1 to 100 - Master All Steps of

Deployment, Integration and

Migration
Of Large SD-Access and SD-WAN Networks

Dhrumil Prajapati Jennifer Bowman

Principal Architect Principal Architect

BRKENS-3834
 Cisco Webex App

Questions?
Use Cisco Webex App to chat
with the speaker after the session

How
1 Find this session in the Cisco Live Mobile App

2 Click “Join the Discussion”

3 Install the Webex App or go directly to the Webex space

4 Enter messages/questions in the Webex space

Enter your personal notes here

Webex spaces will be moderated by the speaker until June 13, 2025.

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 2

-
 01 Introduction
02 Design and Deployment Best Practices
• SDA & SDWAN Integration
• 100,000ft view on Multi-Domain Design

03 Deployment and Migration Lessons Learned

from Large Scale Deployments
Agenda • Having a solid Foundation
• What is the migration process?
04 Leveraging IaaC Approach
05 Conclusion

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 3

-
 Who are we?
Dhrumil Prajapati
Principal Architect
GES Architectures - CX

10+ Years @ Cisco

CCIE #28071 (R/S, SP)
CCDE #20210002

Specialized in: SD-Access, SD-WAN,

MPLS, Multi-Domain Networks, Cloud,
Automation

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 4

-
 Who are we?
Jennifer Bowman
Principal Architect
GES Architectures - CX

10+ Years @ Cisco

CCIE #51241 (R/S, Security)
CCDE #20180016

Specialized in: Full Enterprise IBN with

Security and Automation

jdb1@[Link]
© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 5

-
Design and Deployment
Best Practices
 Why Multi-Domain?

Individual architectures introduce

• Segmentation
• Automation
• Within a single enterprise domain

Multi-Domain Architectures
• Extend Segmentation
• Utilize orchestration
• Make the entire enterprise one IBN enclave

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 7

-
 What Is Involved In SDA & SDWAN Integration?

Steps
• Catalyst Center and Manager integration
• SDWAN Manager owns each cEdge and assigns to Catalyst Center
• Provision SDA specific changes through Catalyst Center, SDWAN
specific changes via Manager
Results
• SDA VNs and SDWAN Service VPNs tied together
• SDA SGT information propagated via SDWAN
• cEdge participates in both fabric domains
• Consistent application and security policy
• API based communication between Catalyst Center and Manager

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 8

-
 Really Really High-Level View

SD-Access SD-WAN ACI

Catalyst Center Catalyst Manager APIC Controller

Campus Branch & Cloud &

and IOT WAN Data Center

Users and Devices Hybrid Cloud Data & Applications

Deliver Great Application Experience Automate Resource and Workflows
Identify and Onboard Everything
Secure Internet and Cloud Access Prevent Data Breaches
Authenticate and Authorize Access

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 9

-
 SDA
• Endpoints dynamically assigned SGTs
and placed into VNs
• Macro and Micro-segmentation
• Unified wired and wireless networks

100,000 ft view
SDWAN
• Extends and bridges segmentation
• Applies Catalyst Center per-VPN
security and application policy.
• Enables end-to-end segmentation

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 10

-
What did we learn from
Large Deployments?
 SD-Access and SDWAN Deployments

• Today available in partly manual “two-box” solution

• Two-box solution (non-integrated solution)
• Clear demarcation between SDA and SDWAN architectures
• SDA BNs can be Cat8K, ASR1K or Cat9K switches, SDWAN edges can be
Cat8K or ASR1K series routers
• SD-Access and SDWAN designs can be implemented at a different pace

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 12

-
 SD-Access and SDWAN Deployments

• Majority of customers have employed two-box solution for modularity of

deployment and flexibility in operations
• Mapping of VNs and VPNs is crucial
• Inter-site traffic flow greatly depends on SDWAN tunnel design and SDWAN
underlay.
• For Multi-Regional (Global) networks, consistency across multiple Catalyst
Center clusters is key.
• Special consideration for inter-VN routing within the site

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 13

-
 SDA to SDWAN Integration (Two-Box)
MANAGEMENT Cisco Catalyst
Center

ISE

Manager
MANAGEMENT

Validator Controller

SD-Access SD-Access
SD-WAN Fabric
Fabric Site Fabric Site

WAN Edge WAN Edge

BGP BGP
LISP VRF-lite OMP VRF-lite LISP CONTROL PLANE

802.1Q 802.1Q
SGT (16 bits) SGT (16 bits)
VXLAN SGT (16 bits) IPSec CMD SGT MPLS VPN SGT (16 bits) VXLAN DATA PLANE
Header Header Header (16 bits) Labels (20 bits) Header
VNID (24 bits) VLAN ID (12 bits) VLAN ID (12 bits) VNID (24 bits)

Inline Tagging Inline Tagging

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 14

-
Migrating The Beast!
 © 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 16

-
Having a Solid Foundation
 5 Pillars and a Bedrock

PDI/AMO PMO Migration Customer Partner

Team

Automation

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 18

-
 Plan Design Implementation / AMO

Testing & Validation

Design & Drive Testing XL,L,M+,SM,XS Design

CC ISE Integration Snowflakes Validation

AAA Certificates Fabric Domain L2BN functionality

SGT VN Policy Profiling

KT and Pilot Sites

Templates & Tools

Golden SDWAN Templates Post MW Hypercare
Endpoint Discovery First 24hr hypercare support
Delta & Underlay Configs

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 19

-
 Setting realistic schedules
Bringing stakeholders together

PMO : Build The City

Bridging the gap and ensuring good

Chase timelines and engineer requests customer sentiment
© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 20

-
 Migration Team

Site Readiness Pre-Migration Window Migration Window

Network Design Document Catalyst Center Discover & Provision

Configuration
BoM Preparation Add to Fabric – L2/L3
Staging of Devices
MoP Preparation External Networks
UAT
Target Design Host Onboarding & Post Check

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 21

-
 Customer

Site Readiness Tasks Migration Window

✓ Circuit ID and Handoff Type ✓ User Acceptance Testing

✓ Site Technical POC ✓ Circuit Provider Ticket if required
✓ Site Survey Information ✓ Correct DNS on DHCP Scopes
✓ Decommission of Old Circuit

Pre-Migration Post-Migration
✓ Site Remediation Completed ✓ Post Migration UAT
✓ Adequate Power & Connectors ✓ Coordination with Cisco for
✓ Rack space & unmanaged devices wireless/wired Testing

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 22

-
 Partner

Staging MW & Post MW

• Code Upgrade
• Cable Moves as per MoP
• License & eWLC package • AP mounting
• Load Bootstrap • Device Cleanup &
• Manager Reachability Decommission

Pre-MW Readiness
• SFP : Copper & Fiber
• Verify on-site inventory • Cables: Console, Patch
• Rack, Stack, Power Cord
• Cable all Devices • Fibers: SMF, MMF
• Equipment: Label Marker

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 23

-
 Automation In SDA/SDWAN

Automation Possibilities
Why is it needed?
Large Site can have over 15000 endpoints Legacy Hardware Readiness &
100% Assessment Tools
Validation & UAT can miss a lot of endpoints
Endpoint Discovery & Site Overview

CC Site Hierarchy Push

How Automation Helps

Fabric Fusion Config Generator
Underlay Config generator reduced MOP time

Reduced Migration Time with Fabric Config Generator Pre & Post Ping Sweep and Routing
Delta
Site Snapshot & Overview of endpoints

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 24

-
What is the Migration
Process?
 Migration Pit Stops/Checkpoints

1 Site Survey & Predictive Model 2 BOM Creation 3 BOM Approval & Remediation
Review

5 Site Staging (Bootstrap) 4 MOP Preparation

6 Site Services Readiness 7 Pre-MW Checks 8 Rack, Stack, UAT

10 ISE & NAD Group Update 9 Push SD-WAN Template & Core SD-Access

11 External Connectivity with SD- 12 Host Onboarding & endpoint 13 UAT & Handover
Access validation
© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 26

-
 Migration Approaches

Single Step Multiple Step

• Move from current state to end • Move from current to end state in
state in 1 Maintenance Window multiple Maintenance Windows
• Suited for Small Sites • Suited for Medium to Large sites
• Process: • Process:
• Move to SD-WAN • Day 1: SDWAN, Fusion and BN/CPs
• Replace and/or upgrade LAN • Day 2+:Replace and/or upgrade
switches to SD-Access targeted LAN closets to SD-Access
• Migrate SD-Access Wireless • Migrate SD-Access Wireless

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 27

-
 Migration Approach – Single Step
CNF/DC with WLC CNF/D CNF/DC
C
Interne
t

MPLS Internet
MPLS/SDWAN Internet MPLS/SDWA
N

SDWAN SDWAN

OR

Fabric

Broadcast new
fabric enabled SSID
Broadcast new
Broadcast Legacy SSID
fabric enabled SSID

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 28

-
 Migration Approach – Multiple Step
MPLS Internet MPLS Internet

SDWAN
SDWAN

Fusion Fusion

Legacy Site
Legacy Site

Fabric Fabric

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 29

-
 Multi Step Migration with L2BN Traffic Flow
MPLS Internet

• Any migrated subnet traffic between Legacy

and Fabric will traverse through Layer 2 Border SDWAN
Node (L2BN)
• Any migrated subnet traffic between legacy
and remote location will traverse through L2BN
> BN/CP > Fusion > SDWAN Fusion

Legacy Site

• Any migrated subnet traffic from legacy to

non-migrated subnet in legacy network will
traverse through L2BN > BN/CP > Fusion >
Legacy site Fabric

• Any non-migrated subnet traffic from legacy

to remote location will traverse directly Flow 1
through Fusion > SDWAN Flow 2
Flow 3
Flow 4
© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 30

-
 Migration Approach – Final Step CNF DC

Internet
MPLS SDWAN

• SDA Capable devices will be on SDWAN

boarded into the fabric

• Any temporary configurations will be Fusion
cleaned
• Local C9800 WLC will be enabled for
fabric mode and re-provisioned with
fabric SSIDs
• All the APs will be provisioned to
Fabric
broadcast the fabric enabled SSIDs.

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 31

-
 SD-Access & SD-WAN Migration Steps

1 2 3 4
Configure SDA
Push SD-WAN Turn on routing
Discover BNs Site specific
Pre-SD-Access between wEdge
from CC tasks and BN
template and BNs
External Handoff

5 6 Confirm all BGP 7 8

Push SD-WAN peers are up and Final
Any configuration
Post-SD-Access reachability to all infrastructure and
cleanup
template networks and UAT testing
VNs

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 32

-
Leveraging IaaC Approach
 Challenges to Network Automation

Services Solution

Culture change is hard Failure to adopt a network automation architecture

Network engineer skills gap Selecting the right automation tools

Lack of commitment across the organization Lack of sandbox functionality

Snowflake networks Failure to use a network automation maturity model

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 34

-
 Network Automation - Architecture

ITSM Dashboards User Interaction Portal ChatOps

Orchestration

Automation Engine Source of Truth Telemetry & Observability

Compliance / Remediation /
Inventory / DCIM / IPAM Collect / Enrich / Store / Monitoring
Provisioning

Network Infrastructure
Physical / Virtual / Cloud

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 35

-
 Network as Code - Architecture

ITSM Self Service User Interaction GitOps ChatOps

Orchestration

Source of Truth Telemetry & Observability

Automation Engine Metrics / Events / Logs / Traces

Network Infrastructure
Physical / Virtual / Cloud

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 36

-
 Network as Code - Solution

ITSM Self Service User Interaction GitOps ChatOps

Workflow Engine Cisco Workflows

Orchestration
Network API NAC-API

Source of Truth GitLab GitHub Telemetry &

Automation Engine Ansible Terraform OpenTofu Observability

ACI NDFC SDWAN ISE Firewall

Network Infrastructure Meraki NX-OS IOS-XR IOS-XE Cat
Center

Physical / Virtual / Cloud

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 37

-
 Network as Code - Automation

Source of Truth GitLab GitHub

CI/CD Jenkins GitLab CI GitHub Actions Notifications Webex

Pre-Change Validation Automation Engine Automated Testing

Syntax Ansible Robot Framework

Semantics Terraform pyATS

Compliance OpenTofu Reporting

ACI NDFC SDWAN ISE Firewall

Network Infrastructure Meraki NX-OS IOS-XR IOS-XE Cat
Center

Physical / Virtual / Cloud

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 38

-
 Services as Code High-level service architecture

Additional

Assess Infrastructure Integration Build Code Branch Full Test

Code Commit
Work starts in Code is ready for push
ITSM collaboration with Cisco into mainline branch for
engineers to tailor code production push
Integration work
Customer Infra Change
base for customer
between ITSM and Test & Validate
Assessment Research on automation pipeline.
of customer state capability insert Base Build Request Testing in lab
to implement as
Code capabilities
into customer tools Request for Code Merge environment facility
to validate control
Initial data structures change is Technical approval
and data plane from
build, ITSM tools started at process.
change requests
integration customer
operational
process

Micro Tests
Customer or engineer run
tests against digital or
Software test topology to validate
automation build
Loading of
repositories or
Cisco Infra code into as Code
tool sets
Install of
Common Automation
Framework

Common Config Test Execution Schedule ITSM Approvals

Embedded Automation is Change execution Change approval
Automation pipeline executed scheduling process processing
Framework configuration push
checks against
and control

network devices
to validate correct
provisioning

Provisioning Governance

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 39

-
Conclusion
 Key Takeaways

• Order of operations is key!

• Underlay of SDA and Trusted VN needs to be bridged to overlay of
SDWAN
• DC first approach – get those cEdge headends built first
• At branch, install SDWAN first, test it and then proceed with SDA
• Infrastructure and UAT testing is very critical
• TrustSec needs to be configured on SDWAN first and then SDA BN
• For sub-interfaces, TrustSec must be enabled on physical and all
sub-interfaces

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 41

-
 Key Takeaways

• SD-Access and SD-WAN migrations can be done at rapid pace

• Consistency in design is key for at-scale migrations
• You are getting one chance to re-do the network – take that
opportunity!
• Remember those 5 pillars
• Automation is crucial for efficiency and accuracy
• BEAST is not as scary as it seems!
• Cisco CX is always there to work with you and accomplish success
together.

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 42

-
 Complete your session evaluations

Complete a minimum of Earn 100 points per Level up and earn Complete your surveys
4 session surveys and survey completed exclusive prizes! in the Cisco Live
the Overall Event and compete on the mobile app.
Survey to be entered in Cisco Live Challenge
a drawing to win 1 of 5 leaderboard.
full conference passes
to Cisco Live 2026.

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 43

-
 Continue your education

Visit the Cisco Book your one-on-one Attend the interactive Visit the On-Demand
Showcase for related Meet the Engineer education with DevNet, Library for more
demos meeting Capture the Flag, and sessions at
Walk-in Labs [Link]/
on-demand

Contact us via webex

© 2025 Cisco and/or its affiliates. All rights reserved. BRKENS-3834 44

-
Thank you