Underlay, Overlay, and Fabric in Controller-Based Networks

The underlay is the physical network and the IP routing that makes every device in it reachable. The overlay is a virtual topology built on top by encapsulating traffic in tunnels that ride across the underlay. The fabric is the two together plus the control plane that tracks where endpoints are and the policy layer deciding who may talk to whom. Separating those terms is the foundation for every SD-Access question the exam asks. Material published before August 2024 describes an older blueprint, so check the objectives version 1.1 added against whatever book or course you are working from.

The underlay

The underlay is switches, routers, and cabling running a routing protocol whose only job is to give every fabric node a route to every other fabric node’s loopback address. Cisco’s automated deployment provisions IS-IS; a manually built underlay can use OSPF in a single area. What matters is that it converges quickly, carries no endpoint subnets, and stays stable.

Two underlay properties are load-bearing. Equal-cost paths carry load sharing, since tunnelled traffic hashes across them, which is one reason data center underlays are cabled as a spine-leaf fabric. And MTU has to be raised (9100 bytes is common) because encapsulation adds a header to every packet, and an underlay sized for 1500-byte frames will fragment or drop it.

A device that routes encapsulated packets between fabric nodes without participating in the overlay is an intermediate node. It knows nothing of endpoints, terminates no tunnels, and enforces no policy.

The overlay

The overlay is a logical topology whose links are tunnels. Two fabric nodes four physical hops apart look adjacent from the overlay’s point of view, because traffic between them is wrapped in an outer header, routed across the underlay, and unwrapped at the far end.

Cisco SD-Access uses VXLAN (Virtual Extensible LAN) for that encapsulation, carrying the original Ethernet frame inside a UDP packet (MAC-in-UDP) on destination port 4789. Its segment identifier, the VNI (VXLAN Network Identifier), is 24 bits, giving roughly 16 million segments against the 4,094 usable VLAN IDs a 12-bit 802.1Q tag allows, which is why overlays scale where VLANs do not. SD-Access uses a variant, VXLAN-GPO, whose header also carries the endpoint’s policy group so enforcement travels with the packet.

Something must know which fabric node currently serves a given endpoint. In SD-Access that is LISP (Locator/ID Separation Protocol), which splits an endpoint’s identity (the EID, endpoint identifier) from its location (the RLOC, routing locator) and keeps a mapping database between the two.

	Underlay	Overlay
What it is	physical devices, links, and IP routing	virtual topology of tunnels
Typical protocol	IS-IS or OSPF	VXLAN encapsulation, LISP control plane
What it carries	reachability between fabric node loopbacks	endpoint traffic and policy group information
Addressing visible in it	infrastructure and loopback addresses	endpoint addresses
Effect of endpoint moves	none	mapping database is updated

SD-Access node roles

Four roles carry the fabric, and exam items lean heavily on telling them apart.

Control plane node. Owns the host-tracking database mapping each endpoint identifier to the fabric node currently serving it. Edge nodes register the endpoints they see, and other nodes query it to learn where to send encapsulated traffic. It is a lookup service, not a forwarding boundary.

Edge node. The access layer of the fabric, where endpoints attach. It authenticates them, registers them into the control plane node’s database, and encapsulates and decapsulates their traffic, keeping only its own local view.

Border node. The fabric’s exit and entry point, connecting it to the data center, the WAN, the Internet, and any other external routing domain. Traffic leaving is decapsulated there and handed to the external network; traffic arriving from outside is encapsulated for delivery inside. The border consults the mapping database rather than owning it.

Fabric-enabled wireless LAN controller. Registers wireless clients into the same host-tracking database wired endpoints use, giving both a single policy model. Access points build VXLAN tunnels to their edge node, so client traffic enters the fabric data plane directly instead of being tunnelled back to the controller over the controller’s own ports and interfaces.

One physical device can hold several roles in a small deployment, but the roles stay conceptually distinct.

Group-based policy

In a traditional design, an access rule is written against IP addresses or subnets, so identity is inferred from location. Extended ACLs matching a device type’s subnet break the moment addressing changes or a device roams, and they must be maintained on every access switch. VLAN-based separation shares the defect: it ties identity to where a device plugged in.

Fabric policy inverts that. The identity service (Cisco Identity Services Engine) assigns each endpoint a scalable group at the moment it authenticates. The group describes what the endpoint is, a guest IoT sensor or a clinical workstation, and travels with it wherever it later connects. Policy is written between groups, so a rule barring one group from reaching another keeps its meaning after a device roams to another building or picks up an address from a different pool.

Three consequences follow. Renumbered or overlapping address space does not break the rules. A move requires no rule rewrite. And enforcement happens at the fabric nodes inside the campus, not at a perimeter firewall that never sees traffic between two endpoints on the same fabric.

The fallback for devices that cannot authenticate is a static group assignment on the switch port, normal for a few device classes but a model that reattaches identity to a cable.

SD-WAN

Cisco SD-WAN applies the same split to the wide area. The underlay becomes whatever transport a site can buy: MPLS, broadband Internet, 4G or 5G. The overlay is a mesh of IPsec tunnels across all of them, making the design transport-independent, since an application policy does not care which circuit carries it.

Four components at CCNA depth:

• vManage is the management plane, a single dashboard for configuration, monitoring, and troubleshooting.
• vSmart is the control plane. Routers peer with it using OMP (Overlay Management Protocol) to exchange routes, tunnel endpoints, and policy, rather than peering with each other.
• vBond is the orchestrator that authenticates devices and introduces them to the other controllers, and it must be reachable at a public address so devices behind NAT can find it.
• cEdge and vEdge routers are the data plane at each site, building tunnels and forwarding traffic.

Application-aware routing policy is defined once in the controller and distributed, instead of being configured hop by hop. Where Catalyst Center fits among controllers is covered in how automation changes network management.

How the 200-301 exam tests this

• A role-identification item describes a function (holding the endpoint-to-location database, connecting the fabric to external networks, attaching endpoints) and asks which node performs it. Control plane, border, and edge respectively, with the fabric-enabled WLC as a fourth option because it registers clients into that database without hosting it.
• A policy scenario gives two device types that roam, may overlap in address space, and must be kept apart without rewriting rules. That points to group assignment at authentication, against distractors of subnet ACLs, VLAN separation, and SSID filtering at a firewall.
• An item asks when and how an endpoint receives its group. The identity service assigns it during authentication and it travels with the endpoint. Deriving it from a subnet, fixing it in a port configuration, or sending it in a DHCP option all fail for one reason: they reattach policy to location.
• A definition item asks what distinguishes underlay from overlay. The underlay routes between infrastructure addresses, the overlay tunnels endpoint traffic across it, and a device that only forwards encapsulated packets is an intermediate node with no overlay role.

Four node roles and three layer terms cover nearly every item, and a set of practice questions will show you which pairings still slip.

Quick reference

• Underlay: physical devices plus IP routing (IS-IS or OSPF) reaching every fabric node loopback. Raise MTU for encapsulation overhead.
• Overlay: tunnels. SD-Access encapsulates with VXLAN (MAC-in-UDP, port 4789) and identifies segments with a 24-bit VNI.
• Fabric: underlay plus overlay plus the control plane and policy layer.
• Control plane node owns the endpoint-to-fabric-node mapping database.
• Edge node is where endpoints attach, register, and get encapsulated.
• Border node is the fabric’s connection to external networks, decapsulating traffic on exit.
• Intermediate node is underlay transit only, with no overlay role.
• Fabric-enabled WLC registers wireless clients into that same database.
• Group-based policy assigns a scalable group at authentication, so rules survive roaming and renumbering.
• SD-WAN: vManage manages, vSmart runs OMP, vBond onboards, cEdge and vEdge forward.