SD-Access is LISP as the control plane, VXLAN as the data plane, and Catalyst Center operating the whole thing. This article explains the fabric architecture, its roles, and the policy model, extending the network virtualization cluster.
VXLAN without a control plane is flood-and-learn, and that does not scale to a real data center. BGP EVPN is what fabrics actually use: what it advertises, the route types that carry reachability, and why it replaced flooding everywhere.
VXLAN stretches Layer 2 across a routed network by wrapping Ethernet frames in UDP. This deep dive takes the encapsulation apart to the byte level with a real crafted-and-decoded packet, covering VNIs and VTEPs.
An IP address is both identity and location, and that overload breaks mobility. LISP splits the two into separate namespaces. This post explains the protocol and proves it on a real IOS XE lab, from first dropped packet to clean flow.
The management plane is the softest target on the box. This article hardens it on Cisco IOS XE with real captures: SSH done right, VTY restrictions, and brute-force protection, alongside AAA and CoPP in the infrastructure security cluster.
RESTCONF, Catalyst Center, and SD-WAN Manager APIs are doors into your infrastructure. Learn tokens, TLS, and least privilege for network APIs, framed for network engineers rather than web developers.
MACsec (IEEE 802.1AE) encrypts and authenticates every Ethernet frame on the link itself, so an attacker tapping the cable sees only ciphertext. This article explains how it works, how MKA distributes keys, and where it fits.
Time-based ACLs, object groups, and IPv6 ACLs on Cisco IOS XE, with real output including a schedule that shows inactive because of when the lab ran. Make policy readable, reusable, and time-aware instead of a flat wall of lines.
ND Inspection, IPv6 Snooping, and IPv6 Source Guard stop address spoofing that RA Guard cannot see. This covers how the device-tracking binding table learns which IPv6 address belongs on which port and how the switch enforces it.
Any device on an IPv6 segment can send a Router Advertisement and reconfigure every host's default gateway. This post configures RA Guard and DHCPv6 Guard, then floods rogue RAs to prove the switch blocks them.
uRPF asks one question of every arriving packet: do I have a route back to this source? Configure strict mode on IOS XE, fire spoofed packets at the router, and count the drops, then see where loose mode fits instead.
A traffic flood aimed at the router's own CPU can drop OSPF and BGP adjacencies without a single link failing. CoPP is the seatbelt: a QoS policy on the control plane that rate-limits each traffic class.