A university campus is deploying SD-Access across five buildings with mobile users who roam between switches. The design requires a single IP subnet to span sites, host mobility without changing IP addresses, and separation of endpoint identity from location. Which SD-Access fabric mechanism provides host tracking and mobility with overlay tunneling?

SD-Access pairs LISP as the fabric control plane with VXLAN as the data plane, meeting the requirements for a stretched subnet, stable addressing, and separation of endpoint identity from location. LISP defines endpoint IDs that remain constant as routing locators change when users roam between switches. Its mapping system registers and resolves each endpoint to its current edge node, allowing one IP subnet to span the five buildings without renumbering hosts during a roam. VXLAN encapsulates host traffic in overlay tunnels across the routed underlay, supporting mobility and segmentation. Advertising endpoint host routes with OSPF fails conceptually because an IGP distributing per-endpoint routes does not map identity to location or scale well for roaming hosts, although VXLAN is the appropriate data plane. Using GRE with LISP fails because LISP provides the needed ID-to-locator mapping, but SD-Access overlay forwarding uses VXLAN with virtual network identifiers rather than GRE. VXLAN flooding without endpoint tracking fails because transport alone does not provide LISP’s mapping database to efficiently locate roaming hosts or separate identity from location, and relies on excessive flooding. An exam caveat: do not select a mechanism merely because it mentions mobility, tunneling, or VXLAN; confirm that both the LISP control plane and VXLAN data plane are present. A practical check is to inspect the LISP site mapping database for endpoint registrations and verify VXLAN overlay tunnels and virtual networks on edge and border nodes during a roam.