Cisco SD-Access: DNA Center and Campus Fabric

Introduction

Cisco SD-Access (Software-Defined Access) is a next-generation campus network solution that uses an overlay fabric (VXLAN+LISP) to provide policy-based segmentation, automation, and simplified management through DNA Center (Catalyst Center).

SD-Access vs Traditional Campus

Feature	Traditional	SD-Access
Segmentation	VLAN-based	VN (Virtual Network)
Policy	Per-VLAN ACL	SGT (Security Group Tags)
Mobility	Re-IP when roaming	IP preserved
Provisioning	CLI per device	DNA Center templates
Troubleshooting	CLI on each box	DNA Center Assurance

SD-Access Architecture

TEXT

DNA Center (Controller)
    |
Fabric Control Plane
    └── LISP (Locator/ID Separation Protocol)
         → Maps endpoint identity to location
    └── IS-IS (underlay routing)
         → Physical connectivity
    └── VXLAN (overlay tunnels)
         → Carries tenant traffic
    └── TrustSec SGT (policy)
         → Micro-segmentation

Physical Components

Underlay: IP routed network (IS-IS between fabric nodes)
Control Plane Node: Runs LISP Map Server/Resolver (usually Border node)
Border Node: Connects SD-Access fabric to external networks (WAN, datacenter)
Edge Node: ToR switch where endpoints connect
Fabric Wireless: WLCs and APs inside the fabric

DNA Center Installation

DNA Center runs on dedicated Cisco UCS hardware or virtual appliances:

Deploy DNA Center OVA or physical appliance
Initial configuration via browser wizard
Add devices to inventory (Cisco Discovery Protocol auto-discovers)
Assign roles: Edge, Border, Control Plane

Fabric Configuration via DNA Center

Step 1: Create Network Hierarchy

TEXT

DNA Center → Design → Network Hierarchy
Global → Country → State → Building → Floor

Step 2: Design Network Settings

TEXT

Design → Network Settings:
- DNS: 8.8.8.8, 8.8.4.4
- NTP: ntp.company.com
- DHCP: 10.0.0.10
- AAA: ISE server

Step 3: Create Virtual Networks (VNs)

TEXT

Policy → Virtual Network
- Guest VN: isolated, internet-only
- Corp VN: full access
- IoT VN: restricted

Step 4: Create Scalable Groups (SGTs)

TEXT

Policy → Group-Based Access Control → Scalable Groups:
- Employees (SGT 10)
- Contractors (SGT 20)
- IoT-Devices (SGT 30)
- Finance (SGT 40)

Step 5: Define Policy Matrix

TEXT

Policy Matrix (who can talk to whom):
           Employees   Contractors   Finance   IoT
Employees     Allow       Allow        Deny    Deny
Contractors   Allow       Allow        Deny    Deny
Finance       Allow       Deny         Allow   Deny
IoT           Deny        Deny         Deny    Deny

Step 6: Provision Fabric

TEXT

Provision → Fabric Sites:
1. Select devices for fabric
2. Assign roles (Edge, Border, Control Plane)
3. Deploy → pushes config to all devices via NETCONF/RESTCONF

Troubleshooting SD-Access

Via DNA Center Assurance

TEXT

Assurance → Network Health:
- View health scores for all fabric nodes
- Client 360: complete view of a specific client's connectivity
- Path Trace: trace actual packet path through the fabric

Via CLI on Fabric Nodes

CISCO

! Check LISP map cache (where is this endpoint?)
show lisp instance-id 4099 ipv4 map-cache

! View VXLAN tunnels
show nve peers
show nve interface nve1

! Check TrustSec SGT
show cts interface GigabitEthernet1/0/1
show cts rbacl

! View fabric configuration
show fabric forwarding address-table

! Check IS-IS underlay
show isis neighbors
show isis database

SD-Access Wireless Integration

TEXT

WLC is a fabric-mode WLC, registered with DNA Center
APs join WLC as fabric mode APs
When client connects:
  1. AP sends RLOC (fabric tunnel) to fabric edge
  2. LISP registers client MAC/IP in control plane
  3. Client gets policy based on authentication (ISE assigns SGT)

ISE Integration for Policy

SD-Access requires Cisco ISE for:

802.1X authentication
SGT assignment based on user identity
Dynamic VLAN/VN assignment
Posture assessment (is device compliant?)

TEXT

ISE Authorization Policy:
IF user in AD group "Employees" AND device certificate valid
THEN assign SGT=10, VLAN=Corp-VN