Out-of-Band Management vs. In-Band Management in SD-Access

The question requires a management network design that ensures operational independence from the production overlay, facilitates troubleshooting, and secures access. The key constraint is that the "overlay network does not cause routing issues," implying the management path must be resilient to data plane or overlay failures.

Option C is the correct choice because it utilizes separate physical interfaces for management traffic. This represents true out-of-band (OOB) management. By physically isolating the management interface from the data/overlay interfaces, the operations team retains access to devices even if the overlay network collapses due to routing loops, misconfigurations, or hardware failures on data ports. This physical separation makes troubleshooting significantly easier, as the management channel is unaffected by production network states.

Option D suggests using a Management VRF within an SD-Access fabric. While Cisco best practices often recommend a Management VRF for logical separation in SD-Access, this solution still relies on the underlying underlay infrastructure. If the underlay has routing issues or the control plane fails, access via the Management VRF can still be impacted or lost depending on the specific implementation and reachability of the border nodes. Therefore, it does not guarantee independence from routing issues as effectively as physical separation. Comments discussing this trade-off highlight the distinction between logical isolation (VRF) and physical isolation (separate interfaces), with the latter providing the highest assurance of availability when the overlay is compromised.