Bringing APs into the fabric without the INFRA_VN, is it possible?

[Joshua Marks]

Hi there,

We have recently labbed an SD-Access implementation using 9200L edge switches, only to be hit with this error when deploying multiple VNs to the fabric:

Provisioning failed due to invalid parameter. Cisco Catalyst 9200L Switch Stack supports maximum of 1 VRFs. Current operation has 2 VRFs.

Some digging has revealed that the 9200L (fixed uplink variant) only supports one VRF, which causes problems in an SDA network as VNs and macro segmentation can not be deployed. We were planning to usea few 9120s as fabric APs, but noting that they would normally operate over the INFRA_VN, is it possible to push APs to operate over another VN if the INFRA_VN is unavailable?

[jedolphi · Accepted solution]

Hello Jousha. The limitation is one user-defined VN on 9200L. INFRA_VN is not user defined, thus it does not contribute to the limit. Also please do note that 9200L will not terminate VXLAN from fabric APs, as per the SDA CVD and the SDA compatibility matrix: https://cs.co/sda-sdg and http://cs.co/sda-compatibility-matrix . If you can wait a few months then you could consider using 9200L as a policy extended node, which means it becomes an TrustSec capable L2 extender homed to an SDA FE switch and thus should (roadmap) bypass the one VN limitation. Another option might be to look at OTT wireless which means there is no AP VXLAN tunnel terminating on the FE. Best regards, Jerome