Cisco SD-Access separates the network into two related systems: an IP underlay that provides basic reachability between fabric devices, and an overlay that carries endpoint identity, segmentation, and traffic across that routed foundation.<\/p>\n
That separation is the easiest way to understand why SD-Access uses familiar routing underneath while introducing LISP and VXLAN above it. It is also directly aligned with the current 350-401 ENCOR v1.2 blueprint, which expects candidates to explain SD-Access control-plane and data-plane elements as well as the LISP and VXLAN virtualization concepts that support the fabric. In 350-401 SD-Access practice<\/a>, identify which control-plane information comes from LISP and which traffic is carried over VXLAN; the distinction determines where to investigate a failed endpoint path.<\/p>\n The underlay is the IP network that connects the devices participating in the fabric.<\/p>\n Its job is straightforward: every relevant fabric node needs reliable IP reachability to the other infrastructure it must communicate with. That means routing, MTU, physical links, and basic resiliency still matter even though SD-Access is software-defined.<\/p>\n This is one reason software-defined networking<\/a> should not be confused with \u201cno routing.\u201d The software-defined layer changes how policy and services are expressed and automated, but packets still need a working physical and IP transport.<\/p>\n In a typical routed-access design, intermediate nodes mainly provide transit connectivity. They do not need to understand every endpoint identity in the overlay; they need to forward the outer IP packets that carry the fabric traffic.<\/p>\n The underlay is deliberately boring in the best sense: it should be a predictable routed network that can move the outer packets between fabric nodes without depending on endpoint-specific state. Cisco’s current design guidance describes this as a Layer 3 routed-access foundation built for performance, deterministic convergence, scalability, and resiliency. End-user subnets live in the overlay rather than in this transport foundation.<\/p>\n That separation changes how failures are interpreted. A routing adjacency flap, an MTU mismatch, or loss of reachability to a routing locator is an underlay problem even if the user notices it as an SD-Access outage. Before investigating LISP mappings or fabric policy, verify that the IP foundation can carry the encapsulated traffic consistently.<\/p>\n MTU deserves special attention because VXLAN<\/a> adds an outer Ethernet, IP, UDP, and VXLAN header. Cisco’s current design guide notes at least 50 bytes of extra encapsulation overhead. A path that forwards ordinary unencapsulated packets but drops larger fabric packets can therefore look deceptively healthy until the overlay is exercised.<\/p>\n The overlay is the logical fabric built on top of that underlay.<\/p>\n Instead of depending only on traditional subnet location to identify where an endpoint lives, the fabric separates endpoint identity from physical location. Cisco uses LISP for the control-plane mapping and VXLAN for data-plane encapsulation.<\/p>\n This lets the fabric preserve virtual-network context while traffic crosses a common routed infrastructure.<\/p>\n That matters for segmentation. Traditional VLANs<\/a> are still relevant at the access edge, but SD-Access can map those endpoint-facing constructs into overlay virtual networks and VXLAN network identifiers for transport across the fabric.<\/p>\n The overlay also gives the campus a different way to think about gateway placement. Fabric edge nodes can provide anycast gateway behavior, allowing the same endpoint subnet and gateway semantics to exist at multiple access locations. That supports mobility without stretching a conventional Layer 2 domain across the campus merely so a device can keep the same IP address.<\/p>\n Macrosegmentation is expressed with virtual networks, which map to separate routing contexts. Microsegmentation can add group-based policy through Security Group Tags. Those are separate dimensions: a user can belong to a virtual network that defines broad routing isolation and also carry group identity that controls communication inside or across permitted boundaries. The VXLAN fabric can transport both the virtual-network identifier and policy metadata across the routed underlay.<\/p>\n Locator\/ID Separation Protocol, or LISP, is the control-plane mechanism that maps an Endpoint Identifier to a Routing Locator.<\/p>\n An endpoint’s address represents who or what the endpoint is inside the overlay. The routing locator represents where that endpoint is currently reachable in the underlay.<\/p>\n Cisco’s SD-Access documentation describes this as an EID-to-RLOC mapping. Fabric devices query the control plane to learn the RLOC associated with a destination EID.<\/p>\n That distinction is useful because an endpoint can move without forcing the entire routed underlay to learn a new host route everywhere. The control-plane mapping changes while the underlay continues to route toward fabric-node locators.<\/p>\n Modern SD-Access control-plane design also uses a LISP publisher\/subscriber model in current Catalyst Center designs. The implementation details have evolved, but the operational idea remains stable: edge nodes register endpoint reachability, control-plane services maintain the mapping system, and fabric nodes obtain the location information needed to send traffic toward the correct edge or border.<\/p>\n The map cache is important during troubleshooting. A fabric edge does not need a conventional host route for every endpoint everywhere in the campus. It can resolve the destination through LISP and install the resulting information for forwarding. If a destination is unknown or cannot be resolved, behavior can differ from a simple traditional routing lookup, so checking registration and mapping state is often more useful than staring only at the global routing table.<\/p>\n VXLAN provides the data-plane encapsulation.<\/p>\n Cisco describes VXLAN as a MAC-in-IP encapsulation method that can preserve the original Ethernet information while adding an outer transport header for movement across the routed underlay.<\/p>\n The overlay can therefore carry Layer 2 and Layer 3 virtual-network context through a Layer 3 infrastructure.<\/p>\nThe underlay is the routed transport foundation<\/h2>\n
The overlay carries endpoint and segmentation context<\/h2>\n
LISP separates endpoint identity from routing location<\/h2>\n
VXLAN transports the original traffic across the fabric<\/h2>\n