Enabling SD-Access for Remote Sites with SD-WAN

300-420 By islever Editorial Last updated Oct 20, 2026

Describe SD-Access fabric design considerations for wired and wireless access (overlay, fabric design, control plan design, border design, segmentation, virtual networks, scalability, over the top and fabric for wireless, multicast)

Short answer

C Use a separate fabric domain for each site and use SD-WAN as the underlay.

Question

What is the easiest way to enable SD-Access for all your remote sites after you have your campus SD-Access fabric up and running?

Treat all the sites as one fabric domain and use the traditional physical network as the underlay.
Use a separate fabric domain for each site and use the traditional physical network as the underlay.
Use a separate fabric domain for each site and use SD-WAN as the underlay Correct Answer
Treat all the sites as one fabric domain and use SD-WAN as the underlay

Key Takeaways

The exam tests knowledge of SD-Access multisite architecture, specifically the trap of assuming a single large fabric or traditional WAN; the correct design uses SD-WAN to interconnect independent fabric sites.

This question addresses the design of multi-site SD-Access fabrics by leveraging Cisco SD-WAN as the transport underlay. It establishes that using separate fabric domains per site with SD-WAN integration is the recommended scalable approach.

Common mistake: Candidates often choose Option A (single domain) because it seems simpler, failing to realize that scaling a single fabric across geographically dispersed sites creates management and segmentation issues.

Expert Analysis

Why the Answer Is Correct

Option C is the correct answer because Cisco's official architecture for extending SD-Access to remote sites involves treating each site as a separate fabric domain. These domains are then interconnected using a dedicated overlay network provided by Cisco SD-WAN, which acts as the transit underlay. This design allows for consistent policy enforcement while maintaining scalability and isolation between sites.

Why the Other Options Are Wrong

Option A is incorrect because creating a single fabric domain across all remote sites is not scalable and violates best practices for segmentation. Options B and D suggest using the "traditional physical network" or a single domain with SD-WAN, respectively; these do not align with the specific SD-Access/SD-WAN integration model where SD-WAN provides the necessary overlay transport for distributed fabric sites.

Community Comment Notes

Community consensus strongly supports Option C. As noted by user iSDA69, referencing the Cisco CVD guide, this is the standard deployment model. User MaxwellJK clarified that "Cisco describes the SD-Access fabric-site underlay/GRT being mapped into a dedicated SD-WAN Service VPN," confirming the technical mechanism. While some users initially questioned if SD-WAN could be an underlay, the context here refers to the logical transport layer provided by SD-WAN for the fabric overlay.

Official Reference

https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Campus/Cisco-SD-Access-SD-WAN-Independent-Domain-Guide.pdf

This link opens the official vendor documentation in a new tab.

Exam Strategy

When designing multi-site solutions, always look for 'separate fabric domains' combined with 'SD-WAN' as the interconnection method. Avoid options suggesting a single massive fabric spanning diverse locations, as this contradicts SD-Access scalability principles.

Frequently Asked Questions

Why can't I use a single fabric domain for all sites?

A single domain becomes unmanageable at scale. Separate domains allow for better segmentation and localized control while SD-WAN handles inter-site transport.

Is SD-WAN considered an underlay in this context?

Yes, logically. SD-WAN provides the overlay transport that serves as the underlay connectivity for the SD-Access fabric overlays between sites.

More 300-420 FAQ →

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

NoHombre 👍 3 Answered A

C and D cant be the answer cause SD-WAN is not an underlay technology, and between A and B, A makes more sense
12504a3 👍 2 Answered A

Using SD-WAN as an underlay is completely wrong, one of the option would have been to use SD-WAN Transits but this not an anwser. So A or B ? It should be A : treating all sites as one fabric domain avoids the complexity of managing multiple fabric domains and supports consistent policy enforcement and segmentation across all sites.
iSDA69 👍 2 Answered C

AI suggested doc and answer (C). D is only for small deployments. Is better to use SD-WAN than the traditional WAN (answer A): https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Campus/Cisco-SD-Access-SD-WAN-Independent-Domain-Guide.pdf
iomar55 👍 2 Answered C

https://www.cisco.com/c/en/us/td/docs/solutions/CVD/Campus/cisco-sd-access-for-distributed-campus-with-cisco-sd-wan-integration-guide.html
MaxwellJK 👍 1 Answered C

For SD-Access multisite integration, Cisco can use the SD-WAN domain as the transit between SD-Access fabric sites. Cisco describes the SD-Access fabric-site underlay/GRT being mapped into a dedicated SD-WAN Service VPN for transport between sites.

Show 1 more comment

drinu89 👍 1 Answered C

Use a separate fabric domain for each site and use SD‑WAN as the underlay

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All 300-420 Questions

Access 150 questions with complete answers and detailed explanations.

View Full 300-420 Practice Test →

← Back to 300-420 Study Guide