What is VXLAN? (Overlay Networks Explained)

The Shipping Box Analogy

Imagine two branch offices of the same company. Inside each office, people pass notes hand to hand down the hallway -- quick, local, no postage needed. That hallway is a Layer 2 network, and a note is an Ethernet frame addressed by MAC address. It works beautifully, but only within one building.

Now you want a note written in Office A to be delivered down the hallway of Office B, on the other side of the country, as if the two hallways were one. You can't just drop a hallway note into the national mail -- the postal system doesn't understand hallway addresses. So you take the original note and place it inside a shipping box with a proper national address label. The mail carriers route the box across the country using that label, never opening it. At Office B, someone opens the box and hands the original note down the hallway, untouched.

That is exactly what VXLAN does. VXLAN (Virtual Extensible LAN) is an overlay technology that wraps a Layer 2 Ethernet frame inside a Layer 3 UDP/IP packet -- a scheme called MAC-in-UDP, using UDP destination port 4789. The routed network carries the outer packet; the original frame rides along inside, untouched, until it reaches the far end and is unwrapped. To the VMs at each end, it feels like one flat LAN -- even though their traffic really crossed a routed network.

Why bother? Two reasons. First, plain VLANs are limited to 4094 IDs (a 12-bit tag) and can't easily cross a Layer 3 boundary. VXLAN's 24-bit VNI (VXLAN Network Identifier) gives about 16 million segments -- essential for large multi-tenant clouds. Second, VXLAN lets a Layer 2 segment span racks, availability zones, and entire data centers over ordinary routed IP.

Overlay vs Underlay

Here is the whole idea in one picture. VM-A and VM-B think they share a hallway (the overlay), but their frames actually travel inside VXLAN packets across a routed IP network (the underlay), wrapped and unwrapped by the VTEPs:

Step through it above and watch the layers stack on, the packet cross the underlay, and the headers peel back off. The original frame never changes -- it simply travels inside a wrapper that the routed network understands. That is the essence of an overlay.

The VXLAN Pieces, Step by Step

Where VXLAN Shows Up

VXLAN is everywhere in modern data centers and clouds. Here are three common situations where it earns its keep:

Common VXLAN Misconceptions

VXLAN is conceptually simple but easy to misunderstand. Watch out for these:

VXLAN and the Control Plane (EVPN)

Early VXLAN deployments used a "flood-and-learn" approach borrowed from classic Ethernet: to find an unknown MAC, a VTEP would flood the frame (often via IP multicast) and learn locations from the replies. That works, but it scales poorly. Modern fabrics instead use EVPN -- an address family of BGP -- as a control plane. EVPN lets every VTEP advertise the MAC and IP addresses it hosts, so the rest of the fabric learns locations directly from routing updates rather than from flooding. This pairing, often written VXLAN-EVPN, is the de facto standard for data-center fabrics and SDN.

Putting It All Together

VXLAN solves a very specific, very common problem: how do you give workloads the convenience of a single flat Layer 2 segment while still building your network on scalable, stable Layer 3 routing? The answer is to wrap each Ethernet frame in a UDP/IP shipping box (MAC-in-UDP on port 4789), label it with the VTEP IPs and a 24-bit VNI, and let the routed underlay carry it.

The bottom line: the overlay is the hallway the VMs think they share; the underlay is the national mail system that actually moves the boxes; the VTEP is the clerk who packs and unpacks them; and the VNI is the label that keeps 16 million different tenants' mail from ever getting mixed up. Once that picture clicks, the rest of data-center networking gets a lot less mysterious.