SD-Access: the campus fabric, the control, data and policy planes
Every mechanism gets a step-by-step animation, the configuration explained line by line and exam notes. Wherever a parameter changes the outcome, there's a simulator where you change it yourself.
TL;DR
SD-Access is Cisco's campus fabric: a routed underlay (IS-IS, /32 loopbacks as RLOCs, MTU 9100) on top of which LISP keeps track of hosts (EID → RLOC) and VXLAN-GPO carries their traffic between edges, with the VNI saying which Virtual Network the packet belongs to and the SGT saying what the source is. The edge authenticates the host through ISE, registers it with the control plane node, serves it an anycast gateway and applies the TrustSec matrix at egress. The border translates toward the rest of the world, the fabric WLC and the APs bring wireless into the same model, and transit links multiple sites together. Catalyst Center writes all the configuration; most incidents come from MTU, from unregistered hosts and from missing enforcement.
How to read the notes: red = critical for the exam, green = theory, blue = numbers, yellow = pitfalls, cyan = differences between standards, platforms and campus ↔ data center. In the animations, the configuration lines used by the current step are highlighted automatically; the ← → arrows change the step while an animation is selected.
The analogy, in short
Think of a large conference center: a central reception keeps the register of who is in which room, each room's doorkeepers sign attendees in and send envelopes inside outer envelopes addressed to the room, with the sender's wristband color written on them; the doorkeeper at the destination room checks the notice board to see whether that color is allowed to reach the recipient.
The model holds up to §11. From §12 onward (multicast, L2 flooding, cache convergence), it breaks down; see the full analogy and its limits in §16.