What problem does VXLAN solve?
Show the answer
Say this first
VXLAN carries Ethernet frames inside UDP/IP, so a layer 2 segment can span a fully routed fabric. It replaces the 12-bit VLAN ID (4,094 usable VLANs) with a 24-bit VNI (about 16 million segments), keeps the underlay routed with ECMP and no spanning tree, and gives tenants their own segments. It is defined in RFC 7348.
Go deeper
The problems it answers
- Scale of segments. 4,094 VLANs is not enough for a multi-tenant or cloud data center.
- Spanning tree. Stretching VLANs across many racks the classic way means STP, blocked links and large failure domains.
- Workload mobility. VMs and containers want to keep their IP when they move to another rack.
- MAC table size in the core. Underlay switches only see VTEP addresses, not every host MAC.
How it works
A VTEP on the leaf maps a local VLAN to a VNI, wraps the frame in VXLAN, UDP and IP, and sends it to the remote VTEP's loopback. The underlay forwards it like any other UDP packet.
Related encapsulations
GENEVE (UDP 6081) has the same 24-bit VNI plus variable-length options. VMware NSX and some cloud services use it. NVGRE and STT were alternatives that did not win in physical fabrics.
They will ask next
Is VXLAN only for layer 2?
No. With EVPN symmetric IRB, a per-VRF L3VNI carries routed traffic between leaves, so VXLAN transports both bridged and routed tenant traffic.
Why UDP and not GRE?
UDP gives ECMP entropy through the source port, which the VTEP derives from a hash of the inner headers. Underlay switches already hash UDP ports, so different inner flows spread across spines.
Traps
- Calling VXLAN secure or encrypted. It is plain encapsulation with no confidentiality.
- Thinking VXLAN removes broadcast domains. A VNI is still a broadcast domain; EVPN only reduces flooding.