A stormwater bureau wants OT/SCADA endpoints kept out of the same routed fabric space as office users. Which SD-Access construct provides that macro segmentation?

A stormwater bureau keeping OT/SCADA endpoints out of the same routed fabric space as office users needs separate Virtual Networks (VNs). In SD-Access, VNs provide macro segmentation via isolated overlay routing spaces (VRFs), so SCADA and office users do not share a common overlay routing table even on the same physical underlay.

A single VN with only CoPP differentiating OT and office traffic offers device CPU protection, not overlay routing isolation between user classes.

Separate underlay IGPs per building so SCADA never shares OSPF with office edges over-complicates the underlay; macro segmentation belongs in overlay VNs, not dueling underlay IGPs.

One VN plus longer DHCP leases on SCADA ports does not create routing isolation or meaningful lateral-movement control.

Exam caveat: shared services VN patterns may selectively interconnect VNs—isolation is default per VN, with controlled leaking only where designed.

Operational check: place a SCADA test endpoint and an office endpoint in different VNs, confirm absence of direct route exchange, then test only intended shared-services paths. Publish the VN matrix in the stormwater OT segmentation standard. In municipal operations, record the rationale in the change ticket so future on-call staff know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same control still holds under the platform code and policy revisions used by the civic network team.