2.3Network virtualization concepts (LISP and VXLAN)

Traditional IP addressing carries a fundamental strain: a single value serves both as "who you are" (identity) and "where you are" (location). That is why a moving endpoint has had to change address, and why keeping the address meant stretching L2 segments. LISP resolves this by explicitly separating the two roles, while VXLAN overlays L2 on top of an L3 network to provide segments unbound by the physical topology. SD-Access combines the two as control plane = LISP, data plane = VXLAN, policy = TrustSec (SGT), and the key to understanding it is never mixing up those roles.

2.3.1LISP: separating identity from location

• LISP (Locator/ID Separation Protocol) is an architecture that separates the EID (Endpoint Identifier), which names the endpoint, from the RLOC (Routing Locator), which says which router the endpoint currently sits behind. When the endpoint moves, the EID stays the same and only the RLOC changes, so mobility with a retained address falls out naturally.
• Resolution happens through mapping. The map server/map resolver (MS/MR) holds the EID-to-RLOC table; the sending ITR (Ingress Tunnel Router) asks "which RLOC serves this EID" (Map-Request, Map-Reply) and encapsulates toward the RLOC it receives. The receiving ETR (Egress Tunnel Router) decapsulates and delivers to the endpoint. Endpoint registration is performed by the ETR toward the MS with a Map-Register.
• The payoffs are a smaller core routing table and the ability to follow movement. Not every endpoint prefix must live in the core, because resolution happens on demand when needed, so the table does not balloon even in a large campus. Keep the distinction sharp: LISP is a control plane (the mechanism that resolves where something is), while carrying the actual encapsulated data is the data plane's job.

2.3.2VXLAN: an L2 overlay on top of L3

• VXLAN (Virtual Extensible LAN) is an encapsulation that wraps L2 frames in UDP and carries them over an L3 network (L2 over L3). Because logical L2 segments can be overlaid on a routed underlay (which only needs IP reachability), you are freed from physical topology and STP constraints and can extend segments across sites, racks, and fabrics.
• The segment identifier is the VNI (VXLAN Network Identifier), which is 24 bits, expressing about 16 million (2^24) segments. That is the decisive advantage over the 12-bit VLAN ID (4094 usable) exhaustion problem, and it is indispensable for multi-tenant data centers and fabrics. The encapsulation uses destination port UDP 4789 (the IANA assignment).
• The VTEP (VXLAN Tunnel End Point) originates and terminates the encapsulation, mapping local VLANs/ports to VNIs and wrapping toward a remote VTEP's IP. The outer packet is just IP/UDP, so transit devices can forward it without knowing VXLAN at all. On the other hand, the added outer headers impose overhead (roughly 50 bytes), so provisioning jumbo frames (a raised MTU) in the underlay is standard practice.

2.3.3The division of roles in SD-Access

• The SD-Access fabric is built on a clear division: control plane = LISP (resolving "where is it" through EID-to-RLOC mapping), data plane = VXLAN (encapsulating the actual traffic), and policy = TrustSec/SGT (group-based control). Confusing these three layers leads to looking in the wrong place during a fault.
• The underlay is the foundation providing IP reachability between physical devices (usually kept simple with an IGP), and the overlay is the logical fabric built on top. If the underlay fails the overlay cannot exist, but conversely a healthy underlay still leaves endpoints unreachable if the mapping (control plane) is broken—choosing the layer to inspect from the symptom is the basis of diagnosis.
• Interoperation with the traditional campus happens at the fabric border, which handles ingress/egress to networks outside the fabric. Rather than converting the whole enterprise at once, the realistic migration approach is phased coexistence through the border.

After rolling out an SD-Access fabric on campus, users on one floor report that their wired endpoints reach neither other segments inside the fabric nor their default gateway. The first move in isolation is to separate whether this is an underlay or an overlay problem. From the fabric edge node on that floor, check whether pings to the loopback (RLOC) of the border and control plane nodes succeed. If they fail, the problem is in the underlay (IGP adjacency, links, MTU), and no amount of overlay investigation will help. Conversely, if RLOC-to-RLOC reachability is fine yet only endpoints fail, suspicion shifts to the control plane, that is, LISP mapping. Concretely, verify whether the endpoint's EID is registered with the control plane node (the map server). If the edge node never detected the endpoint and sent a Map-Register, other nodes cannot resolve that endpoint's RLOC and have nowhere to send packets (to the endpoint this looks like "the gateway is unreachable," indistinguishable at first glance from a plain L2/L3 fault). The easy mistake here is deciding that "since the overlay L2 is not extending, the VXLAN configuration must be at fault." VXLAN is data plane encapsulation; what tells you which RLOC to send toward is the LISP mapping. A state where the destination cannot be resolved is not explainable by VXLAN configuration. Another classic is MTU, and it looks completely different—mapping and reachability are fine and the tunnel works, yet the roughly 50 bytes of outer headers exceed the underlay MTU so only large packets are dropped (small pings succeed while file transfers or HTTPS hang). So the diagnostic pattern that pays off both in practice and on ENCOR is: "nothing reaches at all" means underlay reachability first, then LISP mapping registration; "only some traffic fails" means MTU or policy (SGT). Assigning the symptom to a role—control = LISP, data = VXLAN, policy = TrustSec— is the thinking order for an engineer working with this fabric.

2.3.4Section summary

• LISP separates the EID (identity) from the RLOC (location) and resolves through a map server/resolver—it is the control plane. Since a moving endpoint keeps its EID and only changes RLOC, it handles mobility well
• VXLAN is L2-over-L3 encapsulation: the VNI is 24 bits, about 16 million segments (a VLAN ID is 12 bits, 4094), it uses UDP 4789, and VTEPs are its endpoints—it is the data plane. The outer headers demand MTU headroom in the underlay
• SD-Access divides roles as control = LISP, data = VXLAN, policy = TrustSec (SGT). Choose the layer by symptom: "nothing reaches at all" means underlay reachability then LISP mapping registration, while "only some traffic fails" means MTU or policy