A bigger throat space lets you experiment with more intricate stitching and move your fabric around less. Network virtualization—A LISP Instance ID (IID) is used to maintain independent VRF and VLAN topologies. From a data-plane perspective, the LISP Instance ID maps to either a Layer 2 or Layer 3 VNI. The first way to get this mess cleaned up is for you to take an old credit card and just scrape the glue until it comes off. Or you can use a knife, metal or plastic scraper or another similar object.

Do the SD-Access components in the network support the desired scale for the target topologies, or do the hardware and software platforms need to be augmented with additional platforms? For additional information regarding RP design and RP connectivity on code after Cisco IOS XE 17.1 on the Catalyst 9800s WLC, please see: High Availability SSO Deployment Guide for Cisco Catalyst 9800 Series Wireless Controllers, Cisco IOS XE Amsterdam 17.1. Other organizations may have business requirements where secure segmentation and profiling are needed: When working with different products to remove glues, always do a test first to make sure they won’t harm your clothes. After the test is done for this glue, spread some nail polish remover on the glue. This section provides design guidelines that are built upon these balanced principles to allow an SD-Access network architect to build the fabric using next-generation products and technologies. These principles allow for simplified application integration and the network solutions to be seamlessly built on a modular, extensible, and highly-available foundation design that can provide continuous, secure, and deterministic network operations.

Just take your time and let the glue dry. Then scrape as much off as possible before placing any remover on the stain. After that, it is just a matter of minutes before the glue is gone. Servers and Critical Systems—NTP servers, Building Management Systems (BMS), network orchestrators, management appliances, support systems, administrative applications, databases, payroll systems, and other critical applications may be required for access by one or many virtual networks. For current scale metrics and latency information, please see the SD-Access Resources and Latency Design Guidance on Cisco.com Technology & Support Community. Bidirectional forwarding detection (BFD) is provisioned on seed devices at the router configuration level ( bfd all- interfaces) and at the interface level connecting to the discovered devices. BFD is also provisioned on the discovered devices at the router configuration level and at interface configuration level connecting to the upstream peers.

If VRF-lite cannot be used end to end, options still exist to carry VRFs. The supported options depend on if a one-box method or two-box method is used.

The advantage of head-end replication is that it does not require multicast in the underlay network. This creates a complete decoupling of the virtual and physical networks from a multicast perspective. However, this can create high overhead on the FHRs and result in high bandwidth and CPU utilization. In deployments where multicast cannot be enabled in the underlay networks, head-end replication can be used. Networks should consider Native Multicast due to its efficiency and the reduction of load on the FHR fabric node.

Some physical locations may use unique wiring plans such that the MDF and IDF do not conform to the common two-tier and three-tier hierarchical network structure. The result is that the available fiber and copper wiring may require access switches to be daisy-chained or configured in a ring. Any number of wiring variations may exist in a deployment. Due to the unique nature of supporting all three fabric roles on a node, Fabric in a Box has specific topologies that are supported if additional fabric edge nodes or extended nodes are connected to it (downstream from it). The topologies supported differ based on if SD-Access Embedded wireless (now a fourth fabric role on the device) is also implemented. Policy Administration Node (PAN)— A Cisco ISE node with the Administration persona allows performs all administrative operations on Cisco ISE. It handles all system-related configurations that are related to functionality such as authentication, authorization, and auditing. Monitor and Troubleshooting Node (MnT)— A Cisco ISE node with the Monitoring persona functions as the log collector and stores log messages from all the administration and Policy Service nodes in the network. This persona provides advanced monitoring and troubleshooting tools that used to effectively manage the network and resources. A node with this persona aggregates and correlates the data that it collects to provide meaningful information in the form of reports. If Cisco DNA Center Assurance is used in the deployment, switching platforms can be used to show quantitative application health. Quantitative metrics show how much application traffic is on the network. Routing platforms can be used to show quantitative and qualitative application health. These metrics go beyond simply showing the amount of application of traffic on the network by displaying how the traffic is being serviced using latency and loss information. Additional enhancements are available to devices operating as Policy Extended Nodes. This capability is supported on the Cisco Catalyst IE-3400 and IE-3400H Series Switches. In addition to the operation and management provide by a classic extended node, policy extended nodes directly support SGTs. This provides direct east-west traffic enforcement on the extended node.This deployment type, with fabric APs in a separate physical location than their fabric WLCs, is commonly deployed in metro area networks and in SD-Access for Distributed Campus. APs should not be deployed across the WAN or other high latency circuits from their WLCs in an SD-Access network. A maximum RTT of 20ms between these devices is crucial. Can wireless coverage within a roaming domain be upgraded at a single point in time, or does the network need to rely on over-the-top strategies? Cisco DNA Center has two different support options for extended nodes: classic extended nodes and policy extended nodes. In a University example, students and faculty machines may both be permitted to access printing resources, but student machines should not communicate directly with faculty machines, and printing devices should not communicate with other printing devices. A bit-level diagram of the VXLAN encapsulation method used in SD-Access fabric along with low-level details on policy constructs insertion into the header can be found in Appendix A.

For additional details on multicast RPs, MSDP, and PIM-ASM, please see the Multicast Design section.Fabric wireless controllers manage and control the fabric-mode APs using the same general model as the traditional local-mode controllers which offers the same operational advantages such as mobility control and radio resource management. A significant difference is that client traffic from wireless endpoints is not tunneled from the APs to the wireless controller. Instead, communication from wireless clients is encapsulated in VXLAN by the fabric APs which build a tunnel to their first-hop fabric edge node. Wireless traffic it tunneled to the edge nodes as the edge nodes provide fabric services such as the Layer 3 Anycast Gateway, policy, and traffic enforcement.