Hello! Welcome to your next lesson in the "Network Virtualization" module.
In our last lesson, we analyzed the high-level architecture of Cisco SD-Access, introducing the concepts of the underlay, the overlay, and the key device roles like the Edge Node, Border Node, and Control Plane Node. We briefly mentioned that the fabric's intelligence is powered by two critical protocols: LISP for the control plane and VXLAN for the data plane.
Today, we will dive deep into these technologies. The learning outcome for this lesson is to describe the role of LISP and VXLAN as key protocols in the SD-Access fabric. You will learn not just what they do, but why they were chosen and how they work together to create a flexible, scalable campus network. Understanding this interplay is fundamental to mastering modern network design and a core requirement for the ENCOR exam.
The Problem: Tying Identity to Location
In traditional networking, an IP address serves two purposes: it's an endpoint's identity (who it is) and its location (where it is in the topology). If you move your laptop to a different building with a different subnet, you must get a new IP address. This coupling of identity and location makes seamless mobility and network segmentation complex.
SD-Access solves this by creating an overlay that separates these two concepts. Let's explore the protocols that make this possible.
LISP: The Control Plane for "Finding" Things
The Locator/ID Separation Protocol (LISP) is the control plane of the SD-Access fabric. Its primary job is to decouple an endpoint's identity from its location. To understand how, let's watch a detailed explanation.
This video from KishSquared provides an excellent deep dive into LISP. The first segment explains the problem LISP was designed to solve (routing table explosion on the internet) and introduces its core concepts. This context is invaluable for understanding its application in SD-Access.
Watch from 1:19 to 19:31. As you watch, focus on understanding these key concepts: The fundamental problem LISP solves by separating who from where. Endpoint Identifier (EID): The IP or MAC address of a device. This is its permanent identity. Routing Locator (RLOC): The IP address of the network device the endpoint is currently attached to (in SD-Access, this is the loopback of a Fabric Edge Node). This is its temporary location. The roles of the Ingress Tunnel Router (ITR) and Egress Tunnel Router (ETR) in the LISP domain.
LISP Components and Terminology
As you saw in the video, LISP introduces a new way of thinking about addressing. Let's solidify the key terms in the context of SD-Access:
- Endpoint Identifier (EID): The IP or MAC address of an endpoint (e.g., your laptop's IP address).
- Routing Locator (RLOC): The IP address of the Fabric Edge Node that the endpoint is connected to. This RLOC is an address in the underlay network.
- EID-to-RLOC Mapping: The database entry that says, "EID
192.168.10.5is currently located at RLOC10.10.10.1." - Fabric Edge Node: Functions as an ITR and ETR. It encapsulates packets from a local endpoint (ingress) and decapsulates packets destined for a local endpoint (egress).
But how do the Edge Nodes learn these mappings? This is where the LISP control plane process, managed by the Control Plane Node, comes into play.
Now, let's explore the 'brains' of the LISP operation: the Map-Server and Map-Resolver. This video segment explains how devices register their location and how other devices can query for that information.
Continue watching from 21:15 to 30:05. Pay close attention to the roles of the: Map-Server (MS): Receives registrations from ETRs (Edge Nodes) and builds the EID-to-RLOC database. Map-Resolver (MR): Receives queries from ITRs (Edge Nodes) and resolves EIDs to their corresponding RLOCs. The Map-Register and Map-Request/Map-Reply message flow.
In an SD-Access fabric, the Control Plane Node device runs both the Map-Server and Map-Resolver functions. It acts as the central directory for the entire fabric site. When an endpoint connects, the Fabric Edge Node sends a LISP Map-Register message to the Control Plane Node, creating the mapping. When another device needs to communicate, its Fabric Edge Node sends a LISP Map-Request to the Control Plane Node to find the destination's location.
This "pull" model is highly efficient. An Edge Node only needs to know about the endpoints it's actively communicating with, rather than holding a massive table of all possible destinations.
VXLAN: The Data Plane for "Forwarding" Things
LISP tells us where to send a packet (the destination RLOC). But how do we send it? We need a tunneling protocol for the data plane that can carry our original user traffic over the Layer 3 underlay. This is the role of Virtual Extensible LAN (VXLAN).
This next segment introduces VXLAN. It explains the problems it was designed to solve in the data center, which are remarkably similar to the challenges in a modern campus network.
Watch from 43:31 to 51:43. Focus on these key takeaways: VXLAN is a MAC-in-IP encapsulation technique. It allows you to extend Layer 2 segments over a Layer 3 network. A key feature is that it preserves the original Layer 2 Ethernet header inside the tunnel. The VXLAN Network Identifier (VNI) is a 24-bit field used to segment the overlay network, allowing for up to 16 million virtual networks.
VXLAN Encapsulation
VXLAN works by taking the original Ethernet frame from an endpoint and wrapping it in several new headers:
- Original Ethernet Frame: The complete L2 frame from the user device.
- VXLAN Header: Contains the 24-bit VNI, which identifies the virtual network (or VRF) the packet belongs to. In SD-Access, this header is modified (as VXLAN-GPO) to also carry the Scalable Group Tag (SGT) for security policy.
- UDP Header: VXLAN uses UDP as its transport. The standard destination port is 4789.
- Outer IP Header: This is the header used for transport across the underlay. The source IP is the RLOC of the source Edge Node, and the destination IP is the RLOC of the destination Edge Node (which was learned via LISP).
- Outer L2 Header: The final Ethernet header for the next-hop physical link in the underlay.
Putting It All Together: The LISP and VXLAN Partnership
LISP and VXLAN form a powerful partnership that defines the SD-Access fabric. Neither protocol could build the fabric alone.
- LISP is the control plane: It provides the mapping service (the "GPS") to find endpoints.
- VXLAN is the data plane: It provides the transport mechanism (the "truck") to carry the traffic.
Let's read the official definition that ties this all together.
Cisco Software-Defined Access Solution Design Guide
The official Cisco SD-Access Design Guide provides a concise and authoritative summary of how these protocols create the operational planes of the fabric.
Read the sections titled 'SD-Access operational planes', 'Overlay control plane – LISP', and 'Data plane – VXLAN'. The key sentence to internalize is: 'In Cisco SD-Access the control plane is based on LISP... the data plane is based on VXLAN...'
This relationship can be summarized with a simple formula:
SD-Access Fabric = LISP (Control Plane) + VXLAN (Data Plane) + TrustSec (Policy Plane)
This combination delivers the core benefits of the architecture:
- Mobility: An endpoint can move from one Edge Node to another. Only a quick LISP registration update is needed. The endpoint keeps its IP address, and sessions remain active.
- Segmentation: The VNI in the VXLAN header keeps traffic from different virtual networks (like
IOT_VNandCORP_VN) completely separate, even though they share the same physical underlay. - Scalability: The LISP "pull" model prevents routing tables on Edge Nodes from becoming bloated. The VXLAN 24-bit VNI space removes the 4094 VLAN limit.
Test your understanding!
An engineer is troubleshooting a connectivity issue between two endpoints in an SD-Access fabric. They suspect a problem with the overlay.
- If the source Edge Node cannot determine the location of the destination endpoint, which protocol and which fabric component should they investigate first?
- If the source Edge Node can determine the location but packets are still not arriving, which protocol and which network layer should they investigate?
Show answer
- This is a control plane issue. They should investigate the LISP protocol communication between the Edge Node and the Control Plane Node. They would check if the destination EID is correctly registered in the LISP database.
- This is likely a data plane issue. They should investigate the VXLAN encapsulation and the transport across the underlay network. Problems could include MTU issues on underlay links, access-lists blocking UDP port 4789, or routing problems between the RLOCs in the underlay.
Conclusion
In this lesson, we dissected the two core protocols that power the SD-Access overlay. You learned how their distinct but complementary roles enable the fabric's functionality.
Key Takeaways:
- LISP is the Control Plane: It separates identity (EID) from location (RLOC) and acts as a directory service to find endpoints in the fabric.
- VXLAN is the Data Plane: It is a MAC-in-IP tunneling protocol used to forward traffic across the Layer 3 underlay, preserving the original Layer 2 frame and carrying segmentation information (VNI and SGT).
- The partnership is simple: LISP finds, VXLAN forwards. This separation of concerns is what makes the SD-Access fabric so powerful and flexible.
Preview of the Next Lesson:
We have now established the roles of the underlay and the overlay, and the key protocols that operate within them. In our next lesson, Differentiate between the underlay and overlay networks in a software-defined architecture, we will solidify these concepts by directly comparing and contrasting these two fundamental layers, ensuring you have a complete picture of how software-defined networks are constructed.