Chapter 46 - Cisco Software-Defined Access

Question 1

What is SD-Access?

Answer 1

• Software Define Access
• SDN developed by Cisco for use in campus networks
• Uses DNA Centre as its controller
• Three different roles for switches are included in this architecture:
  - Edge nodes - Connect to end hosts
  - Border nodes - Connect to devices outside of the SD-access network e.g. WAN routers
  - Control nodes - Use LISP (Locator ID Separation Protocol) to perform various control plane functions
• Can be configured on compatible networking equipment that is already in place (Brownfield Deployment) but DNA will not dynamically configure the underlay
• Can be configured from scratch (Greenfield Deployment) and DNA will dynamically configure the underlay
• LISP provides the control plane by mapping EIDs (Endpoint Identifiers) to RLOCs (Routing Locators)
• Cisco TrustSec provides policy control
• VXLAN provides the data plane

Question 2

What is SD-WAN?

Answer 2

• Software Defined WAN
• SDN developed by Cisco for use when automating WANs

Question 3

What is an SDA underlay?

Answer 3

• The physical network of devices and connections that provide IP connectivity for the overlay

Question 4

What is an SDA overlay?

Answer 4

• The virtual network built on top of the physical underlay network
• SD-Access uses VXLAN to build tunnels as its overlay and allow communication between fabric endpoints

Question 5

What is an SDA fabric?

Answer 5

• The combination of the SDA’s underlay and overlay

Question 6

True or False. You can use any equipment for an SDA Brownfield Deployment.

Answer 6

False. The devices must be included on Cisco’s SDA compatibility list. Otherwise new equipment is required.

Question 7

What is a Routed Access layer network design?

Answer 7

• Typically used in a Greenfield SDA Deployment
• Means that:
  - All switches in the topology are layer 3 switches that have routing enabled and use the IS-IS routing
  protocol.
  - All links between switches are layer 3 routed links meaning that STP/RSTP is not necessary
  - SDA Edge nodes act as default gateways for endpoints meaning that an FHRP is not necessary (I don’t
  think it would necessarily be a bad thing though. Would just require each PC to have two NICs to connect
  to each L3 switch)

Question 8

What is VXLAN?

Answer 8

• Virtual Extensible LAN
• Used in SDA overlay
• When a frame is received on an SDA node it is encapsulated in VXLAN. This is then forwarded to its destination by other nodes and VXLAN is only removed by the final node.
• The requirements of VXLAN in an SDA are:
  - The VXLAN tunneling must be performed by each switch’s ASIC so there is no performance penalty. This
  is why the compatibility list is required for SDA
  - The VXLAN encapsulation but supply headers that SDA requires for its features
  - VXLAN must encapsulate the data link frame as well as the IP header of a packet giving SDA layer 2 and
  layer 3 features

Question 9

True or False. The overlay and underlay use the same address space.

Answer 9

False. The underlay uses one address space and the overlay uses another. The endpoint addresses are included in the overlay address space.

Question 10

How does LISP work in SDA?

Answer 10

• Fabric edge nodes learn the locations of possible endpoints via their MAC address, IP address, and subnet, and use this to identify each end point with an EID (End Point Identifier)
• They register the fact that they can reach a given EID into a databse called the LISP Map Server
• The LISP Map Server keeps a list of EIDs and matching RLOCs (Routing Locators) which identify the edge nodes that can reach a given EID
• When the data plane needs to forward a message it looks for the destination in the LISP Map Server

Question 11

What is an ITR?

Answer 11

• Ingress Tunnel Router
• The router in an SDA fabric that receives a given frame and needs to forward it

Question 12

True or False. Cisco DNA Centre is only used as the Controller for SDA networks

Answer 12

False. It can also be used as a management platform for traditionaly non-SDA network devices

Question 13

What is RESTCONF and NETCONF?

Answer 13

• Southbound APIs used for managing networks
• Generally used to manage more recent networking devices. Older ones may use Telnet, SSH, and SNMP, etc.

Question 14

What is a Scalable Group?

Answer 14

• Used to identify groups of users within DNAC that should have security policies applied to them
• Group identifiers are called SGTs (Scalable Group Tags)

Question 15

What are features of a traditional network management program?

Answer 15

• Single Pane of Glass - One GUI to launch all functions and features
• Discovery, Inventory, and Topology - Discovers network devices, builds an inventory, and arranges them in a topology map
• Entire Enterprise - Provides support for traditional enterprise LAN, WAN, and data centre management
• Methods and Protocols - Uses SNMP, SSH, Telnet, CDP, and LLDP to disocver and learn information about network devices
• Lifecycle Management - Supports different tasks to install a new device, configure it to be working in production, and perform ongoing monitoring and maintenance
• Application Visibility - Simplifies QoS configuration deployment
• Converged Wired and Wireless - Enables you to manage both wired and wireless LANs from the same platform
• Software Image Management (SWIM) - Manages software images on network devices and automates updates
• Plug and Play - Performs initial installation tasks for new network devices after they are physically installed

Question 16

What are some features unique to Cisco DNAC?

Answer 16

• EasyQoS - Deploys QoS easily from DNAC
• Encrypted Traffic Analysis - Can use algorithms to recognise security threats even in encrypted traffic
• Device 360 and Client 360 - Gives a comprehensive view of the health of devices
• Network Time Travel - Shows past client performance in a timeline for comparison to current behaviour
• Path Trace- Discovers the path packets take from source to destination based on current forwarding tables

Question 17

What is an example of a Cisco traditional network management software?

Answer 17

• Cisco Prime Infrastructure (only traditional)
• Cisco DNAC (traditional and SDA)