If you haven't yet done so be sure to pause this video, sketch out this diagram
and make sure that you can answer the questions
because if we can get through and answer all of these things and add things to
this diagram that will complete the picture
well that will really make sure that we have a pretty good knowledge of SDA and
how it works.
So let's start off with the control plane.
The control plane says, or task here, says to add a node that will be
responsible for maintaining host to edge mappings.
Well we're going to play that on a database and this database is going to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Well we're going to play that on a database and this database is going to
reside on what's known as the control plane node
which can be a lot of different Cisco devices and ISR, a catalyst 9K.
We have to make sure whatever device we deploy supports being a control plane
node and it's going to keep again the host mappings.
For example we're going to know that over here on the right this 10.100.0.10
maps to our RLock that IP address the loop back of 10.2.2.2. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
maps to our RLock that IP address the loop back of 10.2.2.2.
And so when somebody needs to send a packet out under the network and we need
to know, hey how do I get to this IP address?
Well we are going to use LISP in order to complete that information and again
it uses that poll not push methodology.
I don't proactively share it everywhere. I just go out and get it when I need
it.
Now from a data plane perspective we're migrating to data plane here, draw a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now from a data plane perspective we're migrating to data plane here, draw a
tunnel between the edge nodes.
Okay so I'm going to draw a tunnel from this loop back to this loop back over
here.
And the protocol that's used is VXLAN.
At this point we've called these RLocks before these loop back addresses. Now
these are known as the VTEPs.
So VTEP is a VXLAN term for it, RLock is a LISP term. Either way we are
connecting these fabric edge devices.
Now what routes do the underlay nodes know and what routes do they know nothing
about? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Well these underlay nodes are going to have to be able to route from this loop
back on the left to this loop back on the right,
which means it's probably going to need to know some of the interconnecting sub
nets.
But in the end what we really know for sure in their routing tables are paths
to these loop backs.
They know nothing about the overlay networks that are being deployed over the
top.
So basically when we think about the fact that it extends down like this,
we can think of these hosts as being part of the overlay network because their WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we can think of these hosts as being part of the overlay network because their
traffic goes into the tunnels that are used to build the overlay.
So again the underlay has no knowledge of these external subnets.
Now where do the default gateways reside? Well the default gateways are going
to reside right here and right here.
And any other fabric edge node that has this particular VLAN, the SVI connects
down into this environment.
And so both of these devices can reach their default gateways by going up to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so both of these devices can reach their default gateways by going up to
the connected device.
And that is known as any cast gateways.
Now lastly we're going to talk about the policy plane here.
And the policy plane is all about security.
So the challenge says to draw a circle around the node that's responsible for
dropping a packet.
Well that depends on the flow of traffic.
If we're sending a packet this way up to the fabric edge node on the left and
then over to the node on the right, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
then over to the node on the right,
and then down, well it's going to be this device that decides to drop.
And if it's going the other direction it would be this device because
ultimately it's the egress node that drops traffic.
Which goes a little bit against the grain because as we said security policy
likes to drop traffic early on,
but we are truly dropping it as it leaves the fabric with SDA for the reasons
we discussed.
Now what type of marking is used? We're going to use those scalable group tags, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now what type of marking is used? We're going to use those scalable group tags,
Sgt's,
and those are going to be inserted into the VXLAN header.
So it's carried for us by VXLAN, which allows the egress node to see what type
of traffic it is.
We don't have to identify it. We don't have to look at any information other
than the Sgt that was assigned to it.
And then I can know whether or not to drop the packet.
Now what control integrations use for managing this?
Sgt's are going to be properly managed thanks to ICE, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
but keep in mind the ICE integrates with Catalyst Center.
We as the admins are logging into Catalyst Center,
and this back end integration is going to manage the policy plane for us.
So this is a great look at the overall architecture of SDA.
We're looking at the control plane, the data plane, the policy plane,
and we're also looking at those any cast gateways.
If we can track through this challenge and see how the end-to-end traffic flow
works in an SDA fabric,
it's going to put us in really good shape for understanding the scope of SDA WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it's going to put us in really good shape for understanding the scope of SDA
that we're expected to know
for going and taking this exam.
I hope there's been informative for you, and I'd like to thank you for viewing.
Thank you for viewing.