VXLANs

VXLAN, or Virtual Extensible LAN, is an encapsulation technology used to extend Layer 2 networks over an IP-based underlay. It enables large-scale, multi-tenant data centers by mapping each tenant or network segment to a VXLAN Network Identifier (VNI), supporting up to 16 million distinct VNIs.

VXLAN encapsulates each L2 frame inside a UDP/IP packet. The outer header provides the underlay transport between VXLAN Tunnel End Points (VTEPs), which reside on hypervisors or top-of-rab switches. The VXLAN header is 8 bytes and carries a 24-bit VNI. The standard UDP destination port is 4789, though some deployments may use alternative ports. The underlay must provide IP connectivity between VTEPs.

Traffic forwarding in VXLAN relies on VTEPs to learn MAC addresses and forward frames. In basic deployments without a control plane, broadcast, unknown unicast, and multicast traffic can be flooded to all VTEPs in the same VNI using multicast or head-end replication. For scalable operation, many networks employ an EVPN (Ethernet VPN) control plane, typically using BGP, to distribute MAC reachability and VTEP mappings, enabling efficient, scalable replication without widespread flooding.

Security and management considerations include tenant isolation through VNIs, with VXLAN providing no encryption by default. To protect data confidentiality, encryption such as IPsec can be applied to the underlay or the tunnel. Operational aspects include underlay design, VTEP placement, MTU negotiation, and troubleshooting.

Common use cases for VXLAN include extending L2 networks across data centers, enabling multi-tenant cloud environments, disaster recovery replication, and fabric-based interconnects in large-scale networks.