Designing Cisco Enterprise Networks

In an SD-Access fabric, border nodes are the components responsible for communicating with networks that are external to the fabric. These nodes serve as the gateway and handle the routing of traffic between the SD-Access fabric and external networks, including the internet and other remote sites.

The protocol that runs between the vSmart controllers and between the vSmart controllers and the vEdge routers, and unifies all control plane functions under a single protocol umbrella is OMP (Overlay Management Protocol). OMP is specifically designed for the Cisco SD-WAN solution and is responsible for managing the overlay network by exchanging control plane information like route prefixes, next-hop routes, crypto keys, and policy information over a secure connection.

To mitigate DoS attacks against Cisco SD-WAN vEdge routers, it is essential to control incoming traffic meticulously. By default, denying all incoming traffic at the transport (WAN) side interfaces ensures that no unsolicited or potentially harmful traffic reaches the infrastructure directly, providing a strong defensive measure. Additionally, for direct Internet access, allowing only the traffic that matches the state table entries ensures a stateful inspection, meaning only traffic corresponding to expected connections (and thus less likely to be malicious) is permitted. This combination of default-deny policies and stateful inspection forms a robust defense against DoS attacks.

The three foundational elements required for the new operational paradigm include assurance, policy-based automated provisioning of network, and fabric. Assurance refers to the ability to guarantee performance and reliability, which is critical in modern network operations. Policy-based automated provisioning allows for streamlined and consistent network configuration and management, reducing manual errors and improving efficiency. Fabric refers to the underlying network structure enabling seamless connectivity and integration across various segments, necessary for a robust and flexible operational model.

Cisco ISE's log retention is determined by the available disk space. Additionally, Cisco ISE supports IPv6 downloadable ACLs, making these two statements true.