Introduction to VXLAN

Why carry Ethernet over IP?

VXLAN moves responsibilities rather than removing limits. VTEP MAC tables, neighbor tables, replication and control-plane scale still need capacity planning. Local access networks still need loop prevention. An overlay is also not encryption or authentication.

One application segment spans two edges in the example. A plain router will not bridge its ARP broadcasts. VXLAN adds a wrapper between VTEPs so the tenant can retain Layer 2 connectivity while transit uses IP routing.

Identify the two endpoint instances

One Ethernet segment across an IP fabricIllustrative topology

The example uses VTEP1 at 10.255.0.1 and VTEP2 at 10.255.0.2. Each endpoint can terminate many VNIs using the same transport address. A software virtual switch can act as a VTEP, as can a supported hardware switch. A transit router that merely forwards outer IP is not a VTEP for this segment.

Keep VLAN, VNI and destination separate

The VNI field is 24 bits, giving a roughly 16-million identifier space, not a guarantee of that many supported segments. Reserved values and usable ranges depend on platform. These examples use VNI 5012. An access VLAN tag is not automatically copied as a VNI, and the remote edge may reconstruct a different local tag.

Inspect the wrapper

Outer Ethernet: next-hop MAC addresses on the current link
Outer IPv4:     10.255.0.1 -> 10.255.0.2
Outer UDP:      source 55001 -> destination 4789
VXLAN:          I flag = 1, VNI = 5012
Inner Ethernet: 02:00:00:00:00:11 -> 02:00:00:00:00:22
Inner IPv4:     10.10.10.11 -> 10.10.10.22

This is an illustrative decode, not a recorded capture. UDP destination 4789 is the standard VXLAN port. The source port shown is an example: an implementation can derive it from inner-flow fields to provide entropy for underlay ECMP. It is not H1’s TCP or UDP application port. VXLAN uses an eight-byte header containing flags and the VNI; the I flag indicates that the VNI is valid.

One frame, four decisions

The outer Ethernet addresses change at routed hops and the outer IP TTL is decremented. In this bridged example the inner IP TTL is not decremented merely by crossing the VXLAN tunnel. A later overlay routing operation would be different. The transport does not hash directly on the VNI as a universal rule; actual hashing fields are platform dependent.

Budget the real packet size

For an untagged inner Ethernet frame carrying a 1500-byte IP packet, inner Ethernet is 1514 bytes excluding FCS. Adding VXLAN 8 + UDP 8 + outer IPv4 20 gives an outer IP packet of 1550 bytes. Adding untagged outer Ethernet 14 gives 1564 bytes excluding FCS: 50 bytes more than the original Ethernet frame. Outer IPv6 adds another 20 bytes; tags and other encapsulations change the budget.

Check the platform’s definition of interface MTU rather than blindly adding 50 to every display value. A successful small ping cannot establish full-size VXLAN forwarding. Do not rely on fragmentation to compensate for an undersized underlay.

How does the edge learn the destination?

The data plane needs a destination-MAC-to-remote-VTEP mapping. Static provisioning, flood-and-learn mechanisms and an EVPN control plane are different ways of supplying forwarding information. They are not interchangeable commands, and EVPN is not required merely to use VXLAN encapsulation. Broadcast, unknown-unicast and multicast traffic also need an explicit replication design.

Segment   Destination MAC     Location
VNI 5012  02:00:00:00:00:11    local access attachment
VNI 5012  02:00:00:00:00:22    remote VTEP 10.255.0.2

This is a teaching table, not a vendor show command. The remote entry selects the outer destination, while the VNI preserves segment context. A matching MAC address in another VNI is a separate forwarding entry.