2.3.b VXLAN

VXLAN is an overlay technology that carries Layer 2 frames across a Layer 3 IP underlay.

The simple version:

Original Ethernet frame
VXLAN encapsulation
UDP/IP packet across the underlay
decapsulation
original Ethernet frame delivered

VXLAN is common in data center and fabric designs because it lets you build many logical Layer 2 segments over a routed network.

The wire format is the important mental model:

inner Ethernet frame
VXLAN header with VNI
UDP destination port 4789
outer IP header between VTEP addresses
outer Ethernet frame across the underlay

The VNI is 24 bits, which gives far more logical segments than the 12-bit VLAN ID field. That does not make VLANs disappear; it means VLANs can be mapped to VNIs at the fabric edge.

Why VXLAN exists

Traditional VLANs have limits. VLAN IDs are 12 bits, so the usable VLAN space is limited. More importantly, large Layer 2 networks can be hard to scale and operate.

VXLAN uses a VNI, or VXLAN Network Identifier. A VNI is a logical segment identifier. A VNI is often mapped to a VLAN at the edge of the fabric.

VLAN 10 at the edge
 VNI 10010 in the overlay
VLAN 20 at the edge
 VNI 10020 in the overlay

The underlay does not need to know about the tenant VLAN. It only routes IP packets between VTEPs.

Core terms

Packet walk

Imagine two servers in the same logical segment but attached to different leaf switches.

Server-A
Leaf-1/VTEP
IP underlay
Leaf-2/VTEP
Server-B VLAN 10 VNI 10010 VNI 10010 VLAN 10

Traffic flow:

1. Server-A sends an Ethernet frame to Server-B.
2. Leaf-1 receives the frame on VLAN 10.
3. Leaf-1 maps VLAN 10 to VNI 10010.
4. Leaf-1 encapsulates the frame in VXLAN.
5. The underlay routes the outer IP packet to Leaf-2's VTEP address.
6. Leaf-2 decapsulates the packet.
7. Leaf-2 forwards the original frame out VLAN 10 toward Server-B.

The underlay routed packet is not the same as the inner tenant frame. That distinction is the exam-winning idea.

If a packet is too large after VXLAN encapsulation, the failure can look like an application or intermittent reachability problem. Underlay MTU must account for the outer Ethernet/IP/UDP/VXLAN headers.

VNI vs VLAN

A VLAN is a Layer 2 segment identifier on an Ethernet link.

A VNI is an overlay segment identifier carried in the VXLAN header.

They can be mapped together, but they are not the same thing.

Local edge: VLAN 10
Overlay: VNI 10010
Remote edge: VLAN 10 or another local VLAN mapped to the same VNI

Flood-and-learn vs control plane

VXLAN needs a way to know where remote MAC addresses live.

Two common models:

• Flood-and-learn: unknown traffic is replicated to remote VTEPs. Simple concept, less scalable.
• EVPN control plane: BGP EVPN advertises MAC and IP reachability. More scalable and common in modern fabrics.

ENCOR v1.2 expects you to describe the concepts, not build a full EVPN fabric from scratch. The high-value distinction is underlay versus overlay: the underlay routes between VTEP IP addresses; the overlay carries tenant VLAN and VNI traffic. If a scenario includes SD-Access, connect VXLAN to the data-plane encapsulation idea rather than drifting into data-center-only EVPN minutiae.

Do not collapse VXLAN and EVPN into the same word. VXLAN is the data-plane encapsulation. EVPN is a common control plane that advertises reachability information.

Simplified NX-OS-style lab

Platform syntax varies. This is a compact reading/practice lab for understanding the pieces.

Topology

Server-A · VLAN 10 -> Leaf-1 · VTEP 192.0.2.1 -> Routed underlay · VXLAN UDP/4789 -> Leaf-2 · VTEP 192.0.2.2 -> Server-B · VLAN 10 · VNI 10010

Leaf-1 concept config

feature nv overlay
feature vn-segment-vlan-based
vlan 10
 name TENANT-A
 vn-segment 10010
interface loopback0
 description VTEP source
 ip address 192.0.2.1/32
interface nve1
 no shutdown
 source-interface loopback0
 member vni 10010
 ingress-replication protocol static
 peer-ip 192.0.2.2

Leaf-2 concept config

feature nv overlay
feature vn-segment-vlan-based
vlan 10
 name TENANT-A
 vn-segment 10010
interface loopback0
 description VTEP source
 ip address 192.0.2.2/32
interface nve1
 no shutdown
 source-interface loopback0
 member vni 10010
 ingress-replication protocol static
 peer-ip 192.0.2.1

Verify

show nve peers
show nve vni
show mac address-table vlan 10
show ip route 192.0.2.2
ping 192.0.2.2 source 192.0.2.1

The underlay route between VTEP loopbacks must work. If the VTEPs cannot reach each other, VXLAN cannot save you.

Lab: underlay first, overlay second

Goal

Troubleshoot in the right order.

Given

Leaf-1 VTEP: 192.0.2.1/32
Leaf-2 VTEP: 192.0.2.2/32
VNI: 10010
Server-A: 10.10.10.10/24
Server-B: 10.10.10.20/24

Step 1: verify underlay

Leaf-1# show ip route 192.0.2.2
Leaf-1# ping 192.0.2.2 source 192.0.2.1
Leaf-2# show ip route 192.0.2.1
Leaf-2# ping 192.0.2.1 source 192.0.2.2

Step 2: verify VXLAN state

show nve peers
show nve vni

Step 3: verify endpoint learning

show mac address-table vlan 10
show mac address-table dynamic

Pass condition

You can say whether the failure is underlay reachability, VTEP/VNI state, or endpoint learning.

VXLAN and default gateways

In a fabric, hosts may need a default gateway. Designs often use anycast gateway, where multiple leaf switches share the same gateway IP and MAC for a subnet. That lets hosts use a local gateway while the fabric handles mobility and forwarding.

Do not overcomplicate this for ENCOR. Know the idea: VXLAN can extend segments, and modern fabrics can provide distributed gateway behavior.

Exam traps

• VXLAN uses an IP underlay. Underlay routing must work first.
• VTEPs encapsulate and decapsulate VXLAN traffic.
• VNI is not the same as VLAN, even when they are mapped.
• VXLAN does not encrypt traffic by default.
• EVPN is a control plane often used with VXLAN, not a synonym for VXLAN.
• VXLAN commonly uses UDP destination port 4789.
• MTU problems can appear only after encapsulation.
• If VTEP loopbacks cannot reach each other, overlay forwarding fails.

Quick check

1. What does a VTEP do?
2. What does a VNI identify?
3. Why should you verify underlay reachability first?
4. What is the difference between flood-and-learn and EVPN control plane?
5. Does VXLAN encrypt traffic by default?