SD-Access - Overview

1. Underlay vs. Overlay: The Core Architecture

An SD-Access fabric works by running a virtual logical network (the Overlay) on top of a physical hardware network (the Underlay).

Feature	Underlay Network (The Physical Foundation)	Overlay Network (The Virtual Fabric)
What it is	Physical switches, routers, and cabling.	A logical, virtualized topology built on top of the physical hardware.
Primary Role	Establishes physical, edge-to-edge IP reachability.	Isolates data and control plane traffic to support multitenancy.
How it works	Uses standard IP routing protocols. End-user subnets are not part of it.	Encapsulates user traffic in tunnels (adds a 50-byte fabric header).
Visibility	Completely visible to administrators.	Completely invisible to end hosts.
Examples	Traditional L3 routed access networks.	GRE, MPLS, IPsec, DMVPN, LISP, CAPWAP, ACI.

You can build your physical underlay manually (reusing existing infrastructure) or automate it from scratch using Cisco DNA Center.

Aspect	Manual Underlay	Automated Underlay (LAN Automation)
Best For...	Reusing your existing network.	Greenfield (new) deployments or wiped devices.
How it works	Manually configured, then imported/discovered.	Fully automated bootstrap using Plug-and-Play (PnP).
Key Requirements	IP reachability edge-to-edgeL2 or L3 (L3 highly recommended)Any IGP routing protocol	Standard Cisco PnP bootstrap. Devices must have a clean/erased configRequires a global "underlay" IP address pool
Why IS-IS?	Recommended. Scalable and integrates perfectly with DNA Center.	Prescriptive (Required). Offers IP-agnostic peering, loopback peering, and no IP-dependency for neighbors.
Crucial Limits	MTU: Must accommodate the extra 50-byte fabric header. Latency: Round-trip time (RTT) must be ≤ 100ms.	Customization: 100% prescriptive (non-customizable). Requires a pre-setup "seed" device.

The system is split between management applications (the brains) and fabric nodes (the muscle).

Cisco DNA Automation: The GUI-driven central controller. Provides intent-based control (Network Control Platform) and configuration.
Cisco DNA Assurance: The health monitor. Uses data collectors (like NDP) to analyze traffic flows and monitor fabric health.
Identity Services (Cisco ISE): The security gatekeeper. Maps endpoints to groups and dynamically enforces security policies.

Control Plane Node: The database/map system. Keeps track of which endpoints are connected to which physical devices.
Fabric Border Node: The gateway. Connects external Layer 3 networks (like the internet or a traditional WAN) to the SD-Access fabric.
Fabric Edge Node: The point of entry. Connects wired end-user devices (computers, printers) to the fabric.
Fabric Wireless Controller (WLC): The wireless anchor. Connects Access Points (APs) and wireless clients to the fabric.