Skip to main content

SD-Access - Fabric Components

1. The Three Planes of SD-Access

Instead of a traditional routing model, SD-Access splits network functions into three distinct planes:

  • Control Plane (LISP): Moves the destination routing database to a centralized mapping system (similar to DNS). It tracks endpoints by decoupling their identity (IP/MAC) from their physical location, resulting in smaller routing tables and lower CPU load.

  • Data Plane (VXLAN): Handles encapsulation. SD-Access uses a modified version of VXLAN (instead of LISP) in the data plane because VXLAN supports Layer 2 encapsulation, allowing both L2 and L3 overlays.

  • Policy Plane (Cisco TrustSec): Groups devices with similar requirements into Scalable Group Tags (SGTs). Policies (like security or QoS) are bound to these SGTs rather than IP addresses. SGTs are propagated across the fabric using the SGT Exchange Protocol (SXP) or inline packet tagging.

2. Fabric Node Roles

A. Edge Node (The Access Layer)

image.png

image.png

Anycast Gateway

image.png

Host Pools

The Edge Node serves as the first-hop entry point for users and devices, operating similarly to a traditional access switch but with added fabric intelligence.

  • Endpoint Registration: Detects new devices, adds them to a local Endpoint Identifier (EID) table, and registers them with the Control Plane Node via LISP.

  • Virtual Network Mapping: Places users into Virtual Networks (VNs) by mapping them statically or dynamically (via 802.1X) to specific VLANs and SGTs.

  • LISP Forwarding: Queries the Control Plane for a destination's physical location (RLOC) and caches it. It forwards unresolved traffic to the default Border.

  • VXLAN Encap/Decap: Adds a VXLAN header to outgoing traffic based on the destination RLOC and strips it from incoming traffic.

  • Host Pools: Configures a Switch Virtual Interface (SVI) per host pool. Dynamic EID mapping allows host-specific (/32, /128, or MAC) IP mobility.

  • Anycast Gateway: Employs the exact same SVI virtual IP and MAC address across all edge switches (similar to HSRP/VRRP). This allows users to move physically from one switch to another without changing their default gateway IP.

B. Border Node (The Exit Gateway)

image.png

Border Nodes act as the entry and exit points for data traffic leaving or entering the fabric site. They are classified into three types:

  1. Internal Border: Connects to known internal networks (e.g., Data Centers or shared company services).

  2. External Border: Acts as the gateway of last resort to unknown external networks (e.g., the Internet or WAN).

  3. Anywhere Border: Operates as both an internal and external border gateway.

  • Key Functions:

    • EID Advertisement: Uses BGP to advertise fabric IP prefixes to external networks.

    • Virtualization Extension: Maps LISP instances to external VRFs (like VRF-Lite or MPLS VPN) to preserve traffic isolation outside the fabric.

    • Policy Mapping: Translates internal SGT tags to external network tags using SXP or inline tagging.

C. Control-Plane Node (The Central Map System)

image.png

The Control-Plane Node is the fabric's tracking database. It decouples an endpoint's IP/MAC address from its physical location by running a combined LISP Map-Server and Map-Resolver:

  • Host Tracking Database (HTDB): A central repository storing EID-to-fabric-edge node mapping coordinates.

  • Map-Server (MS): Receives registration messages from Edge Nodes to populate the HTDB.

  • Map-Resolver (MR): Resolves destination queries sent by Edge Nodes to provide mapping coordinates.

  • Note: Control Plane nodes can be collocated with Border nodes or run on dedicated hardware. For resiliency, 2 to 6 nodes of the same platform type are recommended.

D. Intermediate Node (The Underlay Transit Core)

Intermediate nodes represent the standard physical switches and routers inside the underlay cloud. They simply provide IP routing and transport between Edge, Border, and Control-Plane nodes without participating in SD-Access encapsulation or policy services.

Back to top