Fabric vs. Traditional Network Designs

The Problem with Tradition

As we touched on in the previous lesson, while the hierarchical model provides structure, its common implementations come with significant challenges, especially at scale. Spanning Tree Protocol, rigid VLANs tied to physical locations, and manual, box-by-box configuration create complexity and limit agility.

To understand these challenges in more detail, let's watch a video that explores the "why" behind the move to software-defined networking.

As the video highlights, traditional networks face several key limitations:

• Spanning Tree Protocol (STP) Dependency: In traditional Layer 2 access designs, STP is required to prevent loops. This leads to blocked, underutilized links and slower convergence times compared to routed alternatives.
• Lack of Mobility/Flexibility: Subnets are typically tied to a specific set of distribution switches. This creates "VLAN sprawl" and makes it difficult to provide seamless connectivity for users who move between different physical areas of the campus.
• Static, Topology-Dependent Policy: Security policies, implemented with Access Control Lists (ACLs), are bound to IP addresses and VLANs. If a user's IP address changes, their policy enforcement can break. This makes policy management complex and error-prone.
• Manual Configuration: Network changes require logging into individual devices to apply configurations via the command-line interface (CLI). This is slow, inconsistent, and does not scale well.

These challenges led the industry to develop a new architectural approach: the software-defined fabric.

The Fabric Architecture: Introducing SD-Access

A fabric architecture fundamentally reimagines the network by creating a logical, virtualized network on top of the physical hardware. Cisco's implementation for the campus is called Software-Defined Access (SD-Access).

The core idea is to separate the network into two main parts:

1. Underlay Network: This is the physical infrastructure—the switches and routers and the links connecting them. Its only job is to provide IP reachability between all the network devices. It is almost always built as a simple, highly resilient Layer 3 routed network using a standard IGP like IS-IS or OSPF.
2. Overlay Network: This is a virtual network built on top of the underlay using tunneling technology. All user traffic, along with its associated policies, travels through this overlay. This is where all the advanced services and segmentation happen.

This separation allows you to manage the network based on your logical intent without being constrained by the physical topology.

The Operational Planes of SD-Access

To make this underlay/overlay model work, SD-Access divides network functions into four distinct "planes," each powered by a specific technology.

Let's summarize these crucial components:

• Management Plane (Cisco DNA Center): This is the centralized controller and user interface for the entire fabric. Instead of configuring individual switches, you define your network's design, policies, and services in Cisco DNA Center. The controller then automates the configuration of all devices in the underlay and overlay to match your intent. Your experience with REST APIs and automation will make the value proposition of a controller-based approach very clear.
• Control Plane (LISP): The Locator/ID Separation Protocol is the "GPS" of the fabric. It decouples a device's identity (its Endpoint ID or EID, like an IP or MAC address) from its location (its Routing Locator or RLOC, which is the IP address of the switch it's connected to). This allows an endpoint to move anywhere in the fabric and keep its IP address, while the control plane simply updates the EID-to-RLOC mapping.
• Data Plane (VXLAN): The Virtual Extensible LAN is the encapsulation protocol that creates the overlay tunnels. It takes the original Ethernet frame from an endpoint and wraps it in a new set of IP and UDP headers (a process called MAC-in-IP encapsulation). This VXLAN packet is then routed across the Layer 3 underlay. This is how SD-Access extends Layer 2 connectivity across a routed network, eliminating the need for STP.
• Policy Plane (Cisco TrustSec): Instead of using ACLs based on IP addresses, SD-Access uses identity-based policy. When a user or device connects, they are assigned a Scalable Group Tag (SGT) by the Identity Services Engine (ISE). This tag is carried within the VXLAN header and is used by fabric devices to enforce security policies. For example, you can create a policy that says "devices in the 'IoT_Cameras' group cannot communicate with devices in the 'Financial_Servers' group," regardless of their IP addresses or physical location.

New Architecture, New Roles

In a traditional three-tier design, we think in terms of core, distribution, and access switches. In an SD-Access fabric, devices are defined by their logical role.

The following video provides an excellent and detailed walkthrough of the physical components and their roles in an SD-Access fabric.

To summarize the key roles:

• Fabric Edge Node: This is where wired endpoints (PCs, phones) and wireless Access Points connect to the fabric. It is analogous to an access layer switch. Its main job is to identify and register endpoints, assign policy (SGTs), and perform VXLAN encapsulation/de-encapsulation.
• Fabric Border Node: This node is the gateway connecting the SD-Access fabric to any external network, such as the data center, WAN, or internet. It is responsible for translating policies (e.g., SGTs) and routing information between the fabric and the non-fabric world. It often serves a similar function to a core or distribution switch that connects to the WAN edge.
• Fabric Control Plane Node: This is a device (or set of devices for redundancy) running the LISP control plane service. It maintains the EID-to-RLOC mapping database for the entire fabric site.
• Intermediate Node: Any switch in the underlay that doesn't have a specific fabric role. Its only job is to route IP packets between the other fabric nodes. A traditional distribution switch could become an intermediate node during a migration.

It's important to note that these are roles, and a single physical device can often perform multiple roles (e.g., a single powerful switch could be both a border node and a control plane node).

Side-by-Side Comparison: Three-Tier vs. SD-Access Fabric

Now let's bring it all together. The most effective way to understand the differences is a direct comparison.

The image below shows a high-level view of a traditional non-fabric enterprise network next to an SD-Access fabric.

Let's break this down further in a table.

Finally, to see how these concepts apply in a practical migration scenario, the last part of the video we just watched provides a perfect illustration.

Conclusion

Today we've bridged the gap between traditional networking and the software-defined future. You now have a solid framework for comparing these two dominant architectural models.

Key Takeaways:

• Traditional three-tier networks are built on a rigid physical hierarchy and managed device-by-device, with policy tied to topology (IPs/VLANs).
• Fabric architectures like SD-Access separate the network into a simple physical underlay for transport and a flexible virtual overlay for services.
• SD-Access uses a suite of protocols to achieve this: LISP for the control plane, VXLAN for the data plane, and Cisco TrustSec (SGTs) for the policy plane.
• The entire fabric is managed by a centralized controller, Cisco DNA Center, which translates business intent into automated network configuration.
• This approach provides superior flexibility, scalability, security (micro-segmentation), and operational simplicity compared to traditional designs.

Preview of the Next Lesson:
Now that we have compared the two primary architectural models, our next lesson will focus on applying these concepts. We will explore how to use the principles of the Cisco Enterprise Architecture framework to analyze requirements and make informed decisions in real-world network design scenarios.