SD-Access Foundations Lab

Build a complete single-site Software-Defined Access fabric from scratch. Master Catalyst Center integration, IS-IS underlay routing, LISP/VXLAN overlay control plane, Cisco ISE TrustSec policy enforcement, and dynamic endpoint onboarding.

Book Lab Hours

☲

Course Highlights

⌘

Single-Site Fabric Architecture

Deploy a complete SD-Access fabric site including Control Plane, Border, and Edge nodes with IS-IS underlay routing.

▱

Macro-Segmentation

Configure virtual networks (Campus_VN) and VRF route leaking on Fusion routers to control traffic segregation and external reachability.

◈

ISE & Catalyst Integration

Integrate Cisco Catalyst Center with Cisco ISE, TACACS+ device admin, and automated network discovery.

◆

Anycast & Transit Handoff

Set up Anycast Gateways, Layer 3 IP-based transit handoffs, and external BGP peering to datacenter and internet edges.

⚙

Micro-Segmentation & TrustSec

Configure Security Groups (SGTs), Group-Based Access Control (GBAC) policies, and dynamic switch port SGT assignments.

▣

Operational Validation

Perform step-by-step verification of LISP host registration, switch port authentication, and end-to-end data plane policy enforcement.

Essential Hands-On Experience

Designed for network engineers and CCIE candidates who need core, hands-on exposure to Cisco SD-Access technology from initial controller integration to policy verification.

Master the foundational concepts required to successfully design, deploy, and troubleshoot software-defined campus fabrics in enterprise environments.

Step-by-Step Fabric Build: Bootstrap borders, deploy IS-IS underlay, and discover edge nodes.
Complete Controller Workflow: Link Catalyst Center with Cisco ISE from start to finish.
End-to-End Enforcement: Verify LISP host tracking, VRF route leaking, and TrustSec SGT propagation.

Exam & Certification Alignment

This course directly covers foundational SD-Access fabric architecture, LISP/VXLAN overlay, and TrustSec policy topics featured on the Cisco CCIE Enterprise Infrastructure (v1.1) lab blueprint and the core ENCOR (350-401) exam syllabus.

CCIE Enterprise v1.1

Build the fundamental hands-on skills for single-site fabric deployment, handoffs, and policy enforcement.

ENCOR (350-401)

Master core Cisco SD-Access concepts, Cisco ISE integration, and overlay control plane operations.

ENSDWI (300-420)

Reinforce enterprise network design concepts, software-defined segmentation, and secure access.

Technologies Covered

✓ Cisco Catalyst Center & Cisco ISE Integration
✓ LISP Control Plane & VXLAN Data Plane
✓ IS-IS Underlay Routing Protocol
✓ Campus_VN Virtual Network & Anycast Gateways
✓ Border, Control Plane & Edge Node Roles

✓ Fusion Router BGP & VRF Route Leaking
✓ TACACS+ Device Admin & Endpoint Authentication
✓ Cisco ISE TrustSec Integration & Security Groups (SGTs)
✓ Group-Based Access Control (GBAC) Policies
✓ Layer 3 IP-Based Transit Handoff

Modules & Topics

Integrate Cisco Catalyst Center with Cisco ISE
Configure Site Hierarchy
Configure Global Network Settings
Configure Discovery Credentials
Configure Global IP Pools
Prepare Cisco ISE policies for device admin (TACACS+) authentication

Configure BGP connectivity between the datacenter core switch and Fusion routers
Configure Internet edge connectivity
Validate datacenter reachability from Fusion routers

Configure the Campus_VN VRF
Configure underlay and overlay subinterfaces
Configure underlay and overlay BGP
Configure route leaking between the global routing table (GRT) and Campus_VN

Configure hostname, domain, local user account, SSH, SNMP, and NETCONF

Configure underlay routed interfaces
Configure BGP peering with Fusion routers
Validate underlay reachability

Configure IS-IS underlay routing
Validate fabric underlay connectivity

Discover Fabric Border and Fabric Edge nodes
Assign devices to the site hierarchy
Provision network devices
Validate device inventory status

Create the fabric site
Configure Anywhere Border nodes
Assign Border, Control Plane, and Edge node roles
Create the Campus_VN virtual network
Create and reserve fabric IP pools
Configure Anycast Gateways
Configure IP-based transit and Layer 3 handoff
Validate fabric provisioning

Configure TrustSec integration
Configure Security Groups (SGTs)
Configure ISE endpoint identity groups
Configure authorization policies
Perform endpoint authentication
Validate switch port SGT assignment
Validate fabric connectivity

Configure Group-Based Access Control (GBAC) policies
Verify intra-SGT, inter-SGT, and external connectivity through Fusion routers

Validate LISP registration and endpoint learning
Validate segmentation policy

Start Your Lab Experience

Standard Pass

30-Hour Lab Access

Reserve access to a dedicated, pre-wired lab environment and use your purchased lab hours whenever it suits you.

$499 / 30 hours

Direct access via browser and internet connection
Dedicated Catalyst Center and ISE controllers
Full control over single fabric site & underlay
Zero hardware required on your side
Schedule your lab session for any available date and time

Buy 30 Hours

Frequently Asked Questions

No. Every device — switches, routers, Catalyst Center, and ISE — is provided and pre-wired for you. You just need a browser and an internet connection.

It's fully hands-on. You'll build the fabric underlay, provision it through Catalyst Center, and configure ISE policy yourself, module by module, on a live topology.

Basic routing and switching knowledge (OSPF/BGP fundamentals, VLANs, trunking) is recommended. No prior SD-Access or Catalyst Center experience is required — the course builds the fabric from a blank topology.

Lab hours are booked from your account balance. See the Book Hours / Buy Hours options above for current packages and pricing.

Yes. Module 9 and 10 cover TrustSec integration, Security Group Tags (SGTs), and Group-Based Access Control (GBAC) policy validation end to end.