Services as ISE VM or DHCP server could be inside the fabric?

[acc.94]

We are deploying an sd access infrastructure and customer wants to migrate their DC services (ISE, DHCP, AD, etc.) to one of fabric edge nodes.

Would this work or do I need to keep this switch out of the fabric?

In that case, can this services be on the overlay VN?

Thanks!

[balaji.bandi]

As per Cisco Documentation, with my Limited deployment knowledge (not widely done) , I do not think that is the right approach to connect to fabric edge node these services, these critical components part of SD-Access deployment.

Fabric edge nodes only can connect end devices or AP.  

Instead, you move that Services to the upper level.

some design guidelines :

https://www.cisco.com/c/en/us/td/docs/solutions/CVD/Campus/cisco-sda-design-guide.html

[Giuseppe Larosa]

Hello @acc.94 ,

your concerns are correct:

the DHCP server must be out of the fabric.

The explanation for this need is the following:

for a given VXVLAN   each fabric node implements the Anycast Concept for the SVI default gateway.

This means that each Fabric node when performing DHCP relay function wil populate the gi address with the SAME IP address for a specific VXVLAN/IP subnet and then it will send the packet inside a VXVLAN UDP packet towards the Border Node that advertised the subnet where the DHCP server IP address is part of.

Having the DHCP servers out of the fabric allows to use the Fabric Border nodes as proxies, they have a loopback interface configured with the same IP address of the Anycast SVI so they can propagate the DHCP request to the external DHCP servers.

When the DHCP server answer comes back it is first processed by the local loopback, then using LISP and VXVLAN UDP at the data plane,  and having tracked from what fabric node  has arrived the original DHCP request the Border node can send the DHCP offer to the correct fabric node sending actually to the fabric node loopback address ( in the external UDP header the destination address must be unique so it is the loopback address that is advertised in the IGP actually IS-IS)

The fabric node takes the DHCP offer and propagates it the original requester.

So the DHCP servers like other services for example AAA servers or ISE must be out of the fabric and reachable via Border nodes.

Hope to help

Giuseppe

[acc.94]

Thank you for the help!

One last question, in that case, could the 'services switch' be connected to the border node but being out of the fabric and reachable via traditional routing from the border node?

Thank you again!

[balaji.bandi]

sure that is a feasible and workable solution here.

[acc.94]

Thank you all for your help!

Anyways, I have one last question, could this services be directly connected on the CP/Border node even on DEFAULT_VN or in GRT VRFs?