Examkin

Software-Defined Architectures: Overlay, Underlay, and Fabric

29 questions

All types29Multiple choice14Multiple select8Matching7
Question 1Question →

An enterprise network implements a Cisco Software-Defined Access (SD-Access) fabric architecture across a routed Layer 3 campus backbone running OSPF. Host A (10.1.10.15) attached to Fabric Edge 1 initiates unicast communication with Host B (10.1.10.22) attached to Fabric Edge 2 across the fabric overlay. Which statement correctly describes the operation and interaction of the underlay and overlay network components during packet transmission?

Show answer & explanation

Answer: Fabric Edge 1 queries the LISP Control Plane Node to resolve Host B's location, then encapsulates the frame in VXLAN using its own RLOC as the outer source IP and Fabric Edge 2's RLOC as the outer destination IP for underlay routing.

Answer

Fabric Edge 1 queries the LISP Control Plane Node to resolve Host B's location, then encapsulates the frame in VXLAN using its own RLOC as the outer source IP and Fabric Edge 2's RLOC as the outer destination IP for underlay routing.
Software-Defined Access architectures separate control plane and data plane functions across underlay and overlay networks. LISP acts as the control plane to map Endpoint Identifiers (EIDs) to Routing Locators (RLOCs). VXLAN acts as the data plane encapsulation mechanism, wrapping the original inner Layer 2 frame inside an outer IP packet addressed from the source RLOC to the destination RLOC. The underlay network uses standard Layer 3 IP routing (such as OSPF) to transport the outer VXLAN packet across the physical topology.

Step-by-Step Solution

1
Identify the role of the fabric Control Plane (LISP)
Fabric Edge 1 queries the LISP Control Plane Node (Map-Server/Map-Resolver) to map the destination Endpoint Identifier (EID, Host B IP/MAC) to its corresponding Routing Locator (RLOC, Fabric Edge 2 IP).
The fabric overlay relies on control plane mapping to locate endpoints dynamically across the fabric.
2
Identify the role of the fabric Data Plane (VXLAN)
Fabric Edge 1 encapsulates the original Ethernet frame into a VXLAN packet, adding an outer UDP header and outer IP header containing source RLOC (Fabric Edge 1) and destination RLOC (Fabric Edge 2).
VXLAN provides Layer 2 over Layer 3 encapsulation, allowing overlay subnet extensions over an IP underlay.
3
Identify the role of the Underlay Network (IP/OSPF)
Intermediate underlay switches forward the packet strictly using standard Layer 3 destination IP routing based on the outer IP header (Fabric Edge 2's RLOC).
The underlay network's sole responsibility is providing unicast/multicast IP reachability between RLOCs.

Key Concept

SDN Fabric Architecture: LISP Control Plane, VXLAN Overlay Data Plane, and IP Underlay Separation
Question 2Question →

In a Cisco Software-Defined Access (SD-Access) solution, an enterprise deploys a Layer 3 routed underlay network using OSPF to establish IP reachability between Routing Locator (RLOC) interfaces. During testing, host data packets transmitted between different fabric edge switches fail whenever the payload size approaches 1500 bytes. Analysis shows that packet payload expansion is occurring because host frames are encapsulated with outer IP and UDP headers before entering the physical transport. Which protocol and architectural layer are responsible for performing this data plane encapsulation?

Show answer & explanation

Answer: Virtual Extensible LAN (VXLAN) operating at the overlay layer

Answer

Virtual Extensible LAN (VXLAN) operating at the overlay layer
The correct option correctly identifies VXLAN operating at the overlay layer. In Cisco SD-Access architectures, VXLAN is employed as the data plane encapsulation mechanism. It encapsulates original Ethernet frames into UDP-based packets (using UDP port 4789) to transport Layer 2 and Layer 3 virtual networks across an IP-only underlay. This encapsulation adds header overhead (typically 50 bytes), requiring the underlay physical network to support an increased MTU (jumbo frames).

Step-by-Step Solution

1
Differentiate between the underlay and overlay architectural components in Cisco SD-Access.
The underlay consists of physical routers/switches and an IGP (such as OSPF or IS-IS) providing IP connectivity between switch loopback interfaces (RLOCs). The overlay represents the virtual network built on top of the underlay.
Understanding the separation of underlay and overlay is necessary to determine which layer manages data encapsulation.
2
Identify the specific roles of LISP and VXLAN in the SD-Access fabric.
LISP operates as the fabric control plane mapping database (mapping EID to RLOC). VXLAN operates as the fabric data plane protocol.
LISP manages location/identity queries while VXLAN encapsulates actual host data traffic into UDP frames.
3
Analyze the cause of payload expansion and MTU issues.
VXLAN wraps the original Layer 2 Ethernet frame inside outer IP, UDP, and VXLAN headers. This adds approximately 50 bytes of overhead, causing frames near 1500 bytes to exceed standard MTU unless jumbo frames are enabled in the underlay.
VXLAN encapsulation at the overlay layer directly causes the payload expansion described in the scenario.

Key Concept

Software-Defined Architecture: Overlay vs Underlay Roles and VXLAN Data Plane Encapsulation
Estimated Time:2m 0s
Question 3Question →

An enterprise network engineer is designing a software-defined fabric infrastructure using Cisco SD-Access concepts. The design requires establishing IP reachability between physical switches, encapsulating tenant traffic across the fabric, and maintaining a dynamic endpoint location database. Which two statements accurately describe the operational responsibilities of the underlay and overlay network components in this architecture?

Select all that apply

Show answer & explanation

Answer: The underlay network relies on interior gateway protocols such as IS-IS or OSPF to provide IP connectivity between fabric node loopback addresses (RLOCs).; The overlay data plane uses VXLAN encapsulation to transport Layer 2 Ethernet frames and Layer 3 IP packets over the Layer 3 underlay infrastructure.

Answer

The underlay network relies on interior gateway protocols such as IS-IS or OSPF to provide IP connectivity between fabric node loopback addresses, and the overlay data plane uses VXLAN encapsulation to transport Layer 2 Ethernet frames and Layer 3 IP packets over the Layer 3 underlay infrastructure.
In software-defined campus fabric architectures like Cisco SD-Access, the underlay consists of physical switches and routers configured with a Layer 3 routing protocol (such as IS-IS or OSPF) to ensure complete IP reachability between fabric nodes (Routing Locators / RLOCs). The overlay network abstracts virtual networks above this underlay; specifically, the overlay data plane utilizes Virtual Extensible LAN (VXLAN) encapsulation to encapsulate Layer 2 Ethernet frames and Layer 3 IP packets inside UDP packets, forwarding them across the Layer 3 underlay.

Step-by-Step Solution

1
Analyze the underlay network responsibilities.
Identified that the underlay provides physical Layer 3 IP reachability between fabric nodes (RLOCs) using standard routing protocols like IS-IS or OSPF.
Overlay encapsulation (VXLAN) requires underlying IP connectivity between tunnel endpoints.
2
Analyze the overlay network data plane responsibilities.
Identified that VXLAN encapsulates original host frames with a UDP outer header to carry Layer 2/3 traffic across the routed underlay.
Overlay encapsulation decouples host connectivity and virtual networks from the underlying physical topology.
3
Evaluate and eliminate incorrect distractor options.
Disqualified options that misattribute physical port attributes to the overlay, confuse LISP control plane functionality with underlay routing, or misidentify trunking mechanics.
Clear functional separation exists: underlay manages physical reachability, overlay manages virtual encapsulation and endpoint mapping.

Key Concept

Software-Defined Architecture Component Separation (Underlay vs. Overlay)
Estimated Time:2m 0s
Question 4Question →

A network engineer is auditing a campus software-defined fabric infrastructure. During a traffic flow trace between two endpoints residing in different subnets, the engineer notes that the ingress fabric edge switch must resolve the location of a remote Endpoint Identifier (EID) to a destination Routing Locator (RLOC) IP address before encapsulating the frame. Which protocol and architectural layer are directly responsible for maintaining and querying this mapping database?

Show answer & explanation

Answer: Locator/ID Separation Protocol (LISP) operating at the fabric control plane layer

Answer

Locator/ID Separation Protocol (LISP) operating at the fabric control plane layer
The correct answer identifies LISP at the fabric control plane layer. In Cisco SD-Access fabric architectures, LISP acts as the control plane tracking system. It maintains a database mapping host addresses (Endpoint Identifiers or EIDs) to the IP addresses of the edge switches to which they are attached (Routing Locators or RLOCs).

Step-by-Step Solution

1
Identify the requirement in the scenario
The scenario describes looking up an Endpoint Identifier (EID) to find its corresponding Routing Locator (RLOC) IP address.
Before an ingress fabric edge switch can encapsulate customer traffic into VXLAN headers, it must query the mapping database to identify the remote edge node where the target destination host is currently registered.
2
Map the operation to the SDN architectural component
LISP serves as the control plane protocol that manages the map-server/map-resolver database in SD-Access fabrics.
LISP separates endpoint identity (EID) from network location (RLOC), allowing efficient lookup and tracking of host mobility across the fabric overlay.
3
Differentiate control plane, overlay data plane, and underlay transport
The control plane handles EID-to-RLOC mappings (LISP), the overlay data plane handles packet encapsulation (VXLAN), and the underlay transport handles physical IP routing (OSPF/IS-IS).
Understanding the distinct separation of duties prevents misattributing control database functions to data plane encapsulation or underlay routing protocols.

Key Concept

Separation of Underlay Routing, Overlay Encapsulation, and Fabric Control Plane Mapping in Software-Defined Architectures
Question 5Question →

Match each Cisco Software-Defined Architecture component or protocol on the left with its corresponding architectural role or operational function on the right.

Click a left item, then click its matching right item

Items

Physical Routed Underlay
VXLAN Overlay Data Plane
LISP Fabric Control Plane
Fabric Edge Node

Matches

Show answer & explanation

Answer

The Physical Routed Underlay provides transport IP reachability via traditional routing protocols; the VXLAN Overlay Data Plane encapsulates data frames into UDP packets; the LISP Fabric Control Plane manages the mapping database between Endpoint Identifiers (EIDs) and Routing Locators (RLOCs); and the Fabric Edge Node authenticates endpoints and initiates overlay encapsulation.
In software-defined fabric architectures, responsibilities are strictly divided: the physical routed underlay provides IP transport for fabric nodes using standard IGPs; VXLAN handles data plane encapsulation of user traffic into UDP tunnels; LISP acts as the control plane to map host identities (EIDs) to switch locations (RLOCs); and Fabric Edge nodes interface directly with endpoints to perform authentication and overlay encapsulation.

Step-by-Step Solution

1
Identify the primary role of the Physical Routed Underlay.
Determined that the underlay strictly provides underlying IP reachability between switch loopback interfaces using standard IGPs.
The underlay infrastructure provides basic packet transport between fabric switches and operates independently of overlay endpoints.
2
Identify the function of the VXLAN Overlay Data Plane.
Matched VXLAN to data plane encapsulation of Layer 2 frames within UDP port 4789 headers.
VXLAN is the data plane encapsulation standard used in modern software-defined fabrics to tunnel endpoint traffic over an IP underlay.
3
Identify the function of the LISP Fabric Control Plane.
Matched LISP to the control plane tracking mechanism that maps EID host addresses to RLOC switch addresses.
LISP eliminates the need for broadcast-based flood-and-learn mechanisms by maintaining an explicit mapping database of host locations.
4
Identify the operational responsibilities of the Fabric Edge Node.
Matched the Fabric Edge Node to connecting, authenticating, and encapsulating endpoint traffic into the fabric overlay.
Fabric Edge nodes act as first-hop access switches where endpoints connect and where overlay tunnel encapsulation originates.

Key Concept

Software-Defined Fabric Architecture: Separation of Underlay, Overlay Data Plane, Control Plane, and Edge Roles
Estimated Time:2m 0s
Question 6Question →

An enterprise network administrator deploys a Cisco SD-Access fabric overlay using VXLAN for data plane encapsulation over an OSPF-based Layer 3 routed underlay network. During validation, control plane communication between the LISP Control Plane Node and Fabric Edge switches operates normally, and all underlay loopback interfaces show full ping reachability. However, host endpoints in different subnets attached to separate Fabric Edge switches fail to communicate, with packet captures revealing that encapsulated data packets are dropped by transit routers along the underlay path. Which underlay infrastructure condition is causing this traffic delivery failure?

Show answer & explanation

Answer: The Maximum Transmission Unit (MTU) on intermediate underlay router interfaces is set to 1500 bytes, causing VXLAN encapsulated frames with DF flags set to be dropped.

Answer

The MTU on intermediate underlay router interfaces is configured to the standard 1500-byte limit without accounting for VXLAN encapsulation overhead, leading to packet drops along the routed transit path.
In software-defined fabric architectures using VXLAN encapsulation (such as Cisco SD-Access), outer headers add at least 50 bytes of overhead to every packet transmitted between Fabric Edge nodes. Because VXLAN packets typically set the Don't Fragment (DF) bit in the outer IP header, intermediate underlay routers with a standard 1500-byte MTU cannot forward packets exceeding 1500 bytes and will drop them. Therefore, the underlay network interfaces must be configured with an elevated MTU (e.g., 9000 bytes for jumbo frames or at least 1550 bytes) to accommodate the overlay encapsulation.

Step-by-Step Solution

1
Analyze the role of the underlay and overlay components in a fabric architecture.
The underlay provides Layer 3 IP reachability between Fabric Edge loopback interfaces (RLOCs). The overlay uses VXLAN encapsulation to tunnel Layer 2/Layer 3 payload between endpoints.
Understanding the separation of underlay transport and overlay encapsulation isolates where packet processing issues occur.
2
Calculate the header overhead introduced by VXLAN encapsulation.
VXLAN encapsulation adds an outer UDP header (8 bytes), VXLAN header (8 bytes), outer IP header (20 bytes), and outer Ethernet header (14 bytes), totaling 50 bytes of additional encapsulation header.
A standard 1500-byte IP packet becomes 1550 bytes after VXLAN encapsulation.
3
Determine the impact of underlay interface MTU on encapsulated packets with Don't Fragment (DF) bits set.
If transit underlay interfaces retain the default 1500-byte MTU, any 1500-byte host payload encapsulated in a 1550-byte VXLAN packet will exceed the MTU and be dropped by underlay routers.
To support VXLAN fabric overlay traffic, all underlay routed links and switch interfaces must have jumbo frames or an increased MTU (minimum 1550–1600 bytes, typically 9000 bytes) configured.

Key Concept

Underlay MTU Requirements for VXLAN Overlay Encapsulation
Estimated Time:2m 0s
Question 7Question →

An enterprise network implements a Cisco Software-Defined Access (SD-Access) solution where two endpoints residing on different IP subnets communicate across a campus fabric. Fabric Edge Switch 1 encapsulates packets from Endpoint A destined for Endpoint B on Fabric Edge Switch 2. Which two statements correctly describe the operational roles and behaviors of the underlay and overlay networks during this communication flow?

Select all that apply

Show answer & explanation

Answer: The underlay network uses standard Layer 3 routing protocols to provide IP reachability exclusively between the Routing Locator (RLOC) addresses of the fabric edge nodes.; The overlay network encapsulates original host packets inside VXLAN headers containing outer source and destination IP addresses corresponding to the fabric edge RLOCs.

Answer

The correct statements are that the underlay network provides Layer 3 IP reachability strictly between fabric edge node Routing Locators (RLOCs) using standard routing protocols, and the overlay network encapsulates host frames using VXLAN with outer IP headers addressing those RLOCs.
In a Cisco SD-Access fabric, the underlay network is responsible solely for providing robust Layer 3 IP connectivity between fabric node loopback addresses, known as Routing Locators (RLOCs). The overlay network abstracts endpoint traffic by using VXLAN encapsulation at the ingress fabric edge node, wrapping the original packet inside an outer IP header directed to the egress fabric edge node's RLOC.

Step-by-Step Solution

1
Identify the primary responsibility of the underlay network in a software-defined fabric.
The underlay consists of physical switches, routers, and Layer 3 links running an IGP (such as IS-IS or OSPF) to establish IP reachability between node loopbacks (RLOCs).
The underlay functions purely as a IP transport mechanism for outer tunnel traffic without tracking endpoint host routes or overlay VLANs.
2
Analyze how the overlay data plane handles host packet transport across the fabric.
Fabric Edge Switch 1 acts as a VXLAN Tunnel Endpoint (VTEP), wrapping the host's original Layer 2 frame/Layer 3 packet into a VXLAN header and outer UDP/IP header with source RLOC of Edge 1 and destination RLOC of Edge 2.
VXLAN encapsulation isolates endpoint addressing (EIDs) from the physical topology and enables virtualized Layer 2 and Layer 3 overlays.
3
Evaluate intermediate underlay device functions to eliminate incorrect options.
Intermediate core/distribution switches in the underlay route packets based solely on the outer IP header (destination RLOC). They do not run LISP, decapsulate VXLAN, or inspect inner MAC/IP headers.
Maintaining clear separation between underlay transport routing and overlay control/data plane operations keeps the network core simple, scalable, and stateless regarding endpoints.

Key Concept

Underlay vs. Overlay Separation in SDN Fabric Architectures
Question 8Question →

A network operations team is reviewing the architectural layers of a newly deployed software-defined campus fabric. They need to ensure that the physical infrastructure properly supports endpoint encapsulation and tunneled communication across the fabric. Which of the following best describes the primary function of the underlay network in this software-defined architecture?

Show answer & explanation

Answer: Providing underlying physical IP connectivity and routing between fabric nodes using protocols like OSPF or IS-IS to transport overlay packets

Answer

Providing underlying physical IP connectivity and routing between fabric nodes using protocols like OSPF or IS-IS to transport overlay packets
The correct option accurately identifies the underlay network's role: establishing baseline physical layer IP reachability and routing across switches using traditional routing protocols (e.g., OSPF, IS-IS), allowing overlay encapsulated packets to be transported between nodes.

Step-by-Step Solution

1
Identify the role of the Underlay layer in an SDN fabric
The underlay consists of physical switches, routers, cabling, and routing protocols responsible purely for point-to-point IP connectivity between nodes.
Without reliable IP reachability provided by the underlay, overlay tunneling protocols (such as VXLAN) cannot form tunnels between endpoints (VTEPs).
2
Distinguish Underlay responsibilities from Overlay responsibilities
The overlay handles network virtualization, encapsulation (e.g., VXLAN), and mapping (e.g., LISP), running on top of the underlay infrastructure.
Clear separation between underlay transport and overlay service delivery allows overlay networks to scale independently of the physical topology.

Key Concept

Underlay vs. Overlay in Software-Defined Architectures
Question 9Question →

Match each software-defined architecture component or protocol on the left with its corresponding operational role within a Cisco enterprise fabric on the right.

Click a left item, then click its matching right item

Items

VXLAN
LISP
Underlay Network
Cisco DNA Center

Matches

Show answer & explanation

Answer

VXLAN pairs with data plane frame encapsulation via UDP tunnels; LISP pairs with control plane mapping of EIDs to RLOCs; Underlay Network pairs with physical connectivity and Layer 3 IP routing reachability; Cisco DNA Center pairs with centralized management plane orchestration and policy automation.
VXLAN handles data plane encapsulation by tunneling Layer 2 Ethernet frames over Layer 3 UDP headers. LISP functions as the fabric control plane mapping protocol connecting EIDs to RLOCs. The underlay network consists of the physical devices and IP routing protocols that provide base reachability across switches. Cisco DNA Center serves as the centralized management controller responsible for network automation, provisioning, and policy management.

Step-by-Step Solution

1
Identify the data plane overlay tunneling mechanism.
VXLAN uses MAC-in-UDP encapsulation to build overlay tunnels across Layer 3 boundaries.
Overlay data planes require encapsulating original host frames so they can cross intermediate routed infrastructure transparently.
2
Identify the control plane protocol responsible for host mapping.
LISP maintains the mapping database connecting host IP/MAC addresses (EIDs) to their switch location (RLOCs).
Separating host location from identity minimizes flooding and enables endpoint mobility.
3
Identify the infrastructure base supporting overlay communication.
The underlay network provides basic IP routing connectivity between physical switch interfaces.
Fabric nodes must establish IP reachability via IGP routing protocols prior to forming overlay tunnels.
4
Identify the centralized management platform.
Cisco DNA Center manages policy, orchestration, and provisioning across the fabric.
Management plane platforms aggregate controller operations into a single interface for intent-based network management.

Key Concept

Software-Defined Architectures: Overlay, Underlay, and Fabric plane separation
Question 10Question →

A network engineer is auditing a enterprise Software-Defined Access (SD-Access) fabric deployment where endpoint devices in different subnets communicate across the campus network. During a traffic flow analysis, the engineer notes that Layer 2 Ethernet frames are encapsulated into VXLAN packets at the edge switches before transport. Which function represents the primary operational responsibility of the underlying network (underlay) in this architecture?

Show answer & explanation

Answer: Providing IP reachability and routing between physical fabric nodes and Tunnel Endpoints (VTEPs)

Answer

The primary operational responsibility of the underlay network is providing IP reachability and routing between physical fabric nodes and Tunnel Endpoints (VTEPs).
The underlay network provides the physical infrastructure and Layer 3 unicast routing (using protocols such as IS-IS or OSPF) to establish reliable IP reachability between physical fabric devices and VTEP/RLOC interfaces.

Step-by-Step Solution

1
Define the role of the Underlay network in Software-Defined Architectures
The underlay is the physical infrastructure (switches, routers, links) and Layer 3 routing protocols (e.g., OSPF, IS-IS, BGP) that supply IP connectivity.
Without underlay IP reachability, overlay tunnels cannot be established between endpoints.
2
Differentiate Underlay transport from Overlay encapsulation and control functions
Overlay handles VXLAN encapsulation, LISP EID-to-RLOC mappings, and virtual network segmentations. The underlay only routes standard IP packets between the VTEP/RLOC loopback addresses.
Clear separation between underlay transport and overlay virtual networks is a fundamental SDN concept.

Key Concept

Underlay vs. Overlay Responsibilities in SDN Fabrics
Question 11Question →

A network administrator is implementing a Cisco Software-Defined Access (SD-Access) architecture across an enterprise network campus. Which two operational characteristics are specific functions of the fabric overlay network rather than the underlay network? (Select two.)

Select all that apply

Show answer & explanation

Answer: Encapsulating user data traffic into VXLAN packets to maintain logical Layer 2 and Layer 3 virtual network boundaries across the fabric.; Maintaining a control plane mapping database using LISP to map endpoint identifiers to their current routing locator addresses.

Answer

The two correct overlay functions are encapsulating user data traffic into VXLAN packets to maintain logical network boundaries, and using LISP to map endpoint identifiers (EIDs) to routing locators (RLOCs).
In software-defined architectures (such as Cisco SD-Access), the overlay network creates logical virtual networks over the physical topology. The data plane uses VXLAN encapsulation to carry Layer 2 Ethernet frames and Layer 3 IP packets wrapped in UDP headers between fabric nodes. The control plane uses LISP (Locator/ID Separation Protocol) to manage the mapping database connecting Endpoint Identifiers (EIDs) to Routing Locators (RLOCs).

Step-by-Step Solution

1
Differentiate between the roles of underlay and overlay networks in an SDN fabric architecture.
The underlay provides physical interconnectivity and routing reachability between fabric nodes (RLOCs), while the overlay builds virtual networks on top of the underlay.
Clear layer separation is required to identify which protocols and mechanisms belong to the overlay layer.
2
Identify the data plane and control plane encapsulation mechanisms used by the SD-Access overlay.
VXLAN provides Layer 2 and Layer 3 overlay data plane encapsulation, and LISP provides overlay control plane location/identity separation mapping.
VXLAN and LISP are the defining overlay protocols in Cisco SD-Access.

Key Concept

Overlay vs. Underlay Roles in SDN Fabrics
Question 12Question →

During the deployment of an enterprise Cisco Software-Defined Access (SD-Access) fabric, a network engineer must ensure that all fabric edge and control plane switches can exchange IP packets directly. Traditional Layer 3 routing protocols such as OSPF or IS-IS are configured across the physical switch interconnects to establish transport reachability for tunnel endpoints. Which architectural layer is defined by this underlying physical IP routing infrastructure?

Show answer & explanation

Answer: The underlay network

Answer

The underlay network
The underlay network consists of the physical routers, switches, and links operating traditional Layer 3 interior gateway protocols (such as IS-IS or OSPF). Its primary purpose in an SDN fabric architecture is to supply robust, highly available IP reachability between all fabric nodes (VTEPs/RLOCs) so that overlay tunnels can be established.

Step-by-Step Solution

1
Analyze the role of physical IP routing in software-defined network architectures.
Identify that physical switches and Layer 3 routing protocols establish basic IP connectivity between network devices.
Before virtual tunnels can form, physical devices must be able to reach each other via IP.
2
Differentiate between underlay, overlay, and control plane layers.
Confirm that the physical topology and routing protocol layer (OSPF/IS-IS/BGP) is called the underlay network.
The underlay provides the foundational IP transport upon which overlay encapsulation protocols (like VXLAN) operate.

Key Concept

Software-Defined Architecture: Underlay vs. Overlay
Question 13Question →

Associate each software-defined network component on the left with its primary architectural function within a Cisco enterprise campus fabric on the right.

Click a left item, then click its matching right item

Items

Underlay Network
VXLAN Header
LISP Map-Server / Map-Resolver
Fabric Edge Node

Matches

Show answer & explanation

Answer

Underlay Network matches physical L3 IP reachability provider; VXLAN Header matches VNI and group policy tag carrier; LISP Map-Server / Map-Resolver matches central database mapping EIDs to RLOCs; Fabric Edge Node matches onboarding end devices and operating as a VTEP.
Each software-defined component occupies a distinct layer: the Underlay Network handles physical Layer 3 routing between nodes; the VXLAN Header encapsulates data packets with Virtual Network Identifiers (VNIs); the LISP Map-Server/Map-Resolver functions as the control plane tracking host EIDs to switch RLOCs; and the Fabric Edge Node connects endpoints while acting as a VTEP.

Step-by-Step Solution

1
Identify Underlay Network role
Recognized that the underlay provides physical infrastructure connectivity using standard L3 routing protocols.
Overlay encapsulation requires basic underlying IP routing between transport nodes.
2
Identify VXLAN Header role
Recognized VXLAN as the data plane encapsulation mechanism carrying VNIs.
VXLAN encapsulates Layer 2 Ethernet frames inside UDP packets across the overlay.
3
Identify LISP Map-Server / Map-Resolver role
Recognized LISP as the control plane mapping protocol tracking host locations.
LISP decouples host identity (EID) from host location (RLOC) to eliminate ARP flooding.
4
Identify Fabric Edge Node role
Recognized Fabric Edge as the ingress/egress boundary device acting as a VTEP.
Edge nodes interface between traditional end-user endpoints and the fabric overlay.

Key Concept

Distinguishing roles across Underlay transport, VXLAN data plane encapsulation, LISP control plane mapping, and Fabric Edge VTEPs
Question 14Question →

An enterprise network is deploying a Cisco Software-Defined Access (SD-Access) architecture. The network engineering team needs to configure routing protocols to ensure physical IP reachability among all switch loopback addresses used as Routing Locators (RLOCs). Which architectural layer is specifically responsible for establishing this underlying Layer 3 transport infrastructure?

Show answer & explanation

Answer: Underlay network

Answer

The underlay network is responsible for providing foundational physical Layer 3 IP reachability between all fabric nodes.
The underlay network consists of the physical network hardware, interconnecting links, and Layer 3 routing protocols (such as OSPF, IS-IS, or BGP) configured to ensure complete unicast IP reachability between all fabric nodes and RLOC interfaces. It serves as the physical backbone required to transport overlay encapsulated traffic.

Step-by-Step Solution

1
Identify the requirement described in the scenario
The requirement asks for the network component providing physical IP routing reachability among switch loopback interface addresses (RLOCs).
Before overlay tunnels can be established, physical IP connectivity must be established across the hardware devices.
2
Compare the roles of underlay, overlay, fabric control plane, and data plane encapsulation
The underlay network uses standard IGP routing (like OSPF or IS-IS) to route IP packets between physical devices and RLOCs. The overlay network operates on top of the underlay.
Without the underlay providing IP connectivity, VXLAN encapsulation and LISP control plane communication cannot function.

Key Concept

Distinction between Underlay Network, Overlay Network, and Fabric Control Plane in Software-Defined Architectures
Question 15Question →

An network administrator is designing a fabric-based Software-Defined Access (SD-Access) solution for a remote branch campus. Which two operational characteristics specifically describe the role and function of the underlay network within this architecture? (Select two.)

Select all that apply

Show answer & explanation

Answer: It provides physical Layer 3 IP reachability between all network devices, such as fabric edge and control plane nodes.; It relies on standard IGP routing protocols (such as IS-IS or OSPF) to transport IP packets between routed interfaces.

Answer

The underlay network provides physical Layer 3 IP reachability between all nodes and relies on standard IGP routing protocols (such as IS-IS or OSPF) to transport IP packets across physical interfaces.
The underlay network forms the physical foundation of an SDN fabric. Its primary purpose is to provide robust, high-availability Layer 3 IP reachability between all participating fabric nodes using standard Interior Gateway Protocols (IGPs) such as IS-IS or OSPF.

Step-by-Step Solution

1
Define the primary responsibility of the underlay network in SDN architectures.
The underlay consists of physical switches, routers, and links configured to ensure basic Layer 3 unicast reachability between all network infrastructure nodes.
Overlay services like VXLAN tunneling and LISP lookup require dependable IP reachability between Tunnel Endpoints (RLOCs).
2
Identify protocols operating at the underlay layer versus the overlay layer.
Underlay uses traditional routing protocols (OSPF, IS-IS, BGP) to transport IP packets, while overlay uses protocols such as VXLAN for encapsulation and LISP for mapping.
Distinguishing between physical IP transport (underlay) and virtualized service encapsulation (overlay) clarifies architectural boundaries.

Key Concept

Underlay vs. Overlay Architecture in Software-Defined Fabrics
Question 16Question →

A network operations engineer is validating traffic transport across an enterprise Cisco Software-Defined Access (SD-Access) campus environment. The underlying physical switches use IS-IS routing to maintain full IP reachability between switch loopback interfaces. Which statement accurately describes how the underlay and overlay components interact during frame forwarding between endpoints?

Show answer & explanation

Answer: The underlay network provides basic IP reachability between switch loopback interfaces (RLOCs), while the overlay network uses VXLAN encapsulation to tunnel endpoint frames across the underlay.

Answer

The underlay network provides basic IP reachability between switch loopback interfaces (RLOCs), while the overlay network uses VXLAN encapsulation to tunnel endpoint frames across the underlay.
In software-defined network (SDN) architectures such as Cisco SD-Access, the underlay consists of physical hardware devices interconnected via robust Layer 3 routing protocols (OSPF, IS-IS, BGP) that guarantee IP connectivity between Routing Locators (RLOCs/VTEPs). The overlay operates logically above this underlay, encapsulating endpoint data frames into VXLAN headers to deliver virtualized networks across the physical infrastructure.

Step-by-Step Solution

1
Identify the primary function of the underlay network in a software-defined fabric.
The underlay consists of physical switches, routers, and IP routing protocols (such as OSPF or IS-IS) establishing unicast IP reachability between fabric nodes.
Underlay routing provides the underlying transport infrastructure needed for tunnel end-points (VTEPs / RLOCs) to communicate.
2
Identify the primary function of the overlay network.
The overlay creates logical tunnels over the underlay using encapsulation protocols such as VXLAN.
Encapsulating endpoint traffic inside UDP/IP packets allows Layer 2 and Layer 3 virtual networks to run independently over the physical underlay infrastructure.

Key Concept

Underlay vs Overlay Separation in Software-Defined Fabrics
Estimated Time:1m 15s
Question 17Question →

Match each software-defined networking component on the left with its primary architectural function within an enterprise fabric infrastructure on the right.

Click a left item, then click its matching right item

Items

VXLAN
Underlay IGP (e.g., IS-IS / OSPF)
LISP Control Plane
Fabric Edge Node

Matches

Show answer & explanation

Answer

VXLAN pairs with UDP payload encapsulation; Underlay IGP pairs with physical IP reachability between RLOCs; LISP Control Plane pairs with maintaining EID-to-RLOC mapping database; Fabric Edge Node pairs with connecting and authenticating end-user devices.
VXLAN handles data plane encapsulation over UDP, Underlay IGPs handle physical IP reachability, LISP handles the control plane mapping database between EIDs and RLOCs, and Fabric Edge nodes connect endpoints to the fabric network.

Step-by-Step Solution

1
Identify the data plane overlay encapsulation mechanism.
VXLAN encapsulates host traffic inside UDP headers to create virtual overlays over the physical underlay.
Overlay data plane transport relies on encapsulation protocols like VXLAN.
2
Identify the physical network reachability mechanism.
Underlay routing protocols (like IS-IS or OSPF) ensure basic IP reachability between physical nodes and loopback interfaces.
Without underlay IP connectivity, tunnel endpoints cannot exchange encapsulated packets.
3
Identify the mapping database and control plane protocol.
LISP handles the mapping of host Endpoint Identifiers (EIDs) to switch Routing Locators (RLOCs).
LISP replaces traditional MAC learning with a query/response mapping database approach.
4
Identify the fabric device role responsible for host onboarding.
Fabric Edge Nodes connect directly to endpoints, authenticate users, and encapsulate host traffic into the fabric overlay.
Fabric Edge switches act as the entry point into the software-defined access fabric.

Key Concept

Software-Defined Architectures: Overlay, Underlay, and Fabric protocol roles
Question 18Question →

A network engineer is deploying an enterprise Software-Defined Access (SD-Access) fabric that uses Virtual Extensible LAN (VXLAN) for overlay data plane encapsulation across a Layer 3 underlay routed network. During testing, endpoints sending standard 1500-byte IP packets with the Don't Fragment (DF) bit set experience packet drops when traffic traverses the fabric. Which modification to the underlay network infrastructure resolves this issue?

Show answer & explanation

Answer: Increase the Maximum Transmission Unit (MTU) size on physical underlay interfaces to accommodate encapsulation overhead.

Answer

Increase the Maximum Transmission Unit (MTU) size on physical underlay interfaces to accommodate encapsulation overhead.
VXLAN overlay encapsulation adds 50 bytes of header overhead to standard frames. To ensure that 1500-byte payload packets marked with the Don't Fragment (DF) bit can pass through the underlay without being dropped, the physical underlay infrastructure must be configured with an increased MTU (typically 1550 bytes or higher).

Step-by-Step Solution

1
Analyze the impact of overlay data plane encapsulation on packet size.
VXLAN encapsulation adds 50 bytes of overhead (Outer Ethernet + Outer IP + UDP + VXLAN headers) to original host frames.
When a 1500-byte payload frame is encapsulated by a VTEP, the total frame size exceeds the standard 1500-byte underlay MTU boundary.
2
Evaluate the behavior of packets with the Don't Fragment (DF) bit set.
Underlay routers drop packets exceeding their interface MTU because fragmentation is explicitly prohibited by the DF bit.
To prevent packet drops, the underlying physical transport network must support jumbo frames or an MTU size large enough (typically 1550-9000 bytes) to transport the full encapsulated packet without fragmentation.

Key Concept

Underlay MTU requirements for VXLAN overlay encapsulation
Question 19Question →

A network administrator is evaluating the functions of underlay and overlay components within a Cisco Software-Defined Access (SD-Access) fabric deployment. Which two statements accurately describe the responsibilities and operational relationships of the underlay and overlay networks? (Select two.)

Select all that apply

Show answer & explanation

Answer: The underlay network relies on traditional routing protocols, such as OSPF or IS-IS, to establish unicast IP reachability between physical fabric nodes.; The overlay network utilizes Virtual Extensible LAN (VXLAN) encapsulation to transport virtualized Layer 2 and Layer 3 user traffic across the underlay infrastructure.

Answer

The correct statements are that the underlay network relies on traditional routing protocols (like OSPF or IS-IS) to establish IP reachability between physical fabric nodes, and the overlay network utilizes VXLAN encapsulation to transport Layer 2 and Layer 3 user traffic across the underlay infrastructure.
In software-defined fabric architectures (like Cisco SD-Access), the underlay provides basic physical connectivity and IP reachability using traditional IGPs (such as OSPF or IS-IS). The overlay runs on top of the underlay and uses VXLAN to encapsulate Layer 2 and Layer 3 frames into UDP packets, allowing virtual network separation independently of physical cabling.

Step-by-Step Solution

1
Analyze the role of the underlay network in SDN architectures.
The underlay consists of physical switches, routers, and links running standard Layer 3 IP routing protocols (e.g., OSPF, IS-IS, BGP) to ensure IP reachability among fabric devices.
Without underlay IP reachability, overlay tunnels cannot be established between endpoints.
2
Analyze the role of the overlay network and its protocols.
The overlay is a virtual network built on top of the underlay that uses encapsulation (such as VXLAN) for data plane transport and mapping protocols (such as LISP) for control plane tracking.
Overlay networks decoupled logical user segments (VNFs/VLANs) from the underlying physical topology.
3
Evaluate the choices to select the two correct architectural statements.
Statements highlighting IGP IP reachability for underlay and VXLAN encapsulation for overlay are correct.
Misattributing LISP or VXLAN to the underlay confuses overlay data/control plane mechanics with physical transport.

Key Concept

Underlay vs. Overlay Architecture in SDN Fabrics
Question 20Question →

An network operations team is verifying traffic delivery across a Cisco Software-Defined Access (SD-Access) fabric infrastructure. The physical underlay network is configured using an Interior Gateway Protocol (IGP) to ensure full IP reachability between all switch loopback interfaces. Which statement accurately describes the primary function of the fabric control plane when an ingress fabric edge switch needs to forward overlay traffic to a remote host?

Show answer & explanation

Answer: It uses Locator/ID Separation Protocol (LISP) mapping database lookups to correlate destination host Endpoint Identifiers (EIDs) with egress switch Routing Locators (RLOCs).

Answer

The fabric control plane uses Locator/ID Separation Protocol (LISP) mapping database lookups to correlate destination host Endpoint Identifiers (EIDs) with egress switch Routing Locators (RLOCs).
In a Cisco SD-Access fabric architecture, the control plane relies on Locator/ID Separation Protocol (LISP). LISP separates device identity (Endpoint Identifier or EID) from physical location (Routing Locator or RLOC). When an ingress fabric edge switch receives a frame destined for an overlay endpoint, it queries the LISP mapping database to locate the destination host's RLOC (the IP address of the egress fabric edge device), allowing VXLAN encapsulation to transport the payload across the underlay.

Step-by-Step Solution

1
Identify the separation of roles between underlay and overlay in Software-Defined Access (SD-Access).
The underlay provides basic IP reachability between network nodes (RLOCs), while the overlay manages host traffic (EIDs) encapsulated in VXLAN.
SD-Access separates host identity from host location to enable mobility and fabric scale.
2
Determine the control plane protocol responsible for host location mapping.
LISP serves as the control plane protocol operating on the Control Plane node (Map-Server/Map-Resolver).
When a fabric edge switch receives traffic for a destination host EID, it queries the LISP map-server to discover the IP address of the egress fabric edge switch (RLOC).
3
Select the option that correctly describes the LISP EID-to-RLOC mapping function.
The statement describing LISP mapping destination host EIDs to egress switch RLOCs is correct.
This process enables the ingress edge switch to encapsulate the packet in VXLAN addressed to the correct destination RLOC.

Key Concept

Software-Defined Architectures: Fabric Control Plane LISP EID-to-RLOC Mapping
Page 1 / 2Next
Software-Defined Architectures: Overlay, Underlay, and Fabric Practice Questions — Cisco CCNA | Examkin