Blog

SD-ACCESS

SD-Access (Software-Defined Access) is a solution by Cisco that simplifies network management through automation and centralized control. It is part of Cisco’s broader software-defined networking (SDN) approach, designed to make enterprise networks more agile, secure, and scalable. Below is a breakdown of key concepts and components:

Key Concepts of SD-Access:

  1. Fabric Network:
    • A fabric network in SD-Access allows for the segmentation of users, devices, and traffic flows to simplify management and improve security.
    • The network is virtualized into overlays (logical networks) over a physical underlay (physical network infrastructure).
  2. Control Plane (LISP):
    • Cisco uses LISP (Locator/ID Separation Protocol) as the control plane protocol in SD-Access.
    • LISP decouples the identity (IP address) and location (where the device is attached to the network) of network entities, enabling easier mobility across the fabric.
  3. Data Plane (VXLAN):
    • The data plane in SD-Access uses VXLAN (Virtual Extensible LAN) to encapsulate traffic.
    • VXLAN provides Layer 2 segmentation over a Layer 3 network, allowing for scalability and flexibility.
  4. Policy Plane (Cisco TrustSec):
    • Cisco TrustSec is used to define security policies and enforce segmentation based on user roles or other attributes rather than just IP addresses.
    • It integrates with Cisco Identity Services Engine (ISE) to apply group-based policies dynamically.

Main Components of SD-Access:

  1. DNA Center:
    • Cisco DNA Center is the command center for managing and automating SD-Access. It provides a single interface to manage the entire network, allowing centralized policy definition and automation.
    • It simplifies provisioning, policy enforcement, and troubleshooting through its graphical user interface (GUI).
  2. Identity Services Engine (ISE):
    • Cisco ISE integrates with SD-Access to manage user and device authentication, as well as policy enforcement.
    • It allows administrators to define access policies based on identity and role.
  3. Fabric Nodes:
    • These are the network devices (routers, switches) that make up the fabric. They forward traffic using VXLAN and enforce policies.
  4. Fabric Edge Nodes:
    • These are typically access layer switches that connect endpoints (users, devices) to the fabric network.
  5. Fabric Border Nodes:
    • Fabric border nodes act as gateways between the SD-Access fabric and external networks, such as the internet or data centers.
  6. Fabric Control Nodes:
    • Control nodes handle the control plane (LISP) for managing routing and mobility across the fabric.

SD-Access Workflow:

  1. Device and User Onboarding:
    • When a device connects to the network, SD-Access identifies it through ISE.
    • Based on predefined policies, the device is assigned to a virtual network, enforcing security and segmentation policies.
  2. Network Segmentation:
    • The fabric network enables macro-segmentation through Virtual Networks (VNs) and micro-segmentation through Scalable Group Tags (SGTs).
    • Virtual networks separate user groups, while scalable group tags further segment within the same VN.
  3. Policy Enforcement:
    • Policies are enforced at the network edge based on identity and role, which provides granular control over who can access what.
  4. Automation & Assurance:
    • DNA Center automates the configuration and management of the network, reducing manual tasks.
    • It also provides assurance by continuously monitoring the network for issues, providing visibility, and automating troubleshooting tasks.

Key Benefits of SD-Access:

  • Simplified Network Management: Centralized control via DNA Center reduces complexity in deploying and managing networks.
  • Enhanced Security: Identity-based access control, segmentation, and automated policy enforcement significantly improve security.
  • Faster Deployment: Automated provisioning and configuration enable faster deployment of new services or devices.
  • Seamless Mobility: Users and devices can move across the network while maintaining consistent policy and security enforcement.
  • Scalability: The use of VXLAN and LISP allows for large-scale network expansion without the typical limitations of traditional networks.

Leave a Reply