WEBVTT 00:00:01.000 --> 00:00:07.040 So now that we've had the opportunity to learn about LISP and learn about VXLAN, 00:00:07.040 --> 00:00:14.560 let's go ahead and talk about SD-Access. So what is SD-Access? It refers to 00:00:14.560 --> 00:00:22.040 software-defined access and it's Cisco's implementation of software-defined 00:00:22.040 --> 00:00:29.080 networking. And so there's a lot of aspects that go along with that, but one 00:00:29.080 --> 00:00:34.279 of the things is is that using SD-Access and setting up the SD-Access 00:00:34.279 --> 00:00:38.279 environment is going to require what? It's going to require LISP. It's going to 00:00:38.279 --> 00:00:43.160 require VXLAN. It's going to require Identity Services Engine. It's going to 00:00:43.160 --> 00:00:47.880 require DNA Center. So someone asked a while ago about where DNA Center fits 00:00:47.880 --> 00:00:53.000 into it. Well, DNA Center is going to be your management, monitoring, maintaining 00:00:53.160 --> 00:00:59.959 system for configuration, verification, troubleshooting of the entire environment. 00:01:03.560 --> 00:01:09.239 Okay. So if we remind ourselves how traditional networking is designed, 00:01:09.239 --> 00:01:13.400 we've got our Layer 2 and our Layer 3 boundaries. And we already talked about 00:01:13.400 --> 00:01:20.040 the issues today. Biggest issues we run into is that users are bound to their 00:01:20.040 --> 00:01:23.400 physical location because their location is based on their network ID. 00:01:23.959 --> 00:01:28.919 And as such, their security is based on their network ID as well. And therefore, 00:01:29.480 --> 00:01:37.080 security is bound to that location. So if users move, then we have problems. If 00:01:37.080 --> 00:01:41.160 cybercriminals get into the environment, well, then it's possible they can infect 00:01:41.160 --> 00:01:45.320 that entire environment, that entire section, that entire Sun and VLAN 00:01:45.320 --> 00:01:50.040 broadcasting. And potentially move laterally if they find weaknesses in our controls, 00:01:50.040 --> 00:01:55.400 our policies that we are managing on a device-by-device basis at the distribution layer. 00:01:56.120 --> 00:02:02.120 So SD-AXIS changes all of that. Because with SD-AXIS now, we have the ability to have 00:02:02.120 --> 00:02:07.879 centralized management and control, centralized policy and security. And we have the ability to 00:02:07.879 --> 00:02:12.679 have flexibility. We have the ability to have scalability. We have the ability to 00:02:12.679 --> 00:02:17.320 use something like TrustSec now to ensure that no matter who you are, where you are, 00:02:17.320 --> 00:02:22.279 what you are doing, you are going to be bound by security policies that are designed for you 00:02:22.279 --> 00:02:27.000 and what it is you do, depending on what device you're using on top of that. 00:02:27.639 --> 00:02:33.479 So just like we talked about with LISP, just like we talked about with VXLAN, we are going to have 00:02:33.479 --> 00:02:38.679 to move our Layer 2, Layer 3 boundary for SD-AXIS down here. That's why we had that discussion when 00:02:38.679 --> 00:02:43.080 we were talking about LISP. So yes, everybody is. And this is the best way to implement it. 00:02:43.080 --> 00:02:46.919 You don't have to. Could you leave the Layer 2, Layer 3 boundary like this if you wanted to? Sure, 00:02:46.919 --> 00:02:51.720 you could. But you're not going to get the true results that you want to get out of something 00:02:51.720 --> 00:02:56.199 like this. So it requires a little bit of an underlying network design change. So 00:02:56.839 --> 00:03:00.199 replacing those AXIS layer switches with multi-layer switches at the AXIS layer. 00:03:01.000 --> 00:03:05.000 And then having everybody directly connected to their default gateways. And now you can get rid 00:03:05.000 --> 00:03:09.399 of spanning tree protocol in this part of your environment. And you're doing routing. Routing 00:03:09.399 --> 00:03:14.360 right down to the AXIS layer. So your Layer 3 environment is bigger now. And you're routing 00:03:14.360 --> 00:03:19.720 from all these different endpoints in that fabric that you have set up. So we don't need first 00:03:19.720 --> 00:03:23.000 operating protocols. We don't need trunks. We don't need spanning tree protocol. There's a lot 00:03:23.000 --> 00:03:28.039 of services here now we can eliminate. And then we can implement Layer 3 Ether channel bundles, 00:03:28.039 --> 00:03:32.360 Layer 3 Ether channel bundles, Layer 3 Ether, Layer 3 Ether, all throughout those environments 00:03:32.360 --> 00:03:36.199 because these are all routed ports. We're routing. We're running OSPF, EIGRP, or ISPS. 00:03:36.199 --> 00:03:40.119 And we get a much better network when it's all said and done. One that can converge faster 00:03:40.119 --> 00:03:43.479 because spanning tree isn't okay. It's not that great even if you're running multiple spanning 00:03:43.479 --> 00:03:48.520 tree protocol or a rapid spanning tree protocol, right? And we can't utilize all our links as 00:03:48.520 --> 00:03:52.199 efficiently as we could with routing. So a lot better in this case. And we're directly connected 00:03:52.199 --> 00:03:59.080 to our default gateways as well. So let's talk about the AXIS layers here that we have for SD 00:03:59.080 --> 00:04:03.399 access. So you've got the concept of the underlay and you've got the concept of the overlay. You 00:04:03.399 --> 00:04:08.039 really need to ensure you understand these for the certification exam. So what is the underlay? 00:04:08.039 --> 00:04:12.360 That is your physical network. So if we looked at this right now, as is, we would say this is our 00:04:12.360 --> 00:04:18.679 underlay. This is our physical network. This is how everybody is connected together. That essentially 00:04:18.679 --> 00:04:25.000 is your underlay. So your underlay is dedicated to the physical devices and ultimately the 00:04:25.000 --> 00:04:29.480 forwarding of traffic. So your underlay is made up of your routers, your switches, 00:04:30.040 --> 00:04:35.160 and a lot of other different devices, services, and features and routing protocols 00:04:35.880 --> 00:04:40.600 that are going to be utilized in order to move traffic from point A to point B. 00:04:42.119 --> 00:04:45.239 It's going to be simple. It's going to be scalable. It's going to be resilient. 00:04:46.279 --> 00:04:49.559 And it's going to be the foundation for all communication between all devices in the 00:04:49.559 --> 00:04:56.519 environment. So building the solid underlay is your primary concern when developing SD access. 00:04:57.079 --> 00:05:01.320 So what does that mean? Making sure that all of these routers, for example, let's say we're 00:05:01.320 --> 00:05:10.279 running OSPF, OSPF, OSPF, OSPF, OSPF, OSPF, OSPF, and they can all reach each other. But let's not 00:05:10.279 --> 00:05:16.839 forget here, we are not going to be running OSPF on any of these end user networks anymore. We're 00:05:16.839 --> 00:05:20.519 not going to be running OSPF on any of these end user networks. So remember in our OSPF discussion, 00:05:20.519 --> 00:05:26.040 I said, do we have to enable OSPF on the SVIs? And we're like, yeah, we have to, we have to. Yes, 00:05:26.040 --> 00:05:30.600 of course, because we want the other routers to know how to get there. Okay, well, in SD access, 00:05:30.600 --> 00:05:37.399 the answer is no. Oh, yeah. And it goes back to what we talked about during LISP. 00:05:38.040 --> 00:05:42.519 I am no longer routing to the destination networks, right? I'm routing to the 00:05:43.399 --> 00:05:53.000 RLOC of that LISP router, or we're routing to the VTEP of the VXLAN tunnel. 00:05:53.720 --> 00:06:01.720 Same thing, same device. So the LISP ITR ETR with its RLOC is the same thing as the VTEP device 00:06:01.720 --> 00:06:07.320 using the IP address of the RLOC. So in the end, right, that's what we're routing. We're 00:06:07.320 --> 00:06:12.200 running from there to there. So when you think about the underlay now, the underlay is really 00:06:12.200 --> 00:06:19.480 what? From a routing standpoint, we're just routing in this environment. And then if we 00:06:19.480 --> 00:06:24.040 want to leave that environment, then we're going to what? We're going to those non-LISP sites, 00:06:24.040 --> 00:06:30.760 remember, through our PETRs and our PITRs, which would be right there as an example, all right? 00:06:30.760 --> 00:06:34.760 So just keep that in mind. That's your underlay. That has to be built properly first, or the rest 00:06:34.760 --> 00:06:40.679 doesn't matter. It's not going to work. So then you have your overlay that you are going to build, 00:06:40.679 --> 00:06:46.200 and you can have more than one overlay. Let's be clear about that because the overlay is going to 00:06:46.200 --> 00:06:53.160 be the virtualized environments that you build on top of the physical underlay. So for example, 00:06:53.160 --> 00:07:13.959 remember we had a discussion on VRFs. When we had our discussion on VRFs, 00:07:14.839 --> 00:07:22.040 we said that we could have our physical routers now compartmentalized or isolated into different 00:07:22.040 --> 00:07:27.000 routers, and each of those routers would be responsible for something specific. So for 00:07:27.000 --> 00:07:32.359 example, you are creating a virtualized environment. So would we still use potentially VRFs 00:07:32.359 --> 00:07:37.959 here in our overlays? Absolutely. So that way there, we can have virtualized routed environments 00:07:37.959 --> 00:07:42.279 on top of already our physical environment if that's what we needed to accomplish. 00:07:43.000 --> 00:07:46.839 And in the end, if you look at the diagram that we have here underneath, 00:07:54.359 --> 00:07:59.000 you'll see that this router is the same as this one in the virtualized environment. 00:07:59.640 --> 00:08:03.720 This one is the same as this one in the virtualized environment, and this one is this 00:08:03.720 --> 00:08:09.320 one in the virtualized environment. Why? Because they are participating in the virtualized environment. 00:08:09.320 --> 00:08:15.480 Notice these ones are not. So if we go back to here just to kind of get a better representation 00:08:15.480 --> 00:08:21.880 of it from this perspective, these routers would not be part of the virtualized environment. We 00:08:21.880 --> 00:08:27.799 would not see them in the virtualized environment. What do we see? We see these in the virtualized 00:08:27.799 --> 00:08:37.239 environment, and that's what that diagram is showing to you. So in the virtualized environment, 00:08:37.799 --> 00:08:43.320 I have my VTEP, and it knows that a VTEP is over here. Well, if I want to go from here to here, 00:08:43.320 --> 00:08:49.080 I have to go from this VTEP to this VTEP, this RLOC to that RLOC. And so the virtualized 00:08:49.080 --> 00:08:53.880 environments can be anything I want to make them to be when it's all said and done. 00:08:55.320 --> 00:09:01.960 And so by controlling that virtualized environment now, folks, does that mean that we can actually 00:09:01.960 --> 00:09:09.559 build different types of secure networks on top of the physical network and therefore really 00:09:09.559 --> 00:09:16.760 isolate and control our traffic in a more virtualized way than ever before and compartmentalize 00:09:16.760 --> 00:09:23.479 traffic in a virtualized way? Absolutely. Absolutely. So this allows you to break free 00:09:23.479 --> 00:09:29.320 of the handcuffs that have been put on you as networking and security professionals 00:09:29.320 --> 00:09:33.559 because of relying on the physical network controlling what you can do. 00:09:34.440 --> 00:09:42.520 We are now abstracting the real network from the physical network. The real network is the overlay, 00:09:42.520 --> 00:09:50.520 the virtualization. We call it the fabric. So the fabric is the term that goes along with the 00:09:50.599 --> 00:09:58.840 overlay. Remember that. And that fabrics or fabrics that we create gives us the isolation 00:09:58.840 --> 00:10:06.440 for all of those virtual networks that we want to have and keep those all independent 00:10:06.440 --> 00:10:11.400 of the underlying physical network. So again, no matter where you are, 00:10:12.200 --> 00:10:18.919 your identity does not change and therefore the policies applied can follow you everywhere 00:10:18.919 --> 00:10:27.320 and the network can dynamically adjust depending on where people are when they are there. 00:10:30.200 --> 00:10:34.119 I'll give you another example of an overlay network that we've already talked about. 00:10:35.640 --> 00:10:41.640 GRE tunnels. That's an overlay network. Think about it. The internet is the underlay. 00:10:42.200 --> 00:10:47.719 The GRE tunnel is your overlay. So this is not a foreign concept to you, folks. 00:10:47.719 --> 00:10:55.799 You've already seen the concept as overlays and underlays. GRE is a good example. An IPsec site 00:10:55.799 --> 00:11:07.479 to site VPN tunnel, underlay and overlay. The internet is the underlay and your IPsec tunnel 00:11:07.479 --> 00:11:17.159 is the overlay. So technically speaking, can we say that 802.1Q trunking is a type of overlay? 00:11:18.440 --> 00:11:26.599 What would you say? 802.1Q trunking, is that a type of overlay? Seems like it, right? Exactly. 00:11:26.599 --> 00:11:33.000 So this is not a new concept for any of you because everything you've already done that 00:11:33.000 --> 00:11:39.320 had some type of tagging, encapsulation, virtualization, you are just building overlays 00:11:39.320 --> 00:11:45.559 on top of a physical network. But now we're getting even crazier with these overlay networks 00:11:45.559 --> 00:11:50.520 where we're having a true separation between the physical side of things 00:11:50.520 --> 00:12:00.119 and the virtual side of things. Now, the fabric. We have the fabric data plane. We have the fabric 00:12:00.119 --> 00:12:08.679 control plane. We have the fabric policy plane. What's behind door number one? I want you all 00:12:08.679 --> 00:12:12.840 to guess right now. You actually know the answer to this because I mentioned it before. 00:12:13.799 --> 00:12:21.559 What do you think we use as the protocol or the solution or the service in the data plane? Chat 00:12:21.559 --> 00:12:30.760 in your answer. Take a guess if you don't know. VXLAN is the correct answer. Remember the fabric 00:12:30.840 --> 00:12:47.400 data plane. Now, Jeffrey, you said ISIS. ISIS would be used where? In the underlay. OSPF would 00:12:47.400 --> 00:12:55.159 be used in the underlay. The IGRP would be used in the underlay as an example. But remember, 00:12:55.159 --> 00:13:03.799 the term fabric goes with overlay. And so, therefore, fabric data plane would be one of our 00:13:03.799 --> 00:13:12.200 overlay technologies. And that overlay technology is what? Is VXLAN in this case, right? So, 00:13:12.200 --> 00:13:16.840 Jeffrey, I'm really, really glad you typed in ISIS because I was able to say what I said. 00:13:16.840 --> 00:13:20.200 Because I wouldn't have said that if you hadn't typed that in. So, this is really good. This 00:13:20.200 --> 00:13:25.000 helps everybody out because that is such an important concept for the exam. The concept 00:13:25.000 --> 00:13:31.000 of fabric. When we say fabric, we're talking about the overlay. So, what's in the overlay 00:13:31.000 --> 00:13:36.919 versus the underlay? So, thank you so much for answering that way. I know you did it on purpose 00:13:36.919 --> 00:13:43.000 just so I could do what I needed to do. Appreciate it. So, fabric data plane used for forwarding, 00:13:43.559 --> 00:13:51.880 right? Forwarding from here to here, from here to here. So, we say VXLAN, why? We have our what? 00:13:51.880 --> 00:14:04.200 We have our VTEPs as an example in our data plane. VTEP, VXLAN, 00:14:05.000 --> 00:14:14.760 encapsulating our packets. So, we can go from point A to point B over top, over top of what? 00:14:14.760 --> 00:14:21.400 Over top of the underlay. So, we have VXLAN with what? GPO. So, what does GPO mean? It stands for 00:14:21.400 --> 00:14:30.599 Group Policy Extensions. So, why do we have VXLAN with GPO? Because traditional VXLAN doesn't 00:14:30.599 --> 00:14:37.000 support something that we need here with SD Access. And you know what that thing is that 00:14:37.000 --> 00:14:45.960 we need to support? Security Group Tags, which are part of what? TrustSec. So, that's why we 00:14:45.960 --> 00:14:52.119 have our VXLAN with Group Policy Extensions. Group Policy Extensions allows us to add more fields 00:14:52.119 --> 00:14:58.280 to the virtual network identifiers. So, that way there, we can add in our security group tags and 00:14:58.280 --> 00:15:01.479 other things that are allowed with the Group Policy Extensions. But the most important thing 00:15:01.479 --> 00:15:06.039 there for you to recognize is with Group Policy Extensions, we can support what? TrustSec and 00:15:07.719 --> 00:15:13.159 security group tags that go along with TrustSec. Okay. So, that is our fabric data plane, 00:15:13.159 --> 00:15:17.880 VXLAN with GPO, encapsulating packets, point A to point B. Got to know that. 00:15:17.880 --> 00:15:28.760 What about our control plane? Right. So, our control plane is going to be LISP. 00:15:30.520 --> 00:15:36.039 LISP. Now, what is the control plane, right, that we're using in our 00:15:39.320 --> 00:15:43.640 control plane that we're going to go ahead and use in our underlay, right? We're still using 00:15:43.960 --> 00:15:48.119 EIGRP, OSPF, BGP for the routing process and stuff like that. Well, 00:15:48.119 --> 00:15:51.159 in the control plane for the fabric, we got LISP that we're using. 00:15:54.119 --> 00:15:58.679 So, used for building the tables needed by the data plane, mapping and resolving users and 00:15:58.679 --> 00:16:03.880 devices, creating using LISP. So, we talked about before that LISP is both control plane and data 00:16:03.880 --> 00:16:09.719 plane. That is true, but not for SD-Access. For SD-Access, we're only using the control plane 00:16:09.719 --> 00:16:17.400 part of it. So, encapsulation is done by VXLAN, whereas the decision-making process of 00:16:18.599 --> 00:16:27.239 what VTEP we need to go to based on what? A database of information on the mapping server 00:16:27.239 --> 00:16:32.119 will ultimately be used to tell VXLAN what it needs to do to encapsulate. 00:16:32.119 --> 00:16:37.559 So, the decisions that are made by LISP are then used by VXLAN to do the encapsulation. 00:16:38.359 --> 00:16:42.919 So, that's what we mean by control plane in that case. So, LISP is going to be used for what? 00:16:42.919 --> 00:16:48.359 Mapping and resolving endpoints. VXLAN is going to be used for building the tunnels, 00:16:48.359 --> 00:16:59.960 encapsulating the traffic. And in actual fabric policy plane, you've seen this word already today, 00:16:59.960 --> 00:17:06.920 TRUSTSEC. Security group tags and group-based policies are used to translate the business 00:17:06.920 --> 00:17:13.880 intent into the network policies. So, we use TRUSTSEC and Identity Services Engine to accomplish 00:17:13.880 --> 00:17:27.239 that. And remember earlier I said that in your SD-Access environment, especially when traffic is 00:17:27.239 --> 00:17:35.400 flowing from devices to other devices, like maybe users to servers within your fabric, 00:17:37.319 --> 00:17:47.959 within your organization, then if all of your equipment supports larger MTU sizes, 00:17:48.920 --> 00:17:59.959 the recommended MTU size for SD-Access is 9100, not 1500. So, that means you can configure every 00:17:59.959 --> 00:18:08.280 single interface on your SD-Access supported devices to an MTU of 9100 and even have your 00:18:08.280 --> 00:18:15.800 end stations build packets that are 9100 in size, maximum 9100 in size. 00:18:18.760 --> 00:18:24.199 Give or take, all right? Give or take. Because if you exceeded 9100, you got to do fragmentation, 00:18:24.199 --> 00:18:29.560 which is not allowed anyways. We wouldn't want fragmentation anyways. So, we want the packets 00:18:29.560 --> 00:18:33.319 built the right size, but it gives you the opportunity, right, to do all that encapsulation 00:18:33.319 --> 00:18:38.280 you need without having to worry then in that particular case. But always remember that 00:18:38.439 --> 00:18:49.880 having an MTU of 9100 only works if all devices from PC to server support it. Because if there's 00:18:49.880 --> 00:18:54.680 one link along that entire path that's 1500, then it breaks down. You can't do it. 00:18:55.400 --> 00:18:59.160 So, that's why a lot of people talk about, especially in my CCNA class, they bring up, 00:18:59.160 --> 00:19:02.920 oh, MTU of 9100, right? We can totally go ahead and do that. It's like, well, no, wait. 00:19:02.920 --> 00:19:08.760 If your users are going to the internet to do things, the internet's using 1500, not 9100. So, 00:19:08.760 --> 00:19:14.760 you can't do that in your environment. If your traffic leaves, you got to do 1500 or less for 00:19:14.760 --> 00:19:20.760 traffic that's leaving in your environment. Until the entire internet goes to 9100 and everyone 00:19:20.760 --> 00:19:31.560 supports 9100, we can't do it. So, for traffic internally, 9100, no problem. But you still have 00:19:31.560 --> 00:19:35.560 to deal with the fact that any traffic that's leaving the environment, leaving your fabric, 00:19:36.199 --> 00:19:39.400 going somewhere else that doesn't support it, you're going to have to handle that differently 00:19:39.400 --> 00:19:42.439 and make sure that you're not transmitting anything greater than what the maximum transmission 00:19:42.439 --> 00:19:49.319 size would be if somebody went to the internet, like 1500. All right. So, now we have to play a 00:19:49.319 --> 00:19:58.760 game of who's who. Any one of these can show up on your certification exam. It's a long list of 00:19:58.760 --> 00:20:05.079 things you need to know for SD access. But good news is that you have to know basically what that 00:20:05.079 --> 00:20:12.439 is and what it does. That's it. What it is, what it does at a very, very high level. 00:20:14.760 --> 00:20:19.560 So, the idea here is for you to get the main key points for me about each and every single one of 00:20:19.560 --> 00:20:31.800 these. This is Cisco's official diagram. I don't really like it. I don't. So, I've taken this exact 00:20:31.800 --> 00:20:37.640 same information and I put it on ours. Because I really like how this is, because this is more 00:20:37.640 --> 00:20:44.520 realistic when I look at this than when I look at it this way. So, let's go ahead and do this. 00:20:45.479 --> 00:20:53.479 All right. We're going to take our time here. This one, start off with this one here. 00:20:57.000 --> 00:21:03.000 You know, if I star it, folks, if I star it and I leave it starred, 00:21:06.599 --> 00:21:07.560 take that as a hint. 00:21:10.119 --> 00:21:12.520 That's all I can tell you. Can't say any more without getting in trouble. 00:21:14.520 --> 00:21:26.040 Endpoints. I really don't have to say a whole lot about this, do I? 00:21:27.640 --> 00:21:33.719 Endpoint is what? An end user device. Any type of end user device. 00:21:34.439 --> 00:21:44.040 Or an internet of thing device. Or any device that sends and receives traffic as an end point. 00:21:46.040 --> 00:21:54.680 That's your end user device. Inside of what? Inside of your fabric. So, a PC, in this case, 00:21:54.680 --> 00:21:58.520 is my end user device. A phone could be my end user. A camera could be my end user device. 00:21:58.520 --> 00:22:02.199 A camera could be my end user device. End point, I should say. Not end point. 00:22:02.920 --> 00:22:08.920 Printers, end points. Servers, end points. If the server is inside your fabric. In this case, 00:22:08.920 --> 00:22:12.920 my servers are outside of my fabric. Let's keep that in mind. My servers are in a different 00:22:12.920 --> 00:22:19.079 fabric. They're in the ACI, the application centric infrastructure, instead of my SD access 00:22:19.079 --> 00:22:23.319 fabric. They're in a different fabric. So, this would be my data center fabric over here. We call 00:22:23.319 --> 00:22:34.439 ACI. This over here is my SD access fabric. Any device sending or receiving traffic. 00:22:38.920 --> 00:22:45.959 A fabric edge node. Fabric edge node. Let me write out here what a fabric edge node is. Fabric 00:22:46.040 --> 00:22:55.959 edge node. There it is. This would be a device that is physically in our underlay, 00:22:57.479 --> 00:23:07.079 but it actually participates in the overlay as well. It can be an access layer device or a 00:23:07.079 --> 00:23:11.640 distribution layer device, depending on where your layer two layer boundary is. In this case, 00:23:11.640 --> 00:23:19.000 our layer two boundary is here. Layer two, three boundaries here. So, it is my access layer device 00:23:19.000 --> 00:23:23.079 that is my fabric edge node, which is the recommended best practice. 00:23:24.199 --> 00:23:31.000 And the fabric edge node is responsible for connecting your wired and wireless end points 00:23:31.640 --> 00:23:37.880 to the SD access fabric and forwarding their traffic. 00:23:42.199 --> 00:23:49.880 So, what does a fabric edge node do? Connect your end points to the SD access fabric. 00:23:56.760 --> 00:24:03.880 So, in the world of Lisp, folks, what do we call the fabric edge node in the world of Lisp? 00:24:11.640 --> 00:24:25.319 We call it an XTR. Right? So, it can be an ITR or an ETR, exactly. What do we call it in, oh, 00:24:25.319 --> 00:24:35.319 and sorry, and John, what does the EXTR in the, or what does the XTR have? That's right. 00:24:35.959 --> 00:24:42.680 You chatted it in. It has an RLOC. That's what it has. Perfect. I'm glad you're recognizing that. 00:24:42.680 --> 00:24:48.439 Wonderful. And in the world of VXLAN, what do we call this, folks? 00:24:54.359 --> 00:24:57.079 Three different names for the exact same thing. 00:24:59.319 --> 00:25:04.680 What does a fabric edge node do? Everything the XTR does and everything the VTEP does. 00:25:04.680 --> 00:25:11.560 That's your fabric edge node. And it ultimately connects the wired and wireless end points to the 00:25:11.560 --> 00:25:17.160 SD access fabric and forwards their traffic by doing what? Encapsulation and decapsulation. 00:25:18.359 --> 00:25:23.319 The fabric edge node is therefore your default gateway. So, you are essentially directly 00:25:23.319 --> 00:25:27.959 connected to your default gateway, meaning you do not need a first competency protocol here. 00:25:29.000 --> 00:25:33.560 In addition to that, folks, this is where things get awesome. This is like some mind-warping 00:25:33.560 --> 00:25:40.439 technology. It is actually what we call an Anycast Layer 3 gateway as well. What does that mean? 00:25:41.000 --> 00:25:47.479 It means that we can have a common gateway IP address and MAC address for every single one of 00:25:47.479 --> 00:25:55.239 these. But when your device, for example, somebody, let's say this is your home network. 00:25:55.239 --> 00:26:01.800 If this is your home network and you move down here and you connect down here, you're no longer 00:26:01.800 --> 00:26:07.479 in your home network. You still need a default gateway for your subnet down here, don't you? 00:26:07.479 --> 00:26:17.400 You do. Because if you're still 10.0.0.10 down here, and this is the 10.0.0.0 slash 24 network 00:26:17.400 --> 00:26:24.680 up here, and this network down here is 10.0.0. It's a totally different network. How does this device, 00:26:24.680 --> 00:26:32.680 how in the world does this device be your default gateway? It can dynamically configure itself 00:26:34.760 --> 00:26:41.560 with an IP address to be used as your default gateway. Wow. Yeah. 00:26:45.000 --> 00:26:52.280 So, that gateway address is instantiated as a switched virtual interface 00:26:53.079 --> 00:27:00.040 with an IP address and a MAC address that can be utilized when needed. And then when nobody's there 00:27:00.040 --> 00:27:09.479 that needs it, it gets torn down. Built as needed. That's incredible. That is some good stuff. 00:27:11.800 --> 00:27:14.760 I get pretty excited here and use non-work safe words. I got to be careful. 00:27:17.160 --> 00:27:21.800 All right. So, you've got the idea of that. You actually know more than you need to know right now. 00:27:22.199 --> 00:27:26.680 In regards to this stuff. So, that's good. That's good. I like to give people more because then they 00:27:26.680 --> 00:27:31.560 really start to understand what's going on here. Okay. So, now let's talk about our fabric 00:27:31.560 --> 00:27:37.640 intermediate node. So, the fabric intermediate node. Let's talk about this one next. I'll put 00:27:38.280 --> 00:27:41.160 the one I'm talking about. I'll go ahead and put an arrow beside it. And then I'll erase 00:27:41.160 --> 00:27:43.319 it when I'm done talking about it. If I put a star, make sure you remember it. 00:27:44.280 --> 00:27:48.599 Okay. So, what's a fabric intermediate node? So, this is an example of a fabric intermediate node. 00:27:49.239 --> 00:27:54.119 This is an example of a fabric intermediate node. This is an example of a fabric intermediate node. 00:27:55.079 --> 00:27:58.119 All right. So, this would be an example of a fabric edge node. Let's put that down there as 00:27:58.119 --> 00:28:01.719 well. Fabric edge node. Intermediate, intermediate, intermediate edge. So, 00:28:01.719 --> 00:28:11.640 what is a fabric intermediate node? It is a 100% purely underlay device. Meaning, it is not 00:28:11.800 --> 00:28:21.079 actually participating in the fabric. It's not participating in the fabric. So, for example, 00:28:21.079 --> 00:28:28.359 is this running LISP? Nope. Is it running VXLAN? Nope. Nope. Nope. But what is it running? Yeah, 00:28:28.359 --> 00:28:35.560 maybe OSPF, ISIS, or EIGRP, right? So, your fabric edge node would be running LISP, VXLAN, 00:28:35.560 --> 00:28:39.640 and your dynamic routing protocol. Whereas these ones only need to run your dynamic routing 00:28:39.640 --> 00:28:45.160 protocol. That's it. This one would be running your dynamic routing protocol plus LISP and VXLAN. 00:28:51.079 --> 00:28:52.119 Fabric border node. 00:28:52.839 --> 00:29:11.079 Fabric border node is, again, part of your underlay. Obviously, all of these devices are part 00:29:11.079 --> 00:29:25.400 of our underlay. But it is participating in the overlay as well. And what it does is it connects 00:29:25.959 --> 00:29:41.719 your fabric to places outside of your fabric. So, it connects your fabric to non-fabric sites. 00:29:42.839 --> 00:29:50.599 So, this would be a non-fabric site. This would be a non-fabric site. 00:29:51.560 --> 00:30:00.439 So, this would be a fabric border node as an example. This would be a fabric border node as 00:30:00.439 --> 00:30:11.800 an example. Let's get that B better. Fabric border node. There we go. So, just out of curiosity, 00:30:11.800 --> 00:30:19.400 folks, in the world of LISP, what do we call a fabric border node? 00:30:31.239 --> 00:30:39.479 A peter and a piter. That's right. A PXTR. Wonderful. Wonderful. Good job. And in the world 00:30:39.479 --> 00:30:45.079 of VXLAN, okay, so we'd have an RLOC for that as well. Remember, RLOCs for that as well. And then, 00:30:45.079 --> 00:30:57.079 in the world of VXLAN, what do you think we call the fabric border node in the world of VXLAN? 00:30:57.560 --> 00:31:12.680 Anybody want to take a guess? Take a guess. If you don't know, take a guess. Type something in. 00:31:19.479 --> 00:31:24.040 It's the VTAP. That's it. It's just a VTAP. It's a virtual tunnel endpoint. That's it. 00:31:24.040 --> 00:31:29.160 So, in the world of VXLAN, it's still called a VTAP, right? So, in the world of SDAccess, 00:31:29.160 --> 00:31:36.920 we got fabric border node, fabric edge node. We called XTRs and PXTRs in the world of 00:31:37.800 --> 00:31:43.560 LISP and VTAPs in the world of VXLAN. I know. So confusing, isn't it? But this is what I'm 00:31:43.560 --> 00:31:49.800 trying to help you. I'm trying to help you get the confusion out of you by diagramming it this way. 00:31:49.959 --> 00:31:56.359 I was never taught this way, and it took me so long to grasp this stuff because I went through 00:31:56.359 --> 00:32:01.880 so many official Cisco papers, documents, videos, and it was like, I don't get it. 00:32:01.880 --> 00:32:05.640 Then you start diagramming it out, and you're like, oh, that's all that's going on here. It's 00:32:05.640 --> 00:32:10.599 the same names for the same things, just trying to add massive confusion. If you can get around 00:32:10.599 --> 00:32:13.719 the confusion, it's actually pretty simple when it's all said and done. But it takes time. It 00:32:14.599 --> 00:32:18.280 took me a while, right? And once I got through it, I'm like, okay, I get it. 00:32:19.640 --> 00:32:30.760 All right. Fabric control plane node. Fabric control plane node. Control plane node. Oh, 00:32:30.760 --> 00:32:37.479 sounds to me like a server of some type. So, it could be. It could be, for example, 00:32:38.280 --> 00:32:48.359 a server we have set up in our data center, maybe. That would be our fabric control plane node, 00:32:49.000 --> 00:32:55.479 or it could even be, for example, something in here. So, it doesn't even have to be like a 00:32:55.479 --> 00:32:59.319 fabric edge node or a fabric border node. It doesn't even have to be running like Lisp, 00:32:59.319 --> 00:33:07.959 for example, per se, like our fabric edge nodes do, our fabric border nodes. But if we make it 00:33:07.959 --> 00:33:14.119 our fabric control plane node, then it's going to what? Run Lisp. But what's it going to become? 00:33:14.119 --> 00:33:21.800 What's it going to become in the world of Lisp? Mapping server, mapping resolver. That's right. 00:33:21.800 --> 00:33:29.239 Mapping server, mapping resolver. Good job, Conrad. There you go. So, 00:33:29.239 --> 00:33:34.520 a fabric control plane node is what? It's a mapping system that manages the endpoint 00:33:34.520 --> 00:33:39.239 IDs to device relationships and stores information in a centralized local database. 00:33:40.920 --> 00:33:46.760 Any device in your fabric, you can make it that. Could be even a device outside your fabric. 00:33:47.719 --> 00:33:50.920 Right, but if it's outside your fabric, you'd have to leak routes and do route leaking and 00:33:50.920 --> 00:33:54.760 different things like that to accomplish your objective. But that's okay. That's okay. 00:34:00.760 --> 00:34:06.520 Okay, the purpose, what? Learn where everyone lives. So, that way, the edge devices can figure 00:34:06.520 --> 00:34:10.280 out where to send the data they're trying to forge. So, whether it's a fabric border node 00:34:10.280 --> 00:34:14.919 or a fabric edge node, they need to contact what? The fabric control plane node, 00:34:15.080 --> 00:34:22.760 which RLOC to send the traffic to. Which RLOC to send the traffic to. So, 00:34:22.760 --> 00:34:27.399 that goes back to our Lisp discussion. So, we call it the fabric control plane node here. 00:34:28.040 --> 00:34:32.840 We call it the mapping server, the map resolver in the world of Lisp. Same thing. 00:34:37.639 --> 00:34:40.600 Fabric wireless LAN controller. 00:34:41.399 --> 00:34:49.239 A fabric wireless LAN controller would be what? A wireless LAN controller that is fabric-enabled 00:34:50.840 --> 00:35:00.600 and therefore, is part of your physical underlay, but it has the ability to manage the fabric-enabled 00:35:00.600 --> 00:35:06.439 access points that you have. So, that's what a fabric wireless LAN controller would be. 00:35:06.439 --> 00:35:13.560 It has the ability to manage the fabric-enabled access points that you have. The fabric-enabled 00:35:13.560 --> 00:35:18.840 access points. So, you would need fabric-enabled access points, and then you have a fabric-enabled 00:35:18.840 --> 00:35:25.959 wireless LAN controller, and that fabric-enabled wireless LAN controller has the ability to do 00:35:25.959 --> 00:35:34.840 what? That's so important. Forward client registrations and all roaming information 00:35:34.840 --> 00:35:42.040 to who? To the fabric control plane node. And it would also be responsible for the radio 00:35:42.040 --> 00:35:47.959 resource management of all those fabric-enabled access points. So, that fabric wireless LAN 00:35:47.959 --> 00:35:55.479 controller, right, has an extra job compared to what? A non-fabric-enabled wireless LAN 00:35:55.479 --> 00:36:01.959 controller. And what's its extra job? Remember this. Update the fabric control plane node where 00:36:01.959 --> 00:36:07.399 all those wireless devices happen to be connected to. So, just like the cellular network. If you 00:36:07.399 --> 00:36:13.560 hop from what? Access point to access point to access point, something needs to update the 00:36:13.560 --> 00:36:20.199 controller about the fact that you keep moving from what? From tower to tower to tower to tower 00:36:20.199 --> 00:36:27.560 to tower. Same idea, right? So, in this case, the access points tell the wireless LAN controller, 00:36:27.560 --> 00:36:31.320 and the wireless LAN controller tells our fabric control plane node. 00:36:35.239 --> 00:36:39.000 And then you got your fabric access points. So, as we said, our fabric access points, 00:36:39.719 --> 00:36:45.879 right, these are wireless access points that are fabric-enabled. They're part of the overlay. 00:36:48.600 --> 00:36:51.080 They connect wireless clients to the fabric. 00:36:51.800 --> 00:36:55.000 Specifically, our fabric-enabled SSIDs. 00:36:59.000 --> 00:37:03.639 They have the ability to update who? The wireless LAN controller. So, 00:37:03.639 --> 00:37:07.479 whether the wireless LAN controller can update the fabric control plane node. 00:37:11.719 --> 00:37:17.719 And they have the ability to encapsulate our user's traffic into what? VXLAN. 00:37:21.719 --> 00:37:25.719 And there's one thing I want you to realize. 00:37:31.800 --> 00:37:38.360 This is from a document, a Cisco document. I'm just going to state it. 00:37:40.760 --> 00:37:48.040 You don't have to go read the document, but it's on wireless SD access document. It's pretty big, 00:37:48.679 --> 00:37:54.120 but the end thing is this, and it's just like a little sub-note I just want to share with you. 00:37:55.560 --> 00:38:02.199 When you're dealing with fabric access points, access points are placed in what we call 00:38:03.479 --> 00:38:13.719 local mode. Access points are placed in what we call local mode and must connect directly 00:38:14.520 --> 00:38:19.320 to the fabric edge node, our fabric edge switch. 00:38:21.560 --> 00:38:25.800 So, like you see here, there's my access point directly connected to my fabric edge node. 00:38:26.679 --> 00:38:32.679 And what do we place the access point in? Local mode. That might be beneficial to your future. 00:38:37.320 --> 00:38:41.479 But I don't want you to go out there and read an entire document on setting up access points for 00:38:42.439 --> 00:38:45.719 SD access fabric just for one sentence, okay? 00:38:46.600 --> 00:38:50.360 Access points are placed in local mode and must connect directly to the fabric edge switch. 00:38:57.080 --> 00:39:00.600 Do the fabric access points do both VXLAN and CAPWAP? 00:39:01.959 --> 00:39:07.719 So, yeah, we still have to understand we need our proper tunneling. So, remember CAPWAP is control, 00:39:08.360 --> 00:39:15.080 VXLAN is data, right? Think about that. Yeah, CAPWAP is control, VXLAN is data. 00:39:16.360 --> 00:39:19.239 Yeah, yeah. Okay, you figured that out even before I answered it. You're like, 00:39:19.239 --> 00:39:24.040 yeah, never mind. Forget it. Perfect. Thanks, Conrad. But, you know, great question, right? 00:39:24.040 --> 00:39:26.840 Because maybe you're not the only one who's thinking that way, right? Yeah, it's true. 00:39:26.840 --> 00:39:31.080 Like, what about everything else? Well, again, control plane versus data plane, right? Absolutely. 00:39:32.600 --> 00:39:36.280 Woo, DNA Center. Hey, somebody was asking about DNA Center. Hey, 00:39:36.280 --> 00:39:39.800 where does DNA Center fit in all this? There it is. It's part of SD access. 00:39:41.399 --> 00:39:44.760 So, DNA Center, that's what that symbol is right there, DNA Center. 00:39:48.280 --> 00:39:55.560 So, what is DNA Center in the world of SD access? So, DNA Center is your centralized 00:39:55.560 --> 00:40:05.080 command and control option for management, administration, automation, programmability, 00:40:05.080 --> 00:40:11.159 monitoring, assurance, workflows, you name it. Like, everything. Everything. 00:40:13.000 --> 00:40:18.840 And we're not going to cover DNA Center here live. We don't. But in your videos, I do have 00:40:18.840 --> 00:40:24.280 a discussion on DNA Center to get you ready for the certification exam. It's about 34 minutes long. 00:40:25.320 --> 00:40:30.360 So, you don't learn about DNA Center in this course, except for an overview. 00:40:31.320 --> 00:40:37.560 There are courses and exams designed for that. That's not what I wanted. Wrong button. Right? 00:40:37.560 --> 00:40:39.879 So, we're not going to cover that here. But what I want you to remember is, 00:40:40.520 --> 00:40:45.320 if any questions about DNA Center come up, always remember, DNA Center is your centralized command 00:40:45.320 --> 00:40:48.120 and control center for what? Things like management, administration, automation, 00:40:48.120 --> 00:40:51.479 programmability, monitoring, assurance, workflows, all of that, and a whole lot more. 00:40:51.479 --> 00:40:55.479 The great thing, though, is that if DNA Center ever loses connectivity to your fabric, 00:40:57.560 --> 00:41:04.760 the devices are still able to connect and use the fabric. Let me repeat that. If DNA Center 00:41:04.760 --> 00:41:10.520 ever loses connectivity, devices are still able to connect and use the fabric. But one of the 00:41:10.520 --> 00:41:15.000 things you will lose in that case are things like your analytical data and assurance. 00:41:15.639 --> 00:41:18.919 So, if DNA Center is down, you're going to lose the analytical data and assurance data at that 00:41:18.919 --> 00:41:21.879 point in time. Like, I mean, you're not going to have the ability to collect that because DNA 00:41:21.879 --> 00:41:25.879 Center is not there to do that. But you still have the opportunity, what? Connect to the fabric, 00:41:25.879 --> 00:41:30.919 join the fabric, and stuff like that, which is good. That's good. Thank you. Thank goodness Cisco 00:41:30.919 --> 00:41:37.719 has designed it that way. All right. Identity Services Engine. We already talked about how 00:41:37.879 --> 00:41:43.080 Identity Service Engine plays a role in something like TrustSec. It's required for TrustSec. And 00:41:43.080 --> 00:41:48.120 what is Identity Service Engine? It's the authentication, authorization, and accounting 00:41:48.120 --> 00:41:56.120 solution. It's your policy enforcer, your security solution for what? Everything in the world of 00:41:56.120 --> 00:42:03.719 Cisco, specifically for SD Access. It's your security solution for everything in the world of 00:42:03.719 --> 00:42:10.760 Cisco, specifically for SD Access. Whether you're using SD Access or not, folks, you can use 00:42:10.760 --> 00:42:17.320 Identity Services Engine. It's a really great product, right? But it's a really great, great 00:42:17.320 --> 00:42:22.040 product when you're doing it in SD Access. And it's going to be responsible for what? Dynamic 00:42:22.040 --> 00:42:31.959 endpoint to group mappings, policy definitions, Cisco TrustSec. We can integrate it and access it 00:42:31.959 --> 00:42:37.800 from DNA Center as well. That's a huge bonus. So, if you're using DNA Center and ICE, we can work 00:42:37.800 --> 00:42:44.040 with them together. They provide our security group tags for this environment. Because remember, 00:42:45.000 --> 00:42:51.399 when we have TrustSec set up, when you connect to your Fabric Edge node, you get your security 00:42:51.399 --> 00:42:58.919 group tag. So, not only are you registered in the fabric, but you get your security group tag 00:42:58.919 --> 00:43:04.120 identified. So, that way, you are going to have those policies applied to you through that security 00:43:04.120 --> 00:43:15.320 group tag. Fusion Router. What is a Fusion Router? 00:43:28.919 --> 00:43:46.360 There are going to be certain services in your environment that need to be shared. 00:43:48.040 --> 00:43:56.439 Can anybody give me an example of a service that might be shared by many different users, 00:43:56.520 --> 00:44:03.800 by many different sites, by many different parts of your network? Just give me one example 00:44:03.800 --> 00:44:09.479 of any type of service that might need to be shared by everyone. Okay, DNS is one. Anybody 00:44:09.479 --> 00:44:26.040 got another one? DHCP, another one? Nice, John. I was just thinking of that going, 00:44:26.040 --> 00:44:32.199 I wonder if anybody's going to get NTP. NTP, exactly. Yep. What about Identity Services Engine? 00:44:32.760 --> 00:44:37.639 Yep. What about DNA Center? Yep. You know, different things like that. Okay. So, 00:44:39.080 --> 00:44:50.040 those are typically going to be resources that are where? Outside of the actual fabric. They 00:44:50.040 --> 00:44:57.959 might be in a totally different fabric, like in the ACI fabric. So, they are outside of my 00:44:57.959 --> 00:45:02.439 SD access fabric. So, it could be ICE, it could be even a wireless LAN controller, 00:45:02.439 --> 00:45:08.520 it could be DNA Center. They are outside of my fabric. So, over here, for example, in this 00:45:08.520 --> 00:45:18.760 scenario, DHCP, DNS, NTP. So, shared services. So, the thing is, is these shared services are 00:45:18.760 --> 00:45:25.560 in a totally different network, right? They're in their own network, they're in their own fabric. 00:45:25.560 --> 00:45:30.679 How do we interconnect some sort of isolated network, some sort of isolated fabric with 00:45:30.679 --> 00:45:34.760 something else? Well, we know we're going to go through those fabric border nodes now 00:45:34.760 --> 00:45:42.679 to go to someplace outside. But the thing is, is that we need to have a router that has the ability 00:45:42.679 --> 00:45:50.199 to leak, for example, from one network to another virtualized network. So, if we have ourselves set 00:45:50.199 --> 00:45:56.280 up, let's say, with – oh, my gosh, there's that word again. I used it a while ago, and I forgot 00:45:58.360 --> 00:46:00.280 why I'm having trouble with that word today. 00:46:04.280 --> 00:46:12.439 This is embarrassing. VRFs. VRFs. There we go. VRFs. Gosh. So, let's say you have VRFs. 00:46:13.080 --> 00:46:17.399 You have all these different isolated environments with different VRFs. 00:46:17.959 --> 00:46:24.679 How are you going to have traffic in this shared environment, which is a different VRF, 00:46:25.479 --> 00:46:34.679 be usable in your other VRFs? Fusion router. Fusion router. So, your fusion router is a 00:46:34.679 --> 00:46:43.879 router that has the ability to leak traffic from one, for example, VRF, one isolated environment, 00:46:43.879 --> 00:46:48.439 one virtual environment to another environment. 00:46:49.239 --> 00:46:52.199 Okay. That's what I want you to remember for the exam. 00:46:54.600 --> 00:46:59.560 So, in this case, could it be our fabric border node that's also being the fusion router? Yes, 00:46:59.560 --> 00:47:06.360 it could be. Same device. And then, lastly, we have what is called an extended node. 00:47:07.879 --> 00:47:16.439 So, what is an extended node? So, what is an extended node? So, what is an extended node? 00:47:16.679 --> 00:47:24.760 So, what is an extended node? So, it is possible in some scenarios, 00:47:26.040 --> 00:47:35.080 you are going to want to extend your fabric beyond, let's say, this device 00:47:35.560 --> 00:47:44.040 and connect a non-fabric device to it and have other devices connected to it. So, let's say, 00:47:44.040 --> 00:47:51.080 for example, we had a switch connected here, and you have users connected to this switch. 00:47:52.840 --> 00:48:00.840 We have extended the fabric, but the problem is that switch might not actually be a fabric-enabled 00:48:00.840 --> 00:48:06.360 switch. So, it's a non-fabric layer-2 access switch, as an example, and we've connected a 00:48:06.360 --> 00:48:11.800 bunch of devices to it. The thing is, is that we want to be able to 00:48:16.600 --> 00:48:24.840 extend out, extend out that fabric down into that non-fabric layer-2 switch. So, 00:48:24.840 --> 00:48:37.399 non-fabric layer-2 switch. So, we call the extended node, right, this device that extended 00:48:37.399 --> 00:48:42.600 the fabric – or, sorry, extended node. So, this one here, pardon me, would be the extended node 00:48:42.600 --> 00:48:48.280 that extends the fabric downstream to that non-fabric layer-2 switch. And how do we do that? 00:48:48.280 --> 00:49:00.760 Here's the key word, 802.1Q. So, using 802.1Q tagging, we have the ability to extend 00:49:00.760 --> 00:49:09.479 that fabric downstream to that non-fabric layer-2 switch. So, now we have layer-2 port extension 00:49:10.439 --> 00:49:18.120 while providing segmentation, group-based policies to the actual endpoints that are 00:49:18.120 --> 00:49:24.439 connected to that switch further down. So, we can connect now fabric-mode access points 00:49:25.000 --> 00:49:30.520 to that environment as well, to that switch if we had to, and we've been able to extend that down 00:49:30.520 --> 00:49:37.159 using 802.1Q to accomplish that. So, by using 802.1Q and putting in the values that are necessary in 00:49:37.320 --> 00:49:45.000 that tagging of 802.1Q, we'll be able to do that properly. So, just keep that in mind. Any scenario 00:49:45.000 --> 00:49:53.879 that talks about adding a non-fabric layer-2 switch to your fabric, but wanting to extend 00:49:53.879 --> 00:49:59.560 the fabric through that non-fabric layer-2 switch, just think extended node as your answer. 00:50:00.360 --> 00:50:06.679 That's your goal for the exam. Pick these out of a lineup and knock them out of the park. 00:50:06.679 --> 00:50:14.600 All right. One final thing, and that is layer-2 flooding. 00:50:21.080 --> 00:50:27.879 Folks, if I'm in a subnet, if I'm in a VLAN, and I'm in a broadcast domain, and I send out 00:50:27.879 --> 00:50:35.399 an unknown unicast frame, or I send out a broadcast frame, where does it go? Where does it go? 00:50:37.479 --> 00:50:42.520 It goes to everyone in the same subnet, VLAN, and broadcast domain. 00:50:44.919 --> 00:50:55.639 So, if I'm here in my site, and let's say this is 10.0.0.0 slash 24. This is VLAN 10. 00:50:58.199 --> 00:51:04.439 And there's some user down here. I'll just use this user down here and say you are 10.0.0.9. 00:51:07.239 --> 00:51:14.439 Let's say that is the device I want to talk to. Let's say that is the device I want to talk to. 00:51:16.439 --> 00:51:25.639 So, I build my package, source IP me, destination IP you. How do I get your IP address? DNS. 00:51:26.360 --> 00:51:36.760 DNS. Then I have to build a frame. Source MAC me, destination MAC you. 00:51:37.879 --> 00:51:45.719 How do I get your MAC address? We know that if you send out an ARP request, 00:51:46.679 --> 00:51:49.719 it only goes to everybody in the same subnet, VLAN, and broadcast domain, 00:51:49.719 --> 00:51:52.760 and it will not be forwarded across layer-2 connections. 00:51:55.959 --> 00:52:00.919 So, how am I going to get your MAC address? Well, that's where VXLAN 00:52:03.159 --> 00:52:06.199 shines as well. So, remember our VTEPS? 00:52:10.040 --> 00:52:19.560 All right. We are going to have to make sure that we properly forward all, all 00:52:20.520 --> 00:52:31.320 broadcast traffic where it needs to go when it happens, and flood all unknown unicast traffic 00:52:31.320 --> 00:52:40.840 where it needs to go, or else it doesn't work. Our communication, it breaks down. So, with VXLAN, 00:52:42.520 --> 00:52:48.040 there's a concept of it's called layer-2 flooding. So, with layer-2 flooding within VXLAN, 00:52:48.360 --> 00:52:56.199 we can take those unknown unicast messages and those broadcast messages, and we'll be able to 00:52:56.840 --> 00:53:02.360 build those VTEP tunnels that are necessary to reach all the nodes in the same subnet, 00:53:02.360 --> 00:53:06.679 VLAN, broadcast domain, regardless of where they are. Now, again, you might be saying, 00:53:06.679 --> 00:53:09.639 well, how do you figure that out? Well, think about this device here, 00:53:09.639 --> 00:53:14.600 would ultimately have to reach out to the control plane node and identify every single device 00:53:15.479 --> 00:53:18.520 that would normally be in here, but not, 00:53:21.719 --> 00:53:26.679 and figure out where they are. So, if it gets a listing back of this, this, this, this, and this, 00:53:26.679 --> 00:53:29.879 let's say there's five devices that are not in their home network, they're elsewhere. 00:53:31.000 --> 00:53:34.760 Well, now you know that, okay, there's five, where are they? Let's say two of them are here, 00:53:35.399 --> 00:53:38.520 let's say two of them are connected here, and one of them's connected there. 00:53:38.520 --> 00:53:41.560 So, that means they're going to have to do a tunnel from here to here for two of them, 00:53:42.520 --> 00:53:46.280 a tunnel from here to here for two of them, and a tunnel from here to here for one of them, 00:53:47.000 --> 00:53:51.239 and therefore send it out over VXLAN. 00:53:54.520 --> 00:53:58.120 And that way there, they all get that ART message. 00:53:59.879 --> 00:54:07.080 Okay, but then again, right, if you think about it with even more, right, granular control of all of 00:54:07.080 --> 00:54:12.439 this and understanding what happens, if I am really trying to figure out the MAC address of 00:54:12.439 --> 00:54:22.040 this exact device, well then what? This device knows who I'm trying to, because it can look 00:54:22.040 --> 00:54:26.679 into that message, right? It could look into the message and say, oh, I'm trying to find 00:54:26.679 --> 00:54:34.199 10.0.0.9. You reach out to the control plane node and it says 10.0.0.9 is here. 00:54:34.760 --> 00:54:41.000 So, then all I have to do is flood it to there and nowhere else, right? So, that previous example I 00:54:41.000 --> 00:54:45.399 gave you where it gets flooded everywhere isn't necessarily going to happen. It might be even 00:54:45.399 --> 00:54:49.959 better than that, whereby you know exactly, because the ART message has the address. 00:54:49.959 --> 00:54:55.239 So, if you know who you're trying to reach, then we might only need one VTEP tunnel. But if you 00:54:55.239 --> 00:55:00.199 don't, if it's just a pure broadcast of FFFFF, well then we're going to have to send it to everyone, 00:55:00.199 --> 00:55:05.879 no matter what, if we don't know the actual IP. So, for example, when you think about contacting 00:55:05.879 --> 00:55:11.479 a DHCP server, source IP, destination IP, they're unknown. Well, in that case, 00:55:11.479 --> 00:55:16.679 they're going to have to flood it everywhere in order to accomplish that. Or do I? 00:55:20.040 --> 00:55:24.919 No. Why? See, when we think about really how these technologies work, 00:55:24.919 --> 00:55:31.399 with DHCP, we got what? We have our helper address. So, if you reach your default gateway, 00:55:32.040 --> 00:55:38.120 then your helper address is going to do what for you? Your helper address is going to ultimately 00:55:38.120 --> 00:55:42.600 send you to the DHCP server, right? So, you have to really think about it from the perspective of 00:55:42.600 --> 00:55:46.760 the technology. Okay, when this happens, what's going to occur in that scenario? Versus when that 00:55:46.760 --> 00:55:52.679 happens, what's going to occur in that scenario? And that's really how you're truly going to start 00:55:52.679 --> 00:55:57.800 understanding all this stuff. It's by just breaking it down bit by bit, step by step. 00:55:57.800 --> 00:56:01.639 Whenever you have a question about it, you're like, hey, what about this? Check it out. We'll 00:56:01.639 --> 00:56:07.000 do a little bit of research, find out about it. But know that layer two flooding is going to be 00:56:07.000 --> 00:56:11.719 used with VXLAN to ensure that you can get those unknown unicasts or those broadcast messages 00:56:11.719 --> 00:56:17.719 to the other parts of the network where those other users might reside that are part of that 00:56:17.719 --> 00:56:21.959 same subnet VLAN broadcast domain. That's what you want to take away from that discussion. 00:56:23.639 --> 00:56:28.280 How is that for SD access? How many of you are like, wow, that is incredible? 00:56:28.280 --> 00:56:30.760 Or wow, I really don't ever want to have to deal with that. 00:56:34.520 --> 00:56:38.600 Regardless, though, it's some pretty incredible technology where you think about the number of 00:56:38.600 --> 00:56:42.679 people that have come together to ultimately figure out how to get all this to work. 00:56:43.320 --> 00:56:47.800 I'm not at that level. I am not at that level to be able to come up with this stuff, 00:56:48.600 --> 00:56:55.560 which is beautiful stuff. Yeah, incredible, intimidating, exciting. Conrad, you're right. 00:56:56.120 --> 00:57:00.040 All those terms at the same time. So again, let's remind ourselves what we need to know for the 00:57:00.040 --> 00:57:05.800 exam. I encourage you to be able to what? Pick terms and definitions out of a lineup 00:57:05.800 --> 00:57:08.360 when it comes to SD access. That is your goal.