SDA design issue/doubts

[Kanan Huseynli]

Hi there,

Assume that, there is a network that consists of 3 buildings: 2x9407 in each and 9300 access/edge nodes. We have 9410 as super core (central node which aggregates all of 3 buildings). 2xCisco router as ISP facing device, 2x Cisco firewall and 2x Cisco WLC, 2 ISE appliances are also there.

Need design recommendations. My doubt is that what if I want to connect nodes to border device

Option 1) using 9407 in each building as Border/Control node and 9410 as fusion/next device for rest of network.

Here my question: is it possible to attach any node to 9407 border as access port? Or trunk port?

Option 2) using 9407 as intermediate and edge node (at the same time), attach nodes to it and it will be intermediate node for 9300 devices as well (I know that edge behind edge is supported). 9410 will be border device.

There same question appears, can I connect nodes (WLC/DNA/ISE) to 9410 border?

Option 3) The same as option 2,  but use router as control&border element (not as ISP facing devices, FW will be directly connect to ISP).

Question: Since 9410 is aggregation point can I pass traffic from 9407 to ASR1001 as L2/L3 (in case of L3 different VRF for 9410)? 9410 becomes some soft of intermediate device, but I'll use it as the device where DNA/ISE/WLC connected.

I hope could explain the topology/design (in short, as in traditional design: 3 tier design where access/distro nodes are in separate buildings and core nodes aggregates links from distro switches).

And I think option 1 is more stable and safe. Just my doubt is what if customer wants to connect server/some node to 9407 devices (building central device). Node may be one vlan based (access port) or esxi server with mutliple vlan (trunk port).

I can't implement FIAB in 9407 because edge (9300) behind FIAB (9407) is not supported.

Thanks in advance,

[Scott Hodgdon]

Kanan,

Since we can daisy-chain Fabric Edge nodes, you can have this : 9410 (border) >>> 9407 (Fabric Edge) >>> 9300 (Fabric Edge) . You refer to this in Option 2, but really this is not an Intermediate + Fabric Edge, it is just a Fabric Edge. 

It is recommended that shared services not be connected directly to the border. The Best Practice is to attach them to a fusion / next device outside the fabric where any inter-VN policies can be applied. 

The ISE / DNAC  can reside wherever the other servers reside for the customer. They just need IP reachability to the fabric environment. The WLCs can be directly connected to the borders , and their failover VLAN can be on a trunk between the two borders. You will need this trunk anyway as it will provide underlay and overlay resiliency as well.

Cheers,

Scott Hodgdon

Senior Technical Marketing Engineer

Enterprise Networking Groupv

[Kanan Huseynli]

Thanks Scott!

I understand that ,normally, services are not connected to border. But what if I connect them? I understand that for inter VN traffic we need fusion node, since for now LISP extranet is not supported in SDA. But as an option I may use only one VN and enforce policy using SGT groups, right?

In this case, looks like I can connect nodes to Border element.

What interesting for me (since I never did SDA in real environment): what configuration is done for node attachment to border? Is it L2 handoff or what?  How gateway are configured for services devices or nodes attached to border. This is in general interesting for me, because for some small deployments we may have only 9500 as core and floor switches aggregated in it, in addition to, services (servers/ise/dna/wla) are connected to 9500.

Thanks,