In the past article, I discussed SDN so today I will be discussing Cisco’s version of SDN which is called “SD-Acess.” SD-Access is a SDN architecture designed for enterprise campus networks and is used to simplify network deployment, management, automation, and security. Instead of configuring each network device individually, administrators can define policies, segmentation, and user access requirements through a centralized SDN controller called the “Cisco Catalyst Center.”
SD-Access is formed with different components such as:
- Underlay
- Overlay
- Fabric (Underlay + Overlay)
Underlay – The underlay in Cisco SD-Access is the physical IP network that provides the transport foundation of the network. It provides the physical routers, switches, links, and layer 3 routing protocols to provide reliable IP connectivity between all fabric devices. The underlay is responsible for transporting packets across the network and is unaware of virtual networks (overlay), user identities, security policies, and endpoint information. The underlay is typically built using a layer 3 design with an IGP, such as OSPF, EIGRP or IS-IS.
Overlay – The overlay in Cisco SD-Access is the virtual network built on top of the existing physical network (underlay) that carries user traffic without being dependent on the physical design of the underlying network infrastructure. This means that the overlay will continue to function no matter if the network topology is a three-tier design, collapsed-core design, mesh, or star design. Unlike traditional networks which rely on VLANs and IP based forwarding, the overlay uses VXLAN (Virtual Extensible) to encapsulate and forward packets across the network. The overlay allows endpoints to communicate as though they are on the same logical network even if they are geographically distant.
Fabric – In Cisco SD-Access the fabric is a unified logical network that combines the physical underlay and the virtualized overlay into a single, programmable, automated network. The fabric is the entire SD-Access set up combined with network devices providing IP connectivity, and packets being forwarded over that infrastructure using protocols such as VXLAN.
SD-Access involves two different features that differentiate it from traditional networks by introducing Cisco Trustsec and LISP (Locator ID Separation Protocol.)
LISP – LISP (Locator ID Separation Protocol) is in Cisco SD-Access is a routing and tunneling protocol that separates device identity from its physical network location. In traditional IP networks, an IP address is used to provide both device identification and location. SD-Access uses LISP instead, which assigns each authenticated user or device an EID (Endpoint Identifier), which identifies the device by its IP address, and an RLOC (Router Locator), which is the loopback IP address of the fabric edge node where the endpoint is currently connected. Since LISP separates identity from location, endpoints are able to move throughout the network without changing their identity or requiring routing updates.
Cisco TrustSec – TrustSec is a security architecture used in SD-Access that simplifies access control by enforcing security policies based on identity of a user or device rather than its IP address. Instead of relying on traditional IP based ACLs, Trustsec assigns each authenticated device (user) a SGT (Security Group Tag), which is a numeric label that defines its security role. Examples of security roles are employees, guests, contractors, or IoT devices. The SGT determines which network resources, services, and applications the device (user) is permitted to access. As traffic moves through the network, the SGT is carried with it, allowing consistent access policies to be applied regardless of where the endpoint is located. So if John’s laptop has a SGT of 20 with employee rights, moves from switch A to switch B, his permission will stay the same despite moving around the campus network.
SD-Acces network topology is formed with 3 types of network devices:
- Fabric Edge Node
- Border Node
- Control Node
Fabric Edge Node – In Cisco SD-Access, the fabric edge node is a network device, such as a switch, that serves as the connection point between endpoints and the actual fabric. Fabric edge nodes connect wired and wireless devices such as IP phones, printers, computers, APs, or IoT devices to the fabric. It provides the functionality as an access layer switch would.
Border Node – The border node is typically a layer 3 switch that serves as the gateway between the SD-Access fabric and external networks. It enables communication between endpoints inside the fabric and resources outside the fabric such as the internet, data centers, branch offices, legacy networks or other enterprise networks.
Control Node – A control node is a network device that serves as the mapping database for the SD-Access fabric by maintaining the relationship between EIDs and their current location (RLOC) within the network. A control node stores and distributes endpoint-to-location mappings, which allow fabric edge nodes to determine the location of a destination endpoint before forwarding traffic. The control node functions in the control plane, meaning it does not forward user traffic and instead maintains and provides EID-to-RLOC mappings.
Leave a Reply