So with Lisbon VX-Lan covered in more detail, let's go back to Cisco's software
defined
access solution, which is the whole reason we're talking about these different
technologies.
SDA wants to create a campus fabric with a traditional architecture.
We had a difficult choice here.
We had our distribution switches, usually two of them.
We have a bunch of access layer switches.
And the goal here is to try to figure out how do we attach to these, knowing
that there's
additional access layer switches hanging off of the edge here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
additional access layer switches hanging off of the edge here.
And so we had our choices.
We have our layer two design, which is great for flexibility, but it does
require spanning
tree protocol.
And it's not so good at scaling as a result.
Meanwhile layer three flipped this on its head.
It said, okay, we're not very flexible.
We can't extend subnets between access layer closets anymore, but we no longer
need to
worry about spanning tree protocol, which is a good thing.
And scaling is through the roof. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And scaling is through the roof.
We have no limits to scaling with a layer three architecture.
But the reality is that there wasn't a perfect solution here.
I mean, we had pros and cons with both of these.
And so the idea here was to create the idea of a fabric, which leverages a
layer three
underlay in order to gain the benefits of everything we just talked about here.
But then it has a layer two overlay, which is to gain the benefits of a layer
two network.
This should feel a little familiar. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This should feel a little familiar.
It's what we just talked about inside the data center, having a spine and leaf
layer
three underlay with a layer two overlay formed by our VX land tunnels.
Now in our case, we're going to form this overlay using the control plane
protocol of
LISP.
And we are still definitely going to take advantage of VX land at the data
plane in order to achieve
the layer two overlay.
We just want to use LISP to proactively let our edge devices know where in the
network WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
network
to send traffic so we don't have to rely on flood and learn.
So now the idea is we look at these access layer switches and we conform VX
land tunnels
throughout this infrastructure, knowing that we've built this on layer three.
So we're still physically building up the same architecture, but logically it's
going
to look a lot different.
And so what this looks like is building out a fabric architecture that now
gives us a different
logical representation of what's happening.
But we typically draw this as a cloud and we've got the underlay topology in WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But we typically draw this as a cloud and we've got the underlay topology in
here.
So typically we're talking about those distribution switches, which might live
right in the middle
of the architecture.
Technically they could live here at the edge as well because they could serve
as border
nodes.
But either way we have a layer three underlay and now the access switches are
going to exist
around the fabric.
So this is where our access switches go and then we're going to leverage again WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So this is where our access switches go and then we're going to leverage again
VX land
to form our layer two tunnels to all of the other switches.
And so we form this full mesh of layer two switches or layer two connectivity
among our
different switches.
We get the idea here.
But in the end what we've created is the ability to still send our packets in
on one
switch and have them come out the other switch and they maintain their layer
two information.
And so now we can have that concept that we talked about earlier where we've WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so now we can have that concept that we talked about earlier where we've
got network
segments here that are bridged via the dotted line thanks to the X land.
Now in a campus architecture we don't really need a lot of VLAN identifiers and
so we
might just both leave early both of these on VLAN 10.
Whatever the VNI in the middle is we don't particularly care about that can be
chosen
by the system.
And then we've got different hosts now potentially laptops and printers and all WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we've got different hosts now potentially laptops and printers and all
kinds of different
devices that can now be still layer two adjacent even though they're separated
by that layer
three underlay.
So that is how VX land is used by SDA.
But we might want to come back to the control plane and LISP because we just
got done talking
about LISP as well.
And now we can start to map our different LISP components to our SDA components
because
again Cisco just took the LISP control plane elements and inserted them into S WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
again Cisco just took the LISP control plane elements and inserted them into S
DA.
Now recall LISP does have a data plane component that is layer three.
And the fact that it's a layer three set of tunnels makes sense it was built
for the
internet but we don't need to use this and we wouldn't use this as part of SD
access
so instead VX land is going to be used at the data plane.
So this is why we don't use LISP at the data plane but we do still want to use
it at the
control plane.
In the end what we have here is that we've got our different SDA components and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
In the end what we have here is that we've got our different SDA components and
the SDA
components are going to be things like the fabric edge node.
We also have the control plane node and then we have the fabric border node.
And these terms work when we're talking about how SDA traffic flows and we
spent a lot of
time talking about these earlier on in the course.
But we also just got done talking about LISP and all of the different
components and elements
of LISP.
And so when we look at LISP and how it operates remember it operates with e WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so when we look at LISP and how it operates remember it operates with e
gress tunneling
routers and ingress tunneling routers.
Well those actually match up with one another.
And so when we're talking about traffic coming into, well over here, into a LIS
P environment
and then exiting the LISP environment we're trying to get from, you know, the
packet comes
into the ITR, it goes over to the ETR and then it can get sent out to the rest
of the
network.
Well that's the responsibility of the fabric edge node in our Cisco software WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Well that's the responsibility of the fabric edge node in our Cisco software
defined access
environment.
And so we do start to see that these control plane elements are borrowed in a
sense from
LISP.
I mean we're taking the exact LISP architecture and applying it into SDA.
So that control plane node, what would that match up to in LISP?
Well we recall the mapping server and map resolver, that's exactly what we're
going to be mapping
it to.
So the control plane node is a combination of these functions which we've set
in LISP. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
in LISP.
We can combine these functions into one device as well.
Well that's exactly what we're going to do with SDA.
We're going to combine them into one device because the scale of the campus
architecture
is never going to get so high that we need to worry about having an
architecture that
works on the internet.
Instead we'll have one device that manages both functions and this is the
device that
our fabric edge node pulls information from, remember we use a pull methodology
, not a
push methodology anymore, I'm not pushing my routes everywhere. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
push methodology anymore, I'm not pushing my routes everywhere.
In case they're needed I'm instead going to pull them down on an as needed
basis and
I go to the control plane node in order to do that.
Lastly the fabric border node, this is going to match up with my proxy ETR, ITR
.
So when we have traffic entering into the SDA domain and leaving the SDA domain
that
needs to go through the fabric border node.
Well what about LISP?
Well if we're entering the LISP domain or exiting the LISP domain then we're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Well if we're entering the LISP domain or exiting the LISP domain then we're
going to
have to use one of the proxy tunneling routers.
So whether that's an egress tunneling router or an ingress tunneling router
depending on
the flow of traffic.
So again we see the direct parallels here where LISP is used at the control
plane and
the only difference is that where again LISP used a layer 3 tunnel at the data
plane we're
not going to use that instead we are going to say the SDA uses the layer 2 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
not going to use that instead we are going to say the SDA uses the layer 2
tunnel mechanism
at the data plane which of course is the XLAN.
So we're kind of combining technologies here and taking the parts of LISP that
will help
us and not taking the parts of LISP that are of no use to us.
Now LISP not least as we're sitting here talking about SDA access we've talked
about the data
plane and the control plane don't forget that we also have that policy plane
using Cisco WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
using Cisco
truss sec and this is where we integrate the identity services engine or ICE
into the framework.
Remember security these days in the modern network needs to be baked in from
the very
start.
Cisco did not want to create a solution that says okay we're going to build
this wonderful
solution and then we'll just sort of throw security on top.
No completely the opposite this was going to be foundational from the start
that was
a non negotiation or non negotiable from Cisco's perspective they needed it to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
a non negotiation or non negotiable from Cisco's perspective they needed it to
be in the solution
from the very beginning and so we don't just have control plane and data plane
we have
policy plane we have Cisco truss sec and interestingly when we look at Cisco's
implementation
of VXLAN Cisco doesn't use the industry standard VXLAN inside of SDA instead
they use something
called VXLAN GPO which stands for group policy option and the group policy WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
called VXLAN GPO which stands for group policy option and the group policy
option is going
to include those scalable group tags or SGTs which used to be called security
group tags
but the SGTs that come back to our policy plane so this is how I carry policy
across
my SDA fabric because again we want a host logging into this network to be
secure to
authenticate that host make sure that they're allowed to be on the network to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
authenticate that host make sure that they're allowed to be on the network to
manage my
communication so that access control concept can I talk to this host if so cool
if not
then maybe I can't talk to this host but I can talk to this host all of that
policy
is managed by again ICE and Cisco truss sec but VXLAN actually does carry the
scalable
group tags thanks to Cisco's special flavor VXLAN GPO so all of this is how
software
act defined access comes together again it's why we're talking about LISP it's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
act defined access comes together again it's why we're talking about LISP it's
why we're
talking about VXLAN it's all about making sure we fully understand in grasp the
software
defined access solution that Cisco's created and especially then even more
generically than
just Cisco SDA understand that this is how we can create campus fabrics that
allow us
to combine the best of both worlds between layer two and layer three access
design.
[BLANK_AUDIO]