WEBVTT 1 00:00.000 --> 00:04.960 So with Lisbon VX-Lan covered in more detail, let's go back to Cisco's software 2 00:04.960 --> 00:05.400 defined 3 00:05.400 --> 00:09.080 access solution, which is the whole reason we're talking about these different 4 00:09.080 --> 00:10.240 technologies. 5 00:10.240 --> 00:14.700 SDA wants to create a campus fabric with a traditional architecture. 6 00:14.700 --> 00:16.180 We had a difficult choice here. 7 00:16.180 --> 00:19.340 We had our distribution switches, usually two of them. 8 00:19.340 --> 00:22.440 We have a bunch of access layer switches. 9 00:22.440 --> 00:26.150 And the goal here is to try to figure out how do we attach to these, knowing 10 00:26.150 --> 00:27.160 that there's 11 00:27.160 --> 00:31.280 additional access layer switches hanging off of the edge here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 11 00:27.160 --> 00:31.280 additional access layer switches hanging off of the edge here. 12 00:31.280 --> 00:32.440 And so we had our choices. 13 00:32.440 --> 00:38.050 We have our layer two design, which is great for flexibility, but it does 14 00:38.050 --> 00:39.520 require spanning 15 00:39.520 --> 00:41.080 tree protocol. 16 00:41.080 --> 00:44.080 And it's not so good at scaling as a result. 17 00:44.080 --> 00:46.360 Meanwhile layer three flipped this on its head. 18 00:46.360 --> 00:48.600 It said, okay, we're not very flexible. 19 00:48.600 --> 00:53.730 We can't extend subnets between access layer closets anymore, but we no longer 20 00:53.730 --> 00:54.280 need to 21 00:54.280 --> 00:57.920 worry about spanning tree protocol, which is a good thing. 22 00:57.920 --> 01:00.320 And scaling is through the roof. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 22 00:57.920 --> 01:00.320 And scaling is through the roof. 23 01:00.320 --> 01:04.320 We have no limits to scaling with a layer three architecture. 24 01:04.320 --> 01:07.360 But the reality is that there wasn't a perfect solution here. 25 01:07.360 --> 01:10.160 I mean, we had pros and cons with both of these. 26 01:10.160 --> 01:15.400 And so the idea here was to create the idea of a fabric, which leverages a 27 01:15.400 --> 01:16.440 layer three 28 01:16.440 --> 01:23.680 underlay in order to gain the benefits of everything we just talked about here. 29 01:23.680 --> 01:28.770 But then it has a layer two overlay, which is to gain the benefits of a layer 30 01:28.770 --> 01:29.960 two network. 31 01:29.960 --> 01:30.960 This should feel a little familiar. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 31 01:29.960 --> 01:30.960 This should feel a little familiar. 32 01:30.960 --> 01:34.730 It's what we just talked about inside the data center, having a spine and leaf 33 01:34.730 --> 01:34.880 layer 34 01:34.880 --> 01:40.080 three underlay with a layer two overlay formed by our VX land tunnels. 35 01:40.080 --> 01:44.350 Now in our case, we're going to form this overlay using the control plane 36 01:44.350 --> 01:45.160 protocol of 37 01:45.160 --> 01:46.640 LISP. 38 01:46.640 --> 01:50.410 And we are still definitely going to take advantage of VX land at the data 39 01:50.410 --> 01:51.840 plane in order to achieve 40 01:51.840 --> 01:54.160 the layer two overlay. 41 01:54.160 --> 01:59.340 We just want to use LISP to proactively let our edge devices know where in the 42 01:59.340 --> 02:00.000 network WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 42 01:59.340 --> 02:00.000 network 43 02:00.000 --> 02:04.520 to send traffic so we don't have to rely on flood and learn. 44 02:04.520 --> 02:09.750 So now the idea is we look at these access layer switches and we conform VX 45 02:09.750 --> 02:10.840 land tunnels 46 02:10.840 --> 02:15.960 throughout this infrastructure, knowing that we've built this on layer three. 47 02:15.960 --> 02:19.730 So we're still physically building up the same architecture, but logically it's 48 02:19.730 --> 02:20.040 going 49 02:20.040 --> 02:21.960 to look a lot different. 50 02:21.960 --> 02:25.900 And so what this looks like is building out a fabric architecture that now 51 02:25.900 --> 02:26.880 gives us a different 52 02:26.880 --> 02:29.440 logical representation of what's happening. 53 02:29.440 --> 02:34.840 But we typically draw this as a cloud and we've got the underlay topology in WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 53 02:29.440 --> 02:34.840 But we typically draw this as a cloud and we've got the underlay topology in 54 02:34.840 --> 02:35.560 here. 55 02:35.560 --> 02:39.520 So typically we're talking about those distribution switches, which might live 56 02:39.520 --> 02:40.400 right in the middle 57 02:40.400 --> 02:41.400 of the architecture. 58 02:41.400 --> 02:45.070 Technically they could live here at the edge as well because they could serve 59 02:45.070 --> 02:45.600 as border 60 02:45.600 --> 02:46.600 nodes. 61 02:46.600 --> 02:53.560 But either way we have a layer three underlay and now the access switches are 62 02:53.560 --> 02:55.080 going to exist 63 02:55.080 --> 02:56.480 around the fabric. 64 02:56.480 --> 03:01.440 So this is where our access switches go and then we're going to leverage again WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 64 02:56.480 --> 03:01.440 So this is where our access switches go and then we're going to leverage again 65 03:01.440 --> 03:02.880 VX land 66 03:02.880 --> 03:08.520 to form our layer two tunnels to all of the other switches. 67 03:08.520 --> 03:14.060 And so we form this full mesh of layer two switches or layer two connectivity 68 03:14.060 --> 03:14.720 among our 69 03:14.720 --> 03:16.080 different switches. 70 03:16.080 --> 03:17.800 We get the idea here. 71 03:17.800 --> 03:22.430 But in the end what we've created is the ability to still send our packets in 72 03:22.430 --> 03:22.880 on one 73 03:22.880 --> 03:28.300 switch and have them come out the other switch and they maintain their layer 74 03:28.300 --> 03:29.640 two information. 75 03:29.640 --> 03:33.200 And so now we can have that concept that we talked about earlier where we've WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 75 03:29.640 --> 03:33.200 And so now we can have that concept that we talked about earlier where we've 76 03:33.200 --> 03:33.920 got network 77 03:33.920 --> 03:39.920 segments here that are bridged via the dotted line thanks to the X land. 78 03:39.920 --> 03:44.280 Now in a campus architecture we don't really need a lot of VLAN identifiers and 79 03:44.280 --> 03:44.680 so we 80 03:44.680 --> 03:48.880 might just both leave early both of these on VLAN 10. 81 03:48.880 --> 03:52.340 Whatever the VNI in the middle is we don't particularly care about that can be 82 03:52.340 --> 03:52.720 chosen 83 03:52.720 --> 03:54.440 by the system. 84 03:54.440 --> 04:00.060 And then we've got different hosts now potentially laptops and printers and all WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 84 03:54.440 --> 04:00.060 And then we've got different hosts now potentially laptops and printers and all 85 04:00.060 --> 04:01.480 kinds of different 86 04:01.480 --> 04:07.440 devices that can now be still layer two adjacent even though they're separated 87 04:07.440 --> 04:08.520 by that layer 88 04:08.520 --> 04:10.400 three underlay. 89 04:10.400 --> 04:13.080 So that is how VX land is used by SDA. 90 04:13.080 --> 04:17.170 But we might want to come back to the control plane and LISP because we just 91 04:17.170 --> 04:18.240 got done talking 92 04:18.240 --> 04:20.200 about LISP as well. 93 04:20.200 --> 04:25.480 And now we can start to map our different LISP components to our SDA components 94 04:25.480 --> 04:26.120 because 95 04:26.120 --> 04:32.210 again Cisco just took the LISP control plane elements and inserted them into S WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 95 04:26.120 --> 04:32.210 again Cisco just took the LISP control plane elements and inserted them into S 96 04:32.210 --> 04:32.640 DA. 97 04:32.640 --> 04:38.720 Now recall LISP does have a data plane component that is layer three. 98 04:38.720 --> 04:42.490 And the fact that it's a layer three set of tunnels makes sense it was built 99 04:42.490 --> 04:42.920 for the 100 04:42.920 --> 04:47.820 internet but we don't need to use this and we wouldn't use this as part of SD 101 04:47.820 --> 04:48.400 access 102 04:48.400 --> 04:52.320 so instead VX land is going to be used at the data plane. 103 04:52.320 --> 04:55.920 So this is why we don't use LISP at the data plane but we do still want to use 104 04:55.920 --> 04:56.320 it at the 105 04:56.320 --> 04:57.760 control plane. 106 04:57.760 --> 05:03.850 In the end what we have here is that we've got our different SDA components and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 106 04:57.760 --> 05:03.850 In the end what we have here is that we've got our different SDA components and 107 05:03.850 --> 05:04.560 the SDA 108 05:04.560 --> 05:07.960 components are going to be things like the fabric edge node. 109 05:07.960 --> 05:14.120 We also have the control plane node and then we have the fabric border node. 110 05:14.120 --> 05:18.840 And these terms work when we're talking about how SDA traffic flows and we 111 05:18.840 --> 05:19.800 spent a lot of 112 05:19.800 --> 05:22.680 time talking about these earlier on in the course. 113 05:22.680 --> 05:25.920 But we also just got done talking about LISP and all of the different 114 05:25.920 --> 05:27.120 components and elements 115 05:27.120 --> 05:28.400 of LISP. 116 05:28.400 --> 05:32.870 And so when we look at LISP and how it operates remember it operates with e WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 116 05:28.400 --> 05:32.870 And so when we look at LISP and how it operates remember it operates with e 117 05:32.870 --> 05:34.000 gress tunneling 118 05:34.000 --> 05:37.080 routers and ingress tunneling routers. 119 05:37.080 --> 05:40.960 Well those actually match up with one another. 120 05:40.960 --> 05:45.420 And so when we're talking about traffic coming into, well over here, into a LIS 121 05:45.420 --> 05:46.320 P environment 122 05:46.320 --> 05:49.920 and then exiting the LISP environment we're trying to get from, you know, the 123 05:49.920 --> 05:50.720 packet comes 124 05:50.720 --> 05:54.800 into the ITR, it goes over to the ETR and then it can get sent out to the rest 125 05:54.800 --> 05:55.280 of the 126 05:55.280 --> 05:56.280 network. 127 05:56.280 --> 06:00.900 Well that's the responsibility of the fabric edge node in our Cisco software WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 127 05:56.280 --> 06:00.900 Well that's the responsibility of the fabric edge node in our Cisco software 128 06:00.900 --> 06:01.800 defined access 129 06:01.800 --> 06:03.680 environment. 130 06:03.680 --> 06:08.640 And so we do start to see that these control plane elements are borrowed in a 131 06:08.640 --> 06:09.440 sense from 132 06:09.440 --> 06:10.440 LISP. 133 06:10.440 --> 06:16.280 I mean we're taking the exact LISP architecture and applying it into SDA. 134 06:16.280 --> 06:18.920 So that control plane node, what would that match up to in LISP? 135 06:18.920 --> 06:23.560 Well we recall the mapping server and map resolver, that's exactly what we're 136 06:23.560 --> 06:24.560 going to be mapping 137 06:24.560 --> 06:25.800 it to. 138 06:25.800 --> 06:29.780 So the control plane node is a combination of these functions which we've set 139 06:29.780 --> 06:30.480 in LISP. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 139 06:29.780 --> 06:30.480 in LISP. 140 06:30.480 --> 06:33.720 We can combine these functions into one device as well. 141 06:33.720 --> 06:35.400 Well that's exactly what we're going to do with SDA. 142 06:35.400 --> 06:39.320 We're going to combine them into one device because the scale of the campus 143 06:39.320 --> 06:40.160 architecture 144 06:40.160 --> 06:44.650 is never going to get so high that we need to worry about having an 145 06:44.650 --> 06:45.880 architecture that 146 06:45.880 --> 06:47.320 works on the internet. 147 06:47.320 --> 06:51.440 Instead we'll have one device that manages both functions and this is the 148 06:51.440 --> 06:52.240 device that 149 06:52.240 --> 06:57.210 our fabric edge node pulls information from, remember we use a pull methodology 150 06:57.210 --> 06:57.720 , not a 151 06:57.720 --> 07:01.560 push methodology anymore, I'm not pushing my routes everywhere. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 151 06:57.720 --> 07:01.560 push methodology anymore, I'm not pushing my routes everywhere. 152 07:01.560 --> 07:05.550 In case they're needed I'm instead going to pull them down on an as needed 153 07:05.550 --> 07:06.280 basis and 154 07:06.280 --> 07:09.360 I go to the control plane node in order to do that. 155 07:09.360 --> 07:18.060 Lastly the fabric border node, this is going to match up with my proxy ETR, ITR 156 07:18.060 --> 07:18.320 . 157 07:18.320 --> 07:23.350 So when we have traffic entering into the SDA domain and leaving the SDA domain 158 07:23.350 --> 07:23.760 that 159 07:23.760 --> 07:26.200 needs to go through the fabric border node. 160 07:26.200 --> 07:27.200 Well what about LISP? 161 07:27.200 --> 07:31.460 Well if we're entering the LISP domain or exiting the LISP domain then we're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 161 07:27.200 --> 07:31.460 Well if we're entering the LISP domain or exiting the LISP domain then we're 162 07:31.460 --> 07:32.040 going to 163 07:32.040 --> 07:35.400 have to use one of the proxy tunneling routers. 164 07:35.400 --> 07:38.590 So whether that's an egress tunneling router or an ingress tunneling router 165 07:38.590 --> 07:39.520 depending on 166 07:39.520 --> 07:41.440 the flow of traffic. 167 07:41.440 --> 07:46.930 So again we see the direct parallels here where LISP is used at the control 168 07:46.930 --> 07:47.720 plane and 169 07:47.720 --> 07:56.220 the only difference is that where again LISP used a layer 3 tunnel at the data 170 07:56.220 --> 07:56.320 plane we're 171 07:56.320 --> 08:02.460 not going to use that instead we are going to say the SDA uses the layer 2 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 171 07:56.320 --> 08:02.460 not going to use that instead we are going to say the SDA uses the layer 2 172 08:02.460 --> 08:04.120 tunnel mechanism 173 08:04.120 --> 08:10.200 at the data plane which of course is the XLAN. 174 08:10.200 --> 08:13.890 So we're kind of combining technologies here and taking the parts of LISP that 175 08:13.890 --> 08:14.400 will help 176 08:14.400 --> 08:19.160 us and not taking the parts of LISP that are of no use to us. 177 08:19.160 --> 08:23.500 Now LISP not least as we're sitting here talking about SDA access we've talked 178 08:23.500 --> 08:24.840 about the data 179 08:24.840 --> 08:29.530 plane and the control plane don't forget that we also have that policy plane 180 08:29.530 --> 08:30.160 using Cisco WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 180 08:29.530 --> 08:30.160 using Cisco 181 08:30.160 --> 08:35.190 truss sec and this is where we integrate the identity services engine or ICE 182 08:35.190 --> 08:37.280 into the framework. 183 08:37.280 --> 08:42.070 Remember security these days in the modern network needs to be baked in from 184 08:42.070 --> 08:42.520 the very 185 08:42.520 --> 08:43.520 start. 186 08:43.520 --> 08:46.910 Cisco did not want to create a solution that says okay we're going to build 187 08:46.910 --> 08:47.680 this wonderful 188 08:47.680 --> 08:51.040 solution and then we'll just sort of throw security on top. 189 08:51.040 --> 08:56.190 No completely the opposite this was going to be foundational from the start 190 08:56.190 --> 08:56.840 that was 191 08:56.840 --> 09:02.850 a non negotiation or non negotiable from Cisco's perspective they needed it to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 191 08:56.840 --> 09:02.850 a non negotiation or non negotiable from Cisco's perspective they needed it to 192 09:02.850 --> 09:04.200 be in the solution 193 09:04.200 --> 09:08.370 from the very beginning and so we don't just have control plane and data plane 194 09:08.370 --> 09:09.160 we have 195 09:09.160 --> 09:14.660 policy plane we have Cisco truss sec and interestingly when we look at Cisco's 196 09:14.660 --> 09:15.920 implementation 197 09:15.920 --> 09:23.360 of VXLAN Cisco doesn't use the industry standard VXLAN inside of SDA instead 198 09:23.360 --> 09:24.680 they use something 199 09:24.680 --> 09:32.320 called VXLAN GPO which stands for group policy option and the group policy WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 199 09:24.680 --> 09:32.320 called VXLAN GPO which stands for group policy option and the group policy 200 09:32.320 --> 09:33.520 option is going 201 09:33.520 --> 09:38.640 to include those scalable group tags or SGTs which used to be called security 202 09:38.640 --> 09:39.720 group tags 203 09:39.720 --> 09:46.550 but the SGTs that come back to our policy plane so this is how I carry policy 204 09:46.550 --> 09:47.320 across 205 09:47.320 --> 09:54.950 my SDA fabric because again we want a host logging into this network to be 206 09:54.950 --> 09:55.760 secure to 207 09:55.760 --> 10:00.570 authenticate that host make sure that they're allowed to be on the network to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 207 09:55.760 --> 10:00.570 authenticate that host make sure that they're allowed to be on the network to 208 10:00.570 --> 10:01.240 manage my 209 10:01.240 --> 10:06.900 communication so that access control concept can I talk to this host if so cool 210 10:06.900 --> 10:07.440 if not 211 10:07.440 --> 10:11.780 then maybe I can't talk to this host but I can talk to this host all of that 212 10:11.780 --> 10:12.240 policy 213 10:12.240 --> 10:18.540 is managed by again ICE and Cisco truss sec but VXLAN actually does carry the 214 10:18.540 --> 10:19.360 scalable 215 10:19.360 --> 10:26.410 group tags thanks to Cisco's special flavor VXLAN GPO so all of this is how 216 10:26.410 --> 10:27.120 software 217 10:27.120 --> 10:32.290 act defined access comes together again it's why we're talking about LISP it's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 217 10:27.120 --> 10:32.290 act defined access comes together again it's why we're talking about LISP it's 218 10:32.290 --> 10:32.800 why we're 219 10:32.800 --> 10:38.120 talking about VXLAN it's all about making sure we fully understand in grasp the 220 10:38.120 --> 10:38.480 software 221 10:38.480 --> 10:43.480 defined access solution that Cisco's created and especially then even more 222 10:43.480 --> 10:44.640 generically than 223 10:44.640 --> 10:49.520 just Cisco SDA understand that this is how we can create campus fabrics that 224 10:49.520 --> 10:50.160 allow us 225 10:50.160 --> 10:53.950 to combine the best of both worlds between layer two and layer three access 226 10:53.950 --> 10:54.400 design. 227 10:54.400 --> 11:04.400 [BLANK_AUDIO]