4.1 Catalyst SD-Access Fabric Architecture & Plane Separation

4.1 Catalyst SD-Access Fabric Architecture & Plane Separation

Traditional enterprise campus networks face significant architectural challenges: complex Spanning Tree Protocol (STP) topologies, VLAN sprawl across access closets, rigid IP subnetting tied to physical wiring closets, fragmented wired versus wireless policy enforcement, and manual hop-by-hop configuration.

Cisco Catalyst Software-Defined Access (SD-Access) addresses these operational constraints by deploying a programmable overlay fabric on top of a resilient routed underlay. SD-Access decouples endpoint identity and policy from physical network topology, enabling seamless host mobility, automated provisioning, and consistent zero-trust security segmentation across enterprise campus environments.

+-----------------------------------------------------------------------------------+
|                         CISCO SD-ACCESS FABRIC ARCHITECTURE                       |
+-----------------------------------------------------------------------------------+
|  MANAGEMENT & POLICY PLANE                                                        |
|  +-------------------------------------+   pxGrid    +--------------------------+ |
|  |   Cisco Catalyst Center (DNA-C)     |<===========>| Cisco ISE (Policy Engine)| |
|  |   - Automation, NCP, NDP, Assurance |   REST APIs | - 802.1X, AAA, SGT Matrix| |
|  +-------------------------------------+             +--------------------------+ |
+-----------------------------------------------------------------------------------+
|  CONTROL PLANE (LISP - RFC 6830 / 9300)                                           |
|  +------------------------------------------------------------------------------+ |
|  |   Control Plane Node (MS / MR - Map Server / Map Resolver)                   | |
|  |   - Host Tracking Database (HTDB): Maps EIDs (IP/MAC) -> RLOCs (Edge IPs)     | |
|  +------------------------------------------------------------------------------+ |
+-----------------------------------------------------------------------------------+
|  DATA PLANE OVERLAY (VXLAN-GPO - UDP 4789)                                        |
|  +--------------------+    +--------------------+    +------------------------+   |
|  |  Fabric Edge Node  |<==>|  Fabric Edge Node  |<==>|   Fabric Border Node   |   |
|  |  - Anycast Gateway |    |  - SGT Ingress Tag |    |   - External / DC Exit |   |
|  +--------------------+    +--------------------+    +------------------------+   |
+-----------------------------------------------------------------------------------+
|  ROUTED UNDERLAY (Physical Layer 3 Transport)                                     |
|  +------------------------------------------------------------------------------+ |
|  |  Non-blocking Spine-Leaf / Routed Access, IS-IS / OSPF IGP, MTU >= 9100      | |
|  |  Intermediate Nodes (P Routers) forwarding outer RLOC IP headers only        | |
|  +------------------------------------------------------------------------------+ |
+-----------------------------------------------------------------------------------+

1. Underlay vs. Overlay Network Architecture

The fundamental design premise of SD-Access is the strict separation between the Underlay physical transport network and the Overlay logical fabric.

The Underlay Network

The underlay is the physical infrastructure of switches, routers, and optical links responsible for delivering robust, high-speed, and loop-free Layer 3 packet forwarding between fabric nodes.

• Routed Access Design: SD-Access eliminates Layer 2 switching loops and STP across distribution and access tiers. Every link between fabric switches operates as a routed Point-to-Point Layer 3 interface with /30 or /31 IP subnets.
• Interior Gateway Protocol (IGP):
  • IS-IS (Intermediate System to Intermediate System): The default and recommended IGP deployed automatically by Catalyst Center LAN Automation. It provides rapid convergence, native support for multi-topology routing, and protocol independence without relying on IP reachability to establish adjacencies.
  • OSPF (Open Shortest Path First): Supported for manual underlay deployments where enterprise standards mandate OSPFv2/OSPFv3.
• Loopback0 Addressing: Every fabric node is provisioned with a dedicated /32 Loopback0 IP address. This IP serves as the node's Routing Locator (RLOC) and must be advertised by the underlay IGP across the entire network.
• Maximum Transmission Unit (MTU): Because overlay encapsulation appends a 50-byte VXLAN-GPO header (outer Ethernet + IP + UDP + VXLAN) to every original frame, all physical underlay interfaces must be configured with a minimum MTU of 1550 bytes (recommended: 9100 bytes Jumbo MTU) to prevent packet fragmentation.
• Multicast Transport: The underlay must support IP Multicast routing (PIM-ASM or PIM-SSM) or Ingress Head-End Replication to handle Broadcast, Unknown Unicast, and Multicast (BUM) traffic across the overlay.

+-----------------------------------------------------------------------------------+
|                     UNDERLAY VS. OVERLAY ATTRIBUTE MATRIX                         |
+-----------------------+----------------------------------+------------------------+
| Attribute             | Underlay Network                 | Overlay Network        |
+-----------------------+----------------------------------+------------------------+
| Primary Responsibility| Physical Layer 3 packet transport| Host policy & mobility |
| Addressing Identifier | Routing Locator (RLOC IP)        | Endpoint ID (EID IP/MAC|
| Routing Protocols     | IS-IS / OSPF (IGP)               | LISP (Control Plane)   |
| Forwarding Format     | Standard IPv4 / IPv6 Packets     | VXLAN-GPO (UDP 4789)   |
| Loop Prevention       | Layer 3 Equal-Cost Multipathing  | LISP Host Tracking     |
| Security Segmentation | Global Routing Table / Underlay  | Virtual Networks & SGT |
+-----------------------+----------------------------------+------------------------+

The Overlay Network

The overlay represents the virtualized, software-defined network created by encapsulating user frames at the fabric edge and tunneling them across the underlay.

• Decoupled Addressing: Client endpoints retain their IP addresses (Endpoint Identifiers - EIDs) regardless of where they physically attach in the campus, enabling seamless Layer 2 and Layer 3 roaming.
• Macro-Segmentation: Implemented via Virtual Routing and Forwarding (VRF) instances referred to as Virtual Networks (VNs). Each VN maintains an isolated routing and forwarding table, preventing inter-VN communication unless routed through an external firewall or fusion router.
• Micro-Segmentation: Implemented within each VN using Security Group Tags (SGTs) and Scalable Group ACLs (SGACLs).
• Anycast Default Gateway: Every Fabric Edge node is configured with the identical virtual IP and virtual MAC address (00:00:0c:9f:f4:5c or configured switch MAC) for each client subnet. Endpoints use this local anycast gateway as their default router, eliminating First-Hop Redundancy Protocol (HSRP/VRRP) polling overhead.

2. SD-Access Fabric Node Roles & Functions

Within an SD-Access fabric, network devices perform specialized control plane, data plane, or boundary functions.

+-----------------------------------------------------------------------------------+
|                         SD-ACCESS FABRIC NODE ROLES                               |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|             +-----------------------------------------------+                     |
|             |     Control Plane Node (LISP MS / MR)         |                     |
|             |     - Host Tracking Database (EID -> RLOC)    |                     |
|             +-----------------------------------------------+                     |
|                              ^             ^                                      |
|              LISP Control    |             |    LISP Control                      |
|              (Map-Register)  |             |    (Map-Request)                     |
|                              v             v                                      |
|   +-----------------------+                   +-------------------------------+   |
|   |   Fabric Edge Node    |                   |      Fabric Border Node       |   |
|   |   - Anycast Gateway   |                   |      - External / DC Exit     |   |
|   |   - 802.1X / SGT Tag  |                   |      - LISP <-> BGP/OSPF      |   |
|   |   - VXLAN Encap/Decap |                   |      - Internal / External /  |   |
|   +-----------------------+                   |        Anywhere Border Modes  |   |
|          |         |                          +-------------------------------+   |
|     [Wired Host] [Fabric AP]                                |                     |
|                    |                                 [WAN / DC / Internet]        |
|               [Wireless Host]                                                     |
+-----------------------------------------------------------------------------------+

1. Control Plane Node (CP) - LISP Map Server / Map Resolver

• Technology Engine: Operates as a centralized Locator/ID Separation Protocol (LISP) Map Server (MS) and Map Resolver (MR).
• Host Tracking Database (HTDB): Maintains a real-time repository mapping every active endpoint identifier (EID, IPv4/IPv6 host /32 or /128, and Layer 2 MAC address) to the switch loopback IP (RLOC) where the endpoint is physically connected.
• Operational Processing:
  • Receives Map-Register messages from Fabric Edge nodes whenever hosts attach or authenticate.
  • Receives Map-Request queries from Fabric Edge nodes seeking the current RLOC of a remote destination EID.
  • Resolves queries and sends Map-Reply messages directing ingress edges to the appropriate egress RLOC.
• Chassis Redundancy: Multiple Control Plane nodes are deployed in an active/active state. Edge nodes register with all control plane nodes simultaneously for sub-second resiliency.

2. Fabric Edge Node (FE)

• Position: Located at the access layer (e.g., Cisco Catalyst 9300 / 9400 series switches).
• Core Responsibilities:
  • Endpoint Onboarding & Authentication: Integrates with Cisco ISE to execute 802.1X, MAC Authentication Bypass (MAB), or WebAuth. Learns client MAC, IP, VN, and assigns Security Group Tags (SGTs).
  • LISP Registration: Sends LISP Map-Register messages to Control Plane nodes to publish local host EID-to-RLOC bindings.
  • Anycast Default Gateway: Serves as the first-hop default gateway for client subnets.
  • VXLAN Encapsulation / Decapsulation: Acts as a LISP Ingress/Egress Tunnel Router (ITR/ETR). Encapsulates local traffic into VXLAN-GPO (adding outer IP header with source/dest RLOC and 16-bit SGT) and decapsulates incoming VXLAN-GPO frames.
  • Policy Enforcement: Enforces Scalable Group ACLs (SGACLs) at egress based on the destination endpoint's SGT.

3. Fabric Border Node (FB)

• Position: Located at the aggregation/core boundary connecting the SD-Access overlay to outside networks (WAN, Data Center, Internet, Shared Services, Non-Fabric Campus).
• LISP Role: Operates as a LISP Proxy Ingress/Egress Tunnel Router (PITR / PETR).
• Border Node Deployment Modes:

• Route Redistribution: Fabric Border nodes translate between LISP host EIDs inside the fabric and external routing protocols (e.g., BGP EVPN, MP-BGP, or OSPF) used in WAN and Data Center interconnects.

4. Fabric Wireless LAN Controller (Fabric WLC)

• Control Plane Termination: Lightweight Access Points establish standard CAPWAP control tunnels (UDP 5246) to the Fabric WLC for centralized RF management, radio configuration, and client authentication.
• Data Plane Elimination: In traditional campus networks, APs tunnel client data back to the WLC over CAPWAP (UDP 5247). In SD-Access, CAPWAP data tunneling is eliminated! The AP bridges 802.11 client frames to 802.3 Ethernet directly at the Fabric Edge switch port. The Fabric Edge encapsulates client traffic into VXLAN-GPO directly.
• Client Registration: The Fabric WLC registers wireless client EID IP and MAC addresses with the LISP Map Server on behalf of the APs, allowing wired and wireless endpoints to be treated with identical fabric policies.

5. Intermediate Nodes (P Routers)

• Function: Physical routers and switches in the core/distribution underlay situated between Fabric Edge and Border nodes.
• Simplicity: Intermediate nodes are completely unaware of the overlay fabric. They do not maintain LISP tables, do not process VXLAN-GPO headers, and do not track SGTs. They simply route outer IP packets between RLOC loopbacks using standard underlay routing (IS-IS/OSPF) at wire speed.

3. LISP Control Plane Protocol Mechanics

Cisco SD-Access utilizes an enhanced version of the Locator/ID Separation Protocol (LISP) (RFC 6830 / RFC 9300) to maintain an authoritative, pull-based host tracking database.

The LISP Architectural Principle

In standard IP routing, an IP address represents both WHO the device is (Identity) and WHERE the device is physically located in the network topology (Location). When a device moves to a different switch, its IP subnet must change, breaking active TCP sessions.

LISP solves this problem by splitting the IP namespace into two distinct numbering spaces:

1. Endpoint Identifier (EID): The IP address (/32 IPv4 or /128 IPv6) or MAC address assigned to an end device. The EID represents host identity and remains static regardless of physical relocation.
2. Routing Locator (RLOC): The IP address assigned to the upstream switch's Loopback0 interface. The RLOC represents topological location and is routable across the underlay IGP.

+-----------------------------------------------------------------------------------+
|                         LISP EID-TO-RLOC ADDRESS MAPPING                          |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|   ENDPOINT IDENTIFIER (EID)            ROUTING LOCATOR (RLOC)                     |
|   - Host IP: 10.1.1.50                 - Switch Loopback: 192.168.100.1           |
|   - Unchanged during mobility          - Topological Underlay Address             |
|   - Maintained in LISP HTDB            - Routed via Underlay IS-IS / OSPF         |
|                                                                                   |
|   [Host A (EID)] ===== Attached to =====> [Fabric Edge Switch (RLOC)]             |
+-----------------------------------------------------------------------------------+

End-to-End LISP Control & Data Flow Sequence

Consider Host A (EID 10.1.1.10, attached to Fabric Edge 1) transmitting data to Host B (EID 10.1.2.20, attached to Fabric Edge 2):

+----------------------------------------------------------------------------------------------------+
|                                LISP RESOLUTION & FORWARDING WALK                                   |
+----------------------------------------------------------------------------------------------------+
  [1. Host Discovery & Registration]
      * Host B powers on and sends an ARP/DHCP packet to Fabric Edge 2 (FE2).
      * FE2 authenticates Host B via 802.1X with Cisco ISE.
      * FE2 sends a LISP 'Map-Register' message to the Control Plane Node (MS/MR).
      * MS/MR adds Host B (10.1.2.20) -> FE2 Loopback (192.168.100.2) to the Host Tracking Database.
                                      |
                                      v
  [2. Packet Ingress & Local Cache Lookup]
      * Host A transmits an IP packet destined to Host B (10.1.2.20).
      * Fabric Edge 1 (FE1) intercepts the packet at the default Anycast Gateway.
      * FE1 checks its local LISP Map-Cache for destination EID 10.1.2.20.
                                      |
                                      v
  [3. Map-Request to Control Plane]
      * (Assuming Cache Miss): FE1 sends a LISP 'Map-Request' (UDP 4342) to the Map Resolver (MR).
      * The MR checks the Host Tracking Database and locates FE2 as the authoritative RLOC.
                                      |
                                      v
  [4. Map-Reply to Ingress Edge]
      * The MR (or FE2 on behalf of MS) returns a LISP 'Map-Reply' to FE1.
      * The Map-Reply contains: Destination EID prefix (10.1.2.20/32), Target RLOC (192.168.100.2),
        and LISP Instance ID / VNI.
      * FE1 installs this entry into its hardware LISP Map-Cache (FIB).
                                      |
                                      v
  [5. VXLAN-GPO Encapsulation & Underlay Forwarding]
      * FE1 encapsulates Host A's packet inside a VXLAN-GPO header.
      * Outer IP: Source IP = 192.168.100.1 (FE1 RLOC), Dest IP = 192.168.100.2 (FE2 RLOC).
      * VXLAN-GPO Header: VNI = 4099 (Corp VN), Group Policy ID = SGT 4 (Employees).
      * FE1 forwards the packet across the underlay; intermediate P routers route by outer IP.
                                      |
                                      v
  [6. Egress Decapsulation & SGACL Policy Enforcement]
      * FE2 receives the packet, strips the outer IP/UDP/VXLAN headers.
      * FE2 reads the Source SGT (4) from the VXLAN header and destination SGT (5) from local FIB.
      * FE2 evaluates the TrustSec matrix: if permitted, forwards the native frame to Host B.
+----------------------------------------------------------------------------------------------------+

4. VXLAN-GPO Data Plane Architecture

While LISP governs the control plane, Virtual Extensible LAN with Group Policy Option (VXLAN-GPO) (RFC 7348 + Draft-Smith-VXLAN-GPO) powers the data plane forwarding in SD-Access.

Why VXLAN-GPO Instead of Standard VXLAN?

Standard VXLAN encapsulates Layer 2 Ethernet frames inside Layer 4 UDP packets (destination UDP port 4789) and uses a 24-bit Virtual Network Identifier (VNI) to provide up to 16 million overlay segments (macro-segmentation). However, standard VXLAN has no native mechanism to carry security group metadata.

VXLAN-GPO leverages reserved flag bits in the 8-byte VXLAN header to carry a 16-bit Group Policy ID (Security Group Tag - SGT) directly in the encapsulation header! This enables simultaneous Macro-segmentation (VNI/VRF) and Micro-segmentation (SGT) in every single data packet without requiring out-of-band policy lookups.

+-----------------------------------------------------------------------------------+
|                    VXLAN-GPO PACKET ENCAPSULATION BREAKDOWN                       |
+-----------------------------------------------------------------------------------+
|  OUTER TRANSPORT HEADERS (Underlay Routing)                                       |
|  +-----------------------------------------------------------------------------+  |
|  | Outer Ethernet Header (14 Bytes): Ingress MAC -> Next-Hop MAC, EtherType IP |  |
|  +-----------------------------------------------------------------------------+  |
|  | Outer IP Header (20 Bytes): Src IP = Ingress RLOC, Dst IP = Egress RLOC     |  |
|  +-----------------------------------------------------------------------------+  |
|  | Outer UDP Header (8 Bytes): Src Port = Flow Hash, Dst Port = 4789           |  |
|  +-----------------------------------------------------------------------------+  |
|  OVERLAY FABRIC HEADER (SD-Access Policy & Virtualization)                         |
|  +-----------------------------------------------------------------------------+  |
|  | VXLAN-GPO Header (8 Bytes):                                                 |  |
|  |  [Flags: G=1, I=1] [Group Policy ID / SGT (16-bit)] [VNI (24-bit)] [Rsvd]   |  |
|  +-----------------------------------------------------------------------------+  |
|  INNER CLIENT PAYLOAD (Original Endpoint Frame)                                   |
|  +-----------------------------------------------------------------------------+  |
|  | Inner Ethernet Header (14 Bytes): Host A MAC -> Host B MAC                  |  |
|  +-----------------------------------------------------------------------------+  |
|  | Inner IP Header (20 Bytes): Src IP = 10.1.1.10, Dst IP = 10.1.2.20          |  |
|  +-----------------------------------------------------------------------------+  |
|  | Client Payload Data (TCP/UDP, Application Data)                             |  |
|  +-----------------------------------------------------------------------------+  |
|  | Frame Check Sequence / FCS (4 Bytes)                                        |  |
|  +-----------------------------------------------------------------------------+  |
+-----------------------------------------------------------------------------------+

Detailed Field Breakdown

1. Outer UDP Header:

   • Destination Port: Always UDP port 4789 (the IANA-assigned standard port for VXLAN / VXLAN-GPO).
   • Source Port: Dynamically calculated by the ingress switch using a 5-tuple hash of the inner payload (Inner Source IP, Dest IP, Protocol, Source Port, Dest Port). This dynamic UDP source port allows underlay intermediate switches to load-balance flows across multi-path links using standard Equal-Cost Multi-Pathing (ECMP) without inspecting inner payload headers.

2. VXLAN-GPO 8-Byte Header Structure:

   • G-Bit (Group Policy Bit): Bit 2 is set to 1 to indicate that the Group Policy ID field contains a valid 16-bit SGT.
   • I-Bit (VNI Bit): Bit 3 is set to 1 to indicate that the 24-bit VNI field contains a valid Virtual Network Identifier.
   • Group Policy ID (16 Bits): Carries the Source Security Group Tag (e.g., SGT 4 for Employees, SGT 10 for Point-of-Sale). The egress switch reads this tag directly to enforce micro-segmentation SGACLs.
   • Virtual Network Identifier / VNI (24 Bits): Identifies the target Layer 2 or Layer 3 Virtual Network (VRF), enabling 16 million distinct macro-segments.

3. Total Header Overhead & MTU Budget:

   • Outer Ethernet (14 bytes) + Outer IP (20 bytes) + Outer UDP (8 bytes) + VXLAN-GPO (8 bytes) = 50 Bytes Total Encapsulation Overhead.
   • A standard 1500-byte client Ethernet frame expands to 1550 bytes when encapsulated. Therefore, all physical switch uplinks, core routers, and fiber transport in the underlay must be configured with an MTU of $\ge$ 1550 bytes (recommended: 9100 bytes).

5. Cisco Catalyst Center & Cisco ISE Integration

SD-Access is fully orchestrated and managed through the integration of Cisco Catalyst Center (formerly Cisco DNA Center) and Cisco Identity Services Engine (ISE).

+-----------------------------------------------------------------------------------+
|                     CATALYST CENTER & CISCO ISE INTEGRATION                       |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|  +-------------------------------+             +-------------------------------+  |
|  |     Cisco Catalyst Center     |    pxGrid   |          Cisco ISE            |  |
|  |  [Single Pane of Glass UI]    |<===========>|  [Identity & Policy Authority]|  |
|  |  - Design (Sites, IP Pools)   |  REST APIs  |  - 802.1X / AAA Authentication|  |
|  |  - Policy (SGT Matrix, VNs)   |             |  - Endpoint Profiling & Posture|  |
|  |  - Provision (LAN Automation) |             |  - Dynamic SGT Assignment     |  |
|  |  - Assurance (NDP, AI Health) |             |  - TrustSec Matrix Propagation|  |
|  +-------------------------------+             +-------------------------------+  |
|                  |                                             |                  |
|       NETCONF / RESTCONF / CLI                              RADIUS                |
|                  v                                             v                  |
|  +-----------------------------------------------------------------------------+  |
|  |                    SD-Access Campus Fabric Hardware Nodes                   |  |
|  +-----------------------------------------------------------------------------+  |
+-----------------------------------------------------------------------------------+

Catalyst Center Architectural Subsystems

1. Network Control Platform (NCP): The automation and orchestration engine. NCP translates intent-based policies defined in the GUI into device-level configurations and pushes them to fabric switches via NETCONF / RESTCONF / YANG and SSH/CLI.
2. Network Data Platform (NDP): The analytics and assurance engine. NDP ingests streaming telemetry (NetFlow, Syslog, SNMP, gRPC telemetry) from fabric switches, APs, and WLCs, evaluating network health, client connectivity issues, and generating automated root-cause remediation steps.

Four Core Catalyst Center Workflows

• Design: Hierarchical definitions of geographic sites, buildings, floors, IP address pools, global network settings (DNS, NTP, AAA), and wireless SSIDs.
• Policy: Creation of Virtual Networks (VNs), Security Group Tags (SGTs), Access Control Contracts (SGACLs), and the TrustSec group-based policy matrix.
• Provision: Onboarding devices via LAN Automation (Plug-and-Play discovery over IS-IS), assigning fabric roles (Control Plane, Edge, Border), and provisioning fabric sites.
• Assurance: Comprehensive 360-Degree Device and Client Health Dashboards, predictive AI/ML analytics, automated packet trace analysis, and issue correlation.

Cisco ISE pxGrid Integration

Cisco Catalyst Center and Cisco ISE establish a secure, bidirectional integration over Platform Exchange Grid (pxGrid) and REST APIs:

• Catalyst Center automatically registers as a pxGrid client on Cisco ISE.
• ISE shares user identity, device profiling attributes, and SGT definitions with Catalyst Center.
• When an administrator creates or modifies an SGT policy matrix rule in Catalyst Center, Catalyst Center pushes the policy intent to Cisco ISE.
• When an endpoint attaches to a Fabric Edge switch, the switch authenticates the host with Cisco ISE via RADIUS (802.1X/MAB). ISE responds with a RADIUS Access-Accept containing the authorized Virtual Network (VRF) and SGT assignment.

6. Cisco IOS-XE SD-Access CLI Verification

Although SD-Access is provisioned automatically by Cisco Catalyst Center, network engineers must master CLI commands to verify LISP control plane state, VXLAN data paths, and fabric client registrations.

! 1. Verify LISP Control Plane Map Server status on the Control Plane Node
ControlPlane-Switch# show lisp site
LISP Site Registration Information
Site Name      Last Register       Up     Who Last Registered     EID Prefix
site_corp      00:00:14            yes    192.168.100.1:4342      10.1.1.0/24
               00:00:08            yes    192.168.100.2:4342      10.1.2.0/24

! 2. Verify specific host EID-to-RLOC registration in a Virtual Network (VNI)
ControlPlane-Switch# show lisp instance-id 4099 ipv4 server
LISP Site Registration Table for Instance ID 4099 (VRF: CORP)
EID Prefix          Producer    Last Registered     RLOC Address
10.1.1.10/32        Edge-1      00:00:12            192.168.100.1
10.1.2.20/32        Edge-2      00:00:05            192.168.100.2

! 3. Verify hardware LISP Map-Cache on an Ingress Fabric Edge Switch
Edge1-Switch# show lisp instance-id 4099 ipv4 map-cache
LISP IPv4 Mapping Cache for EID-table vrf CORP (Instance ID 4099)

10.1.2.20/32, uptime: 00:18:42, expires: 23:41:18, priority: 1, weight: 100
  Locator           Uptime    State      Pri/Wgt     Encsum
  192.168.100.2     00:18:42  up           1/100     none

! 4. Verify 802.1X Authentication and Dynamic SGT Assignment on Fabric Edge
Edge1-Switch# show access-session interface GigabitEthernet1/0/1 details
            Interface:  GigabitEthernet1/0/1
          MAC Address:  00a1.2b3c.4d5e
         IPv4 Address:  10.1.1.10
            User-Name:  alice@enterprise.local
               Status:  Authorized
               Domain:  DATA
       Security Group:  4 (Employees)
                  VLAN:  1020 (VN: CORP)
          Session-Timeout:  3600s