A fabric that cannot talk to anything outside itself is a very expensive island. The border node is how an SD-Access fabric connects to the rest of the world - the data centre, the WAN, the internet, another fabric - and getting the handoff right is where fabric design meets traditional networking. It is also where the three most-confused SD-Access terms live: IP transit, SDA transit, and Layer 2 handoff.
This article untangles them. It is a concept-and-architecture piece - the border provisioning needs Cisco Catalyst Center - but the technologies underneath (VRF-lite, BGP, LISP) are standard and real. For the wider context, see the network virtualization pillar.
The border's job
Inside the fabric, everything is VXLAN-encapsulated, LISP-mapped, and SGT-tagged. Outside the fabric, none of that exists - it is ordinary IP routing. The border node is the translator. It de-encapsulates fabric traffic leaving the fabric and encapsulates external traffic entering it, and it decides how the fabric's virtual networks map to whatever is on the other side.
The way it does that translation is the "transit" type, and there are three patterns.
1. IP transit
The simplest and most common. The border hands off to a traditional routed network using VRF-lite - each fabric virtual network is mapped to a VRF on the border, and each VRF connects to the outside via its own routed sub-interface running a routing protocol (usually BGP).
What is preserved: the VRF separation (macro-segmentation). Each VN stays isolated on the other side.
What is lost: the SGT. IP transit does not carry the security group tag past the border unless you specifically extend TrustSec (SXP or inline tagging) to the next device.
Use when: connecting the fabric to a traditional network, a data centre, or the internet - the everyday case.
The border config is recognisable to anyone who has done MPLS L3VPN or plain VRF-lite - a VRF per VN, a routed sub-interface per VRF, a BGP session per VRF:
vrf definition VN-EMPLOYEES
rd 1:10
address-family ipv4
!
interface GigabitEthernet1/0/48.10
encapsulation dot1Q 10
vrf forwarding VN-EMPLOYEES
ip address 172.16.10.1 255.255.255.252
!
router bgp 65001
address-family ipv4 vrf VN-EMPLOYEES
neighbor 172.16.10.2 remote-as 65100
neighbor 172.16.10.2 activateThat is standard VRF-aware BGP - real, labbable, and exactly the material in the MPLS and route-control clusters. The fusion router on the other side is the device that (optionally) leaks routes between VRFs where the design needs shared services, and it is plain VRF route-leaking that PingLabz has captured before.
2. SDA transit
When you have multiple fabrics and want to connect them while keeping the fabric semantics intact end to end, IP transit is not enough - it drops the SGT and terminates the fabric at each border. SDA transit solves this by extending the fabric across the transit itself.
What is preserved: everything - the virtual network and the SGT travel end to end between fabrics.
Use when: a multi-site SD-Access deployment (SD-Access for Distributed Campus) where policy must be consistent across sites.
The key difference: with IP transit, the fabric ends at each border and traditional routing takes over. With SDA transit, the fabric continues across the transit - it is one policy domain spanning multiple sites. SDA transit is heavier (it needs a dedicated transit control plane and a capable underlay between sites) but it preserves segmentation and SGTs everywhere, which IP transit cannot.
3. Layer 2 handoff
Sometimes you need to extend a Layer 2 domain out of the fabric - to a legacy device, a data-centre subnet, or a piece of equipment that has to be in the same broadcast domain as fabric endpoints. Layer 2 handoff maps a fabric virtual network's Layer 2 segment to a traditional VLAN outside the fabric.
What is preserved: the Layer 2 adjacency - endpoints on both sides are in the same broadcast domain.
Use when: migrating into the fabric (keeping old and new in one subnet during transition), or connecting equipment that genuinely requires L2 adjacency with fabric endpoints.
Caution: you are extending a broadcast domain, so all the usual L2 risks apply - keep it minimal.
Layer 2 handoff is mostly a migration tool. During a brownfield migration to SD-Access, you often need old (traditional VLAN) and new (fabric) hosts to coexist in the same subnet while you move them across. L2 handoff bridges the two. Once migration is complete, you generally remove it - a permanent stretched Layer 2 domain is something to minimise, not embrace.
Choosing the transit
Border types: internal, external, anywhere
You will also hear borders described by what they know about external routes:
- Internal border - connects to known networks (the data centre, specific internal subnets). It imports those specific routes into the fabric.
- External border - the default exit, connecting to the unknown (the internet). Endpoints use it as the gateway of last resort; it does not need to know every external route.
- Anywhere border - both roles on one device, connecting to both known internal networks and the unknown outside.
Most fabrics have an external border for internet-bound traffic and one or more internal borders for the data centre - or an anywhere border doing both on a capable device. Deploy them redundantly, as with every fabric role.
What needs the controller, and what does not
- Needs Catalyst Center: assigning the border role, provisioning the VN-to-VRF mappings, configuring SDA transit, the fabric-side of the handoff.
- Real and standalone: the external side of an IP transit handoff is VRF-lite + VRF-aware BGP + route leaking on a fusion router - all standard, all captured in the MPLS and route-control clusters. The routing that carries fabric VNs into the wider network is ordinary VRF routing.
The border's external handoff is, at its heart, the same VRF-lite and VPNv4-adjacent routing PingLabz has labbed extensively. The fabric side needs the controller; the traditional-network side is real networking you can build and verify.
Key takeaways
- The border node translates between the fabric's VXLAN/LISP/SGT world and the ordinary routed world outside. The "transit" type is how it does that translation.
- IP transit: VRF-lite handoff, one VRF + BGP session per virtual network. Preserves VRF separation, drops the SGT (unless you extend TrustSec). The everyday case.
- SDA transit: extends the fabric (VXLAN, VNI, and SGT) across the transit between fabric sites. For multi-site with consistent end-to-end policy.
- Layer 2 handoff: bridges a fabric L2 segment to an external VLAN. Mostly a migration tool - minimise and remove.
- Borders are also classed as internal (known routes), external (default exit), or anywhere (both). Deploy redundantly.
- The external side of an IP-transit handoff is standard VRF-lite + BGP + fusion-router route leaking - real, labbable technology. The fabric side needs Catalyst Center. We are clear about the boundary.
Next: SD-Access segmentation - macro (VN) vs micro (SGT). The full cluster index lives on the network virtualization pillar, cross-linked to MPLS.
