VXLAN Explained: VNIs, VTEPs and Overlay Networks for Network+

VXLAN — Virtual Extensible LAN — exists because traditional VLANs ran out of room. The VLAN ID field in the 802.1Q header is 12 bits, which allows 4,094 usable VLANs. That was generous in 1998 and is nowhere near enough for a modern multi-tenant data centre.

VXLAN uses a 24-bit identifier instead of 12, raising the ceiling from about 4,000 segments to roughly 16 million — and it carries layer 2 traffic across a layer 3 network.

Those two properties are the whole exam answer, and the second one is arguably more important than the first.

The Problems VXLAN Solves

Scale. 4,094 VLANs is a hard limit. A cloud provider with thousands of customers, each needing several isolated segments, exhausts it immediately.

Layer 2 across layer 3. Traditional VLANs cannot cross a router. But virtual machine live migration generally requires the VM to keep its IP address, which means the destination host must be in the same layer 2 domain. Stretching VLANs across a data centre with large spanning tree domains is fragile and wasteful. VXLAN tunnels layer 2 frames inside layer 3 packets, so the underlying network can be fully routed while the workloads still believe they share a segment.

Spanning tree waste. A routed underlay can use every link via equal-cost multipath, instead of blocking redundant paths the way STP must.

How It Works

VXLAN is an encapsulation protocol. The original Ethernet frame is wrapped in a VXLAN header, then UDP, then IP, then a new Ethernet header — sometimes called MAC-in-UDP.

• VNI — VXLAN Network Identifier. The 24-bit segment ID, the direct equivalent of a VLAN ID.
• VTEP — VXLAN Tunnel Endpoint. The device that encapsulates and decapsulates. It may be a physical switch or a virtual switch in a hypervisor. VTEPs are the only devices that need to understand VXLAN; everything between them just routes IP.
• UDP port 4789 is the IANA-assigned destination port. Worth memorizing.
• Overlay and underlay. The underlay is the physical routed IP network. The overlay is the virtual layer 2 network built on top. This vocabulary appears across SDN and cloud material.

One practical consequence: the added headers increase packet size by roughly 50 bytes, so the underlay needs a larger MTU — commonly 9000-byte jumbo frames. Forgetting to raise the MTU is the classic VXLAN deployment failure, producing fragmentation or silent drops that look like an application problem.

Finding the Destination

A VTEP needs to know which remote VTEP holds a given MAC address. Early implementations used multicast flood-and-learn, which worked but required multicast in the underlay — something many networks did not want to run.

Modern deployments use EVPN (Ethernet VPN) with BGP as the control plane, distributing MAC and IP reachability information between VTEPs directly. VXLAN with BGP EVPN is the current standard design for data centre fabrics, usually in a spine-and-leaf topology, and the pairing is worth knowing by name.

Comparison With the Alternatives

	VLAN	VXLAN	GRE	NVGRE / STT
Identifier size	12-bit, 4,094 usable	24-bit, ~16 million	n/a	24-bit
Crosses layer 3?	No	Yes	Yes	Yes
Transport	802.1Q tag	UDP 4789	IP protocol 47	GRE / TCP-like
Adoption	Universal	Data centre standard	General tunnelling	Largely superseded

Note the UDP choice in VXLAN: because the source port is derived from a hash of the inner frame, existing ECMP load balancing in the underlay spreads tunnel traffic across multiple paths automatically. That is a deliberate design detail rather than an accident.

Security Considerations

VXLAN provides isolation, not encryption. The encapsulated frame travels in cleartext, so anyone who can capture underlay traffic can read the tenant's data. Confidentiality requires IPsec or MACsec over the top — a point worth knowing because "VXLAN segments tenants, therefore tenants are protected" is a tempting and wrong conclusion.

Other points: a rogue or spoofed VTEP could inject traffic into a segment, so the underlay and the control plane need protecting; and VXLAN traffic is opaque to security tools that do not decapsulate it, which creates a monitoring blind spot if the IDS sits in the underlay.

Network+ (N10-009) Exam Tips

• VLAN IDs are 12-bit with 4,094 usable; VXLAN VNIs are 24-bit with about 16 million. The headline numbers.
• VXLAN carries layer 2 over layer 3 by encapsulating frames in UDP.
• UDP port 4789.
• Know VTEP, VNI, overlay and underlay.
• MTU must be increased to accommodate the encapsulation overhead.
• Spine-and-leaf is the topology it is usually deployed in, and it replaces spanning tree with routed ECMP.
• It does not encrypt.

Cloud+ and Security+ Angles

Cloud+ (CV0-004) notes that cloud provider virtual networks are built on overlay technologies of this kind — the isolation between two customers using the same private address range is encapsulation plus a segment identifier, which is exactly this mechanism.

Security+ (SY0-701) treats it under segmentation and micro-segmentation, with the caveat that logical isolation is not confidentiality.

Key Takeaways

• VXLAN raises the segment limit from 4,094 to roughly 16 million using a 24-bit VNI.
• It tunnels layer 2 frames over a layer 3 network, which is what enables VM mobility across a routed fabric.
• VTEPs encapsulate and decapsulate; everything between them just routes IP.
• UDP port 4789, with roughly 50 bytes of overhead — raise the MTU.
• BGP EVPN is the modern control plane, replacing multicast flood-and-learn.
• It isolates but does not encrypt.