Enterprise Architecture: Campus Hierarchy, Fabrics, and Controllers
Choosing a design model
Traditional campus design uses a three-tier hierarchy. Access provides port density and PoE, distribution enforces policy and route summarization, and core moves packets fast. Small sites collapse distribution and core into two tiers. Data centers replace hierarchy with a spine-leaf Clos fabric, where every leaf is one hop from every spine, giving predictable east-west latency and equal-cost multipath.
Controller-based architectures
The exam expects you to know which component owns which plane. In Cisco SD-WAN, vManage is the management plane, vSmart is the control plane and runs OMP to distribute routes and policy, and vBond handles orchestration and initial authentication of devices. Forwarding happens on cEdge/vEdge routers over IPsec tunnels across any transport, with application-aware routing driven by BFD probes.
In Cisco SD-Access, LISP is the control plane (endpoint-to-location mapping), VXLAN is the data plane encapsulation, and Cisco TrustSec carries policy through security group tags. DNA Center supplies the intent and management layer. Fabric edge nodes register endpoints to the control plane node; border nodes hand traffic to the outside.
Resilience
The three redundancy layers are device-level (stacking, VSS, vPC), gateway-level (HSRP, VRRP, GLBP), and controller-level (on-premises or cloud-hosted controllers).
Traps
Questions love to mix the planes. LISP is control, VXLAN is data, SXP and CTS are policy. vSmart does not forward user traffic. vBond is not the management interface. OMP is the SD-WAN overlay routing protocol, not the underlay routing protocol.
Rule of thumb
When asked which component does something, answer by plane: configuration and visibility mean vManage, admission and bootstrapping mean vBond, topology and policy mean vSmart.