--- title: What Is Cisco SD-Access Fabric? SDA Explained description: "Cisco SD-Access (SDA) fabric explained: how the overlay, underlay, control plane and policy work together to automate and segment your campus network." image: https://blog.iptel.com.au/hubfs/Blogs/What%20is%20Cisco%20SDA/What%20is%20Cisco%20SDA_%20(Instagram).png --- [![IPTellogo-byline-2020-dark-v2-pnd-optimised-500 (1)](https://blog.iptel.com.au/hs-fs/hubfs/IPTellogo-byline-2020-dark-v2-pnd-optimised-500%20(1).png?width=200&height=59&name=IPTellogo-byline-2020-dark-v2-pnd-optimised-500%20(1).png "IPTellogo-byline-2020-dark-v2-pnd-optimised-500 (1)")](https://iptel.com.au) - [Home](https://iptel.com.au/) - [Solutions](https://iptel.com.au/solutions) Technologies - [Cisco Access Manager](https://iptel.com.au/technologies/cisco-access-manager) - [Cisco Catalyst Center](https://iptel.com.au/technologies/cisco-catalyst-center) - [Cisco Meraki](https://iptel.com.au/technologies/cisco-meraki) - [Cisco SDA Fabric](https://iptel.com.au/technologies/cisco-sda-fabric) - [Cisco Spaces](https://iptel.com.au/technologies/cisco-spaces) - [Everpure Storage](https://iptel.com.au/technologies/everpure-storage) - [Industrial IoT](https://iptel.com.au/technologies/industrial-iot) - [LAN](https://iptel.com.au/technologies/lan) - [Security and Cisco ISE](https://iptel.com.au/technologies/security-and-cisco-ise) - [ThousandEyes](https://iptel.com.au/technologies/thousandeyes) - [Virtualisation](https://iptel.com.au/technologies/virtualisation) - [Wi-Fi](https://iptel.com.au/technologies/wi-fi) Services - [Backup Assure](https://iptel.com.au/services/backup-assure) - [Cisco Network Upgrades](https://iptel.com.au/services/cisco-network-upgrades) - [Cisco URWB](https://iptel.com.au/services/cisco-urb) - [Cisco Webex Calling](https://iptel.com.au/services/cisco-webex-calling) - [Eco-Friendly Network Refresh](https://iptel.com.au/services/eco-friendly-network-refresh) - [Network Equipment Supply](https://iptel.com.au/services/network-equipment-supply) - [Splunk](https://iptel.com.au/services/splunk) - [Wi-Fi Assurance Review](https://iptel.com.au/services/wi-fi-assurance-review) - [Wi-Fi Surveys](https://iptel.com.au/services/wi-fi-surveys) - [Industries](https://iptel.com.au/industries) Education and Healthcare - [Education and Campuses](https://iptel.com.au/industries/education) - [Healthcare and Clinical](https://iptel.com.au/industries/healthcare) - [Hospital Wi-Fi Onboarding](https://iptel.com.au/services/hospital-wi-fi-onboarding-cisco-ise) - [Aged Care](https://iptel.com.au/industries/aged-care) Enterprise - [Enterprise Networks](https://iptel.com.au/industries/enterprise) Industrial - [Mining and Camps](https://iptel.com.au/industries/mines) - [Utilities](https://iptel.com.au/industries/utilities) Retail & Warehousing - [Retail](https://iptel.com.au/industries/retail-and-stores) - [Warehousing](https://iptel.com.au/industries/warehousing) Entertainment - [Stadiums](https://iptel.com.au/industries/stadiums) - [Hospitality](https://iptel.com.au/hospitality-and-hotels) - [MSP](https://iptel.com.au/managed-services) Meraki - [Meraki Access](https://iptel.com.au/managed-services/meraki-access-and-security) - [Meraki Security and SD-WAN](https://iptel.com.au/managed-services/meraki-sd-wan) Cisco - [Cisco Campus Access](https://iptel.com.au/managed-services/cisco-campus-access) - [Cisco SD-WAN](https://iptel.com.au/managed-services/cisco-sd-wan) - [Cisco ISE](https://iptel.com.au/managed-services/cisco-ise) Security and Collaboration - [Security Service Edge](https://iptel.com.au/managed-services/security-service-edge) - [Meeting Rooms](https://iptel.com.au/managed-services/meeting-rooms-as-a-service) Data Centre and More - [AI Infrastructure](https://iptel.com.au/managed-services/ai-infrastructure) - [Non-Cisco Devices](https://iptel.com.au/managed-services/non-cisco-device-management) Free Assessment - [Managed Services Assessment](https://score.iptel.com.au/managed-network-services) - [Equipment](https://iptel.com.au/services/network-equipment-supply) Equipment Supply - [Network Equipment Supply](https://iptel.com.au/services/network-equipment-supply) - [Buy Cisco Equipment](https://iptel.com.au/services/cisco-equipment-supply) - [Buy Meraki Equipment](https://iptel.com.au/services/meraki-equipment-supply) Get Pricing - [Get a Hardware Quote](https://iptel.com.au/services/network-equipment-supply#hardware-quote) - [Wi-Fi AP Estimator](https://iptel.com.au/resources/wifi-access-point-estimator) - [Blog](https://blog.iptel.com.au) - [Resources](https://iptel.com.au/resources) Free Resources - [Top Wi-Fi Secrets](https://iptel.com.au/top-8-wi-fi-secrets) - [Cisco SDA Fabric](https://iptel.com.au/the-cios-guide-to-sda-fabric) - [Catalyst Center Enablement](https://iptel.com.au/cisco-catalyst-center-enablement) Assessments - [ASD Essentials Assessment](https://score.iptel.com.au/asd-essentials-network-assessment) - [Cloud AI Assessment](https://score.iptel.com.au/cloud-ai-assessment) - [Collaboration Assessment](https://score.iptel.com.au/collaboration-assessment) - [Managed Services Assessment](https://score.iptel.com.au/managed-network-services) - [Network Assessment](https://score.iptel.com.au/network-assessment) - [Security Assessment](https://score.iptel.com.au/security-assessment) - [Splunk Assessment](https://score.iptel.com.au/splunk-assessment) Tools - [Automating Meraki](https://www.automatingmeraki.com) - [MAC Address Converter](https://iptel.com.au/resources/mac-address-converter) - [ThousandEyes Option Tool](https://score.iptel.com.au/thousandeyes) - [Wi-Fi AP Estimator](https://iptel.com.au/resources/wifi-access-point-estimator) Demos and Design - [Request a Meraki Demo](https://iptel.com.au/free-meraki-demo) - [FREE Meeting Room Design](https://iptel.com.au/schedule-meeting-room-design-session) - [Catalyst Center Enablement](https://iptel.com.au/cisco-catalyst-center-enablement) - [About](https://iptel.com.au/about-us) IPTel Solutions - [About us](https://iptel.com.au/about-us) - [Job Applications](https://careers.iptel.com.au/job-application) - [Privacy Policy](https://iptel.com.au/privacy-policy) - [Careers Blog](https://careers.iptel.com.au) Contact Us - [Contact Us Form](https://iptel.com.au/contact-us) - [Email Us](mailto:sales@iptel.com.au) Customer - [Customer Feedback](https://iptel.com.au/customer-feedback) - [Customer Referral](https://iptel.com.au/customer-referral) - [Terms and Conditions](https://iptel.com.au/terms-and-conditions) News Stories - [Project Guardian uses Networking Infrastructure as a Sensor](https://www.dailytelegraph.com.au/news/nsw/transport-for-nsw-launches-worldfirst-sensor-trial-to-stop-rail-and-bridge-trespassers/news-story/8dc52e8fbca4c471da408e670cf0163e) - [IPTel partners for monitoring for Meeting Rooms as a Service](https://www.commsbusiness.co.uk/content/news/highlight-partners-with-iptel-solutions) - [Webex Monitoring with Highlight](https://itbrief.co.uk/story/highlight-iptel-add-webex-monitoring-for-meeting-rooms) - [ITBrief with Meeting Room Monitoring](https://itbrief.com.au/story/highlight-iptel-add-webex-monitoring-for-meeting-rooms) - [Cisco Webex Meeting Rooms Monitoring](https://telconews.co.uk/story/highlight-iptel-add-webex-monitoring-for-meeting-rooms) - [IPTel adopts Highlight](https://itbrief.com.au/story/iptel-adopts-highlight-to-enhance-managed-services) - [Highlight MSP Upgrade](https://datacentre.solutions/news/71753/iptel-solutions-upgrade-with-highlights-service-platform) - [Cisco 360](https://www.crn.com.au/news/2026/networking/aussie-partners-react-cisco-360) - [DP World Transformation](https://www.cisco.com/site/us/en/about/case-studies-customer-stories/dp-world.html) - [Cisco Managed Services](https://www.arnnet.com.au/article/1251771/how-partners-can-take-a-leap-of-faith-with-managed-services.html) - [Project Delivery Excellence](https://channellife.com.au/story/cisco-honours-top-nz-partners-cisco-live) - [Great Place to Work](https://greatplacetowork.com.au/companies/iptel-solutions/) - [Wi-Fi Doesn't have to be Unreliable](https://www.techpartner.news/feature/iptel-wi-fi-doesnt-have-to-be-unreliable-494069) Buying from IPTel - [Buying Panels](https://iptel.com.au/professional-supply-panels) - [IPTel Store](https://store.iptel.com.au) - [Request a Quote](https://iptel.com.au/request-a-quote) - [Managed Services](https://iptel.com.au/managed-services-enquiry) Case Studies - [DP World Video](https://blog.iptel.com.au/hubfs/Case%20Studies/DP%20World_Case_Study.mp4) - [DP World](https://blog.iptel.com.au/dp-world-case-study) - [Backup Assure](https://blog.iptel.com.au/backup-assure-a-disaster-recovery-case-study) [Contact Us](https://iptel.com.au/contact-us) This is a search field with an auto-suggest feature attached. - There are no suggestions because the search field is empty. ## What is Cisco SDA Fabric? Oct 18, 2025 Cisco are massively moving the needle on how future networks will be designed and deployed. Cisco SDA Fabric is a term we're going to be hearing a whole lot more about. Why change something that works? In this blog, we’ll take a look at that exact question.  ![What is Cisco SDA\_](https://blog.iptel.com.au/hs-fs/hubfs/Blogs/What%20is%20Cisco%20SDA/What%20is%20Cisco%20SDA_.png?width=2240&height=1260&name=What%20is%20Cisco%20SDA_.png) As an upfront intro, I’ve been a networking engineer for over 20 years now, with over 15 years of that as a CCIE. In a nutshell, I’ve lived and breathed command line, as every network engineer worth their stripes has. We’re all learning, and this is my current understanding of all these terms. Know any different? Feel free to provide some feedback for discussion.  Related reading - [Cisco SDA](https://blog.iptel.com.au/the-cios-guide-to-cisco-sda-fabric) - [Cisco SDA Fabric](https://iptel.com.au/technologies/cisco-sda-fabric) - [Cisco SD-Access Lab](https://blog.iptel.com.au/cisco-sd-access-lab) - [Software Defined Networking Explained](https://blog.iptel.com.au/software-defined-networking) --- ## Defining Software-Defined Access (SDA) Have you heard the term [Software Defined Access](https://blog.iptel.com.au/software-defined-networking)[(SDA for short), or Software Defined Networking](https://blog.iptel.com.au/software-defined-networking)(unsurprisingly SDN for short)? ![Cisco SDA FAbric Key Concepts (Instagram)](https://blog.iptel.com.au/hs-fs/hubfs/Blogs/Cisco%20SDA%20Fabric%20Key%20Concepts/Cisco%20SDA%20FAbric%20Key%20Concepts%20(Instagram).png?width=214&height=214&name=Cisco%20SDA%20FAbric%20Key%20Concepts%20(Instagram).png) These are bandied around quite freely these days in regards to networking and are key concepts.  Essentially SDA is the concept of uncoupling that reliance on the CLI. Let’s start with a key concept – SDA underlay and SDA overlay.  I've got a blog just on the topic of [what Cisco SD Access is](https://blog.iptel.com.au/blog/cisco-sd-access-scalable-group-tags), if you wanted to read more on that.   Related reading - [Cisco Catalyst Center Beginners Guide](https://blog.iptel.com.au/cisco-catalyst-center-beginners-guide) --- ## SDA Fabric Underlay vs Overlay SDA underlay is where the network configures its routed core. Gone are the days of a layer 2, VLAN centric network. It is automatically configured and it’s layer 3 in nature. This is the SDA network underlay – essentially it’s about providing connectivity between all network elements, so all corners of the network can now route to each other (Cisco is using IS-IS for the underlying routing protocol, due to its ability to use L2 tags).   [![Cisco SDA Fabric](https://blog.iptel.com.au/hs-fs/hubfs/image-12.png?width=211&height=209&name=image-12.png)](https://blog.iptel.com.au/what-is-sda-fabric) Once the SDA underlay is complete, you can move on to the SDA overlay. The overlay is the actual features (or Contracts) that you have configured. Devices are now tagged and based on the tag, functionality is provided to a device. The contract might determine an end-to-end QoS profile, or determine that one device can see a subset of other connected devices, but may not route to an external destination, and so on.  Hopefully this makes sense – the SDA underlay is the base network, the SDA overlay is the network functionality that a user experiences.    ## [![Software Defined Networking Wide](https://blog.iptel.com.au/hs-fs/hubfs/Stock%20Images/Product%20Photos/SDN/Software%20Defined%20Networking%20Wide.jpg?width=2898&height=1035&name=Software%20Defined%20Networking%20Wide.jpg)](https://blog.iptel.com.au/software-defined-networking) Related reading - [Software Defined Networking: Explained](https://blog.iptel.com.au/software-defined-networking) --- ## Policy Based Networking Policy Based Networking is another related term, worth a quick look at. On the one hand, I think this term is pretty synonymous with the term SDA Overlay that I defined above. Perhaps though, it should be considered as a combination of the SDA Underlay and SDA Overlay combined functionality.   Policy Based Networking is all about freeing the user from the command line to really focus on the type of network policy they want to deploy and not worry about the CLI specifics.   Related reading - [Zero Trust Architecture (ZTA) Introduction](https://blog.iptel.com.au/zero-trust-architecture) - [Zero Trust Architecture (ZTA) Deployment](https://blog.iptel.com.au/zero-trust-deployment) --- ## Micro Segmentation Micro Segmentation is the concept of having multiple clients in the same VXLAN, but allowing them to all have a different policy. This is based on tags and provides for an incredibly granular ability to determine what access different clients will have. Cisco have a pretty good video on [what Micro-Segmentation is](https://www.cisco.com/c/en/us/products/security/what-is-microsegmentation.html), which is worth a watch. This is much more powerful than the existing (and at some point in the not too distant future, legacy technology) of allocating clients to different VLANs, with routed connections between them.  Related reading - [Cisco SD Access: Micro Segmentation Explained](https://blog.iptel.com.au/blog/cisco-sd-access-micro-segmentation-explained) --- ## What is SDA Fabric? And so, this takes us to the real question we want to answer in this blog – what is SDA fabric?   ![Cisco Fabric Network](https://blog.iptel.com.au/hs-fs/hubfs/image-8.png?width=233&height=336&name=image-8.png) Answers on a postcard, but this is my take:- we’ve defined SDA as the ability to use a GUI based management system to configure the network, and not have to use the CLI. SDA frees the network admin to configure the network, based on policy, not your ability with the CLI.  Fabric is something a little different – but builds on this theme. When you integrate the network elements (and I mean switches, WLCs, routers here), into the SDA Fabric, you hand them over to the SDA architecture. What I mean by this is that you wipe the device and it’s completely configured – and controlled by Catalyst Center from this point.  The combined sum of all the switches now acts like a single giant switch, where you can plug in anywhere you like and Policy Based Networking is applied to tag you and dictate the network experience you receive.   Related reading - [Catalyst Center Beginners Guide](https://blog.iptel.com.au/cisco-catalyst-center-beginners-guide) --- ## LAN Switching: Key Fabric Concepts There’s a pretty interesting concept which is applied to the use of Fabric in a LAN switching scenario. While you configure the IP ranges to be used, the network applies the underlying VLANs, so you no longer have to worry about that side of the Layer 2 design (in fact it's all somewhat redundant now, since the move is to Layer 3 routing, even at the access layer).  The essential concept then is the ‘exploded switch’. This is that once Fabric is enabled, all switches really operate as one giant switch. Think of the normal 3 layer Cisco switching hierarchy – you have all those access switches, but now they are treated as one large switch – plug in wherever you like and get the same user experience.   --- ## Wireless: How the WLAN Joins the Fabric The design and configuration of a wireless LAN is not unaffected by Fabric. We have some new concepts to take a look at for the WLAN:  - **Fabric Mode WLC:** CAPWAP is still used – but traffic is not all centrally switched any longer - **Fabric Mode APs**:  Operate in local mode – use central CAPWAP for control and user traffic dropped off locally The image below details some of the key concepts for the SDA WLAN Architecture:    ![Image result for SD- access wireless architecture optimizing data plane](https://image.slidesharecdn.com/ciscoconnectvancouver2017-optimizingyourclientswifiexperience-171120152728/95/cisco-connect-vancouver-2017-optimizing-your-clients-wi-fi-experience-53-638.jpg?cb=1511191997) \*Image from Cisco Connect Vancouver 2017 The way in which SDA works with regards to WLAN traffic is much more akin to the local mode switching, which is a current option. This means that user traffic is dropped off locally at the AP and not shipped over the CAPWAP tunnel to the central WLC. The underlying SDA architecture is responsible for then ensuring that traffic can get to where it needs to go.   Under the surface, the AP forms a VXLAN connection to the access switch it is connected to. This then allows the use of policy(ies) to dictate how user traffic is treated, with the really important (new) operating mode: WLAN traffic is treated identically to wired traffic.  The applied policies affect and are applied to the WLAN traffic in an identical way to wired – as user traffic exits the AP and enters the LAN, it is essentially exactly the same as if traffic were deposited onto the LAN from a wired client. Micro Segmentation policies are applied in exactly the same way to WLAN traffic as they would with LAN based traffic.   Final note – the Cisco Catalyst 9800 WLC fully supports SDA wireless. Legacy AireOS controllers are being retired, so if you're still running one, plan the move to the 9800 as part of your SDA project.  --- ## What is SDA Fabric: Summary In essence, SDA Fabric spins everything we’ve known about networking on its head. I’ve always designed networks with VRFs, VLANs and carefully allocated subnets. You’ve got your classic Cisco three tier model (core, distribution and access), but now it’s all changed. VXLAN is there to replace VLANs now, so this is another new term to add to the networking engineer’s vocabulary.  The network allocates most of the config for you – your job is to ensure you architect the physical layer to be efficient and resilient – and after this let the SDA Fabric overlay do its thing.  Cisco Catalyst Center is a major aspect of the whole SDA Fabric story - it's the key element to configuring Fabric. If you need any help with this, we have a service to help with [Cisco Catalyst Center Enablement](https://blog.iptel.com.au/cisco-catalyst-center-enablement). If you're looking for a bit more information on how SDA and Cisco Catalyst Center work together, take a look at [our Cisco SDA Fabric page](https://iptel.com.au/technologies/cisco-sda-fabric). Related reading - [Cisco Catalyst Center Enablement](https://blog.iptel.com.au/cisco-catalyst-center-enablement) - [Software Defined Networking Explained](https://blog.iptel.com.au/software-defined-networking)   ## Cisco SD-Access Fabric: FAQs ### What Is Cisco SD-Access? Cisco SD-Access (SDA) is Cisco's software-defined campus architecture. It builds a virtual overlay network on top of the physical network and applies identity-based access policy, automated from Catalyst Center. ### What Are the Components of an SDA Fabric? An SDA fabric has edge nodes where users connect, border nodes that connect the fabric to other networks, control plane nodes that track where endpoints are, and a VXLAN overlay. Catalyst Center automates it and Cisco ISE supplies identity and policy. ### Do I Need Catalyst Center and ISE for SD-Access? Yes. Catalyst Center provides the automation and assurance, and Cisco ISE provides authentication and group-based policy. Together with supported Catalyst switches and wireless, they make up the SD-Access solution. ### What Is the Difference Between Macro and Micro Segmentation? Macro segmentation separates traffic into virtual networks, like separate VRFs. Micro segmentation uses Security Group Tags inside a virtual network to control which groups of users and devices can talk to each other. ### Need Help With SD-Access? IPTel designs and deploys [Cisco SD-Access fabric](https://iptel.com.au/technologies/cisco-sda-fabric) for Australian campuses. If that would be useful, [get in touch with the IPTel team](https://iptel.com.au/contact-us) or email [sales@iptel.com.au](mailto:sales@iptel.com.au). #### Related Articles ###### [Cisco SDA Migration](https://blog.iptel.com.au/cisco-sda-migration) Mar 31, 2026 ###### [Cisco SD Access: Scalable Group Tags](https://blog.iptel.com.au/blog/cisco-sd-access-scalable-group-tags) June 19, 2025 ###### [Deploying Cisco SDA](https://blog.iptel.com.au/cisco-sd-access-deployed) Apr 10, 2025 Free tool ### How Many Wi-Fi Access Points Do You Need? Work out APs, PoE and switch ports floor by floor, using the same survey grades our Cisco wireless engineers design to. Takes under a minute. [Try the AP Estimator →](https://iptel.com.au/resources/wifi-access-point-estimator?utm_source=blog&utm_medium=cta&utm_campaign=ap-estimator) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Mark McSherry", "url" : "https://blog.iptel.com.au/author/mark-mcsherry" }, "dateModified" : "2026-10-03T07:47:32.857Z", "datePublished" : "2025-10-18T02:46:42.000Z", "headline" : "What Is Cisco SD-Access Fabric? SDA Explained", "image" : [ "https://blog.iptel.com.au/hubfs/Blogs/What%20is%20Cisco%20SDA/What%20is%20Cisco%20SDA_%20(Instagram).png" ], "mainEntityOfPage" : { "@id" : "https://blog.iptel.com.au/what-is-sda-fabric", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.iptel.com.au/hubfs/IPTel_Solutions_February2020%20-%20Header%20SiteMap/Images/IPTellogo-byline-2020-dark-v2.png" }, "name" : "IPTel Solutions Pty Ltd" } } ```