SDN campus and data centre fabrics: underlay, overlay and policy

Why fabrics replaced traditional designs

Classic three-tier networks stretch VLANs between switches and rely on Spanning Tree Protocol (STP) to block loops. That works, but large layer 2 domains are fragile, links sit idle, and every change means touching many boxes by hand. A fabric takes a different approach. The physical network becomes a plain routed core, and the flexible part (which user or workload belongs in which segment) is built on top as a virtual overlay. A controller or automation platform then manages the whole thing as one system rather than as dozens of separate switches.

The building blocks

• Underlay: point-to-point routed links between switches using an interior routing protocol such as IS-IS or OSPF. Its only job is reachability between switch loopback addresses. Equal-cost multipath (ECMP) means every link carries traffic.
• Overlay data plane: usually VXLAN (Virtual Extensible LAN), which wraps layer 2 frames in UDP so they can cross the routed underlay. A 24-bit VXLAN Network Identifier (VNI) allows around 16 million segments, far beyond the 4094 usable VLANs.
• Overlay control plane: something must tell each switch where an endpoint lives. In data centres this is usually BGP EVPN (Ethernet VPN), which advertises MAC and IP addresses as BGP routes. Some campus solutions use LISP (Locator/ID Separation Protocol) as a lookup service instead.
• Policy plane: group tags or endpoint groups carried in the VXLAN header let switches enforce rules such as "cameras may only talk to the video recorder", regardless of IP address.
• Management plane: a controller or automation tool that holds the intended design and pushes consistent configuration.

Data centre fabrics normally use a leaf-spine topology: every leaf connects to every spine, so any server is the same number of hops from any other. You can read more about the planes in SDN planes and about the overlay in campus and data centre architecture.

Campus and data centre: same tools, different jobs

In a campus fabric, a user plugs in, authenticates, and the network places them in the right virtual network with the right group tag. If they walk to another building, the same policy follows them. In the data centre, a new application tier gets its own segment in minutes through automation instead of a change ticket for every switch.

Designing and running a fabric well

1. Keep the underlay boring: routed links, consistent MTU (VXLAN adds about 50 bytes, so raise the underlay MTU), and fast failure detection with BFD (Bidirectional Forwarding Detection).
2. Define segments and groups from business needs (staff, guests, cameras, payment systems) before touching configuration.
3. Plan the border: where the fabric hands off to firewalls, the WAN and the internet.
4. Automate configuration from a single source of truth so every switch is consistent.
5. Monitor both layers. An overlay problem can hide an underlay fault and the reverse.

Tip: the most common fabric outage is an MTU mismatch in the underlay. Small pings work, but large packets silently drop. Test with a large ping that does not allow fragmentation.

Common mistakes include copying the old VLAN design straight into the fabric, skipping the border design, and treating the controller as a single unprotected box. The controller holds the keys to the whole network, so back it up and restrict who can reach it. In exams, expect questions on underlay versus overlay and on why VXLAN scales better than VLANs.