Explain the working principles of the Cisco SD-Access solution
Cisco SD-Access is one of two software-defined networking solutions created by Cisco, and is meant to be an evolution of a typical enterprise network to a modern design utilizing fabric overlays and virtualization. SD-Access runs on Cisco DNA center, which is used to automate wired & wireless networks.
1.4.a SD-Access control and data planes elements
SD-Access Architecture
The SD-Access architecture includes hardware & software components, arranged into four different layers:
- Physical layer:
- Cisco switches: switches provide wired access to the fabric.
- Cisco routers: routes branch office traffic across the WAN and fabric.
- Cisco wireless access points: provides wireless access to the fabric.
- Cisco controller appliances
- Network layer:
- Underlay: the underlying physical network responsible for transporting packets for the fabric overlay.
- Overlay: the virtual network built on the top of the underlay, and can be a layer 2 or layer 3 overlay network.
- Layer 2 overlay: used for transporting a single subnet (broadcast domain).
- Layer 3 overlay: an overlay that allows for mulitple IP networks in the virtual network.
- Controller layer:
- Cisco network control platform (NCP): provides the underlay and fabric automation & orchestration services.
- Cisco network data platform (NDP): the data collection & analytics subsystem of DNA center.
- Cisco identity services engine (ISE): provides network access control and identity services.
- Management layer: the DNA cetner user interface, where information from all other layers is presented in a central management dashboard.
SD-Access Operational Planes
Cisco SD-Access operates in four distinct operation planes:
- Control plane: The messaging & communication protocol between infrastructure devices in the fabric. It is based on Locator/ID Separation Protocol (LISP).
- Data plane: Refers to the encapsulation method used for the transport of data packets. VXLAN is used for the data plane.
- Policy plane: The security & segmentation of network devices, based on Cisco TrustSec.
- Management plane: The orchestration, assurance, visibility & management of the SD-Access solution, using Cisco DNA center.
LISP: LISP separates identity and location through a mapping relationship of two namespaces: endpoint identifier (EID) and a routing locater (RLOC). The mapping is known as an EID-to-RLOC mapping. Fabric devices can query a control plane node to determine the RLOC associated with a destination address, and then use the RLOC as the traffic destination.
VXLAN: An encapsulation technique that allows the transport of lower layer data over IP packets. VXLAN encapsulates the original Ethernet header in an IP packet, which allows the creation of a layer 2 and layer 3 overlay. SD-Access also places VXLAN network identifier in the VXLAN header to identify each overlay network.
TrustSec: Cisco TrustSec is used to assign a security group tag (SGT) value to a packet at the ingress point to the network. Policies such as QoS & ACLs are then applied throughout the SD-Access fabric using the SGT.
DNA Center: Cisco DNA center enables automation of device deployments and device configuration.
SD-Access Fabric Roles
An SD-Access fabric is comprised on several components, and the roles that the components fulfill. Each device in the fabric can have one or more roles assigned to it. The following components & roles are involved in SD-Access:
- Control plane nodes
- Edge nodes
- Intermediate nodes
- Border nodes
- Fabric WLCs
- Fabric-mode access points
- Embedded wireless
- Fabric in a box
- Shared services
Control Plane nodes
The control plane node is based on the LISP map server & map resolver on the same fabric device. This node keeps tracks of all endpoints in the fabric, and enables the following functions:
- Host tracking database (HTDB): a central repository of EID-to-RLOC mappings.
- EID: an address used for identifying an endpoint device in the fabric.
- LISP map server: received endpoint registrations with the associated RLOC and stores them in the HTDB.
- LISP map resolver: responds to queries from fabric devices requesting RLOC mapping information from the HTDB.
Edge nodes
Edge nodes are the equivalent of access layer switches. Their functionality is centered on the ingress & egress tunnel routers (xTR) in LISP. An edge node enables the following functions:
- Endpoint registration: when the edge node detects an endpoint, the endpoint is added to a local database called the EID table. The edge node then issues a LISP map register message to the control plane node to notify it of the endpoint.
- Anycast layer 3 gateway: a common gateway is used at every edge node, which shares a common EID subnet and provides forwarding across different RLOC. This interface is an SVI across all edge nodes.
- User/Network mapping: endpoints connected to an edge node are placed into virtual networks by being assigned to a VLAN associated with an SVI.
- AAA authenticator: assigning endpoints to VLANs can be done dynamically by a AAA server, and is required for 802.1x authentication.
- VXLAN encapsulation/decapsulation: packets received from an endpoint are encapsulated in the frabic VXLAN and forwarded across the overlay to another edge node, where it is decapsulated and forwarded to the destination endpoint.
Intermediate nodes
Intermediate nodes are devices used for interconnections between border nodes and edge nodes. These nodes comprise the underlay network, and provide IP connectivity for the overlay networks.
Border nodes
A fabric border node acts as the gateway between the SD-Access fabric and external networks. It is responsible for virtualization & SGT propagation from the fabric to the rest of the network. The border node provides the following functions:
- Advertisement of EID subnets: BGP is the routing protocol used to advertise the aggregate endpoint prefix space outside of the fabric.
- Fabric exit point: A border node is the gateway of last resort for fabric edge nodes. It is implemented with the LISP proxy tunnel router (PxTR) function.
- Network virtualization extension: expands virtual networks from the fabric to the rest of the network using VRF-lite and VRF aware routing protocols.
- Policy mapping: the SGT information from within the fabric is maintained when packets are exiting the fabric.
- VXLAN encapsulation/decapsulation: Packets received from outside the fabric are encapsulated in VXLAN headers, and decapsulated when exiting the fabric to the rest of the network. This is similar behavior as the edge node, except that border nodes connect to a non-fabric network instead of endpoints.
Fabric wireless LAN controllers
In an SD-Access fabric, CAPWAP tunnels between the WLCs and access points are used for control traffic only. Data traffic from wireless clients is forwarded to the first hop fabric edge node, where policies can be applied.
SD-Access embedded wireless
The Catalyst 9800 embedded wireless controller for the Catalyst 9000 series switches is supported in three SD-Access fabric topologies:
- Catalyst 9000 series switches functioning as the border & control plane node.
- Catalyst 9000 series switches functioning as an edge node when the border and control plan nodes are on a routing platform.
- Catalyst 9000 series switches functioning as a Fabric in a Box.
Fabric in a Box
Fabric in a Box is an SD-Access product in which the border node, control plane node and edge node are running on the same fabric device. It may be a single switch, or a switch stack.
Shared services
Network services, such as DHCP, DNS, NTP, etc., need to be shared across multiple virtual networks. A router called a Fusion router can enable access to these service while maintaining isolation between the virtual networks. The fusion router is located outside of the SD-Access fabric and does VRF leaking to enable host connectivity to the shared services. Some of the shared services to consider are:
- DHCP, DNS, IPAM, AD
- Internet access
- IP voice * video services
- Servers and other critical systems