WEBVTT

1
00:00.000 --> 00:04.800
If you haven't yet done so be sure to pause this video, sketch out this diagram

2
00:04.800 --> 00:07.000
and make sure that you can answer the questions

3
00:07.000 --> 00:10.830
because if we can get through and answer all of these things and add things to

4
00:10.830 --> 00:13.000
this diagram that will complete the picture

5
00:13.000 --> 00:18.310
well that will really make sure that we have a pretty good knowledge of SDA and

6
00:18.310 --> 00:19.000
how it works.

7
00:19.000 --> 00:22.000
So let's start off with the control plane.

8
00:22.000 --> 00:25.250
The control plane says, or task here, says to add a node that will be

9
00:25.250 --> 00:29.000
responsible for maintaining host to edge mappings.

10
00:29.000 --> 00:33.380
Well we're going to play that on a database and this database is going to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:29.000 --> 00:33.380
Well we're going to play that on a database and this database is going to

11
00:33.380 --> 00:37.000
reside on what's known as the control plane node

12
00:37.000 --> 00:42.000
which can be a lot of different Cisco devices and ISR, a catalyst 9K.

13
00:42.000 --> 00:46.630
We have to make sure whatever device we deploy supports being a control plane

14
00:46.630 --> 00:49.000
node and it's going to keep again the host mappings.

15
00:49.000 --> 00:56.650
For example we're going to know that over here on the right this 10.100.0.10

16
00:56.650 --> 01:04.000
maps to our RLock that IP address the loop back of 10.2.2.2.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:56.650 --> 01:04.000
maps to our RLock that IP address the loop back of 10.2.2.2.

17
01:04.000 --> 01:10.290
And so when somebody needs to send a packet out under the network and we need

18
01:10.290 --> 01:14.000
to know, hey how do I get to this IP address?

19
01:14.000 --> 01:18.810
Well we are going to use LISP in order to complete that information and again

20
01:18.810 --> 01:21.000
it uses that poll not push methodology.

21
01:21.000 --> 01:25.340
I don't proactively share it everywhere. I just go out and get it when I need

22
01:25.340 --> 01:26.000
it.

23
01:26.000 --> 01:30.560
Now from a data plane perspective we're migrating to data plane here, draw a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
01:26.000 --> 01:30.560
Now from a data plane perspective we're migrating to data plane here, draw a

24
01:30.560 --> 01:32.000
tunnel between the edge nodes.

25
01:32.000 --> 01:36.580
Okay so I'm going to draw a tunnel from this loop back to this loop back over

26
01:36.580 --> 01:37.000
here.

27
01:37.000 --> 01:40.000
And the protocol that's used is VXLAN.

28
01:40.000 --> 01:45.230
At this point we've called these RLocks before these loop back addresses. Now

29
01:45.230 --> 01:47.000
these are known as the VTEPs.

30
01:47.000 --> 01:52.840
So VTEP is a VXLAN term for it, RLock is a LISP term. Either way we are

31
01:52.840 --> 01:55.000
connecting these fabric edge devices.

32
01:55.000 --> 01:59.420
Now what routes do the underlay nodes know and what routes do they know nothing

33
01:59.420 --> 02:00.000
about?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

34
02:00.000 --> 02:04.280
Well these underlay nodes are going to have to be able to route from this loop

35
02:04.280 --> 02:07.000
back on the left to this loop back on the right,

36
02:07.000 --> 02:10.720
which means it's probably going to need to know some of the interconnecting sub

37
02:10.720 --> 02:11.000
nets.

38
02:11.000 --> 02:15.520
But in the end what we really know for sure in their routing tables are paths

39
02:15.520 --> 02:17.000
to these loop backs.

40
02:17.000 --> 02:21.550
They know nothing about the overlay networks that are being deployed over the

41
02:21.550 --> 02:22.000
top.

42
02:22.000 --> 02:27.000
So basically when we think about the fact that it extends down like this,

43
02:27.000 --> 02:31.310
we can think of these hosts as being part of the overlay network because their
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

43
02:27.000 --> 02:31.310
we can think of these hosts as being part of the overlay network because their

44
02:31.310 --> 02:35.000
traffic goes into the tunnels that are used to build the overlay.

45
02:35.000 --> 02:40.000
So again the underlay has no knowledge of these external subnets.

46
02:40.000 --> 02:44.520
Now where do the default gateways reside? Well the default gateways are going

47
02:44.520 --> 02:47.000
to reside right here and right here.

48
02:47.000 --> 02:52.540
And any other fabric edge node that has this particular VLAN, the SVI connects

49
02:52.540 --> 02:55.000
down into this environment.

50
02:55.000 --> 03:00.350
And so both of these devices can reach their default gateways by going up to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
02:55.000 --> 03:00.350
And so both of these devices can reach their default gateways by going up to

51
03:00.350 --> 03:02.000
the connected device.

52
03:02.000 --> 03:06.000
And that is known as any cast gateways.

53
03:06.000 --> 03:10.000
Now lastly we're going to talk about the policy plane here.

54
03:10.000 --> 03:14.000
And the policy plane is all about security.

55
03:14.000 --> 03:19.780
So the challenge says to draw a circle around the node that's responsible for

56
03:19.780 --> 03:21.000
dropping a packet.

57
03:21.000 --> 03:24.000
Well that depends on the flow of traffic.

58
03:24.000 --> 03:29.200
If we're sending a packet this way up to the fabric edge node on the left and

59
03:29.200 --> 03:31.000
then over to the node on the right,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

59
03:29.200 --> 03:31.000
then over to the node on the right,

60
03:31.000 --> 03:36.000
and then down, well it's going to be this device that decides to drop.

61
03:36.000 --> 03:41.060
And if it's going the other direction it would be this device because

62
03:41.060 --> 03:46.000
ultimately it's the egress node that drops traffic.

63
03:46.000 --> 03:50.220
Which goes a little bit against the grain because as we said security policy

64
03:50.220 --> 03:52.000
likes to drop traffic early on,

65
03:52.000 --> 03:56.780
but we are truly dropping it as it leaves the fabric with SDA for the reasons

66
03:56.780 --> 03:58.000
we discussed.

67
03:58.000 --> 04:02.840
Now what type of marking is used? We're going to use those scalable group tags,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
03:58.000 --> 04:02.840
Now what type of marking is used? We're going to use those scalable group tags,

68
04:02.840 --> 04:03.000
Sgt's,

69
04:03.000 --> 04:06.000
and those are going to be inserted into the VXLAN header.

70
04:06.000 --> 04:11.700
So it's carried for us by VXLAN, which allows the egress node to see what type

71
04:11.700 --> 04:13.000
of traffic it is.

72
04:13.000 --> 04:16.480
We don't have to identify it. We don't have to look at any information other

73
04:16.480 --> 04:19.000
than the Sgt that was assigned to it.

74
04:19.000 --> 04:22.000
And then I can know whether or not to drop the packet.

75
04:22.000 --> 04:25.000
Now what control integrations use for managing this?

76
04:25.000 --> 04:30.000
Sgt's are going to be properly managed thanks to ICE,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
04:30.000 --> 04:33.000
but keep in mind the ICE integrates with Catalyst Center.

78
04:33.000 --> 04:36.000
We as the admins are logging into Catalyst Center,

79
04:36.000 --> 04:41.000
and this back end integration is going to manage the policy plane for us.

80
04:41.000 --> 04:45.000
So this is a great look at the overall architecture of SDA.

81
04:45.000 --> 04:48.000
We're looking at the control plane, the data plane, the policy plane,

82
04:48.000 --> 04:51.000
and we're also looking at those any cast gateways.

83
04:51.000 --> 04:56.750
If we can track through this challenge and see how the end-to-end traffic flow

84
04:56.750 --> 04:58.000
works in an SDA fabric,

85
04:58.000 --> 05:02.000
it's going to put us in really good shape for understanding the scope of SDA
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

85
04:58.000 --> 05:02.000
it's going to put us in really good shape for understanding the scope of SDA

86
05:02.000 --> 05:03.000
that we're expected to know

87
05:03.000 --> 05:05.000
for going and taking this exam.

88
05:05.000 --> 05:08.000
I hope there's been informative for you, and I'd like to thank you for viewing.

89
05:08.000 --> 05:09.120
Thank you for viewing.