A township board asks why user VLANs in SD-Access terminate at the fabric edge instead of spanning through the campus core. What is the correct explanation?
Select an answer to reveal the explanation.
Short Explanation
Old campuses stretched VLANs like holiday lights through the core—pretty until one bulb floods everything. In fabric, the edge is where that Layer-2 neighborhood stops and routing into the overlay begins. User subnets live at the edge; the core stays a transport, not a giant broadcast domain.
Full Explanation
A township board asking why user VLANs terminate at the fabric edge should hear that the edge is the Layer-2/Layer-3 demarc where endpoint subnets are anchored; the fabric overlay carries traffic without stretching those VLANs across the campus core. That is foundational SD-Access behavior versus classic end-to-end VLAN designs.
Keeping the core as a giant Layer-2 domain so every user VLAN floods end-to-end reintroduces the broadcast and STP problems fabric is meant to avoid.
Configuring user VLANs only on the border so edges never switch local traffic misplaces the access demarc and breaks local switching/onboarding at the edge.
Spanning user VLANs across the underlay IGP to replace VXLAN collapses overlay back into underlay VLAN sprawl.
Exam caveat: L2 border handoff is a deliberate exception for migration—not the default for every user VLAN across the core.
Operational check: verify endpoint subnets are defined at edges/pools, confirm no user VLAN trunks across the core underlay, and show overlay forwarding between edges. Update the township campus standard with the “VLANs stop at the edge” rule. In municipal operations, record the rationale in the change ticket so future on-call staff know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same control still holds under the platform code and policy revisions used by the civic network team.