So, for an SDA Small Deployment, a collapsed design (due to limited hardware) whereby configuring BGP and sub-interfaces on the Firewall peering with the Dist/Core switch (SW1) would be the preferred deployment, understood.  Alternatively, in an Enterprise design, I would anticipate the preferred design be to replace the BC1 "router" with a stackable or HA pair of L3 switches port-channeled to the Core/Dist pair/stack of switches (SW1) to ensure high-availability and h/w fault tolerance (replace Loopbacks with SVIs).  In other words, we would inject another HA layer in order to perform BGP peering to separate the VRF/VNs between the new layer and the SW1(Dist/Core) pair of switches (/30 VRF subnets in your design).  Would this be the appropriate design for SDA Medium/Large deployments?

 If a customer has Edge(Access) switches, then Core/Distribution switches, then Firewall that egresses to the Internet, which device is the standard topology would be considered the ULAY1 device and BC1 router. For inter-VRF & External Connection communications, we need to configure BGP on what I would assume would be the Core/Distribution switch(SW1) with BC1. Do we need to add a router (BC1) in between their Core Switch (SW1) and their Edge nodes (E1) - I would be concerned about injecting another layer of failure (we would need HA devices). We need to design the network to add BGP Peering (SW1/BC1) and the edge nodes wouldn't be doing that, unless you extend L3 switching down to the edge and put BGP on the E1 nodes? Alternatively, we would need to add another layer to the topology so we can have 2 BGP routing peers to VRF the various VNs. Could you help me understand the best practice for the design?

Hello all,

I was wondering how difficult is to migrate a 9500 border node to a 9600 when the SDA fabric is up and running. Can they run in parallel and once the physical connections are moved to the new switch the old one can be decommitted.

Thank you.

I am trying to build a Cat3850 as a device sensor and want to use radius only with ISE to both profile and authenticate... is this possible. I don't want CDP, add my ISE through ip helper or enable SNMP... Can ISE be configured without this additional means. I am in a high security area and don't want this integration between the NAD and the ISE

I am not aware of any limitation and can't see why it wouldn't work. FTD in the cluster should collaborate multicast forwarding although there may be differences depending if you do L2 or L3 load distribution between FTD in cluster.