VXLAN

Modern data centers host thousands of virtual machines distributed across many physical servers.
This creates a significant networking challenge for engineers.

The VLAN Scalability Problem

These virtual machines require Layer 2 connectivity.
They must behave as if they are on the same switch, even across different racks or buildings.

Traditional VLANs cannot meet this demand.
The 802.1Q standard uses a 12-bit VLAN ID field, which limits you to 4094 VLANs across your entire infrastructure.

Figure 1 – VLAN scalability limitation in a multi-tenant data center

In a multi-tenant data center where each customer requires isolated network segments, that ceiling is reached quickly.

There is a second problem.
Modern data centers use a routed spine-leaf architecture where every link is a Layer 3 link.
VLANs are a Layer 2 construct and cannot cross Layer 3 boundaries without complex workarounds.

VXLAN as the Solution

VXLAN (Virtual eXtensible LAN), defined in RFC 7348, solves both problems.

It encapsulates Layer 2 Ethernet frames inside UDP packets, creating a virtual Layer 2 network that travels freely across any Layer 3 infrastructure.

Figure 2 – The VXLAN

Instead of a 12-bit VLAN ID, VXLAN uses a 24-bit VNI (VXLAN Network Identifier).
That is over 16 million unique segments, enough for any multi-tenant environment at any scale.

VXLAN is built on a two-layer model: a physical IP network below, and a virtual Layer 2 network above.
Understanding this separation is the foundation of everything that follows.

The Underlay Network

The underlay is your physical IP network.
In a data center, this is typically a routed spine-leaf fabric where every switch runs a routing protocol such as OSPF or BGP.

Figure 3 – The underlay IP fabric: a routed spine-leaf network carrying VXLAN traffic

The underlay has one job: forward IP packets between devices.
It carries VXLAN-encapsulated traffic without knowing anything about the virtual networks inside.

The Overlay Network

The overlay is the virtual Layer 2 network built on top of the underlay.

• Each VNI defines one isolated segment.

VMs inside the same VNI communicate as if they share the same switch, regardless of where they physically sit in the fabric.