2.2 Cisco SD-Access Architecture: Control Plane, Data Plane, and Fabric Node Roles

Cisco SD-Access Architecture: Control Plane, Data Plane, and Fabric Node Roles

Enterprise campus networks historically relied on hierarchical models with Layer 2 Spanning Tree Protocol (STP) domains spanning access and distribution layers. These designs suffered from blocked links, complex multi-chassis EtherChannel workarounds, broadcast flooding, and rigid VLAN-to-subnet bindings that restricted mobility. Securing endpoints required complex manual IP-based Access Control Lists (ACLs).

Cisco Software-Defined Access (SD-Access) resolves these limitations by introducing a programmable campus fabric that decouples network services from physical infrastructure, pairing an automated routed underlay with a virtualized overlay to deliver uniform policy, automated segmentation, and seamless mobility.

Underlay vs. Overlay Architecture

SD-Access establishes a strict separation between physical transport and virtualized network services:

+--------------------------------------------------------------+
|                         OVERLAY                              |
|   Virtual Networks (VRFs) + Group-Based Policy (SGTs)        |
|   Data Plane: VXLAN-GPO  |  Control Plane: LISP              |
+--------------------------------------------------------------+
                               |
               (Encapsulated across Underlay)
                               v
+--------------------------------------------------------------+
|                         UNDERLAY                             |
|   Physical Switches, Routers, and Point-to-Point Links       |
|   Layer 3 Routed Fabric (IS-IS / OSPF) with MTU >= 9100      |
+--------------------------------------------------------------+

The Routed Underlay

The underlay comprises the physical switches, routers, and cabling providing base IP connectivity:

• Layer 3 Routed Fabric: Spanning Tree is eliminated from the core and distribution layers. Every link between access and distribution switches operates as a routed point-to-point Layer 3 connection.
• Equal-Cost Multi-Pathing (ECMP): With Layer 3 routed interfaces, all physical links actively forward traffic simultaneously, delivering deterministic sub-second convergence.
• Routing Protocol: Intermediate System to Intermediate System (IS-IS) is standard and automatically deployed by Cisco Catalyst Center LAN Automation; routed OSPF is also supported.
• Underlay MTU: Cisco recommends a 9100-byte jumbo MTU on underlay links, and LAN Automation configures it. At a minimum, every link must carry the largest client frame plus the 50 bytes of VXLAN-GPO overhead, so a 1500-byte client packet needs at least 1550 bytes.

The Virtualized Overlay

The overlay is the virtualized network operating over the underlay:

• Macro-Segmentation: Implemented via Virtual Networks (VNs) using Virtual Routing and Forwarding (VRF) instances to isolate distinct user groups (e.g., Corporate, IoT, Guests).
• Micro-Segmentation: Granular security enforced within each VN using Cisco TrustSec Security Group Tags (SGTs). Policies apply to endpoints regardless of IP address or switch port.

Control Plane Architecture: Locator/ID Separation Protocol (LISP)

Traditional routing conflates identity (who a device is) with location (where it connects). SD-Access uses Locator/ID Separation Protocol (LISP; originally RFC 6830, now RFC 9300 and RFC 9301) to split the IP address into two namespaces:

1. Endpoint Identifier (EID): The IP or MAC address assigned to an end host. The EID represents host identity and remains static when roaming.
2. Routing Locator (RLOC): The Layer 3 underlay loopback IP address of the Fabric Edge switch to which the host attaches. The RLOC represents location and is routable in the underlay.

LISP Control Plane Components

[Host A (EID_A)] ---> [Edge 1 (RLOC_1)] ---------------------> [Edge 2 (RLOC_2)] ---> [Host B (EID_B)]
                            |                                        ^
                   (1) Map-Request (EID_B?)                 (2) Map-Reply (EID_B is at RLOC_2)
                            v                                        |
                   +-------------------------------------------------+
                   |           Fabric Control Plane Node             |
                   |               (LISP MS / MR)                    |
                   +-------------------------------------------------+

Eliminating Broadcast Flooding

Instead of broadcasting ARP requests across all switches in a VLAN, the Fabric Edge intercepts host ARP requests, queries the Control Plane Node with a unicast LISP Map-Request, receives the target switch's RLOC, and forwards traffic directly via unicast VXLAN.

Data Plane Encapsulation: VXLAN-GPO

SD-Access uses Virtual Extensible LAN with Group-Based Policy (VXLAN-GPO) for data forwarding. Standard VXLAN (RFC 7348) encapsulates Layer 2 frames in UDP (port 4789) with a 24-bit VXLAN Network Identifier (VNI). VXLAN-GPO modifies the 8-byte VXLAN header to carry a 16-bit Group Policy ID (Security Group Tag / SGT).

VXLAN-GPO Header Breakdown

Total encapsulation overhead is 50 bytes, allowing policy (SGT) and multi-tenancy (VNI) to travel inline with every packet.

Fabric Node Roles

An SD-Access fabric organizes devices into distinct functional roles:

Border Node Classifications

• Internal Border: Connects to corporate data centers and internal services; advertises fabric subnets out and imports enterprise routes.
• External Border: Connects to uncontrolled external networks (Internet/Cloud); originates and advertises a default route (0.0.0.0/0) into the fabric.
• Anywhere Border: Combines internal and external border responsibilities on a single platform.

Centralized Orchestration: Catalyst Center and ISE

• Cisco Catalyst Center (formerly DNA Center): Central automation and assurance engine. Manages LAN Automation (PnP underlay provisioning via IS-IS), fabric design, and telemetry assurance.
• Cisco Identity Services Engine (ISE): Integrates via pxGrid to authenticate endpoints, evaluate posture, assign SGTs dynamically, and propagate security matrices to fabric nodes.