VXLAN concept — RFC 7348, VNI 24-bit, UDP 4789, overlay networking

VXLAN (Virtual Extensible LAN) is the modern overlay networking protocol for extending Layer 2 networks across a Layer 3 infrastructure. It is widely used in data centers for multi-tenant segmentation, with support for up to 16 million virtual networks (24-bit VNI space), as opposed to the 4094 VLANs of traditional 802.1Q. VXLAN encapsulates Layer 2 frames in UDP/IP packets, allowing them to traverse routed networks as if they were on the same Layer 2 segment.

This lesson covers what VXLAN is at the protocol level, the role of the underlay and overlay, the 24-bit VNI, the UDP 4789 transport, and the production use cases.

What VXLAN solves

A traditional VLAN (IEEE 802.1Q) provides Layer 2 segmentation in a single broadcast domain. The 12-bit VLAN ID field allows up to 4094 VLANs (0 and 4095 are reserved). For a multi-tenant data center with thousands of tenants, 4094 VLANs are insufficient.

VXLAN addresses this by:

1. Larger namespace: VXLAN uses a 24-bit VNI (VXLAN Network Identifier), allowing up to 16 million virtual networks. Far more than 4094 VLANs.
2. Layer 3 transport: VXLAN encapsulates Layer 2 frames in UDP/IP, allowing them to traverse routed networks (the underlay). Tenants can be in different data centers, connected by an IP network.
3. Multitenancy: each tenant gets a unique VNI; broadcasts are confined to the tenant’s VNI (avoiding broadcast storms).

flowchart LR
  subgraph TENANT_A["Tenant A (VNI 10001)"]
    VM_A1["VM A1<br/>10.0.1.10"]
    VM_A2["VM A2<br/>10.0.1.11"]
  end
  subgraph TENANT_B["Tenant B (VNI 10002)"]
    VM_B1["VM B1<br/>10.0.2.10"]
    VM_B2["VM B2<br/>10.0.2.11"]
  end
  VM_A1 <-- "VXLAN tunnel<br/>over IP" --> VM_A2
  VM_B1 <-- "VXLAN tunnel<br/>over IP" --> VM_B2

A typical VXLAN deployment has:

• Underlay: an IP network (Layer 3) connecting the VXLAN Tunnel Endpoints (VTEPs). The underlay carries the encapsulated VXLAN packets.
• Overlay: a Layer 2 network (or multiple) carried over the underlay via VXLAN. Each overlay is identified by a VNI.
• VTEPs: the VXLAN Tunnel Endpoints that perform the encapsulation/decapsulation. Each VTEP is a router/switch that participates in VXLAN.

Packet format

A VXLAN packet is a Layer 2 Ethernet frame encapsulated in UDP/IP:

Original Layer 2 frame:
[Destination MAC][Source MAC][Ethernet type][Payload][FCS]

VXLAN packet:
[Outer IP header][UDP header (port 4789)][VXLAN header][Original L2 frame][FCS]

The VXLAN header is 8 bytes:

• Flags: 8 bits. The I flag (bit 3) indicates whether the VNI is valid; the reserved fields are zero.
• Reserved: 16 bits (must be zero).
• VNI: 24 bits. The VXLAN Network Identifier.
• Reserved: 8 bits (must be zero).

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|R|R|R|R|I|R|R|R|            Reserved                           |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                VXLAN Network Identifier (VNI) |   Reserved    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

The UDP destination port is 4789 (IANA-registered for VXLAN). Some implementations also use port 4790 (VXLAN-GPE — Generic Protocol Extension) or other ports.

The encapsulation flow

When a host on a VXLAN segment sends a Layer 2 frame:

1. The host sends the frame to its default gateway (the VTEP).
2. The VTEP looks up the destination MAC in its VXLAN forwarding table (FDB).
3. The VTEP encapsulates the frame in a UDP/IP packet (UDP port 4789, IP source = VTEP’s IP, IP dest = remote VTEP’s IP).
4. The packet is routed normally via the underlay (Layer 3).
5. The remote VTEP receives the packet, decapsulates it, and delivers the inner frame to the destination host.

sequenceDiagram
  participant VM_A1 as VM A1<br/>10.0.1.10
  participant VTEP_1 as VTEP 1<br/>192.0.2.10
  participant NET as Underlay (L3)
  participant VTEP_2 as VTEP 2<br/>192.0.2.20
  participant VM_A2 as VM A2<br/>10.0.1.11
  VM_A1->>VTEP_1: ARP for 10.0.1.11
  VTEP_1->>NET: VXLAN encapsulated<br/>UDP 4789, src=192.0.2.10, dst=192.0.2.20
  NET->>VTEP_2: IP routing
  VTEP_2->>VTEP_2: Decapsulate VXLAN
  VTEP_2->>VM_A2: Inner ARP
  VM_A2->>VTEP_2: ARP reply
  VTEP_2->>NET: VXLAN encapsulated reply
  NET->>VTEP_1: IP routing
  VTEP_1->>VTEP_1: Decapsulate VXLAN
  VTEP_1->>VM_A1: Inner ARP reply

The underlay (the IP network between VTEPs) does not need to be Layer 2; it can be a routed network spanning data centers.

Configuration on VyOS 1.5 LTS

A basic VXLAN configuration on VyOS:

configure
# Create a VXLAN interface
set interfaces vxlan vxlan10001 vni 10001
set interfaces vxlan vxlan10001 address 10.0.1.1/24
# Specify the local VTEP IP (used as the source for VXLAN packets)
set interfaces vxlan vxlan10001 source-address 192.0.2.10
# Specify the default destination VTEP (unicast) or use multicast
set interfaces vxlan vxlan10001 remote 192.0.2.20
# Or use multicast for flood-and-learn
# set interfaces vxlan vxlan10001 group 239.1.1.1

# MTU (account for VXLAN overhead)
set interfaces vxlan vxlan10001 mtu 1450

commit
save

The configuration:

• VNI: 10001 (24-bit value, up to 16M).
• Local IP: 192.0.2.10 (the source IP for VXLAN packets).
• Remote IP: 192.0.2.20 (the destination VTEP for unicast).
• MTU: 1450 (lower than 1500 to accommodate VXLAN overhead).
• Address: 10.0.1.1/24 (the IP address within the tenant’s segment).

The VTEP encapsulates Layer 2 frames in VXLAN/UDP/IP with source 192.0.2.10 and destination 192.0.2.20. The underlay (Layer 3) routes the packets between the VTEPs.

Validation

# Inspect the VXLAN interface
show interfaces vxlan vxlan10001
# Shows the interface state, address, VNI, source IP

# Verify on the wire
tcpdump -ni eth0 'udp port 4789' -c 4 -vv
# Shows the VXLAN packets

# Test end-to-end
ping 10.0.1.11
# Should succeed (over the VXLAN tunnel)

# Inspect the kernel
ip -d link show vxlan10001
# Shows VXLAN-specific interface details

A clean validation: the VXLAN interface is up with the configured VNI; tcpdump shows VXLAN packets on the wire; ping to a host behind the remote VTEP succeeds.

Production failure modes

Underlay MTU too low

The underlay (the IP network between VTEPs) has an MTU lower than 1500 (e.g., PPPoE link with MTU 1492). VXLAN with default MTU 1450 still exceeds the underlay’s MTU. Packets are fragmented or dropped.

Diagnostic: ping -M do -s 1450 <remote-VTEP> fails.

Fix: lower the VXLAN MTU to match the underlay’s MTU.

Multicast not supported

VXLAN with multicast (flood-and-learn) requires multicast support in the underlay. If the underlay does not support multicast (e.g., some WANs), the multicast floods fail.

Diagnostic: ARP requests from VMs are not reaching the remote VTEP; ARP entries are missing in the VTEP’s table.

Fix: use unicast VXLAN with explicit remote destinations; or use BGP EVPN as the control plane (covered in lesson xliv-04).

VNI mismatch

The two VTEPs have different VNIs. The VTEP receives the VXLAN packet but the VNI does not match any local VNI; the inner frame is dropped.

Diagnostic: a VTEP shows the VXLAN packets arriving but no traffic flows to the local VMs.

Fix: align the VNI on both VTEPs.

Routing loop in the underlay

A routing loop in the underlay causes VXLAN packets to loop. The looping packets are dropped by the TTL or by the loop detector.

Diagnostic: traceroute <remote-VTEP> shows a loop.

Fix: fix the underlay routing loop.

Rollback

# Enter configuration mode and write the running configuration to a
# file you can load back. `save` is a configuration-mode command that
# takes a path; operational mode has no `| save` pipe.
configure
save /config/pre-change-vxlan-TICKET.conf

# Remove the VXLAN configuration
delete interfaces vxlan vxlan10001

# Read the diff before committing anything
compare
commit

# Or restore a previous configuration
load /config/pre-change-vxlan-TICKET.conf
commit
save

The rollback removes the VXLAN interface; the tunnel is torn down.

Production discipline

Cross-course references

• Part VIII-02 (VIII-VyOS-VLANs / VLAN sub-interfaces) covers VLANs as a comparison.
• Part XLIV-02 (XLIV-VyOS-VXLAN / VNI) covers VNI design.
• Part XLIV-03 (XLIV-VyOS-VXLAN / underlay) covers the underlay requirements.
• Part XLIV-04 (XLIV-VyOS-VXLAN / BGP EVPN) covers BGP EVPN as the control plane.

Quiz