500-490 Sample Questions Answers

SD-Access and ACI Fabric are both solutions that provide software-defined networking for different domains. SD-Access is designed for the campus and branch networks, while ACI Fabric is designed for the data center networks. However, they share some common features and concepts, such as:

• Use of Scalable Group Tags: Both SD-Access and ACI Fabric use Scalable Group Tags (SGTs) to identify and classify the endpoints based on their attributes, such as user identity, device type, or application. SGTs are numerical labels that are assigned to the endpoints and carried in the packets, either in the header or in the metadata. SGTs enable granular and dynamic policy enforcement based on the endpoint identity and context, rather than the network topology and IP addresses12.
• Use of overlays: Both SD-Access and ACI Fabric use overlays to create a network abstraction layer that decouples the network services and functions from the underlying physical infrastructure. Overlays enable network virtualization and segmentation, as they allow multiple logical networks to coexist on the same physical network. Overlays also simplify the network design and management, as they reduce the complexity and variability of the network elements and interfaces. SD-Access uses VXLAN as the overlay protocol, while ACI Fabric uses VXLAN with EVPN as the overlay protocol34.
• Use of Endpoint Groups: Both SD-Access and ACI Fabric use Endpoint Groups (EPGs) to group the endpoints based on their policy requirements and network scope. EPGs are logical containers that define the allowed interactions between the endpoints, such as the protocols, ports, and quality of service. EPGs also define the network boundaries that isolate the endpoints from each other, based on the security and compliance needs. EPGs are synonymous with Scalable Groups in SD-Access, and they can be mapped between SD-Access and ACI Fabric to enable end-to-end policy across the domains56.

References:

• Cisco TrustSec Overview
• Cisco TrustSec Configuration Guide, Cisco IOS XE Gibraltar 16.12.x - Scalable Group Tags [Cisco IOS XE 16] - Cisco
• Cisco SD-Access Architecture Overview
• Cisco Application Centric Infrastructure Fundamentals, Release 4.0(1) - ACI Fabric Fundamentals [Cisco Application Policy Infrastructure Controller (APIC)] - Cisco
• Cisco SD-Access (SDA) Integration with Cisco Application Centric Infrastructure (ACI) - Cisco Community
• Cisco Application Centric Infrastructure - Cisco Multidomain Integration At-a-Glance

The node that enables Cisco ISE to share contextual information on a device with Cisco Stealthwatch is the pXGrid Controller. The pXGrid Controller is a component of the ISE Policy Service Node (PSN) that facilitates the exchange of contextual data between ISE and other security products, such as Stealthwatch, via the Platform Exchange Grid (pxGrid) protocol. The pXGrid Controller acts as a broker that registers, authenticates, and authorizes pxGrid clients, and allows them to publish and subscribe to topics of interest. For example, Stealthwatch can subscribe to the Session Directory topic to obtain user and device information from ISE, and use it to enrich the network flow data and provide better visibility and security analytics. Stealthwatch can also publish topics, such as Rapid Threat Containment (RTC), to allow ISE to take mitigation actions on compromised endpoints, such as quarantine or re-authentication. References:

• Cisco Identity Services Engine Administrator Guide, Release 2.4 - Manage Platform Exchange Grid Services [Cisco Identity Services Engine] - Cisco1
• Deploying Cisco Stealthwatch 7.x with Cisco ISE 2.4 using pxGrid - Cisco Community2
• Stealthwatch — Networking fun3
• pxGrid in Depth > Sharing the Context | Cisco Press4

 A “one switch at a time” approach to integrating SD-Access into an existing brownfield environment is a method that allows network administrators to gradually migrate their legacy network devices to SD-Access fabric devices without disrupting the network operations. This approach has two main advantages:

• It is appropriate for campus and remote site environments, where there may be different types of devices and network topologies. By replacing one switch at a time, the network administrators can ensure that the existing network connectivity and functionality are preserved, while gaining the benefits of SD-Access features such as automation, segmentation, and assurance12.
• It allows simplified testing prior to cutover, as the network administrators can verify the performance and compatibility of each switch before adding it to the fabric. This reduces the risk of errors and failures during the migration process, and allows for faster troubleshooting and resolution of any issues34.

References:

• Cisco SD-Access Solution Design Guide (CVD)
• Discuss Cisco 500-490 Exam Topic 1 Question 33 - Pass4Success
• How to provision devices in SD-Access ( SDA ) - Cisco Community
• A quick-start guide to SD-Access - Cisco Blogs

 Cisco SD-Access is a solution within Cisco DNA, which is built on intent-based networking principles. Cisco SD-Access provides visibility-based, automated end-to-end segmentation to separate user, device, and application traffic without redesigning the underlying physical network1. Cisco SD-Access also enables programmable overlays that allow network virtualization across the campus, branch, data center, and cloud2. Cisco SD-Access has two main components: the fabric and the policy3.

The fabric is the network overlay that consists of interconnected nodes that provide a consistent and scalable way of delivering network services and functions. The fabric nodes are classified into four types: edge nodes, border nodes, control plane nodes, and intermediate nodes. The edge nodes are the access switches or wireless controllers that connect to the end devices. The border nodes are the routers or switches that connect the fabric to external networks, such as the Internet, WAN, or data center. The control plane nodes are the routers or switches that maintain the mapping between the endpoint identifiers and the network locators. The intermediate nodes are the routers or switches that provide transit services within the fabric3.

The policy is the network configuration that defines the network behavior and outcomes, based on the business intent and requirements. The policy is composed of three elements: the endpoint groups, the contracts, and the virtual networks. The endpoint groups are the logical containers that group the endpoints based on their attributes, such as user identity, device type, or application. The contracts are the rules that specify the allowed interactions between the endpoint groups, such as the protocols, ports, and quality of service. The virtual networks are the logical partitions that isolate the endpoint groups and contracts from each other, based on the network scope and security3.

Cisco SD-Access addresses the following challenges and benefits:

• It simplifies the network design and management, as it reduces the complexity and variability of the network elements and interfaces.
• It enhances the network security and compliance, as it enforces granular and dynamic policies based on the endpoint identity and context, rather than the network topology and IP addresses.
• It improves the network performance and user experience, as it optimizes the network path, load balancing, and traffic engineering based on the network conditions and application requirements.
• It enables the network agility and scalability, as it supports the rapid deployment and integration of new devices, applications, and services, without affecting the existing network operations.

References:

• Cisco Software-Defined Access - Cisco Software-Defined Access Solution Overview
• What Is Software-Defined Access? - SD-Access - Cisco
• Cisco SD-Access Architecture Overview

 The current time in enterprise networking history is characterized by the rapid pace of change in the network technologies, architectures, and services. Some of the factors that contribute to this change are:

• The increasing demand for network performance, scalability, reliability, security, and agility from the business and end users.
• The emergence of new network paradigms, such as software-defined networking (SDN), network function virtualization (NFV), cloud networking, and intent-based networking (IBN).
• The proliferation of network devices, applications, and data sources, such as the Internet of Things (IoT), mobile devices, cloud services, big data, and artificial intelligence (AI).
• The evolution of network standards, protocols, and best practices, such as IPv6, 5G, Wi-Fi 6, Ethernet, and network automation.

These factors create new opportunities and challenges for enterprise network designers, engineers, and administrators, who need to keep up with the latest trends and innovations, and adapt their network solutions to the changing business and technical requirements.

References:

Cisco Enterprise Network Architecture and Design, https://www.cisco.com/c/en/us/solutions/design-zone/networking-design-guides/enterprise-networking-design.html 1 : Enterprise Networking Explained: Types, Concepts & Trends, https://www.bmc.com/blogs/enterprise-networking/ 2 : What is enterprise networking?, https://www.cloudflare.com/learning/network-layer/enterprise-networking/ 3 : Enterprise WAN – A Brief History, https://blogs.juniper.net/en-us/enterprise-cloud-and-transformation/enterprise-wan-a-brief-history 4

The protocol that runs between the vSmart controllers and between the vSmart controllers and the vEdge routers, and unifies all control plane functions under a single protocol umbrella is the Overlay Management Protocol (OMP)12. OMP is a proprietary protocol that is designed to enable the Cisco SD-WAN solution, which provides a software overlay that runs over standard network transport, including MPLS, broadband, and internet to deliver applications and services3. OMP provides the following services12:

• Orchestration of overlay network communication, including connectivity among network sites, service chaining, and VPN or VRF topologies
• Distribution of service-level routing information and related location mappings
• Distribution of data plane security parameters
• Central control and distribution of routing policy

OMP is an all-encompassing information management and distribution protocol that enables the overlay network by separating services from transport. Services provided in a typical VPN setting are usually located within a VPN domain, and they are protected so that they are not visible outside the VPN. In such a traditional architecture, it is a challenge to extend VPN domains and service connectivity. OMP addresses these scalability challenges by providing an efficient way to manage service traffic based on the location of logical transport end points. This method extends the data plane and control plane separation concept from within routers to across the network2.

References:

1: Routing Configuration Guide for vEdge Routers, Cisco SD-WAN Release 20.x - Unicast Overlay Routing 2: Introduction to Overlay Management Protocol in Viptela 3: Cisco SD-WAN vEdge vManage vSmart IBM

 The current digital business era is characterized by the rapid growth and adoption of digital technologies that enable companies to improve their business capabilities, operational efficiencies, and customer experiences. According to various sources, such as McKinsey1 and Forbes23, some of the key focus areas of the current digital business era are:

• IoT scale: The Internet of Things (IoT) refers to the network of physical devices, sensors, and machines that are connected to the internet and can communicate, collect, and exchange data. The IoT scale represents the massive amount and variety of data that are generated and processed by the IoT devices, as well as the potential value and insights that can be derived from them. The IoT scale also poses new challenges and opportunities for businesses, such as enhancing customer engagement, optimizing operations, creating new products and services, and ensuring security and privacy45.
• Automation: Automation refers to the use of technology to perform tasks or processes that would otherwise require human intervention or effort. Automation can increase productivity, efficiency, accuracy, and consistency, as well as reduce costs, errors, and risks. Automation can also enable businesses to scale up or down their operations, respond to changing customer demands, and innovate faster. Automation can be applied to various domains and functions, such as manufacturing, marketing, customer service, finance, and human resources6 .
• Connectivity: Connectivity refers to the ability to access, share, and exchange information and resources across different platforms, devices, and locations. Connectivity can enhance the communication and collaboration among businesses, customers, partners, and employees, as well as enable new business models and value propositions. Connectivity can also create new customer expectations and preferences, such as personalization, convenience, and speed. Connectivity can be enabled by various technologies, such as cloud computing, mobile devices, social media, and artificial intelligence .

References:

1: Digital strategy in the postpandemic era | McKinsey 2: The Business Benefits Of Living In The Most Digital Era Yet - Forbes 3: Why The Era Of Digital Transformation Is Important For … - Forbes 4: [What is IoT? How Smart Devices Impact Businesses in 2021] 5: [The Internet of Things: How IoT is changing the world - Forbes] 6: [What is Automation? Definition, Benefits, and Examples] : [How Automation Is Changing The Future Of Work - Forbes] : [What is Connectivity? Definition, Types, and Examples] : [How Connectivity Is Driving Business Transformation - Forbes]