2.0 Virtualization

Virtualization is the idea of making one physical system behave like many logical systems.

For ENCOR, think of virtualization in three buckets:

1. Device virtualization: hypervisors, virtual machines, and virtual switches.
2. Data path virtualization: VRFs and tunnels that keep traffic separate or carry it across another network.
3. Network virtualization: LISP and VXLAN, where the network separates endpoint identity from transport or builds overlays on top of an IP underlay.

You do not need to turn this into a cloud engineering course. You need to be able to explain what each technology is, what problem it solves, how traffic moves, and how to verify the configuration topics that are listed as configure-and-verify.

The exam version of the story

A normal network forwards traffic by looking at a destination IP address in one routing table.

Virtualization adds indirection.

A router can have multiple routing tables with VRFs. A packet can be wrapped inside another packet with GRE. A tunnel can be protected with IPsec. A host can run as a VM on a hypervisor instead of on a dedicated server. A virtual switch can connect VM NICs to each other and to a physical network. A fabric can carry overlays using LISP or VXLAN.

The key is to ask two questions every time:

• What is the inner traffic?
• What is the outer transport?

For example, GRE carries an inner packet across an outer IP path. VXLAN carries an inner Ethernet frame across an outer IP/UDP path. LISP carries endpoint traffic by mapping endpoint identifiers to routing locators.

High-yield comparison

Verification mindset

When a virtualization problem appears, do not start by memorizing commands. Start by finding the boundary.

Original endpoint traffic
logical boundary: VM, VLAN, VRF, tunnel, VNI, EID
outer forwarding system: host uplink, underlay route, WAN path, RLOC, VTEP
destination logical boundary
original endpoint traffic again

Then verify both layers.

For a tunnel, verify the tunnel and the underlay route.

show interface tunnel0
show ip route <tunnel-destination>
show ip route <remote-inner-prefix>
ping <remote-inner-ip> source <local-inner-ip>

For a VRF, verify the right table.

show vrf
show ip route vrf BLUE
ping vrf BLUE 10.10.10.2

For an overlay, verify the underlay first.

show ip route <remote-vtep-or-rloc>
show lisp map-cache
show nve peers
show nve vni

Commands vary by platform, but the method does not: prove that the outer network works, then prove the virtualized path works.

Lab: draw the inner and outer packet

Use this lab before configuring anything.

Topology

Host-A -> R1 -> Underlay / WAN -> R2 -> Host-B

Task

For each technology, write what the device uses to forward the packet.

Pass condition

You pass this lab when you can explain why the underlay can be completely unaware of the inner customer traffic. The underlay only needs to deliver the outer packet.

Exam traps

• A VRF is not a VLAN. A VLAN separates Layer 2 broadcast domains. A VRF separates Layer 3 routing tables.
• GRE does not encrypt by itself. GRE gives you encapsulation. IPsec gives you protection.
• A tunnel interface can look healthy while the inner route is wrong.
• VXLAN is not just “a bigger VLAN.” It is an overlay that uses VTEPs and VNIs over an IP underlay.
• LISP does not simply replace routing. It adds a mapping system between endpoint identifiers and routing locators.

Quick check

1. Which topics in this domain are configure-and-verify?
2. Why do you verify the underlay before the overlay?
3. What is the difference between VRF separation and tunnel encapsulation?
4. Which technologies in this domain wrap one packet or frame inside another packet?
5. Which technologies use a mapping system or identifier that is not the same as the normal destination IP route?