University Campus Segmentation Under a Five-Month Deadline
State University has 12 buildings, 18,000 wired endpoints, 1,200 access points, and 60,000 students and staff. The core is a pair of Catalyst 6500 VSS with 10G fiber to 3850 stacks; all user VLANs are trunked to the core, and a single OSPF area spans campus. The security team needs policy separation for students, faculty, guests, research IoT (600 devices), and PCI payment kiosks. A recent audit found guest traffic reaching research subnets through a misconfigured trunk. The university has six network engineers, no SD-Access experience, and a five-month window before the fall semester. Uplinks are 10G, but 1G access closets remain. The CIO is considering SD-Access but is worried about complexity and fabric border placement. Wireless uses a single 5508 controller in the core.
1. Compare SD-Access and a traditional VLAN/VRF-lite segmentation design for this campus. Recommend one and justify it against the five-month deadline.
Read the worked answer
SD-Access gives macro segmentation (VRFs), group-based policy (SGTs), and mobility without stretching VLANs; it would solve the guest-to-research leak at the policy layer. But it requires a routed underlay, ISE, border/control-plane nodes, fabric edge configuration, and new operational skills. With six engineers, no SD-Access experience, and a five-month deadline, a full 12-building fabric migration is high risk. Recommend a traditional segmented design for the fall: VRF-lite at the distribution pair, 802.1X/MAB with dynamic VLAN assignment, strict trunk allowed lists, and ACLs or a firewall between VRFs. Use SGT-capable hardware where available but do not depend on inline tagging. Pilot SD-Access in one new building after the semester. This meets the audit now and preserves the fabric path. If SD-Access is mandatory, limit phase 1 to two buildings and keep the rest on VRF-lite; do not mix a half-migrated fabric with trunked VLANs to the core.
2. If SD-Access is adopted, where do the border and control-plane nodes go, and how does traffic reach the legacy data center and internet?
Read the worked answer
In SD-Access, place a control-plane node pair in the data center or core, not at each building. The control plane holds the LISP map-server/database for endpoint-to-edge mappings. Place border nodes at the core where the fabric meets the DC, WAN, and internet. Use two borders for redundancy: an internal border for DC/WAN and an external border for internet, or one border pair with separate VRF handoffs. The border connects to a fusion router for VRF leaking and shared services. The underlay is routed /31 links with IS-IS or OSPF; do not trunk user VLANs to the core. Fabric edge switches run VXLAN and register endpoints to the control plane. For 18,000 endpoints and 1,200 APs, a pair of control-plane nodes and a pair of borders is sufficient; scale by adding border nodes for throughput, not by adding control planes. The 5508 wireless controller should be fabric-enabled or replaced; do not backhaul CAPWAP across the fabric blindly.
3. Address the guest-to-research leak: what design controls prevent it, independent of whether SD-Access is deployed?
Read the worked answer
Independent of fabric, the leak means a guest VLAN was allowed on a trunk that reached research. Enforce a design rule: guest traffic terminates on a dedicated VRF and firewall; it is never trunked to the core or research distribution. Use 802.1X for faculty and staff, and MAB for IoT; put unknown devices in a quarantine VLAN. Apply switchport trunk allowed lists and change control that rejects guest VLANs on inter-switch links. Use private VLANs or isolated guest SSIDs mapped to a guest VRF. Add ACLs at the distribution and a firewall between guest and research. Monitor with NetFlow and ISE. The design should fail closed: if 802.1X fails, the port lands in a registration VLAN with no research route. This is cheaper and more auditable than relying on a single trunk fix.