Table of Contents
Overview
Virtual Extensible LAN, usually shortened to VXLAN, is a technology that creates virtual Layer 2 networks on top of an existing Layer 3 IP network. You can think of it as a way to stretch VLAN like segments across routers, data centers, or clouds, without being limited by traditional VLAN identifiers or by the physical topology.
VXLAN belongs to the family of overlay network technologies. It takes Ethernet frames from a tenant or application network, wraps them inside UDP/IP packets, and sends them across a routed underlay network. At the other edge, the frames are unwrapped and delivered as if the devices were on the same local VLAN.
The Need VXLAN Addresses
Traditional VLANs use a 12 bit VLAN ID field. This gives a maximum of 4094 usable VLANs. In modern data centers with many tenants, applications, and isolated environments, this number can become a hard limit. VLANs are also limited by spanning tree based Layer 2 domains. Large Layer 2 domains can be fragile and difficult to scale.
VXLAN solves these problems by moving the logical separation into an overlay. Instead of relying on VLAN tags and a large Layer 2 fabric, VXLAN uses an IP routed fabric as the transport. This splits the design into:
Underlay: a simple, scalable, routed IP network, often using ECMP and modern routing protocols.
Overlay: VXLAN segments that carry tenant Layer 2 traffic on top of the underlay.
VXLAN Identifiers and Address Space
One of the most important characteristics of VXLAN is the size of its network identifier. VXLAN uses a 24 bit field called the VXLAN Network Identifier, or VNI.
A 24 bit field supports:
$$2^{24} = 16,777,216 \text{ possible values}$$
This is a huge increase compared with the 4094 VLAN limit. VNIs are used to identify the virtual Layer 2 segment within the overlay.
To see the contrast clearly:
| Technology | Identifier type | Bits | Maximum segments (theoretical) |
|---|---|---|---|
| VLAN | VLAN ID | 12 | 4096 |
| VXLAN | VNI | 24 | 16,777,216 |
Key statement: VXLAN provides up to $2^{24}$ VNIs, which is 16,777,216 possible virtual segments, far beyond the VLAN scale limit.
Encapsulation Concept
VXLAN is an encapsulation technology. It takes a normal Ethernet frame from the original network and puts it inside a new packet that can be routed across the underlay.
Conceptually, the packet transformation looks like this:
Original frame:
[ Original Ethernet header ][ Original payload ]
VXLAN encapsulated packet:
[ Outer Ethernet ][ Outer IP ][ UDP ][ VXLAN header with VNI ][ Original Ethernet ][ Original payload ]
The outer IP and UDP headers make the packet routable across the underlay IP network. The VXLAN header carries the VNI which identifies which virtual segment the inner frame belongs to.
VXLAN uses UDP as the transport protocol. A well known UDP destination port (typically 4789) is used so that devices can identify VXLAN traffic and process it accordingly.
Key statement: VXLAN encapsulates entire Layer 2 Ethernet frames inside UDP/IP packets, and the VNI in the VXLAN header tells the receiver which virtual network the frame belongs to.
The Role of VTEPs
VXLAN does not run on end hosts directly in most enterprise designs. Instead, edge devices perform the encapsulation and decapsulation. These devices are called VXLAN Tunnel Endpoints, or VTEPs.
A VTEP typically has:
An IP interface in the underlay network. This IP address is the source and destination for VXLAN UDP packets.
One or more interfaces or logical subinterfaces that connect to local VLANs or port based segments. These are mapped to VNIs.
When a VTEP receives an Ethernet frame from a local host, the VTEP checks which VNI corresponds to that VLAN or segment. It then encapsulates the frame with an outer IP and UDP header, adds the VXLAN header with the correct VNI, and sends it toward the remote VTEP.
When a VTEP receives a VXLAN packet from the underlay, it looks at the VNI, strips off the outer headers, and forwards the original Ethernet frame into the local segment that corresponds to that VNI.
Overlay vs Underlay with VXLAN
With VXLAN you always have two distinct but related network layers.
The underlay is the physical or base IP network. It connects VTEPs using normal Layer 3 routing. The underlay is responsible for delivering IP packets between VTEPs and usually does not care about tenant segmentation.
The overlay is formed by VXLAN tunnels between VTEPs. Within this overlay, devices can behave as if they are on the same Layer 2 segment, even though their traffic is being routed through the underlay.
In modern data centers the underlay is often built with a leaf spine architecture. VTEP functions usually exist on leaf switches, which means the overlay terminates at the network edge where servers connect.
Layer 2 Extension with VXLAN
A core use case for VXLAN is to extend Layer 2 segments across locations that are separated by Layer 3 boundaries. For example, two racks of servers in different rows or different data centers might both need to share the same subnet and default gateway behavior.
Instead of creating a huge Layer 2 domain with spanning tree, VXLAN lets each location connect servers to a local switch. Those switches act as VTEPs and create VXLAN tunnels between them. To the servers, this appears as a single broadcast domain. Underneath, the traffic is simply IP routed between the switches.
This is valuable whenever you need:
Workload mobility, where virtual machines or containers move across racks or sites while keeping IP addresses.
Tenant isolation, where each customer or application has its own virtual network.
Consistent addressing, where you prefer the same subnet to exist in multiple physical locations.
VXLAN and Multicast
At a basic level VXLAN must handle unknown unicast, broadcast, and multicast traffic within the overlay. Inside a normal VLAN, this type of traffic is flooded to all ports in that VLAN. VXLAN needs a way to perform equivalent flooding across VTEPs.
One option is to use multicast in the underlay. In this model, each VNI is mapped to an IP multicast group. VTEPs that participate in a particular VXLAN segment join the corresponding multicast group. When a VTEP needs to flood traffic for that VNI, it sends a VXLAN packet to the multicast group address. The IP network replicates and delivers this to all VTEPs that joined the group.
This method closely mirrors traditional Layer 2 flooding behavior but moves the replication to the routed underlay using multicast mechanisms. However, it requires multicast configuration and support in the underlay network.
Some deployments avoid multicast and use other control plane mechanisms, often through EVPN, which is covered separately. In such designs, the control plane tells VTEPs where to send traffic, so underlay multicast is not required for flooding.
VXLAN and MAC Learning
In a pure Layer 2 switch, MAC addresses are learned from incoming frames, and the switch then knows which port to use when sending traffic to that MAC. With VXLAN overlays, there is a similar need to know which remote VTEP holds which MAC addresses.
There are two high level approaches:
Data plane learning, where VTEPs learn MAC to VTEP mappings by examining incoming VXLAN packets. This resembles how traditional switches learn from frames.
Control plane learning, where a separate protocol informs VTEPs of MAC reachability. Ethernet VPN, or EVPN, is commonly used for this role and is treated separately in its own topic.
In simple multicast based VXLAN deployments, data plane learning combined with underlay multicast may be used. In more advanced deployments, control plane learning via EVPN is preferred for scalability and better convergence.
VXLAN and Multi Tenancy
Because VXLAN provides a very large identifier space and separates overlay from underlay, it is extremely suitable for multi tenant environments. Each tenant can be assigned one or more VNIs. Their traffic remains isolated in the overlay, even if they share the same physical infrastructure in the underlay.
Tenants can also use overlapping IP address ranges, because isolation is achieved at the VXLAN VNI level. The underlay sees only the VTEPs’ IP addresses, not the tenant IP addresses. The tenant addressing schemes are confined to their VNIs.
This form of logical separation is foundational for modern cloud architectures and large enterprise data centers that must host many logical environments on shared hardware.
VXLAN and Anycast Gateway
An important concept closely associated with VXLAN fabric designs is the use of distributed or anycast gateways. The idea is that multiple VTEPs, often leaf switches, share the same default gateway IP and MAC address for a subnet.
From the host point of view there is one default gateway. In reality, whichever leaf switch the host connects to provides the default gateway function locally. This reduces traffic tromboning and keeps routing decisions close to the source.
In a VXLAN overlay, this allows each subnet to be extended across multiple leaf switches and racks. Anycast gateway behavior keeps first hop routing efficient while VXLAN tunnels carry intra and inter subnet traffic across the fabric.
VXLAN in Data Center Fabrics
VXLAN is heavily used in modern data center designs, especially when combined with a leaf spine underlay. Key characteristics in that context include:
Routed underlay with equal cost multipath (ECMP) so that many parallel paths can be used for load balancing.
VTEPs at the leaf layer, often integrated with routing and switching on the same hardware.
Overlay networks built for each tenant or application, often connected to external networks through border leaf devices.
Because the overlay is independent of the physical layout, servers and virtual machines can move between racks without affecting IP addresses or breaking segmentation.
VXLAN over Long Distances
VXLAN can also be used to stretch networks across data centers or between on premises and cloud environments. Since it is IP based, it only requires IP reachability between VTEPs. The intermediate transport could be MPLS, the open internet through secure tunnels, or a private WAN.
However, stretching Layer 2 segments across long distances must be done carefully, especially when you consider latency and failure domains. The fact that VXLAN allows it does not automatically mean it is always a good design choice. In many cases, VXLAN overlays for Layer 3 segmentation are favored to limit extended broadcast domains, while still enabling flexible connectivity.
VXLAN Overhead and MTU
Encapsulation always adds overhead to packets. VXLAN adds its own header, plus an outer UDP and IP header, and sometimes additional transport headers depending on deployment. This makes the VXLAN packet larger than the original Ethernet frame.
If the underlay MTU is not increased, VXLAN packets might be fragmented or dropped. In practical designs, the underlay is configured with a larger MTU, sometimes called a jumbo MTU, to accommodate the extra bytes introduced by VXLAN.
Important rule: The underlay MTU must be large enough to carry the original Ethernet frame plus all VXLAN encapsulation headers. Failing to account for VXLAN overhead leads to fragmentation or packet loss.
VXLAN and Integration with Routing
Within a VXLAN fabric, traffic can stay within a VNI or move between VNIs. When traffic remains within a VNI, the behavior resembles a bridged VLAN. When traffic moves between VNIs, routing is required.
Modern implementations perform routing at the VTEPs, often with the anycast gateway concept mentioned earlier. The VTEPs act as both Layer 2 and Layer 3 devices. They bridge within VNIs and route between VNIs.
Because VXLAN overlays are identified by VNI, route leaking between VNIs can be controlled. This lets you design fine grained policies about which tenants or segments may communicate, even though they share the same physical underlay.
VXLAN and EVPN Context
Although EVPN is a separate topic, it is useful to understand how VXLAN fits into that picture conceptually. VXLAN is the data plane encapsulation. It carries the traffic. EVPN is frequently used as the control plane to distribute MAC and IP reachability information among VTEPs.
In such a model:
VXLAN provides the encapsulation and virtual segments through VNIs.
EVPN provides signaling and route distribution, so VTEPs know where to send encapsulated frames without relying on multicast flooding.
This combination has become a standard approach in many enterprise and service provider data centers, because it gives both scalability and control over traffic flows.
Summary
VXLAN is a network virtualization and overlay technology that allows you to create millions of isolated Layer 2 segments over a routed Layer 3 IP underlay. It uses a 24 bit VNI to identify virtual networks, encapsulates Ethernet frames inside UDP/IP packets, and uses VTEPs to perform the edge encapsulation and decapsulation.
By separating overlay from underlay, VXLAN enables scalable, multi tenant, and flexible data center fabrics. It supports Layer 2 extension without large physical broadcast domains, and it integrates naturally with modern designs that use anycast gateways and specialized control planes.