1.3Cisco SD-Access

In a traditional campus, "which department a device belongs to" was expressed by a VLAN and "where it may go" by an IP-address-based ACL. That approach requires VLANs and ACLs to chase every desk move or wireless roam, and it breaks down as scale grows. Cisco SD-Access solves this by decoupling who a device is (policy) from where it is (location). The key to understanding it is that responsibilities split cleanly into three: LISP resolves location, VXLAN carries the traffic, and SGT expresses policy.

1.3.1The three-layer division of labor

• LISP (Locator/ID Separation Protocol) is the control plane. It separates the EID, the endpoint's identifier, from the RLOC, the location of the fabric node the endpoint currently attaches to, and associates them in a mapping database. Edge nodes resolve a destination EID's RLOC by querying the map server, so an endpoint can move to another edge without changing its IP. Since not every node must hold every route as before, routing-table bloat is also contained.
• VXLAN is the data plane. It encapsulates the original L2 frame in UDP/IP (identifying the segment with a VNI and using UDP port 4789) and carries it across the L3 underlay. Against the 12-bit (4094) ceiling on VLAN IDs, a VNI is 24 bits, identifying roughly 16 million segments, which withstands large-scale multi-tenant separation. Crucially, the SGT is carried along inside the VXLAN header.
• Cisco TrustSec and the SGT (Security Group Tag) form the policy plane. At authentication an endpoint receives an SGT representing its group, and permissions are expressed as a matrix of source SGT by destination SGT. Because this depends on neither IP address nor VLAN, policy follows the endpoint as it moves. Policy definition and distribution are handled by Cisco Identity Services Engine (ISE), while Catalyst Center (formerly DNA Center) handles automation and visibility for the fabric as a whole.

1.3.2Underlay and overlay

• The underlay is the foundational network providing physical IP reachability. Fabric nodes are joined by routed links and establish loop-free reachability with an IGP (typically IS-IS or OSPF). It does not deal with endpoint IPs; it guarantees only that RLOCs can reach each other. Because an unstable underlay guarantees an unstable overlay, isolation always starts from the underlay.
• The overlay is the logical network built with VXLAN atop the underlay. Endpoints attach here and appear to share a segment without being constrained by physical cabling or VLANs. Even for a "ping fails" symptom, there are cases where RLOC-to-RLOC in the underlay succeeds while EID-to-EID in the overlay does not, and that gap points to a LISP mapping or policy-side problem.
• Fabric node roles: the edge node (attaches endpoints, registers EIDs, and performs encapsulation/decapsulation), the control plane node (holds the EID-to-RLOC mapping as the LISP map server/map resolver), and the border node (the gateway to and from outside the fabric). Which node's responsibility a symptom maps to determines where to look.

1.3.3Interoperating with the traditional campus

• The fabric interconnects with traditional VLAN/ACL-based networks (existing server rooms, the WAN, internet egress, and so on) at the fabric border (the border node). This is where VXLAN encapsulation terminates: traffic leaving the fabric is decapsulated back into ordinary IP packets. During migration, coexistence—"the new building is fabric, the existing building is traditional"—is normal, and the border is the translation point between them.
• A practical pitfall is that an SGT cannot simply cross the border. Because SGTs ride in the VXLAN header (or inline tagging), the tag is lost when traffic exits into a traditional network that does not support them. Without measures such as propagating IP-to-SGT bindings with SXP (SGT Exchange Protocol), group-based policy that worked inside the fabric stops taking effect outside it.

Suppose you built a new building as an SD-Access fabric while the existing building still runs a traditional VLAN/ACL design. After go-live, a report arrives: "from a sales-department endpoint in the new building, access to a business server in the existing building's server room connects, but the restrictions we expected from the ACL are not taking effect." Jumping to "the SGT policy definition is wrong" and going to fix the ISE matrix is premature. What you should check first is where that traffic gets decapsulated from VXLAN. Between endpoints inside the new building, traffic stays in VXLAN and policy is applied at the edge node based on the SGT carried in the header, so restrictions work as expected. But traffic bound for the existing building's server is decapsulated at the fabric border and travels the traditional network beyond it as ordinary IP packets carrying no SGT. Since traditional devices do not understand SGTs, a group-based rule of "deny sales SGT to server SGT" loses anything to apply to the moment it crosses the border. The root cause is therefore not a faulty policy definition but SGT propagation being severed at the border. The sound remedies are to configure SXP so that IP-to-SGT bindings are conveyed beyond the border, or to explicitly place an equivalent restriction as an IP-based ACL at the entry to the SGT-unaware segment. Conversely, had the report been "restrictions do not work even between endpoints inside the new building," then suspecting the policy definition or the SGT assignment at authentication (the endpoint not landing in the intended group) would be exactly right. And if it were "one endpoint inside the fabric loses connectivity after moving," the suspect is not policy but LISP mapping updates (whether the EID re-registered correctly at the new edge node and the control plane node's map was updated). SD-Access diagnosis narrows to a single layer once you determine whether the affected segment is inside the overlay or across the border, and whether what is broken is reachability (LISP/VXLAN) or restriction (SGT).

1.3.4Section summary

• SD-Access splits responsibilities across three layers: control = LISP (EID/RLOC mapping), data = VXLAN (L2 over L3, 24-bit VNI), and policy = TrustSec/SGT
• The underlay provides IGP-based IP reachability between RLOCs and the overlay is the logical VXLAN network. Always isolate from the underlay first; if RLOC-to-RLOC works but EID-to-EID does not, suspect LISP or the policy side
• Interoperation with the traditional campus happens at the fabric border, which is where VXLAN terminates. SGTs are lost across the border, so propagate them with SXP or place an equivalent ACL