- [Narrator] We've discussed what makes up
a complete SD-Access solution.
So now let's take a look at a common way we might see
this implemented in an Enterprise Topology.
You can see at the very bottom we have our End User Devices,
both wired and wireless clients here.
The first piece of the SD-Access implementation
that we'll examine are called the Fabric Edge Nodes,
this is the layer that provides user access
through wired or wireless connections,
not only does this provide a connection point,
but this also is where identity and authentication
for users takes place.
This is where Cisco TrustSec and Cisco ISE are leveraged
to enforce security policies and to place users
into the appropriate access groups within the network.
So these devices sit on the edge of the SD-Access Fabric
as you can see here, and they provide users a place
to connect into the network.
We also have what are referred to
as Fabric Intermediate Nodes, and there could be
any number of these nodes.
These are simply the internal routers or switches
that are part of the Underlying Physical Structure.
They have no role in SD-Access other than providing
the underlay services using protocols such
as OSPF or EIGRP for example.
Remember that the Underlay Network isn't dependent
on any specific protocol, it can be a mixture of all kinds
of protocols and that can be wired or wireless as well.
Then we have what's called the Fabric Control Plane Node,
remember from our previous video that
the control plane uses LISP encapsulation for node mapping.
LISP contains two namespaces for each node
an Endpoint Identifier or EID and a Routing Locator or RLOC,
this particular node would essentially be a LISP server
and it would contain a database that would be used
to resolve these EIDs to RLOCs in order to map
the nodes within the network.
So the Fabric Edge Nodes that we looked at earlier
would provide information from our connected clients back
to the Fabric Control Plane Node so that they could create
and update these mappings, now this LISP server would
also resolve lookups from those nodes.
It's important to note that you'll want to choose
a fairly robust device to act as a Fabric Control Plane Node
because this is going to contain all of the fabric mappings,
so just be aware that there's some fairly stringent hardware
and software requirements when you choose
this particular node, you want to choose
a fairly Robust Device and we also have
a Fabric Border Node,
these are essentially LISP Proxy Tunnel Routers
that allow for external layer three connectivity back
into the SD-Access Fabric, so they can communicate policy
and identity information between separate domains,
whether that's a remote office or maybe a data center.
There are three types of Fabric Border Nodes
you want to know about, there are Internal Border,
Default Border and Anywhere Border.
Internal Border Nodes are also referred
to as Rest of Company nodes.
They connect only to known areas of the organization,
these could be the local data center,
a wireless land controller or a firewall, for example.
Default Border Nodes are also called Outside Border nodes,
they connect only to unknown external networks such
as the public Internet or a public cloud.
This will be configured with a default route pointing
to the outside world and Anywhere Borders combine Internal
and Default Border Nodes offering connectivity
both to the inside of the organization
and outside to the public Internet.
We can see the Fabric Control Plane
and Fabric Border Nodes here connected out
to our server room,
this of course will contain our Cisco DNA Center
and Cisco Identity Services Engine appliances
and we also see a wireless LAN controller here,
so this requires that you have
Fabric capable wireless LAN components by the way,
we do want to mention that both the access points
and the wireless LAN controllers should be Fabric capable.
One difference to point out here as opposed
to Traditional Wireless Deployment
that we've discussed already.
What's very common to see a Centralized Topology
in the enterprise,
this means that the wireless LAN controller
when it's traditionally placed
is centrally connected to the network infrastructure
and has access points dispersed throughout
the physical buildings
and when we have that traditional model,
all of the control plane and the data plane traffic
from the wireless clients
is moved from the access point and it's tunneled
through the wireless LAN controller using CAPWAP Tunnels.
We've talked about those already as well,
and that allows the wireless LAN controller
to handle everything, both the control plane
and the data plane traffic.
Now the difference in that Traditional Wireless
and SD-Access Wireless, we know that with SD-Access,
the data plane is distributed using VXLAN.
You'll recall that from our previous video
so in an SD-Access Wireless Deployment, a Fabric AP
would establish a VXLAN Tunnel with a Fabric Edge Node
and it would do that rather than establishing
a CAPWAP Tunnel with the wireless LAN controller,
now it still does have a CAPWAP communication going on,
We'll talk about that in just a second,
but the VXLAN Tunnel that's created here is used
to carry data from the access point back
to the SD-Access Fabric, where the Overlay Network
can take care of directing the traffic anywhere it's needed.
So this is a much more efficient and scalable type
of topology for wireless
because the traffic doesn't always have to be carried
all the way back to the wireless LAN controller
in this model.
For Control Plane Traffic, we see that
this is still carried back to the wireless LAN controller
using CAPWAP, but this time it's CAPWAP encapsulated
inside of a VXLAN Tunnel, so that's still handled
by the Overlay Network and you still get the advantage
of using the SD-Access Fabric to carry
the Control Plane Traffic back to the controller.
And of course this is all managed, orchestrated
and monitored by Cisco DNA Center.
This provides a GUI Interface where we can create policies
and subdivide our network into virtual instances
and we have an Automated Control Platform
that's going to assist us with configuration
and device provisioning.
So that's a look at how SD-Access is commonly implemented
in an enterprise environment and how it interacts
with Traditional Physical Network devices
to help us improve our networks
and to make management of the networks much easier.