VLAN & VXLAN

802.1Q tagging, trunk vs access ports, VXLAN encapsulation over UDP port 4789, VTEP endpoints, and NVO3 overlay networks.

Overview

Overview VLANs (Virtual Local Area Networks) and VXLAN (Virtual Extensible LAN) are foundational technologies for network segmentation and overlay networking, both critical in modern cloud and data center infrastructure.

A VLAN is a logical partition of a Layer 2 network. Using IEEE 802.1Q tagging, a 12-bit VLAN ID (1-4094) is inserted into the Ethernet frame header, allowing switches to segregate traffic into isolated broadcast domains without requiring separate physical infrastructure. VLANs are the building block of traditional enterprise network segmentation, used to separate departments, isolate tenants, and reduce broadcast domain size.

However, VLANs have a fundamental limitation: the 4094 VLAN limit is grossly insufficient for large multi-tenant environments like public clouds. AWS, GCP, and Azure each host millions of customer VPCs, far exceeding what 802.1Q can address. VXLAN was designed to solve this.

VXLAN encapsulates Layer 2 Ethernet frames inside UDP packets, creating an overlay network across an existing Layer 3 underlay. The VXLAN header includes a 24-bit VNI (VXLAN Network Identifier), allowing over 16 million virtual segments. Traffic flows between VTEP (VXLAN Tunnel Endpoint) devices, which perform encapsulation and decapsulation.

VXLAN is the backbone of OpenStack Neutron, VMware NSX-T, and Kubernetes CNI plugins like Flannel and Cilium. AWS uses a proprietary variant (Nitro hypervisor encapsulation) for VPC networking. Understanding VTEP behavior, multicast vs unicast VXLAN, and EVPN control plane is expected knowledge for senior networking and cloud platform engineers.

Key concepts

802.1Q Tagging: The IEEE standard for VLAN tagging. A 4-byte tag is inserted into the Ethernet frame between the source MAC and EtherType fields. The tag contains: Tag Protocol Identifier (0x8100), Priority Code Point (3 bits, QoS), Drop Eligible Indicator (1 bit), and VLAN ID (12 bits, 1-4094).
Trunk Port vs Access Port: An access port carries traffic for a single VLAN and does not tag frames — used for connecting end hosts. A trunk port carries traffic for multiple VLANs and tags frames with 802.1Q headers — used for switch-to-switch and switch-to-router links. A native VLAN on a trunk port carries untagged traffic.
VTEP (VXLAN Tunnel Endpoint): The device that performs VXLAN encapsulation and decapsulation. A VTEP has an IP address in the underlay network and one or more VNIs in the overlay. VTEPs can be implemented in hardware (ToR switches), hypervisor kernel (Linux VXLAN driver), or software (OVS, Cilium).
VNI (VXLAN Network Identifier): The 24-bit segment identifier in the VXLAN header, equivalent to a VLAN ID but with 16 million possible values (2^24). Each VNI defines an independent Layer 2 domain in the overlay. Equivalent to an AWS VPC segment ID internally.
EVPN (Ethernet VPN): A BGP-based control plane for VXLAN that replaces flood-and-learn MAC discovery. EVPN uses BGP route types to distribute MAC/IP bindings (Type 2), IP prefix routes (Type 5), and multicast membership (Type 3) between VTEPs. This eliminates broadcast flooding and enables scale-out data center fabrics.

When to use it

Designing multi-tenant data center overlays exceeding 4094 VLAN limit
Troubleshooting Kubernetes pod-to-pod networking with overlay CNI plugins
Configuring VXLAN-based SDN in OpenStack or VMware NSX environments
Understanding AWS VPC and ENI networking at the hypervisor level
Implementing network segmentation in bare-metal cloud or colocation environments

Interview questions

How does VXLAN encapsulation work, and how would you troubleshoot a scenario where pods in different Kubernetes nodes cannot communicate using a VXLAN-based CNI?
What is the difference between VLAN and VXLAN and when would you choose one over the other in a data center design?

VLAN & VXLAN

Overview

Key concepts

When to use it

Interview questions

More Networking topics