Traditional campus vs SD-Access: underlay and overlay, group-based policy from Catalyst Center

In a traditional campus, segmentation and policy are tied to network topology. You create VLANs, map each VLAN to a subnet and default gateway, and write IP-based access control lists to control traffic between subnets. If you want a user group available in several buildings, you stretch VLANs across trunks, which brings spanning tree, broadcast domains that grow and larger failure domains. Every switch is configured by hand, and ACLs grow into long lists of addresses that must change whenever addressing changes.