1.4 Cisco SD-Access

2. Fabric Roles

SD-Access assigns logical roles to fabric devices. The same physical device can sometimes host more than one role when supported, but understanding the responsibilities separately is essential for design and troubleshooting.

Figure 2 — Core SD-Access fabric roles and their responsibilities

Fabric Edge Node

Connects wired endpoints and, in fabric-enabled wireless designs, the access infrastructure used by wireless clients.

Provides the endpoint-facing default-gateway function using an anycast gateway model so gateway behavior is consistent across fabric edges.

Discovers and tracks locally attached endpoints, then registers their endpoint identifiers with the control-plane node.

Encapsulates traffic into VXLAN when the destination is on another fabric node and decapsulates traffic arriving for local endpoints.

Applies segmentation and group-based policy based on the endpoint virtual network and security-group classification.

Control-Plane Node

Hosts the LISP control-plane mapping function for the fabric.

Maintains endpoint-location information as EID-to-RLOC mappings.

Receives registrations from fabric edge nodes and answers mapping queries from other fabric nodes.

Enables endpoint mobility by updating the mapping database when an endpoint moves to a different fabric edge.

Should be designed redundantly so a single control-plane-node failure does not remove the fabric mapping service.

Border Node

Connects the SD-Access fabric to networks outside the fabric such as WAN, Internet/security edge, data center, shared services, or traditional campus routing domains.

Exchanges reachability between fabric virtual networks and external routing domains according to design policy.

Provides the fabric handoff point used during coexistence and migration with non-fabric networks.

Can be deployed with control-plane functionality on the same platform in some designs, but the logical roles remain distinct.

Intermediate / Underlay Node

Provides routed IP transport between fabric nodes.

Does not need to terminate endpoints or participate in fabric endpoint mapping.

Should forward infrastructure traffic predictably, with redundant paths and appropriate MTU for encapsulated traffic.

3. Control Plane

The SD-Access control plane uses LISP (Locator/ID Separation Protocol) to separate endpoint identity from endpoint location. A user or device is represented by an Endpoint Identifier (EID), while the fabric node that currently owns that endpoint is represented by a Routing Locator (RLOC). The control-plane node maintains the relationship between the two.

Figure 3 — LISP control-plane mapping and VXLAN data-plane forwarding

EID and RLOC

Control-Plane Registration and Lookup

1. Endpoint A attaches to EDGE-1. EDGE-1 learns the endpoint identity and classification.

2. EDGE-1 registers Endpoint A with the control-plane node, creating an EID-to-RLOC mapping.

3. Endpoint B sends traffic toward Endpoint A from another fabric edge.

4. The source fabric edge queries the control-plane mapping system when it does not already have the destination mapping cached.

5. The control-plane node returns the RLOC of the fabric edge that currently owns Endpoint A.

6. The source fabric edge can now build the VXLAN data-plane forwarding decision toward the destination RLOC.

Endpoint Mobility

When an endpoint moves from one fabric edge to another, the new edge learns the endpoint and updates the control-plane mapping. Other fabric nodes can then resolve the EID to the new RLOC. This is a key reason the logical endpoint identity can remain stable even though the physical attachment point changes.

4. Data Plane

The SD-Access data plane uses VXLAN to carry user traffic between fabric nodes. The original endpoint frame or packet is encapsulated so the physical underlay only needs to route between fabric-node transport addresses. This allows the logical segmentation and endpoint network to be decoupled from the physical path.

VXLAN Forwarding Sequence

1. Endpoint sends traffic to its default gateway on the local fabric edge.

2. The edge determines whether the destination is local, remote in the fabric, or outside the fabric.

3. For a remote-fabric destination, the source edge uses the LISP mapping result to identify the destination RLOC.

4. The source edge encapsulates the traffic in VXLAN and sends it across the routed underlay.

5. Intermediate nodes route only on the outer IP header; they do not need endpoint-specific routes.

6. The destination fabric node removes the VXLAN encapsulation and forwards the original traffic toward the endpoint.

7. Group-based policy can be enforced using endpoint classification such as SGT information associated with the traffic.

Anycast Gateway at the Fabric Edge

Fabric edge nodes present consistent gateway behavior for endpoint subnets. This anycast gateway model reduces dependence on a single physical gateway device and supports endpoint mobility across fabric edges without redesigning the gateway topology for each move.

5. Control-Plane Node — Detailed Operation

The control-plane node is the logical directory service of the fabric. It performs LISP mapping-system functions so that fabric edges and borders can register endpoint or prefix ownership and resolve destinations without relying on broad Layer 2 flooding.

What the Control-Plane Node Does Not Do

It is not the default gateway for every endpoint; the fabric edge provides the endpoint-facing gateway function.

It is not required to sit in the data path for every user packet.

It is not a substitute for the routed underlay; RLOC-to-RLOC IP reachability must already exist.

It is not the policy engine by itself; identity and group-based policy are integrated with the policy system such as Cisco ISE and orchestration through Catalyst Center.

6. Traditional Campus Integration with SD-Access

Most enterprises do not migrate every building and VLAN to SD-Access in one maintenance window. A practical design allows traditional campus blocks and fabric-enabled blocks to coexist, with controlled routing and service handoffs at the fabric border.

Figure 6 — Traditional campus and SD-Access fabric coexist through routed handoff, fusion/shared-services routing, and a fabric border

Common Integration Patterns

Suggested Migration Sequence

1. Inventory existing VLANs, gateways, routing adjacencies, security policy, DHCP/DNS dependencies, and shared services.

2. Build and validate the routed underlay and fabric control-plane/data-plane infrastructure.

3. Integrate the fabric border with external routing and shared services.

4. Create virtual networks, IP pools, identity groups, and policy.

5. Migrate a low-risk access block or pilot group first.

6. Validate endpoint onboarding, policy, DHCP/DNS, internal reachability, and Internet/data-center paths.

7. Repeat the migration by building/floor while monitoring convergence and policy behavior.

8. Remove obsolete Layer 2 extensions and legacy gateway functions only after the new fabric path is stable.

7. End-to-End Packet Flow Examples

Scenario A — Endpoint A to Endpoint B in the Same Virtual Network

1. Endpoint A sends traffic to the local anycast gateway on EDGE-1.

2. EDGE-1 determines that Endpoint B is remote and resolves its EID through the LISP control plane if necessary.

3. The control plane identifies EDGE-2 as the destination RLOC.

4. EDGE-1 VXLAN-encapsulates the traffic and forwards it across the routed underlay.

5. EDGE-2 decapsulates the packet, applies the appropriate policy, and forwards it to Endpoint B.

Scenario B — Endpoint to Data Center / Internet

1. Endpoint traffic reaches the local fabric edge.

2. The edge identifies that the destination is external to the fabric and uses fabric reachability toward the border.

3. The border removes the fabric encapsulation as appropriate and forwards into the external routing/security domain.

4. Return traffic must be routed back through the correct border/fabric path so stateful security devices and policy remain consistent.

Scenario C — Communication Between Different Security Groups

1. Both endpoints may exist inside the same virtual network or in different authorized segments.

2. The identity/policy system classifies endpoints into scalable groups.

3. The source group and destination group are compared against the policy matrix.

4. The policy result permits, denies, or restricts communication according to business intent.

5. The physical switch port or endpoint location can change without requiring the policy to be rewritten for every port.

8. Traditional Campus vs SD-Access

Traditional Enterprise Campus Networking and Cisco Software-Defined Access (SD-Access) are two approaches to designing and operating enterprise campus networks.

A Traditional Campus Network uses technologies such as VLANs, Spanning Tree Protocol (STP), OSPF, BGP, HSRP, VRFs, and Access Control Lists (ACLs) to provide connectivity, routing, redundancy, and security.

Cisco SD-Access builds on enterprise routing and switching technologies by introducing a software-defined fabric with centralized automation, endpoint mobility, network virtualization, and identity-based segmentation.

Both architectures can provide reliable and secure enterprise connectivity. The primary difference is how network services, policies, endpoint reachability, and operations are implemented and managed.