topic Re: Some SDA Design questions in Software-Defined Access (SD-Access)

Some SDA Design questions

Kanan Huseynli — Wed, 02 Jun 2021 00:23:38 GMT

Hi SDA-lovers,

suppose I have 9400 (chassis) border device (colocated Border actually, B&C).

Can I connect some servers directly to this border and have SVI for servers on border? Can I add this subnet-SVI to different VRF (life "shared") and do leaking for other VNs without Fusion (basically, doing import/export on border)? Is this type of design supported (may be manual workflow)? Or is there another this type of inter-VN leaking without fusion?

My second question is can I have one pair of physical WLC,but for multiple sites?

Thanks in advance,

Re: Some SDA Design questions

balaji.bandi — Wed, 02 Jun 2021 22:24:44 GMT

yes you can do, but most DNAC design says, make it dedicated B and C, if the network is big.

My second question is can I have one pair of physical WLC,but for multiple sites?

yes, you can have as long as your SD-Access stretched, but for the remote sites suggest having a local break-out WLC or Fabric in box suggested.

Re: Some SDA Design questions

Scott Hodgdon — Thu, 03 Jun 2021 13:24:59 GMT

Kanan,

Connecting servers directly to the Border would not be best practice. Based on your description, you would be doing route-leaking on the Border, and we highly recommend that this is done off the border on a Fusion device.

If you have a multi-site design, each site that is doing SD-Access Wireless must have a unique controller for that site. A single WLC pair cannot act as a controller for many sites. If the sites are small, you can run the WLC with a Fabric-in-a-Box.

Cheers,
Scott Hodgdon

Senior Technical Marketing Engineer

Enterprise Networking and Cloud Group

Re: Some SDA Design questions

Kanan Huseynli — Thu, 03 Jun 2021 18:17:47 GMT

Hi Scott,

thank you very much.

As I understand , there is no way to do leaking on border using DNA GUI,yes? We should do it via CLI like we do in Fusion (import/export RT) ,yes?

Regarding WLC, yes, I expected that answer. Honestly, I don't have hands-on SDA/DNA practice, but read lots of docs/ciscolive sessions. Just wanted to ensure, because on another topic I have seen that pair of ISE PSN can be used for multiple sites.

Regards,

Re: Some SDA Design questions

Scott Hodgdon — Thu, 03 Jun 2021 19:07:02 GMT

Kanan,

We do not do any leaking configuration in DNA Center. We only do L3 / L2 handoff on the border. If you insist on doing it on the border then it is CLI. I must stress highly, though, that we would rather this be on the fusion. Almost every deployment I have seen that has done this on the border has run into troubles, and most (if not all) went eventually to fusion. The fusion does not have to be very powerful. It just needs to run the routing protocol used on the Border and must support VRF-Lite.

Cheers,
Scott Hodgdon

Senior Technical Marketing Engineer

Enterprise Networking and Cloud Group

Re: Some SDA Design questions

Kanan Huseynli — Sat, 05 Jun 2021 10:36:48 GMT

The fusion does not have to be very powerful. It just needs to run the routing protocol used on the Border and must support VRF-Lite.

Can I ask why? Fusion is also in data path, isn't it?

regards,