LISP vs VXLAN in Cisco SD-Access: What's the Difference? (CCNP ENCOR)
This is one of the highest-value confusions to clear up for CCNP ENCOR, because the exam repeatedly asks you to place SD-Access functions into the right plane. The short version: LISP is the control plane (it knows where every endpoint is), and VXLAN is the data plane (it carries the traffic there). They are not competitors - they are two halves of the same fabric doing completely different jobs. Once you stop treating them as alternatives, most SD-Access questions get easy.
Test yourself on real ENCOR fabric questions
Take a full-length CCNP ENCOR 350-401 practice exam free - SD-Access, SD-WAN, automation, and more, with an Explanation and an Exam Tip on every item and a personalized Exam Coach when you finish. The code auto-applies after sign-up.
CCNP-EXAM-FULL
Start the free exam
Already have an account? Log in to start
In This Guide
SD-Access is built from planes, not one protocol
Cisco SD-Access (the campus fabric managed by Catalyst Center, formerly DNA Center) deliberately splits responsibilities into separate planes. Each plane has its own protocol, and the whole trick to this topic is knowing which protocol owns which plane:
| Plane | Protocol | Its one job |
|---|---|---|
| Control plane | LISP | Track where every endpoint is (EID → RLOC mapping) |
| Data plane | VXLAN | Encapsulate and forward the traffic across the underlay |
| Policy plane | Cisco TrustSec (SGT) | Carry group-based segmentation policy (rides inside VXLAN) |
| Management | Catalyst Center | Automation, provisioning, assurance |
LISP: the control plane - "where is it?"
LISP (Locator/ID Separation Protocol) solves one problem: in a big mobile network, you need to know where an endpoint currently is without flooding to find it. LISP separates two ideas that a normal IP address jams together:
- EID (Endpoint Identifier) - who the endpoint is (the host's IP/MAC). This stays with the device.
- RLOC (Routing Locator) - where it is (the fabric edge node it sits behind, identified by that switch's loopback).
A control plane node runs the LISP Map-Server / Map-Resolver, holding the host-tracking database of EID-to-RLOC mappings. When a fabric edge node needs to reach an endpoint it doesn't know, it sends a map-request and gets back the RLOC to forward to. No flooding, and when an endpoint roams, the mapping updates - which is how SD-Access handles mobility cleanly.
VXLAN: the data plane - "carry it there"
Once LISP has told the edge node where to send the packet, VXLAN (Virtual Extensible LAN) is how it gets there. VXLAN wraps the original frame in a new header and tunnels it across the routed Layer 3 underlay (the recommended underlay IGP is IS-IS), so a Layer 2 or Layer 3 overlay can ride on top of a fully routed network.
Crucially, the SD-Access VXLAN header carries two extra pieces of information that make segmentation work end to end:
- VNI (VXLAN Network Identifier) - identifies the virtual network / VRF (macro-segmentation). Different tenants or networks map to different VNIs.
- SGT (Scalable Group Tag) - the TrustSec group tag for micro-segmentation policy, carried inline so policy follows the traffic across the fabric.
How a packet actually flows (LISP + VXLAN together)
- A host sends a packet to its fabric edge node.
- The edge node asks the LISP control plane: "which RLOC is the destination behind?" (map-request → map-reply).
- The edge node VXLAN-encapsulates the packet toward that RLOC, stamping in the VNI (virtual network) and SGT (policy group).
- The routed underlay forwards the VXLAN packet to the destination edge node.
- The destination node de-encapsulates and delivers the original frame, applying any SGT-based policy.
LISP answered where; VXLAN did the carrying; TrustSec's SGT enforced policy. Three planes, one packet.
LISP vs VXLAN at a glance
| LISP | VXLAN | |
|---|---|---|
| Plane | Control plane | Data plane |
| Question it answers | Where is the endpoint? | How does the packet get there? |
| Key objects | EID, RLOC, Map-Server/Resolver | VNI, SGT, VTEP, UDP 4789 |
| Carries user traffic? | No (mapping/signaling only) | Yes (encapsulates the data) |
| Analogy | GPS / directory lookup | The shipping envelope |
Exam traps and the BGP EVPN distinction
- "VXLAN does the mapping." No - VXLAN only encapsulates. The mapping (EID↔RLOC) is LISP's job. This is the single most common wrong answer.
- Underlay vs overlay. The underlay is the plain routed network (IS-IS) that moves VXLAN packets. The overlay is the virtual fabric built by VXLAN + LISP on top. Don't mix them.
- SD-Access uses LISP as its VXLAN control plane; data center fabrics usually use BGP EVPN. Same data-plane encapsulation (VXLAN), different control plane. If a question says "campus SD-Access," think LISP; if it says "data center VXLAN fabric," think BGP EVPN.
- SGT is policy, not location. The SGT rides in the VXLAN header but comes from TrustSec (the policy plane) - it segments who can talk to whom, independent of IP subnet.
- VNI ≠ VLAN. The VNI is a 24-bit fabric-wide identifier for the virtual network; it scales far beyond the 4,094 VLAN limit and is what enables macro-segmentation.
Fabric questions are easy points once they click
Take a free CCNP ENCOR practice exam and find out whether SD-Access is genuinely solid or just feels solid. You get a concept-level breakdown of exactly where your points leak.
CCNP-EXAM-FULL
Start the free exam
Confused about SD-Access vs SD-WAN too? Read the SD-WAN vs SD-Access breakdown →
CCNP ENCOR SD-Access Practice Questions
Five questions in the ENCOR "which plane / which protocol" style, each with a full explanation.
Ready for More?
Fabric planes locked in. Here's what to reinforce next:
Frequently Asked Questions
What is the difference between LISP and VXLAN in SD-Access?
They occupy different planes. LISP is the control plane - it maps which endpoint (EID) sits behind which fabric node (RLOC), so the fabric knows where to send traffic. VXLAN is the data plane - it encapsulates the packets and carries them across the Layer 3 underlay, including the VNI (virtual network) and SGT (policy). LISP decides where; VXLAN carries there.
Is LISP the control plane or the data plane?
LISP is the control plane. The control plane node runs the LISP Map-Server and Map-Resolver, holding the host-tracking database that maps EIDs to RLOCs. Edge nodes query it instead of flooding to locate an endpoint.
What is the difference between an EID and an RLOC?
The EID (Endpoint Identifier) is the host's address - who it is. The RLOC (Routing Locator) is the fabric node's address - where it is. LISP separates identity from location and keeps the mapping between them.
Why does SD-Access use LISP with VXLAN instead of BGP EVPN?
Both are valid VXLAN control planes. Cisco chose LISP for the campus fabric because its on-demand, query-based mapping scales well for large numbers of mobile endpoints and handles roaming cleanly. Data center VXLAN fabrics more often use BGP EVPN. For ENCOR, remember: SD-Access = VXLAN + LISP.