Notebook/content/documentation/VXLAN/beginners/vxlan-for-beginners.en.md

title, date, cascade

title	date	cascade
VXLAN for Beginners	2024-08-01T20:00:00+02:00	type docs

Understanding VLAN and VXLAN: Simplified for Non-Technicians

In the fast-paced world of technology, understanding networking concepts can be intimidating, especially if you're not an expert in the field.
Today, we're going to break down two important networking concepts: VLAN and VXLAN, using simple analogies and clear explanations.
We'll also cover their limitations, real-world use cases, and a few technical notes for the more curious among you.

Let's dive in.

What is a VLAN?

VLAN (Virtual Local Area Network) is like organizing a large office building with several departments: Marketing, Sales, HR, and IT. To keep things orderly, each department gets its own floor. That way, people from Marketing stay on their floor, people from Sales stay on theirs, and so on.

A VLAN works similarly for computer networks. It divides a large physical network into smaller, isolated networks. Each VLAN is like a separate floor for a department, allowing devices within the same VLAN to communicate easily while keeping traffic separate from other VLANs.

Key points about VLAN

• Separation: Keeps different groups (like departments) apart.
• Efficiency: Reduces unnecessary traffic and potential network issues.
• Security: Limits access and strengthens security by isolating groups.

VLAN limitations

• ID limit: Historically, a VLAN is identified on 12 bits, allowing up to 4094 VLANs (from 1 to 4094). For a large enterprise or a datacenter, this can turn out to be insufficient.
• Local isolation: VLANs are mostly designed for local use (a single site or a set of locally connected switches). As soon as you want to extend this concept across multiple sites, you need more advanced solutions.

What is VXLAN?

VXLAN (Virtual Extensible LAN) takes things further. Imagine your company grows and expands into several buildings across the city. You still want departments to feel as if they were on their own floors, even though they're now spread across different locations. To achieve this, you create a virtual system that connects all the floors across the buildings, so that Marketing on the 3rd floor of one building is still virtually connected to Marketing on the 3rd floor of another building.

VXLAN does exactly that for networks. It extends VLANs across multiple physical locations using a technique called tunneling. This way, devices in the same VLAN can communicate as if they were on the same local network, even though they're geographically far apart.

Key points about VXLAN

• Scalability: Extends networks across different locations, and goes beyond the 4094 VLAN limit.
• Flexibility: Enables larger, more dynamic network designs.
• Connectivity: Ensures seamless communication across dispersed networks.

A technical deep dive into VXLAN

VXLAN was developed to address the limitations of traditional VLANs (scalability, geographic reach). It uses a 24-bit VXLAN network identifier (VNI) to identify up to 16 million logical segments, far exceeding the 4094 VLAN limit.

Because of virtualization, MAC address tables in datacenters can grow very large, while physical switches have limited capacity. VXLAN addresses this challenge by using MAC-in-UDP encapsulation, which allows Ethernet frames (layer 2) to be carried over an IP network (layer 3).

How does it work?

The goal of VXLAN is to extend layer 2 across a layer 3 (IP) network. This essentially "tricks" layer 3 into making the user or virtual machine believe it's still on the same local network (layer 2).

In plain terms: Ethernet frames (layer 2) are encapsulated inside a UDP packet (layer 4), which is itself carried over IP (layer 3).

[!NOTE]The "hardware" layers

• The Data Link layer (2) is commonly handled by switches.
• The Network layer (3) is commonly handled by routers.

By encapsulating layer 2 within layer 3, we get the benefits of IP routing (flexibility, scalability) while retaining the isolation and simplicity of layer 2 for applications and virtual machines.

VXLAN explained through the container transport analogy

1. The trucks (lower layers)

Picture trucks on the road. Their job is to carry containers (your data) from point A to point B. These trucks represent the Ethernet layer (layer 2), where each vehicle (frame) has a "license plate" (MAC address).

2. The train (VXLAN tunnel)

When it comes to covering longer distances or crossing varied infrastructure, loading the trucks onto a train becomes more efficient. Here, the train represents VXLAN: it encapsulates the trucks (Ethernet frames) inside a wagon (the tunnel). Each train is identified by a VNI (VXLAN Network Identifier), somewhat like a convoy number for each freight line.

3. The rail tracks (IP network)

The train runs on rails (the IP network, layer 3). The rail tracks are already built and managed to find the best route: they ensure route convergence and can reroute traffic in case of a problem (failure, congestion, etc.). In the same way, the IP network automatically picks the most optimal path to carry VXLAN packets.

Key takeaways

• Overlay: VXLAN is a transport system that sits "on top of" layer 3 (the rails). It allows multiple layer 2 networks (the trucks) to be interconnected as if they formed a single one.
• Dual addressing:
  • Trucks (Ethernet frames) are identified via MAC addresses (license plate).
  • The train (VXLAN tunnel) uses IP addresses (route plan) to travel on the rails.
• Isolation and segmentation: Just as several trains can run on the same railway line, it's possible to operate different VXLAN tunnels (each with its own VNI) over the same IP infrastructure.
• Elasticity and reliability: By relying on layer 3, VXLAN benefits from all the optimizations of IP routing (route recalculation, fault tolerance, etc.).

Real-world use cases

• Multi-datacenter: To connect several geographically dispersed datacenters while keeping the feel of a single layer 2 network.
• Hybrid cloud: Extend a corporate network to a public or private cloud provider without reconfiguring the entire addressing plan.
• Virtual machine migration: Enable migration (VM Mobility) between remote sites without losing layer 2 connectivity.
• Massive virtualization: In very dense environments (e.g. hundreds of thousands of virtual machines), the 24-bit VNI identifier is necessary.

Controlling VXLAN: BGP EVPN and other protocols

In modern deployments, especially in datacenters, VXLAN isn't simply configured statically. It's often paired with a control plane via the BGP EVPN (Ethernet VPN) protocol.

• BGP EVPN: Allows MAC and IP table information to be exchanged between devices, facilitating automation and scalability.
• Other technologies: Historically, you could come across other overlay protocols (NVGRE, STT), but VXLAN has established itself as the de facto standard.

Performance considerations

• Encapsulation overhead: VXLAN adds an extra header (8 bytes + UDP/IP header). This can impact the maximum frame size (MTU), and it's often necessary to configure a Jumbo MTU (typically 9000 bytes) to avoid packet fragmentation.
• IP network resilience: The reliability of the VXLAN tunnel depends on the quality of the underlying IP network (routes, congestion, etc.).

Configuration example (for the curious)

Here's a simplified excerpt of a VXLAN configuration on a Cisco NX-OS device (syntax varies by vendor):

interface nve1
  no shutdown
  source-interface loopback1
  member vni 5001
    ingress-replication protocol static
    mcast-group 239.1.1.1

• interface nve1: We create an "NVE" (Network Virtualization Endpoint) interface to handle VXLAN encapsulation.
• source-interface loopback1: The IP address of the loopback1 interface will be used to establish the tunnels.
• member vni 5001: We associate a VNI (VXLAN Network Identifier) with our network overlay.

Note: In more complex environments, the control plane is also configured (e.g. BGP EVPN).

Summary

• VLAN
  It's like having separate floors for different departments in a building, keeping their activities isolated.
  - Main limitation: 4094 VLANs maximum and a scope often limited to a single site.

• VXLAN
  It's like connecting those separate floors across multiple buildings, all while keeping the illusion that they're in the same building.
  - Key advantages: Huge addressing capacity (16 million segments), L2 extension over L3, flexibility for virtualization and multi-site deployments.

VXLAN meets the need for large-scale isolation and gets around the MAC address table limits of physical switches. Paired with a control plane like BGP EVPN, it simplifies the management of modern overlay networks.

Conclusion

If you're looking for basic segmentation for your local network, a VLAN is largely sufficient. But as soon as you want to link multiple sites, build a highly virtualized network, or go beyond the traditional 4094 VLAN limit, you need VXLAN.

Whether you're a network lab enthusiast, a NetOps engineer, or simply curious about the inner workings of IT infrastructure, understanding these two concepts will help you grasp what happens as your data travels between sites, all while keeping the illusion of being "at home" on the same local network.

[!TIP] Want to go further?

• Take a look at BGP EVPN for the VXLAN control plane.
• Explore Jumbo MTU configuration to optimize your performance.
• Compare VXLAN with other protocols (NVGRE, GENEVE) to understand network design choices.