Cisco SD-Access Fabric with Catalyst Center (3.1.6) Lab
Solution overview
Cisco's SD-Access is a move towards a fully automated, centrally managed, intent-based network. SD-Access is one component of the overall DNA Architecture framework from Cisco. This solution adopts a fabric-based network similar to what has gained significant adoption in the data center, with central management handled through Catalyst Center, formerly known as DNA Center.
Catalyst Center is the central management, automation, and monitoring point for an intent-based Cisco campus network. This lab walks through building an SD-Access fabric from the ground up, integrating Cisco Identity Services Engine (ISE) for identity-based access control, and using Catalyst Center's Assurance capabilities to monitor and troubleshoot the resulting network. Some of the benefits explored include:
Automation
- Centralized site hierarchy, network settings, and device credential management
- Automated device discovery and provisioning
- Virtual Networks (VNs) for logical segmentation across a shared physical fabric
- Fabric role assignment (Control Plane, Border, and Edge Nodes) and Anycast Gateways for seamless client roaming
- Layer 3 Handoff and route leaking for controlled connectivity between segmented networks and the outside world
Segmentation and Security
- Integration with Cisco ISE for centralized, identity-based AAA
- Macro-segmentation using isolated Virtual Networks (VRFs) to separate populations such as Corporate, IT, and Guest traffic
- Micro-segmentation with Cisco TrustSec and Security Group Tags (SGTs), enabling group-based policy that travels with the user or device rather than being tied to IP address or VLAN
Assurance
- Health Scores (Network, Client, and Application)
- System 360 visibility into Catalyst Center's own platform health
- Configuration compliance and drift detection between running and stored device configurations
- Root-cause insights that speed up troubleshooting across the fabric