Assurance dashboard with client, device, and application health metrics
Identity Services Engine (ISE) Link to heading
ISE is the policy and identity engine that integrates with DNA Centre:
- Enforces NAC using 802.1X, MAC Authentication Bypass (MAB), and Web Authentication
- Assigns SGTs to authenticated users and devices based on identity attributes
- Maps endpoints to scalable groups and host pools
- Programs SGACLs and group-based policies onto fabric devices
Management Layer: DNA Centre Workflows Link to heading
The management layer is the DNA Centre GUI/API through which operators manage the full SD-Access solution:
| Workflow | Function |
|---|---|
| Design | Define network hierarchy (global → area → building → floor → device) |
| Policy | Create group-based access policies using SGTs and SGACLs |
| Provision | Discover devices (PnP/SNMP/NETCONF), assign to sites, deploy configuration |
| Assurance | Collect telemetry, visualise client/device/app health, identify issues |