Putting Layer 2 Inside Layer 3
VXLAN — Virtual Extensible LAN — is an overlay technology. The idea behind any overlay is to run a virtual network on top of a physical one that knows nothing about it. VXLAN's specific feat is to make a layer-2 network behave as if it spans a layer-3 routed network underneath.
It achieves this through encapsulation: it takes an entire Ethernet frame and wraps it inside a UDP packet. The original frame becomes the payload of a normal IP packet that can be routed across the network like any other traffic, then unwrapped at the destination to recover the exact original frame. To the devices at each end, it looks like they are on the same local segment; to the network in between, it is just IP packets being routed. This "frame-in-a-packet" approach — sometimes called MAC-in-UDP — is the whole trick. The underlying routed network is called the underlay; the virtual layer-2 network riding on top is the overlay.
VNI and VTEP: the Two Terms to Know
Two pieces of jargon carry most of the meaning in any VXLAN discussion:
- The VNI (VXLAN Network Identifier) is a number that says which virtual network a frame belongs to — the VXLAN equivalent of a VLAN ID. It is added in the VXLAN header during encapsulation, so every wrapped frame is tagged with the segment it belongs to.
- The VTEP (VXLAN Tunnel Endpoint) is the device that does the wrapping and unwrapping. The ingress VTEP encapsulates a frame entering the overlay; the egress VTEP decapsulates it and delivers the original frame. A VTEP can be a physical switch or software running on a server (for example, on a virtualization host).
Put together: a frame leaves a host, the local VTEP wraps it with a VXLAN header carrying its VNI plus UDP/IP headers, the underlay routes the resulting packet to the remote VTEP, and that VTEP strips the wrapping and hands the original frame to the destination — all invisibly. The two endpoints never know they were ever anything but neighbours on the same LAN.
Why VXLAN Beats VLANs at Scale
The shortcomings of VLANs that VXLAN was built to fix come down to two hard limits, and the contrast is stark:
| VLAN | VXLAN | |
|---|---|---|
| Identifier size | 12-bit VLAN ID | 24-bit VNI |
| Number of segments | ~4,000 | ~16 million |
| Scope | A single layer-2 domain | Across a routed layer-3 fabric |
| Transport | Native Ethernet | Ethernet encapsulated in UDP/IP |
The first limit is sheer numbers. A VLAN ID is 12 bits, capping a network at roughly 4,000 segments — fine for an office, hopelessly small for a cloud provider hosting thousands of customers who each need many isolated networks. VXLAN's VNI is 24 bits, lifting the ceiling to about 16 million segments. The second limit is scope: a VLAN lives within one layer-2 domain, whereas VXLAN rides over a routed fabric and can therefore stretch a single segment across an entire data center — or between data centers — without requiring everything in between to be one giant, fragile layer-2 network.
The Problem It Really Solves
That second point is the one that made VXLAN essential rather than merely convenient. Large layer-2 networks are fragile: they are vulnerable to broadcast storms, rely on Spanning Tree Protocol blocking links (wasting capacity), and do not scale gracefully. Layer-3 routed networks, by contrast, scale beautifully, use all their links, and contain failures — but traditionally could not provide the same-subnet, same-segment connectivity that some applications and virtual machines expect.
VXLAN gives you both. The physical network can be a clean, scalable, fully-routed layer-3 fabric — robust and efficient — while VXLAN paints layer-2 segments on top wherever they are needed. This is exactly what virtualization demands: a virtual machine can migrate from a host in one rack to a host in another, keeping its IP and MAC addresses and staying on the same logical network, because that network is an overlay unbound from any single physical location. The VM moves; the overlay follows.
Where You'll Encounter It
VXLAN is foundational infrastructure in modern data centers and cloud platforms, almost always as the data-plane component of a larger design (frequently paired with a control protocol that handles how VTEPs learn where each MAC address lives, avoiding inefficient flooding). You will rarely configure VXLAN on a home network — it is squarely an at-scale technology — but understanding it explains a great deal about how cloud networking actually works beneath the abstractions: how millions of tenant networks coexist, how a VM can move anywhere and stay reachable, and how providers offer you an apparently simple "virtual network" that is in fact an overlay stretched across a vast routed fabric. It is the quiet plumbing that lets the cloud present a flexible, software-defined network on top of rigid physical hardware. For the layer-2 fundamentals it builds upon, see how a switch switches and VLANs and trunking.
Frequently Asked Questions
What is VXLAN?
Virtual Extensible LAN — an overlay technology that lets a layer-2 network span a layer-3 routed network. It encapsulates an entire Ethernet frame inside a UDP packet so the frame can be routed across an IP fabric and unwrapped at the far end, making devices in different locations appear to share one local network.
What is a VNI in VXLAN?
The VXLAN Network Identifier — a 24-bit number identifying which virtual network a frame belongs to, like a VLAN ID. Being 24 bits, it supports about 16 million segments versus the ~4,000 of a 12-bit VLAN ID. It is carried in the VXLAN header added during encapsulation.
What is a VTEP?
The VXLAN Tunnel Endpoint — the device that encapsulates and decapsulates. The ingress VTEP wraps a frame in UDP/IP and sends it across the network; the egress VTEP unwraps it and delivers the original frame. VTEPs can be physical switches or software on servers.
How is VXLAN different from a VLAN?
A VLAN segments a layer-2 network, limited to ~4,000 segments and one layer-2 domain. VXLAN is an overlay over a routed layer-3 network, supports ~16 million segments, and can stretch a segment across data centers. VLANs partition a local switched network; VXLAN extends layer 2 across a larger routed fabric.
Why is VXLAN used in data centers?
Data centers need far more segments than VLANs allow and must let virtual machines move between hosts without changing networks. VXLAN provides millions of segments and lets a layer-2 segment span the facility over a scalable routed fabric, so a VM can migrate anywhere and stay on the same logical network.