Skip to main content

SD-Access - Role of Cisco DNA Center and ISE

1. Core Solution Components

Cisco SD-Access provides automated, end-to-end user, device, and application segmentation without requiring a physical network redesign. This architecture relies on two primary components:

  • Cisco DNA Center (DNAC): The central automation and orchestration engine used to design, provision, apply policies, and monitor the fabric.

  • Cisco Identity Services Engine (ISE): The secure access platform that defines identity, authenticates endpoints, and enforces security policies.

2. Integration & Policy Automation

DNAC and ISE integrate using pxGrid (Platform Exchange Grid) and REST APIs to exchange client context and automate fabric configurations on ISE.

  • Orchestration vs. Execution: Groups, policies, AAA, and profiling are driven by ISE, but orchestrated through the user-friendly policy workflows inside DNAC.

  • Segmentation Mechanics: ISE provides network segmentation by passing key attributes—specifically VLANs, SGTs, and SGACLs (Security Group Access Control Lists)—to fabric switches.

  • Overlay Encapsulation: Scalable groups are identified using a 16-bit Scalable Group Tag (SGT) carried directly inside the VXLAN data plane header, while macro-segmentation isolates multiple virtual networks using unique VNIDs (Virtual Network Identifiers).

  • Wireless Guest Automation: The integration completely automates wireless guest onboarding end-to-end.

image.png

3. ISE Node Roles & Deployment Models

ISE serves as the policy controller, providing intent services like AAA, network visibility, onboarding, security, and macro/microsegmentation.

ISE Node Personas (Roles)

  • Primary Administration Node (PAN): The single point of configuration and integration with DNAC. It registers all configuration changes, synchronizes database context, and relays the IP addresses of other active ISE nodes (PSN, MnT, pxGrid) to DNAC.

  • Policy Service Node (PSN): The "muscle" that processes active authentication, authorization, and onboarding requests sent by fabric edge switches.

  • Monitoring and Troubleshooting Node (MnT): The logging engine that gathers analytical data and network logs.

  • pxGrid Node (ISE-PXG): Shares session directories and TrustSec metadata with DNAC.

image.png

Deployment Models

  • Redundant Standalone / Two-Node: The basic recommended SD-Access deployment. Two nodes run all services (PAN, PSN, MnT) concurrently for redundancy, presenting a single IP address to the network for the PSN persona.

  • Distributed Model: Utilizes multiple active, dedicated PSNs, each with a unique IP address. DNAC automatically learns these addresses, allowing administrators to map specific fabric edge switches to their geographically nearest PSN.

4. The 4-Step DNA Center Workflow

DNAC structures campus lifecycle management into four operational pillars:

image.png

  • Design: Used to configure global network settings, physical site profiles, IP address pools, DNS, DHCP, Software Image Management (SWIM), Plug-and-Play (PnP) templates, and user access parameters.

  • Policy: Used to define business intent, create Virtual Networks (VNs), assign endpoints to VNs, and establish group-to-group policy contracts.

  • Provision: Used to provision devices for active management, define fabric domains, assign node roles (Control Plane, Border, Edge), configure fabric wireless, and establish external transit connectivity.

  • Assurance: Employs proactive monitoring, health dashboards (for network devices, clients, and applications), issue management, path traces, and sensor-driven testing to ensure the network meets its configured intent.

Back to top