2.3.b VXLAN

What this objective tests

This is a describe objective. The exam wants you to explain Virtual Extensible LAN (VXLAN) as an overlay and walk a frame through it. You do not need to build a full fabric.

VXLAN carries Layer 2 frames across a Layer 3 IP underlay. It lets you build many logical Layer 2 segments over a routed network.

The wire format

The encapsulation stack is the mental model to memorize:

inner Ethernet frame
-> VXLAN header with VNI
-> UDP header, destination port 4789
-> outer IP header between VTEP addresses
-> outer Ethernet frame across the underlay

Key facts:

• VXLAN uses UDP destination port 4789.
• The VXLAN Network Identifier (VNI) is 24 bits. VLAN IDs are 12 bits. VXLAN supports far more segments.
• The underlay routes only the outer IP packet. It never sees the tenant frame.

Core roles

The VTEP is the control point. It maps local VLANs to VNIs, encapsulates frames, and sends them to the correct remote VTEP.

L2 VNI and L3 VNI

There are two kinds of VNI in modern fabrics:

• L2 VNI: carries bridged traffic for one Layer 2 segment. A frame in VLAN 10 maps to L2 VNI 10010 and stays in the same subnet.
• L3 VNI: carries routed traffic between subnets. When a host in VLAN 10 talks to a host in VLAN 20, the fabric routes the packet and transports it in an L3 VNI.

For ENCOR, know the distinction. L2 VNI means bridging. L3 VNI means routing inside the fabric.

Example: one frame across two leaf switches

Scenario: Server-A and Server-B are both in VLAN 10, subnet 10.10.10.0/24. Leaf-1 is VTEP 192.0.2.1. Leaf-2 is VTEP 192.0.2.2. VLAN 10 maps to VNI 10010.

Server-A 10.10.10.10 -- VLAN 10 -- Leaf-1 (VTEP 192.0.2.1)
                                      == routed underlay ==
                                   Leaf-2 (VTEP 192.0.2.2) -- VLAN 10 -- Server-B 10.10.10.20

The frame walk:

1. Server-A sends an Ethernet frame to Server-B.
2. Leaf-1 receives the frame on VLAN 10.
3. Leaf-1 maps VLAN 10 to VNI 10010.
4. Leaf-1 encapsulates the frame in VXLAN, UDP destination port 4789.
5. The underlay routes the outer IP packet to 192.0.2.2.
6. Leaf-2 decapsulates the packet.
7. Leaf-2 forwards the original frame out VLAN 10 toward Server-B.

The underlay routed a packet to a VTEP address. It never knew VLAN 10 existed.

Flood-and-learn vs EVPN control plane

VXLAN needs to learn where remote MAC addresses live. Two models exist:

Do not merge the two words. VXLAN is the data-plane encapsulation. EVPN is the control plane that distributes reachability. ENCOR expects you to describe both, not to configure EVPN.

Note: In Cisco SD-Access, connect VXLAN to the data-plane encapsulation role. Do not drift into data-center-only EVPN detail.

Example config fragment

Platform syntax varies. This NX-OS-style fragment shows the pieces to recognize on Leaf-1:

feature nv overlay
feature vn-segment-vlan-based
!
vlan 10
 name TENANT-A
 vn-segment 10010
!
interface loopback0
 description VTEP source
 ip address 192.0.2.1/32
!
interface nve1
 no shutdown
 source-interface loopback0
 member vni 10010
  ingress-replication protocol static
   peer-ip 192.0.2.2

Read it line by line:

• vn-segment 10010: VLAN 10 maps to VNI 10010.
• source-interface loopback0: the VTEP address is 192.0.2.1.
• peer-ip 192.0.2.2: static replication to the remote VTEP.

Leaf-2 mirrors this with source 192.0.2.2 and peer 192.0.2.1.

Lab: underlay first, overlay second

This lab trains the correct troubleshooting order. Use the example values above.

Do these steps:

1. Verify the underlay on Leaf-1 with show ip route 192.0.2.2.
2. Ping 192.0.2.2 from Leaf-1 with source 192.0.2.1.
3. Verify VXLAN state with show nve peers and show nve vni.
4. Verify endpoint learning with show mac address-table vlan 10.
5. Send traffic from Server-A to Server-B.
6. Name the failing layer if step 2 fails. (Answer: underlay reachability.)
7. Name the failing layer if step 2 succeeds but step 3 shows no peer. (Answer: VTEP or VNI state.)
8. Name the failing layer if the peer is up but the Server-B MAC is missing. (Answer: endpoint learning or edge attachment.)

Expected results:

• Step 2 succeeds. Without it, nothing above can work.
• Step 3 shows VNI 10010 up with peer 192.0.2.2.
• Step 4 shows the Server-B MAC learned through the NVE interface.

Gateways and MTU

Hosts in a fabric need a default gateway. Modern fabrics use an anycast gateway: many leaf switches share the same gateway IP and MAC for a subnet. Each host uses its local leaf as gateway.

VXLAN adds about 50 bytes of headers. The underlay MTU must carry the larger outer packets. MTU failures appear only after encapsulation, so they look like random application problems.

Exam traps

• VXLAN uses an IP underlay. Verify underlay routing first.
• VTEPs encapsulate and decapsulate. The VNI identifies the segment.
• VNI is not VLAN, even when they are mapped together.
• VXLAN uses UDP destination port 4789.
• VXLAN does not encrypt traffic by default.
• EVPN is a control plane used with VXLAN, not a synonym for VXLAN.
• If VTEP loopbacks cannot reach each other, the overlay fails.

Pass check

You are ready for this objective when you can do these things:

• Draw the VXLAN wire format from inner frame to outer frame.
• Define VNI, VTEP, underlay, and overlay in one sentence each.
• Explain the difference between an L2 VNI and an L3 VNI.
• Explain the difference between flood-and-learn and EVPN.
• Walk a frame from Server-A to Server-B in seven steps.
• Troubleshoot in the order: underlay, VXLAN state, endpoint learning.