- [Narrator] We previously examined
the merits of software-defined networking
and how that helps simplify
the management and configuration of our infrastructure.
Cisco has taken that one step further
with something they call Software-Defined Access
or SD-Access.
Let's run through a few advantages
provided by Software-Defined Access,
starting with the features of Cisco DNA Center.
Cisco DNA Center is a key piece of the SD-Access solution
and acts as a central point of management.
And that central point is able to automate the deployment
and the configuration of network devices.
With SD-Access and Cisco DNA Center,
network device configuration becomes automated,
whether you're deploying one
or multiple new devices in the network,
DNA Center works as a central hub of control,
which allows for super fast deployments.
Policy enforcement is another important improvement
offered by SD-Access.
Rather than relying on traditional access control lists,
SD-Access uses something called
Security Group Access Control Lists or S-G-A-C-Ls.
These can be thought of as a group-based policy
and they're much more scalable.
If you think about traditional ACLs,
those rely on IP addresses and sub-nets,
which can be complicated to maintain
or to scale for a larger network.
SGACLs used by SD-Access,
those overcome this limitation
through group policies that are based
on client identity rather than IP addresses,
so we don't have to worry about the scalability.
Using those policies make it much easier to scale.
Going hand in hand with this is the ability
to securely segment the network very simply.
Since SD-Access sees the entire infrastructure,
both wired and wireless,
as a single network fabric,
it's very easy to segment the network
without the need for various firewalls
or other complicated access control lists.
And network virtualization is also a big plus for SD-Access.
This allows our single physical infrastructure
to be separated into multiple virtual networks.
Each of these virtual networks can have their own set
of access policies that are created
and enforced through SD-Access.
We can break down the SD-Access solution
into two main components:
Cisco DNA Center, which we've already mentioned,
that provides automation and orchestration
throughout the network,
and something called Campus Fabric.
Recall that we discussed underlay and overlay networks
in a previous video.
The underlay network is our physical infrastructure.
And Campus Fabric is simply another example
of an overlay network.
Specifically it's a Cisco-validated overlay.
The Campus Fabric solution ideally will manage the network
through use of Cisco's DNA Center.
This can also be managed via CLI or API
through the NETCONF protocol and YANG modeling language.
We'll discuss NETCONF and YANG more in depth
later in this series, but for now,
just know that these are options used
to operate the network infrastructure in a Campus Fabric.
The reason that a Campus Fabric was developed
is to overcome traditional campus network issues.
Things like spanning tree problems
and layer two forwarding.
And it's also an improvement over architectures,
such as three-tier or spine and leaf.
So Campus Fabric can really simply be thought of
as a next generation campus network,
where management and configuration is simplified
and centralized into a single point.
Here we can see a graphical example of what this looks like.
We see an actual, physical underlay network
and the Campus Fabric overlay network.
The Campus Fabric is what provides our network
with segmentation and security features
through those policy-based security groups
that we mentioned earlier.
Also know that the security provided here
goes beyond traditional routing
and switching security capabilities,
because it's recommended that you leverage
Cisco's Identity Services engine
to gather contextual user information
for those security policies.
So here we can see that even though our underlay network
is a little more complicated
and it has a few more intermediate devices,
the overlay network simply sees that
as a much smaller and simplified network.
So that's just a really easy example of how that works.
Now we've already mentioned that the Campus Fabric overlay
can be configured through CLI or API
or it can be fully automated through DNA Center,
which is actually the recommended method.
So while you can use a Campus Fabric solution
and manually configure that through CLI or API,
that is not considered to be SD-Access
when you configure in that manner.
SD-Access is specifically defined
as being fully automated with DNA Center.
If DNA Center is not being used,
then you simply have a Campus Fabric solution.
You do not have a Software-Defined Access solution.
So that's just some nomenclature
that you should be aware of.
So from here on out in this discussion,
we're assuming that we're using both
a Campus Fabric solution and DNA Center,
which we'll generally refer to as SD-Access
or the SD-Access Fabric.
You probably won't be surprised to learn
that there are three planes of operation
in the SD-Access Fabric.
The Control Plane, the Data Plane, and the Policy Plane.
The Policy Plane is based on Cisco TrustSec,
which will be covered in depth later in the series.
TrustSec helps to create the security groupings
that we mentioned earlier.
So the policies can be based on identities,
rather than IP address schemes.
The SD-Access Control Plane is based
on the Locator ID Separation Protocol or LISP for short.
LISP is simply an addressing architecture
developed by Cisco as a variation of node addressing.
So rather than relying on a single
numbered address identifier,
such as an IP address,
LISP creates two addresses for each node.
One address for its identity
and another for the location where its found in the network.
So LISP is a way to simplify traditional routing
and to streamline our network.
The SD-Access Data Plan leverages a tunneling technology
called Virtual Extensible LAN or VXLAN.
This encapsulation is what creates
the SD-Access overlay network.
This is UDP-based communication,
meaning that any IP capable device
has the ability to forward the information.
The VXLAN encapsulation allows
for not only layer three overlay networks,
but also for creating separate virtual network instances,
where separate policies can be applied and enforced.
So know that the Control Plane uses LISP data encapsulation
while the Data Plane uses VXLAN encapsulation.
Both of these encapsulations will be examined closer
later in this series.
If we break down a typical topology structure visually,
we'll see four distinct layers in SD-Access architecture.
We can see that the physical layer is of course
our actual infrastructure devices.
Routers, switches, our wireless infrastructure,
a DNA Center appliance, and a Cisco Identity Services
appliance as well.
In the network layer, we see our underlay
and overlay networks.
The underlay network includes the settings
and protocols used in the physical infrastructure
for transporting data packets,
while the overlay network is a virtual network
that forms a fabric of its own.
As we saw earlier in our example topology,
this overlay strips out some of the limitations
and complexities of the network
and makes a more simplified fabric.
The tunneling is performed using VXLAN encapsulation
to build that fabric.
And then we have the controller layer,
which consists of Cisco DNA Center
and DISCO Identity Services Engine appliances.
We can break down Cisco's DNA Center
into two main structures here,
which are the Cisco Network Control Platform
and Cisco Network Data Platform.
Cisco NCP is used for automation
and orchestration of the physical and network layers,
while Cisco NDP is used to collect analytics
and historical trends used by the management layer
and by Cisco ISE.
Cisco ICE of course is for Identity
and Security Services and is the piece
that identifies and places users into those policy groups,
so that the policies can be enforced
throughout the network fabric.
Finally, we have the management layer,
which is the Cisco DNA Center User Interface.
This is essentially a centralized dashboard
that allows you to view and control your entire network
through intent-based networking.
The unique thing here is that Cisco DNA Center
provides really simply GUI tools
for management and deployment,
which means that you don't necessarily
have to know how to configure each individual network device
in order to use this deployment method.
Really unique.
So now that we understand why SD-Access is relevant
and we know the required pieces of the SD-Access Fabric,
in the next video we'll take a look
at a common way we might see this implemented
in a real-world enterprise topology.