--- title: "Cisco SD-Access Deployment: Underlay, Overlay and Fabric" description: "How a Cisco SD-Access deployment works in practice: Catalyst Center automation, the fabric underlay and overlay, and what to plan before you start." image: https://blog.iptel.com.au/hubfs/Blogs/Cisco%20SDA%20Deployment/Cisco%20SDA%20Deployment%20-%20Instagram.jpg --- [![IPTellogo-byline-2020-dark-v2-pnd-optimised-500 (1)](https://blog.iptel.com.au/hs-fs/hubfs/IPTellogo-byline-2020-dark-v2-pnd-optimised-500%20(1).png?width=200&height=59&name=IPTellogo-byline-2020-dark-v2-pnd-optimised-500%20(1).png "IPTellogo-byline-2020-dark-v2-pnd-optimised-500 (1)")](https://iptel.com.au) - [Home](https://iptel.com.au/) - [Solutions](https://iptel.com.au/solutions) Technologies - [Cisco Access Manager](https://iptel.com.au/technologies/cisco-access-manager) - [Cisco Catalyst Center](https://iptel.com.au/technologies/cisco-catalyst-center) - [Cisco Meraki](https://iptel.com.au/technologies/cisco-meraki) - [Cisco SDA Fabric](https://iptel.com.au/technologies/cisco-sda-fabric) - [Cisco Spaces](https://iptel.com.au/technologies/cisco-spaces) - [Everpure Storage](https://iptel.com.au/technologies/everpure-storage) - [Industrial IoT](https://iptel.com.au/technologies/industrial-iot) - [LAN](https://iptel.com.au/technologies/lan) - [Security and Cisco ISE](https://iptel.com.au/technologies/security-and-cisco-ise) - [ThousandEyes](https://iptel.com.au/technologies/thousandeyes) - [Virtualisation](https://iptel.com.au/technologies/virtualisation) - [Wi-Fi](https://iptel.com.au/technologies/wi-fi) Services - [Backup Assure](https://iptel.com.au/services/backup-assure) - [Cisco Network Upgrades](https://iptel.com.au/services/cisco-network-upgrades) - [Cisco URWB](https://iptel.com.au/services/cisco-urb) - [Cisco Webex Calling](https://iptel.com.au/services/cisco-webex-calling) - [Eco-Friendly Network Refresh](https://iptel.com.au/services/eco-friendly-network-refresh) - [Network Equipment Supply](https://iptel.com.au/services/network-equipment-supply) - [Splunk](https://iptel.com.au/services/splunk) - [Wi-Fi Assurance Review](https://iptel.com.au/services/wi-fi-assurance-review) - [Wi-Fi Surveys](https://iptel.com.au/services/wi-fi-surveys) - [Industries](https://iptel.com.au/industries) Education and Healthcare - [Education and Campuses](https://iptel.com.au/industries/education) - [Healthcare and Clinical](https://iptel.com.au/industries/healthcare) - [Hospital Wi-Fi Onboarding](https://iptel.com.au/services/hospital-wi-fi-onboarding-cisco-ise) - [Aged Care](https://iptel.com.au/industries/aged-care) Enterprise - [Enterprise Networks](https://iptel.com.au/industries/enterprise) Industrial - [Mining and Camps](https://iptel.com.au/industries/mines) - [Utilities](https://iptel.com.au/industries/utilities) Retail & Warehousing - [Retail](https://iptel.com.au/industries/retail-and-stores) - [Warehousing](https://iptel.com.au/industries/warehousing) Entertainment - [Stadiums](https://iptel.com.au/industries/stadiums) - [Hospitality](https://iptel.com.au/hospitality-and-hotels) - [MSP](https://iptel.com.au/managed-services) Meraki - [Meraki Access](https://iptel.com.au/managed-services/meraki-access-and-security) - [Meraki Security and SD-WAN](https://iptel.com.au/managed-services/meraki-sd-wan) Cisco - [Cisco Campus Access](https://iptel.com.au/managed-services/cisco-campus-access) - [Cisco SD-WAN](https://iptel.com.au/managed-services/cisco-sd-wan) - [Cisco ISE](https://iptel.com.au/managed-services/cisco-ise) Security and Collaboration - [Security Service Edge](https://iptel.com.au/managed-services/security-service-edge) - [Meeting Rooms](https://iptel.com.au/managed-services/meeting-rooms-as-a-service) Data Centre and More - [AI Infrastructure](https://iptel.com.au/managed-services/ai-infrastructure) - [Non-Cisco Devices](https://iptel.com.au/managed-services/non-cisco-device-management) Free Assessment - [Managed Services Assessment](https://score.iptel.com.au/managed-network-services) - [Equipment](https://iptel.com.au/services/network-equipment-supply) Equipment Supply - [Network Equipment Supply](https://iptel.com.au/services/network-equipment-supply) - [Buy Cisco Equipment](https://iptel.com.au/services/cisco-equipment-supply) - [Buy Meraki Equipment](https://iptel.com.au/services/meraki-equipment-supply) Get Pricing - [Get a Hardware Quote](https://iptel.com.au/services/network-equipment-supply#hardware-quote) - [Wi-Fi AP Estimator](https://iptel.com.au/resources/wifi-access-point-estimator) - [Blog](https://blog.iptel.com.au) - [Resources](https://iptel.com.au/resources) Free Resources - [Top Wi-Fi Secrets](https://iptel.com.au/top-8-wi-fi-secrets) - [Cisco SDA Fabric](https://iptel.com.au/the-cios-guide-to-sda-fabric) - [Catalyst Center Enablement](https://iptel.com.au/cisco-catalyst-center-enablement) Assessments - [ASD Essentials Assessment](https://score.iptel.com.au/asd-essentials-network-assessment) - [Cloud AI Assessment](https://score.iptel.com.au/cloud-ai-assessment) - [Collaboration Assessment](https://score.iptel.com.au/collaboration-assessment) - [Managed Services Assessment](https://score.iptel.com.au/managed-network-services) - [Network Assessment](https://score.iptel.com.au/network-assessment) - [Security Assessment](https://score.iptel.com.au/security-assessment) - [Splunk Assessment](https://score.iptel.com.au/splunk-assessment) Tools - [Automating Meraki](https://www.automatingmeraki.com) - [MAC Address Converter](https://iptel.com.au/resources/mac-address-converter) - [ThousandEyes Option Tool](https://score.iptel.com.au/thousandeyes) - [Wi-Fi AP Estimator](https://iptel.com.au/resources/wifi-access-point-estimator) Demos and Design - [Request a Meraki Demo](https://iptel.com.au/free-meraki-demo) - [FREE Meeting Room Design](https://iptel.com.au/schedule-meeting-room-design-session) - [Catalyst Center Enablement](https://iptel.com.au/cisco-catalyst-center-enablement) - [About](https://iptel.com.au/about-us) IPTel Solutions - [About us](https://iptel.com.au/about-us) - [Job Applications](https://careers.iptel.com.au/job-application) - [Privacy Policy](https://iptel.com.au/privacy-policy) - [Careers Blog](https://careers.iptel.com.au) Contact Us - [Contact Us Form](https://iptel.com.au/contact-us) - [Email Us](mailto:sales@iptel.com.au) Customer - [Customer Feedback](https://iptel.com.au/customer-feedback) - [Customer Referral](https://iptel.com.au/customer-referral) - [Terms and Conditions](https://iptel.com.au/terms-and-conditions) News Stories - [Project Guardian uses Networking Infrastructure as a Sensor](https://www.dailytelegraph.com.au/news/nsw/transport-for-nsw-launches-worldfirst-sensor-trial-to-stop-rail-and-bridge-trespassers/news-story/8dc52e8fbca4c471da408e670cf0163e) - [IPTel partners for monitoring for Meeting Rooms as a Service](https://www.commsbusiness.co.uk/content/news/highlight-partners-with-iptel-solutions) - [Webex Monitoring with Highlight](https://itbrief.co.uk/story/highlight-iptel-add-webex-monitoring-for-meeting-rooms) - [ITBrief with Meeting Room Monitoring](https://itbrief.com.au/story/highlight-iptel-add-webex-monitoring-for-meeting-rooms) - [Cisco Webex Meeting Rooms Monitoring](https://telconews.co.uk/story/highlight-iptel-add-webex-monitoring-for-meeting-rooms) - [IPTel adopts Highlight](https://itbrief.com.au/story/iptel-adopts-highlight-to-enhance-managed-services) - [Highlight MSP Upgrade](https://datacentre.solutions/news/71753/iptel-solutions-upgrade-with-highlights-service-platform) - [Cisco 360](https://www.crn.com.au/news/2026/networking/aussie-partners-react-cisco-360) - [DP World Transformation](https://www.cisco.com/site/us/en/about/case-studies-customer-stories/dp-world.html) - [Cisco Managed Services](https://www.arnnet.com.au/article/1251771/how-partners-can-take-a-leap-of-faith-with-managed-services.html) - [Project Delivery Excellence](https://channellife.com.au/story/cisco-honours-top-nz-partners-cisco-live) - [Great Place to Work](https://greatplacetowork.com.au/companies/iptel-solutions/) - [Wi-Fi Doesn't have to be Unreliable](https://www.techpartner.news/feature/iptel-wi-fi-doesnt-have-to-be-unreliable-494069) Buying from IPTel - [Buying Panels](https://iptel.com.au/professional-supply-panels) - [IPTel Store](https://store.iptel.com.au) - [Request a Quote](https://iptel.com.au/request-a-quote) - [Managed Services](https://iptel.com.au/managed-services-enquiry) Case Studies - [DP World Video](https://blog.iptel.com.au/hubfs/Case%20Studies/DP%20World_Case_Study.mp4) - [DP World](https://blog.iptel.com.au/dp-world-case-study) - [Backup Assure](https://blog.iptel.com.au/backup-assure-a-disaster-recovery-case-study) [Contact Us](https://iptel.com.au/contact-us) This is a search field with an auto-suggest feature attached. - There are no suggestions because the search field is empty. ## Cisco SD Access Deployment Sept 25, 2025 At IPTel we've been working on the deployment of Cisco SD Access. This is pretty new technology for most people and so has a bit of mystery to how this is deployed. In this blog, we'll take a look at how a real world deployment of Cisco SD Access looks. ## ![Cisco SDA Deployment](https://blog.iptel.com.au/hs-fs/hubfs/Blogs/Cisco%20SDA%20Deployment/Cisco%20SDA%20Deployment.jpg?width=2260&height=1240&name=Cisco%20SDA%20Deployment.jpg) --- ## Background to Cisco SD Access For many years, networking engineers have been lovingly building and configuring enterprise networks with an almost endless variety of tools and best practices, which have been cobbled together over years. The CLI was the main method of provisioning these devices, and with the help of spreadsheets and hand-crafted scripts we artisanally deployed networks like precious little snowflakes. Enter [Cisco Catalyst Center](https://blog.iptel.com.au/cisco-catalyst-center-beginners-guide) (formerly Cisco DNA Center), which is the management plane of [Cisco’s Software Defined Access strategy.](https://blog.iptel.com.au/software-defined-networking) When we think of our network as code, it means that we can repeatedly execute the same steps on some piece of hardware without needing to explicitly care about the underlying details. Say goodbye to those Excel configuration scripts! Related reading - [Cisco Catalyst Center Enablement](https://blog.iptel.com.au/cisco-catalyst-center-enablement) - [Cisco SDA Fabric](https://iptel.com.au/technologies/cisco-sda-fabric) - [Software Defined Networking Explained](https://blog.iptel.com.au/software-defined-networking) - [Cisco AI Analytics in operation](https://blog.iptel.com.au/cisco-ai-analytics-in-operation) - [Cisco Machine Learning and AI](https://blog.iptel.com.au/cisco-machine-learning-and-ai) --- ![DNACenterConsiderations1](https://blog.iptel.com.au/hs-fs/hubfs/Stock%20Images/Imported_Blog_Media/DNACenterConsiderations1.png?width=300&height=514&name=DNACenterConsiderations1.png) ## Cisco Catalyst Center Automation I won’t explain [Cisco SDA (Software Defined Access)](https://blog.iptel.com.au/what-is-sda-fabric) here, but I wanted to share with you how impressive Catalyst Center LAN Automation is, since it can accelerate your fabric deployment. In essence, SDA is an overlay technology that runs on a layer 3 underlay. One misconception is that the underlay must run IS-IS routing protocol, and that it has to be built by Catalyst Center. The underlay must be layer 3, but the routing protocol is up to you. If, however, you choose to build your underlay using [Cisco Catalyst Center](https://blog.iptel.com.au/cisco-catalyst-center-beginners-guide), then it will be built using IS-IS during the LAN Automation process. Much of this automation has its roots in APIC-EM, Cisco's earlier enterprise network controller, which was the predecessor to DNA Center (now Catalyst Center). LAN Automation deserves a bit more attention. Related reading - [Cisco SD-Access Lab](https://blog.iptel.com.au/cisco-sd-access-lab) --- ## Cisco SDA Fabric **Imagine the scenario:** You are building an SDA fabric in a campus and you have 50 edge switches (e.g. C9300 or C9200) to commission. How do you go about it in the most efficient manner to save having to send expensive resources to site to commission devices? How about zero touch deployment, or Plug and Play, as Cisco calls it? This is where Catalyst Center comes into play. There is a little bit of upfront planning in Catalyst Center, but the process is literally as simple as discovering your first seed device (e.g. a border fabric node) and telling Catalyst Center to use that device as the starting point for PnP ([we've also got some blogs exploring how Meraki does this](https://blog.iptel.com.au/meraki-cloud-wifi)). The onsite personnel rack and stack all the switches in factory defaulted mode and cable them up in the typical three-tiered Access/Distribution/Core model. Out of the box, the switches will power up and run a PnP agent that listens for instructions from the seed device. Within minutes Catalyst Center will start pushing configuration to all the devices using a pool of IP addresses that have been assigned to the underlay. Devices receive hostnames (optionally related to serial numbers if required), loopback addresses and all the AAA, SNMP, NTP, Device Tracking, and golden software image. Sit back and watch the underlay being built. Related reading - [Cisco SDA Fabric Key Concepts](https://blog.iptel.com.au/what-is-sda-fabric) - [Software Defined Networking: Explained](https://blog.iptel.com.au/software-defined-networking) --- ## Cisco SDA Fabric: Underlay Once the underlay has been built, Catalyst Center adds all the devices into its inventory and then you can manage/provision these devices. Provisioning the devices will ensure that they are added to the correct site/building, and if you have ISE integrated with Catalyst Center, then all of the devices will be added into ISE for device administration. It couldn’t be smarter than this, because the configuration will be done according to Cisco best practice – gone are the days of juggling multiple configuration snippets for each device type, operating system and feature. Related reading - [Catalyst Center Beginners Guide](https://blog.iptel.com.au/cisco-catalyst-center-beginners-guide) - [What is SDA Fabric](https://blog.iptel.com.au/what-is-sda-fabric) --- ## Cisco SDA Fabric: Overlay When deploying the overlay fabric, Catalyst Center really starts to shine. If you don’t believe me, then consider the complexity involved in configuring a Centralised Web Auth guest portal on a C9800 platform, with ISE hosting the web portal. There are many moving parts in ISE to build the portal, create the Policy Set and Policy Results. On the C9800 wireless controller there are redirection ACLs (which follow a different logic to the old AireOS) and all the AAA commands required to achieve URL redirection. You may spend a day or more figuring all this out and perhaps you missed a permit/deny somewhere along the lines. With SDA you will design and deploy a guest portal within Catalyst Center without touching ISE or the WLC. This is what is meant by network as code – create the intent in Catalyst Center and allow the tool to push the commands out to the devices. Every journey starts with the first step, and Catalyst Center gives us a leg up with great features such as LAN Automation. Related reading - [How to Build an SDA Fabric Lab: Part 1](https://blog.iptel.com.au/cisco-sd-access-lab-part-1) - [How to Build an SDA Fabric Lab: Part 2](https://blog.iptel.com.au/cisco-sd-access-lab-part-2) --- ## Cisco SD-Access Deployment: FAQs ### How Long Does a Cisco SD-Access Deployment Take? It depends on the size of the network and how much needs redesigning. A pilot site can be up in weeks, while a full campus rollout is usually staged over several months. ### What Is the SD-Access Underlay? The underlay is the physical routed network that connects the fabric switches. Catalyst Center can build it automatically with LAN automation, or it can use an existing routed design. ### What Is the SD-Access Overlay? The overlay is the virtual network built on top of the underlay using VXLAN. It carries user and device traffic in virtual networks, with policy applied by group rather than by IP address. ### Can I Migrate to SD-Access Without Downtime? Most migrations are staged building by building, with the fabric connected to the existing network through border nodes, so each area moves in a planned window. --- ## Cisco SDA Deployment: Summary Cisco Catalyst Center, [Cisco Spaces](https://blog.iptel.com.au/cisco-spaces-introduction) and [Software Defined Access](https://blog.iptel.com.au/software-defined-networking)are big topics in the Cisco world. The terms underlay (the routing layer) and the overlay (the contract layer, at which clients communicate) are at once familiar topics, but also new. They are a rebuilding of how we have approached networking over the years (we all know the OSI stack right?), but with a new twist. The network is now managed via a GUI. Those of us that have been in networking a while (over 25 years now!) have loved the CLI - it's quick and efficient. [Cisco Machine learning and Cisco AI Analytics](https://blog.iptel.com.au/cisco-machine-learning-and-ai) are going to be big concepts in networking - the ability to alert on changes in behaviour will help cut down on alarm fatigue. With so much larger networks, with a myriad of features, the time is here now to begin the journey to software defined networking. Related reading - [SD Access Deployment](https://blog.iptel.com.au/cisco-sda-deployment) - [Zero Trust Architecture](https://blog.iptel.com.au/zero-trust-architecture) - [Zero Trust Deployment](https://blog.iptel.com.au/zero-trust-deployment) - [Catalyst Center Beginners Guide](https://blog.iptel.com.au/cisco-catalyst-center-beginners-guide)   ### Need Help With SD-Access? IPTel designs and deploys [Cisco SD-Access fabric](https://iptel.com.au/technologies/cisco-sda-fabric) for Australian campuses. If that would be useful, [get in touch with the IPTel team](https://iptel.com.au/contact-us) or email [sales@iptel.com.au](mailto:sales@iptel.com.au). #### Related Articles ###### [Cisco SD Access: Scalable Group Tags](https://blog.iptel.com.au/blog/cisco-sd-access-scalable-group-tags) June 19, 2025 ###### [Cisco SD-Access Lab: Part 2](https://blog.iptel.com.au/cisco-sd-access-lab-part-2) May 9, 2025 ###### [Deploying Cisco SDA](https://blog.iptel.com.au/cisco-sd-access-deployed) Apr 10, 2025 ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Mark McSherry", "url" : "https://blog.iptel.com.au/author/mark-mcsherry" }, "dateModified" : "2026-10-03T07:44:37.386Z", "datePublished" : "2025-09-25T04:38:01.000Z", "headline" : "Cisco SD-Access Deployment: Underlay, Overlay and Fabric", "image" : [ "https://blog.iptel.com.au/hubfs/Blogs/Cisco%20SDA%20Deployment/Cisco%20SDA%20Deployment%20-%20Instagram.jpg" ], "mainEntityOfPage" : { "@id" : "https://blog.iptel.com.au/cisco-sda-deployment", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.iptel.com.au/hubfs/IPTel_Solutions_February2020%20-%20Header%20SiteMap/Images/IPTellogo-byline-2020-dark-v2.png" }, "name" : "IPTel Solutions Pty Ltd" } } ```