Chapter 23: Quiz – Fabric Technologies (Answers) CCNPv8 ENCOR

Explanation: In an automated underlay model, the Cisco DNA Center LAN automation feature creates a Layer 3 routed access campus design through the use of IS-IS.

Explanation: Manual network configuration changes are slow and lead to misconfigurations. The SD-Access network automation functionality uses the Cisco DNA Center as a single point of automation, orchestration, and management of network device and service deployment.

Explanation: LISP is used to separate the identify (endpoint IP address) from its current location (network edge/border router IP address).

Explanation: The vSmart controller is considered the brain of the Cisco SD-WAN solution and has pre-installed credentials to enable authentication of SD-WA routers as they come online.

Explanation: There are four workflows defined by Cisco DNA Center: design, policy, provision, and assurance. Cisco DNA assurance workflow provides the tools needed to manage the SD-Access fabric. These tools include Dashboard, Client 360, Devices 360, and Issues.

Explanation: There are three planes of operation in the SD-Access fabric:

• Control plane, based on Locator/ID Separation Protocol (LISP)
• Data plane, based on Virtual Extensible LAN (VXLAN)
• Policy plane, based on Cisco TrustSec

Explanation: There are five basic device roles in the SDA fabric overlay. The role of the fabric border node is to connect external Layer 3 networks to the SDA fabric.

Explanation: The overlay network provides policy-based network segmentation, host mobility, and enhanced security.

Explanation: The Cisco SD-WAN solution has four main components:

• The vManage Network Management System (NMS) is the single pane of glass (GUI) for managing the SD-WAN solution.
• The vSmart controller acts as the brains of the solution.
• The SD-WAN routers involve vEdge and cEdge routers.
• The vBond orchestrator authenticates and orchestrates connectivity between SD-WAN routers and vSmart controllers.

Explanation: The underlay network for SD-Access consists of the hardware components making up the physical networking infrastructure that transports packets for the SD-Access fabric overlay.

Explanation: The controller layer provides all of the management subsystems for the management layer using Cisco DNA Center and Cisco ISE. The subsystems at the controller layer are Cisco Network Control Platform (NCP), Cisco Network Data Platform (NDP), and Identity Services Engine (ISE).

Explanation: There are three control layer subsystems in the Cisco SD-Access architecture.

• Cisco Network Control Platform (NCP) – provides underlay and fabric automation and orchestration
• Cisco Network Data Platform (NDP) – analyzes and correlates network events
• Cisco Identity Services Engine (ISE) – provides identity and policy services

Explanation: Although LISP is the control plane for the SD-Access fabric, it does not use LISP data encapsulation for the data plane; instead, it uses VXLAN encapsulation because it is capable of encapsulating the original Ethernet header, and this allows SD-Access to support Layer 2 and Layer 3 overlays.

Explanation: The original VXLAN specification was enhanced for SD-Access to support Cisco TrustSec Scalable Group Tags (SGTs). This was accomplished by adding new fields to the first 4 bytes of the VXLAN header in order to transport up to 64,000 SGTs. The new VXLAN format is called VXLAN Group Policy Option (GPO), and it is defined in the IETF draft draft-smith-vxlan-group-policy-05.

Explanation: The SD-Access fabric control plane is based on Locator/ID Separation Protocol (LISP).

Explanation: The VXLAN-GPO specification includes a 16-bit identifier that is used to carry the SGT tag called the Group Policy ID.

Explanation: Cisco SD-Access was designed for enterprise campus and branch network environments and not for other types of network environments, such as data center, service provider, and WAN environments.

Explanation: The SD-Access architecture includes the following components:

• Cisco switches: Provide wired (LAN) access to the fabric. Multiple types of Cisco Catalyst switches are supported, including NX-OS.
• Cisco routers: Provide WAN and branch access to the fabric. Multiple types of Cisco ASR 1000, ISR, and CSR routers, including the CSRv and ISRv cloud routers, are supported.
• Cisco wireless: Cisco WLCs and APs provide wireless (WLAN) access to the fabric.
• Cisco controller appliances: There are only two types of appliances to consider: Cisco DNA Center and Cisco ISE. Cisco ISE supports both VM and physical appliance deployment models.

Explanation: The Cisco SD-WAN solution is composed of four main components and an optional analytics service:

• vManage network management system (NMS)
• vSmart controller
• SD-WAN routers
• vBond orchestrator
• vAnalytics (optional)

Explanation: The vSmart controller establishes permanent and secure Datagram Transport Layer Security (DTLS) connections to all SD-WAN routers in the SD-WAN fabric and runs a proprietary routing protocol called Overlay Management Protocol (OMP) over each of the DTLS tunnels.

Explanation: SD-WAN is transport agnostic and can use any type of IP-based underlay transport networks, such as the Internet, satellite, dedicated circuits, 3G/4G LTE, and MPLS.

Explanation: vManage is the single pane of glass for the SD-WAN solution.

Explanation: The main function of the vBond orchestrator is to authenticate the vSmart controllers and the SD-WAN routers and orchestrate connectivity between them.