What is Cisco SD Access?
At its core, SD-Access is a comprehensive network architecture that combines the fundamental principles of Software-Defined Networking (SDN) with advanced automation and security to revolutionize network access. The primary motivation for SD-access is to tighten security controls on whom and what can connect, as well as determine what connected entities can do.
In traditional networks, managing network access typically involves VLANs, access control lists (ACLs), and complex configurations. These often result in a web of tangled rules and manual configurations.
SD-Access, however, introduces a paradigm shift. It's founded on policy-based segmentation, where access control is determined by the identity of the user, the type of device, and the contextual information associated with the connection.
Access utilizes identity-based policies, which are enforced by the network infrastructure. These policies define who or what can access specific network resources, providing granular control.
Segmentation policies in the context of SD-Access are rules and configurations that determine how network access is controlled based on various criteria. Here are a few examples of segmentation policies:
User-Based Access Control
Device Type Policies
Location-Based Segmentation
Application-Specific Policies
Compliance and Security Policies
Time-of-Day Policies
Guest Network Policies
Quality of Service (QoS) Policies
Access Control Lists (ACLs)
Group-Based Policies
Threat Detection Policies
Role-Based Access Control
Cisco SD-Access consists of three core components that work together to deliver network assurance, automation and security. The three components of SD-Access are:
Cisco DNA Center is a central component for implementing SD-Access. Deploy Cisco DNA Center, the network management and automation platform, which serves as the brain behind SD-Access. DNAC is an intuitive, centralized management system that enables network engineers to apply policies across the SD-Access network. It centrally manages the design, policy, provision, and assurance workflows.
Network fabrics: These fabrics enable consistent user experiences on any device and from any location without compromising the security of your network. Using the policies created in DNAC, the single network fabric provides consistency across your network and for your users.
Centralized Control: The heart of SD-Access is a central controller, often Cisco's Identity Services Engine (ISE). This controller serves as the policy engine, governing access policies network-wide. ISE focuses on authentication, authorization, and accounting (AAA) services. It supports features like 802.1X for secure access, posture assessment for compliance checks, and guest access services.
Let's delve deeper into some of the core features that make SD-Access exceptional.
-Access seamlessly integrates with identity services, such as Active Directory or LDAP. This integration enhances authentication and authorization n mechanisms.
SD-Access is perfectly suited for enterprises, educational institutions, and organizations with complex campus networks. It shines in scenarios where network access control, security, and scalability are paramount.
SD-Access often employs VXLAN (Virtual Extensible LAN) for scalable network segmentation. VXLAN enables the creation of overlay networks, reducing the limitations imposed by traditional VLANs.
With the power of SD-Access, policies can be dynamically assigned based on real-time context. This means that the network adapts and enforces policies based on changing user, device, and location conditions.
Quality of Service (QoS): SD-Access doesn't just focus on access control; it enhances the user experience by ensuring that critical applications receive the necessary network resources. Real-time applications, like voice and video, receive prioritized treatment.