Back to Dashboard
Module 50
Cisco DNA Center and SD-Access
← Previous Module
Next Module →
# 📘 CCNA 200-301 - Video 50: Cisco DNA Center and SD-Access ## Deep Study Notes --- ## 📌 Learning Objectives By the end of this video, you should understand: - What Cisco DNA Center is and its role - Intent-Based Networking (IBN) concepts - Cisco DNA Center architecture and components - SD-Access (Software-Defined Access) architecture - Fabric concepts (underlay, overlay, fabric roles) - DNA Center automation and assurance - Network segmentation with SD-Access --- ## 🧠 Core Concepts ### 1. What is Cisco DNA Center? **Definition:** Cisco Digital Network Architecture (DNA) Center is a centralized network management platform that provides automation, assurance, and security for enterprise networks using intent-based networking principles. **Analogy:** Think of Cisco DNA Center like a smart building management system. Instead of manually adjusting each light, thermostat, and door lock (individual devices), you tell the system "I want the building to be comfortable, secure, and energy-efficient" (intent). The system figures out how to achieve that across all devices. ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ CISCO DNA CENTER CAPABILITIES │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ AUTOMATION │ │ │ │ • Day 0/1/2 provisioning │ │ │ │ • Zero-touch deployment (ZTP) │ │ │ │ • Template-based configuration │ │ │ │ • Software image management (SWIM) │ │ │ │ • Network Plug and Play (PnP) │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ ASSURANCE │ │ │ │ • Network health monitoring │ │ │ │ • Client health (wired/wireless) │ │ │ │ • Application health (SaaS, on-prem) │ │ │ │ • AI/ML anomaly detection │ │ │ │ • Sensor-based testing │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ SECURITY │ │ │ │ • Segmentation (SD-Access) │ │ │ │ • Policy-based access control │ │ │ │ • Encrypted Traffic Analytics (ETA) │ │ │ │ • Threat detection and response │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ PLATFORM │ │ │ │ • REST APIs for integration │ │ │ │ • Workflow automation │ │ │ │ • App hosting │ │ │ │ • Multi-vendor support │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` --- ### 2. Intent-Based Networking (IBN) **Definition:** Intent-Based Networking is a paradigm where network administrators define "what" they want to achieve (intent), and the network automatically determines "how" to achieve it. ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ INTENT-BASED NETWORKING CYCLE │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ INTENT │ │ │ │ "What do you want to achieve?" │ │ │ │ Example: "All employees should have secure access to │ │ │ │ corporate resources from any location" │ │ │ │ │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ │ ▼ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ TRANSLATION │ │ │ │ Convert intent into network policy │ │ │ │ • Security policies │ │ │ │ • QoS policies │ │ │ │ • Segmentation rules │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ │ ▼ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ ACTIVATION │ │ │ │ Deploy policies across network devices │ │ │ │ • Zero-touch provisioning │ │ │ │ • Automated configuration │ │ │ │ • Software updates │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ │ ▼ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ ASSURANCE │ │ │ │ Monitor and verify intent is satisfied │ │ │ │ • Network health │ │ │ │ • Client experience │ │ │ │ • Application performance │ │ │ │ • Anomaly detection │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ │ │ (Feedback loop) │ │ ▼ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ REMEDIATION │ │ │ │ Automatically fix issues or notify administrators │ │ │ │ • Self-healing network │ │ │ │ • Automated troubleshooting │ │ │ │ • Root cause analysis │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ │ │ │ │ └────────────────────────────────────────┘ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` --- ### 3. Cisco DNA Center Architecture ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ CISCO DNA CENTER ARCHITECTURE │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ NORTHBOUND APIs │ │ │ │ (REST, Python, Ansible) │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ │ ▼ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ CISCO DNA CENTER │ │ │ │ ┌─────────────────────────────────────────────────────────────┐ │ │ │ │ │ Automation │ Assurance │ Security │ Platform│ │ │ │ │ └─────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─────────────────────────────────────────────────────────────┐ │ │ │ │ │ Data Platform (Analytics) │ │ │ │ │ └─────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─────────────────────────────────────────────────────────────┐ │ │ │ │ │ Multivendor Support (Third-party) │ │ │ │ │ └─────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ │ │ SOUTHBOUND (NETCONF, RESTCONF, CLI) │ │ ▼ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ NETWORK DEVICES │ │ │ │ ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐ │ │ │ │ │ Router │ │ Switch │ │ Wireless│ │ Firewall│ │ │ │ │ └─────────┘ └─────────┘ └─────────┘ └─────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` --- ### 4. SD-Access (Software-Defined Access) **Definition:** SD-Access is Cisco's enterprise network architecture that uses fabric technology to automate and simplify network operations, providing consistent policy enforcement regardless of user location. ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ SD-ACCESS ARCHITECTURE │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ CONTROL PLANE │ │ │ │ (LISP - Locator/ID Separation Protocol) │ │ │ │ │ │ │ │ • Map Server (MS) - Maintains EID-to-RLOC mappings │ │ │ │ • Map Resolver (MR) - Resolves EID-to-RLOC queries │ │ │ │ • Control Plane Node │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ DATA PLANE │ │ │ │ (VXLAN - Virtual Extensible LAN) │ │ │ │ │ │ │ │ • Overlay network (VXLAN tunnels) │ │ │ │ • Encapsulates traffic between fabric nodes │ │ │ │ • Provides segmentation (VNIs) │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ POLICY PLANE │ │ │ │ (Cisco TrustSec - SGT/CTS) │ │ │ │ │ │ │ │ • Security Group Tags (SGT) │ │ │ │ • Policy-based segmentation │ │ │ │ • Consistent policy across fabric │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` --- ### 5. SD-Access Fabric Roles | Role | Description | Functions | |------|-------------|-----------| | **Control Plane Node** | Maintains endpoint mappings | LISP map server, map resolver | | **Border Node** | Connects fabric to external networks | Gateway to outside, policy enforcement | | **Edge Node** | Connects endpoints to fabric | Serves wired endpoints, policy enforcement | | **Fabric WLC** | Wireless controller integrated with fabric | Manages wireless endpoints | ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ SD-ACCESS FABRIC ROLES │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ ┌─────────────────┐ │ │ │ Control Plane│ │ │ │ Node │ │ │ │ (CP Node) │ │ │ └────────┬────────┘ │ │ │ │ │ ┌──────────────────┼──────────────────┐ │ │ │ │ │ │ │ ▼ ▼ ▼ │ │ ┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐ │ │ │ Border Node │ │ Edge Node │ │ Edge Node │ │ │ │ (External) │ │ (Internal) │ │ (Internal) │ │ │ └────────┬────────┘ └────────┬────────┘ └────────┬────────┘ │ │ │ │ │ │ │ │ │ │ │ │ ┌────────▼────────┐ ┌────────▼────────┐ ┌────────▼────────┐ │ │ │ External │ │ Wired │ │ Wireless │ │ │ │ Network │ │ Endpoints │ │ Endpoints │ │ │ │ (Internet) │ │ (PCs) │ │ (APs) │ │ │ └─────────────────┘ └─────────────────┘ └─────────────────┘ │ │ │ │ Fabric Nodes communicate via VXLAN overlay │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` --- ### 6. Underlay vs. Overlay ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ UNDERLAY vs. OVERLAY │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ UNDERLAY (Physical Network): │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ ┌─────┐ ┌─────┐ ┌─────┐ ┌─────┐ │ │ │ │ │Switch│────│Switch│────│Switch│────│Switch│ │ │ │ │ └─────┘ └─────┘ └─────┘ └─────┘ │ │ │ │ │ │ │ │ • Physical network infrastructure │ │ │ │ • IP routing (OSPF, IS-IS) │ │ │ │ • Provides connectivity between fabric nodes │ │ │ │ • Simple, scalable design │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ OVERLAY (Virtual Network): │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ ┌─────────────────────────────────────────────────────────────┐ │ │ │ │ │ VXLAN Tunnel 1 (VNI 10001 - Engineering) │ │ │ │ │ │ ┌─────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ VXLAN Tunnel 2 (VNI 10002 - Sales) │ │ │ │ │ │ │ │ ┌─────────────────────────────────────────────┐ │ │ │ │ │ │ │ │ │ VXLAN Tunnel 3 (VNI 10003 - HR) │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ Logical networks over physical underlay │ │ │ │ │ │ │ │ │ └─────────────────────────────────────────────┘ │ │ │ │ │ │ │ └─────────────────────────────────────────────────────┘ │ │ │ │ │ └─────────────────────────────────────────────────────────────┘ │ │ │ │ │ │ │ │ • Virtual network overlays │ │ │ │ • VXLAN encapsulation │ │ │ │ • Independent of physical topology │ │ │ │ • Enables network virtualization │ │ │ │ │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` --- ### 7. Fabric Encapsulation (VXLAN) **VXLAN (Virtual Extensible LAN):** Encapsulates Layer 2 frames in UDP packets for transport across Layer 3 networks. ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ VXLAN ENCAPSULATION │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ Original Ethernet Frame: │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ MAC Header │ IP Header │ Payload │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ VXLAN Encapsulation: │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ Outer MAC │ Outer IP │ UDP │ VXLAN Header │ Original Frame │ │ │ │ Header │ Header │ (4789)│ (VNI) │ (Encapsulated) │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ VXLAN Components: │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ • VNI (VXLAN Network Identifier): 24-bit ID (up to 16M segments) │ │ │ │ • VTEP (VXLAN Tunnel Endpoint): Device that encapsulates/decapsulates│ │ │ │ • UDP Port: 4789 │ │ │ │ • Outer IP: Underlay network │ │ │ │ • Inner MAC/IP: Overlay network │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` --- ### 8. LISP (Locator/ID Separation Protocol) **LISP** separates endpoint identity (EID) from location (RLOC), enabling mobility and policy. ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ LISP ARCHITECTURE │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ LISP Terminology: │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ • EID (Endpoint Identifier): Identity of endpoint (IP address) │ │ │ │ • RLOC (Routing Locator): Location of endpoint (underlay IP) │ │ │ │ • Map Server (MS): Maintains EID-to-RLOC mappings │ │ │ │ • Map Resolver (MR): Resolves EID-to-RLOC queries │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ LISP Operation: │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ Host A (EID: 10.1.1.10) wants to talk to Host B │ │ │ │ │ │ │ │ 1. Edge Node receives packet from Host A │ │ │ │ 2. Edge Node queries Map Server for Host B's location │ │ │ │ 3. Map Server returns RLOC (underlay IP) of Host B's Edge Node │ │ │ │ 4. Edge Node encapsulates packet in VXLAN │ │ │ │ 5. Packet forwarded through underlay to Host B's Edge Node │ │ │ │ 6. Edge Node decapsulates and delivers to Host B │ │ │ │ │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` --- ### 9. SD-Access Segmentation **Macro-segmentation:** Isolates entire networks (Virtual Networks - VNs) **Micro-segmentation:** Isolates groups within a Virtual Network (SGT-based policies) ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ SD-ACCESS SEGMENTATION │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ MACRO-SEGMENTATION (Virtual Networks): │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ Virtual Network: Engineering (VN 1001) │ │ │ │ ┌─────────────────────────────────────────────────────────────┐ │ │ │ │ │ • All Engineering devices │ │ │ │ │ │ • Can communicate within VN │ │ │ │ │ │ • Cannot communicate with other VNs (unless policy allows) │ │ │ │ │ └─────────────────────────────────────────────────────────────┘ │ │ │ │ │ │ │ │ Virtual Network: Sales (VN 1002) │ │ │ │ ┌─────────────────────────────────────────────────────────────┐ │ │ │ │ │ • All Sales devices │ │ │ │ │ │ • Can communicate within VN │ │ │ │ │ │ • Cannot communicate with other VNs (unless policy allows) │ │ │ │ │ └─────────────────────────────────────────────────────────────┘ │ │ │ │ │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ MICRO-SEGMENTATION (Security Groups): │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ Engineering Virtual Network │ │ │ │ ┌─────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ │ │ │ │ SGT 10: Engineers (Full access) │ │ │ │ │ │ SGT 20: Contractors (Limited access) │ │ │ │ │ │ SGT 30: Guests (Internet only) │ │ │ │ │ │ │ │ │ │ │ │ Policy: Engineers can access servers │ │ │ │ │ │ Contractors cannot access servers │ │ │ │ │ │ Guests cannot access internal resources │ │ │ │ │ │ │ │ │ │ │ └─────────────────────────────────────────────────────────────┘ │ │ │ │ │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` --- ### 10. DNA Center Automation **Zero-Touch Provisioning (ZTP):** ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ ZERO-TOUCH PROVISIONING │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ Step 1: Plug in new switch │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ New Switch: DHCP request │ │ │ │ DHCP Server: Option 43 (DNA Center IP) │ │ │ │ │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ │ ▼ │ │ Step 2: Switch contacts DNA Center │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ Switch: "I need a configuration" │ │ │ │ DNA Center: "Here's your config and image" │ │ │ │ │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ │ ▼ │ │ Step 3: Switch is fully provisioned │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ • Image downloaded and installed │ │ │ │ • Configuration applied │ │ │ │ • Added to inventory │ │ │ │ • Ready for production │ │ │ │ │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` **Software Image Management (SWIM):** ```cisco ! DNA Center can manage software images across devices ! Features: ! • Image repository ! • Compliance checking ! • Automated upgrades ! • Distribution to devices ``` --- ### 11. DNA Center Assurance **Assurance Capabilities:** | Feature | Description | |---------|-------------| | **Network Health** | Overall network health score (1-10) | | **Client Health** | Wired and wireless client experience | | **Application Health** | Performance of business-critical apps | | **Sensor Health** | Synthetic testing from sensor devices | | **AI/ML Anomalies** | Automated detection of unusual behavior | | **Issues** | Identified problems with recommended fixes | ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ DNA CENTER ASSURANCE DASHBOARD │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ Network Health: 9.2/10 │ │ │ │ │ │ │ │ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │ │ │ │ │ Wired │ │ Wireless │ │ SD-WAN │ │ │ │ │ │ 9.5/10 │ │ 8.8/10 │ │ 9.0/10 │ │ │ │ │ └─────────────┘ └─────────────┘ └─────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ Top Issues │ │ │ │ │ │ │ │ • High latency on AP-23 (Resolved) │ │ │ │ • Authentication failures on switch-12 (Open) │ │ │ │ • Application performance: Salesforce (Degraded) │ │ │ │ │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ Client Health │ │ │ │ │ │ │ │ Top 5 Clients by issues: │ │ │ │ 1. User: jdoe (MAC: aa:bb:cc) - Poor Wi-Fi │ │ │ │ 2. User: msmith (MAC: dd:ee:ff) - DHCP timeout │ │ │ │ │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` --- ### 12. DNA Center APIs **REST API Examples:** ```python # Example: Get list of devices from DNA Center import requests url = "https://dna-center.example.com/api/v1/device" headers = { "X-Auth-Token": "your-token", "Content-Type": "application/json" } response = requests.get(url, headers=headers, verify=False) devices = response.json() for device in devices["response"]: print(f"{device['hostname']} - {device['managementIpAddress']}") ``` ```python # Example: Provision a new site payload = { "site": { "name": "Branch-Office", "parent": "Global" }, "devices": [ { "deviceId": "device-uuid", "roles": ["border-node", "edge-node"] } ] } response = requests.post(url, json=payload, headers=headers) ``` --- ## 🔧 Complete Configuration Examples ### Lab 1: DNA Center Discovery ```python # Python script to discover devices via DNA Center API import requests import json # DNA Center credentials DNAC_URL = "https://dna-center.example.com" USERNAME = "admin" PASSWORD = "Cisco123" # Get authentication token auth_url = f"{DNAC_URL}/dna/system/api/v1/auth/token" response = requests.post(auth_url, auth=(USERNAME, PASSWORD), verify=False) token = response.json()["Token"] # Get devices headers = {"X-Auth-Token": token} devices_url = f"{DNAC_URL}/dna/intent/api/v1/network-device" response = requests.get(devices_url, headers=headers, verify=False) # Print devices devices = response.json()["response"] for device in devices: print(f"{device['hostname']} - {device['managementIpAddress']}") ``` --- ### Lab 2: SD-Access Fabric Configuration (via DNA Center) **Note:** SD-Access configuration is typically done via GUI, not CLI. ``` 1. Create Underlay Network: - Configure IP addressing - Configure routing (OSPF/IS-IS) 2. Create Fabric: - Define fabric name - Add control plane nodes - Add border nodes - Add edge nodes 3. Create Virtual Networks: - Engineering VN - Sales VN - HR VN 4. Configure Security Policies: - Define SGTs - Create policy contracts 5. Onboard Devices: - Use ZTP or manual addition - Assign device roles ``` --- ## ✅ Exam Tips (For CCNA 200-301) | Topic | What Cisco Tests | |-------|------------------| | **DNA Center** | Centralized management, automation, assurance | | **Intent-Based Networking** | Define intent, network translates and activates | | **SD-Access** | Fabric-based architecture, segmentation | | **Fabric Roles** | Control Plane, Border, Edge, Wireless | | **VXLAN** | Overlay encapsulation, UDP 4789, VNI | | **LISP** | EID/RLOC separation, mapping system | | **Segmentation** | Macro (VN), Micro (SGT) | ### Common Exam Scenarios: **Scenario 1:** "What is the purpose of Cisco DNA Center?" - **Answer:** Centralized network management platform for automation, assurance, and security **Scenario 2:** "Which protocol does SD-Access use for overlay encapsulation?" - **Answer:** VXLAN (Virtual Extensible LAN) **Scenario 3:** "What is the difference between macro and micro segmentation in SD-Access?" - **Answer:** Macro segmentation isolates entire Virtual Networks; micro segmentation isolates groups within a Virtual Network using SGTs ### Mnemonics: **SD-Access Fabric Roles:** **"C.B.E.W." - Control, Border, Edge, Wireless** - **C**ontrol Plane Node: Maintains mappings - **B**order Node: Connects to external - **E**dge Node: Connects endpoints - **W**ireless Controller: Wireless integration **SD-Access Planes:** **"C.D.P." - Control, Data, Policy** - **C**ontrol Plane: LISP - **D**ata Plane: VXLAN - **P**olicy Plane: TrustSec --- ## 📝 Summary (1-Minute Revision) ``` CISCO DNA CENTER: PURPOSE: ├── Centralized network management ├── Automation (ZTP, SWIM, templates) ├── Assurance (health monitoring) └── Security (segmentation, policy) INTENT-BASED NETWORKING: ├── Intent: What you want to achieve ├── Translation: Convert to policy ├── Activation: Deploy to network ├── Assurance: Verify and monitor └── Remediation: Auto-fix issues SD-ACCESS: ARCHITECTURE: ├── Underlay: Physical network (IP routing) ├── Overlay: Virtual networks (VXLAN) └── Fabric: Combined underlay + overlay FABRIC ROLES: ├── Control Plane Node: LISP map server ├── Border Node: External connectivity ├── Edge Node: Endpoint connectivity └── Fabric WLC: Wireless integration ENCAPSULATION: ├── VXLAN (UDP 4789) ├── VNI (24-bit, up to 16M segments) └── VTEP (encapsulation endpoint) SEGMENTATION: ├── Macro: Virtual Networks (VNs) └── Micro: Security Group Tags (SGTs) DNA CENTER CAPABILITIES: ├── Automation: Day 0/1/2 operations ├── Assurance: Health scores, issues ├── Security: Policy-based access └── Platform: REST APIs ``` --- ## 🧪 Practice Questions **1. What is the primary purpose of Cisco DNA Center?** - A) Routing and switching - B) Centralized network automation and assurance - C) Firewall security - D) Wireless access <details> <summary>Answer</summary> <b>B) Centralized network automation and assurance</b> - DNA Center provides automation, assurance, and security. </details> **2. Which protocol does SD-Access use for overlay encapsulation?** - A) GRE - B) IPsec - C) VXLAN - D) MPLS <details> <summary>Answer</summary> <b>C) VXLAN</b> - VXLAN (Virtual Extensible LAN) is used for overlay encapsulation in SD-Access. </details> **3. What is the role of a Control Plane Node in SD-Access?** - A) Forward packets between endpoints - B) Maintain endpoint-to-location mappings - C) Connect fabric to external networks - D) Manage wireless access <details> <summary>Answer</summary> <b>B) Maintain endpoint-to-location mappings</b> - Control Plane Node runs LISP for mapping. </details> **4. What does LISP separate in SD-Access?** - A) MAC and IP addresses - B) EID (Endpoint ID) and RLOC (Routing Locator) - C) IPv4 and IPv6 - D) Control and data planes <details> <summary>Answer</summary> <b>B) EID (Endpoint ID) and RLOC (Routing Locator)</b> - LISP separates identity from location. </details> **5. Which UDP port does VXLAN use?** - A) UDP 4789 - B) UDP 5246 - C) UDP 5247 - D) UDP 2055 <details> <summary>Answer</summary> <b>A) UDP 4789</b> - VXLAN uses UDP port 4789. </details> **6. What is the purpose of micro-segmentation in SD-Access?** - A) Isolate entire departments - B) Isolate groups within a Virtual Network - C) Connect to external networks - D) Manage wireless clients <details> <summary>Answer</summary> <b>B) Isolate groups within a Virtual Network</b> - Micro-segmentation uses SGTs to isolate groups. </details> **7. What does VNI stand for?** - A) Virtual Network Interface - B) VXLAN Network Identifier - C) Virtual Network Identifier - D) VLAN Network Interface <details> <summary>Answer</summary> <b>B) VXLAN Network Identifier</b> - VNI identifies VXLAN segments (24-bit). </details> **8. Which component connects SD-Access fabric to external networks?** - A) Edge Node - B) Control Plane Node - C) Border Node - D) Fabric WLC <details> <summary>Answer</summary> <b>C) Border Node</b> - Border Node provides connectivity to external networks. </details> **9. What is the IBN cycle?** - A) Intent, Business, Network - B) Intent, Translation, Activation, Assurance, Remediation - C) Identify, Build, Navigate - D) Install, Boot, Network <details> <summary>Answer</summary> <b>B) Intent, Translation, Activation, Assurance, Remediation</b> - The intent-based networking cycle. </details> **10. What is the purpose of DNA Center Assurance?** - A) Deploy configurations - B) Monitor network and client health - C) Manage software images - D) Create virtual networks <details> <summary>Answer</summary> <b>B) Monitor network and client health</b> - Assurance provides health monitoring and issue detection. </details> **11. Which protocol is used for SD-Access control plane?** - A) VXLAN - B) LISP - C) OSPF - D) BGP <details> <summary>Answer</summary> <b>B) LISP</b> - LISP (Locator/ID Separation Protocol) is used for the control plane. </details> **12. What is the maximum number of VXLAN segments (VNI)?** - A) 4096 - B) 16,777,216 - C) 1,000,000 - D) 65,536 <details> <summary>Answer</summary> <b>B) 16,777,216</b> - VNI is 24-bit, supporting up to 16 million segments. </details> --- ## 📌 Next Steps After completing Video 50, you should be ready for: - **Video 51:** Troubleshooting Methodology - **Video 52:** Troubleshooting Switching Issues **Lab Practice:** 1. Explore DNA Center GUI (if available) 2. Understand SD-Access architecture 3. Review LISP and VXLAN concepts 4. Practice DNA Center API calls 5. Understand fabric roles and segmentation --- **Ready for Video 51?** Share the link or say "next" and I'll continue with Troubleshooting Methodology. I'll continue with **Video 51: Troubleshooting Methodology** based on the standard CCNA 200-301 curriculum. ---