VXLAN
Course Description
VXLAN (Virtual Extensible LAN) is a tunneling protocol that carries Ethernet frames over an IP network. It solves the problems of large layer 2 networks: spanning tree blocking redundant links, the limit of 4094 VLANs, and huge MAC address tables because of server virtualization. VXLAN builds overlay networks on top of a simple layer 3 underlay, and uses a 24-bit VNI, so you can create about 16 million segments. In this course, we start with overlay networks and how data center fabrics evolved, then configure VXLAN with static ingress replication, multicast flood and learn, and MP-BGP EVPN, and finish with the underlay options: OSPF, IS-IS, and eBGP. Most examples use Cisco Nexus switches.
Course Highlights
In this course you will learn:
- What overlay and underlay networks are, and why data centers moved from spanning tree to spine and leaf fabrics.
- What VXLAN is, how VTEPs encapsulate Ethernet frames in UDP, and what the 24-bit VNI is for.
- How to configure VXLAN with static ingress replication.
- How flood and learn with a multicast underlay handles BUM traffic, on Cisco NX-OS and IOS XE.
- How to make the multicast RP redundant with anycast RP.
- How MP-BGP EVPN advertises MAC and IP addresses for L2 VNIs, and routes between subnets with L3 VNIs.
- How ARP suppression reduces flooding in an EVPN fabric.
- How to build the underlay with OSPF, IS-IS, or eBGP with the two-AS and multi-AS models.
Presented to you by instructor Rene Molenaar, CCIE #41726
Course at a glance
- 14 lessons.
- Format: self-paced lessons with Cisco NX-OS and IOS XE configurations, packet captures, and video.
- Last updated: October 2026.
Requirements
- A good understanding of layer 2 and layer 3 networking: VLANs, spanning tree, and IP routing.
- Basic knowledge of tunneling, multicast, and MP-BGP; the EVPN lessons build on MPLS VPN concepts like route distinguishers and route targets.
Course Schedule
What is VXLAN?
VXLAN (Virtual Extensible LAN) is a tunneling protocol that tunnels layer 2 Ethernet frames over a layer 3 IP network. A VTEP (VXLAN Tunnel Endpoint) takes the Ethernet frame of a host, adds a VXLAN header, and encapsulates it in UDP and IP, using UDP port 4789. The remote VTEP removes the encapsulation and forwards the original frame. VTEPs can be hardware, like a switch or router, or software in a hypervisor.
What makes VXLAN different from a traditional layer 2 network is the split between the underlay and overlay. The underlay is a simple layer 3 network whose only job is to get packets from one VTEP to another. Because it’s routed, there’s no spanning tree and all links can be used with ECMP. The overlay is where your segments live, identified by a 24-bit VNI (VXLAN Network Identifier) instead of a 12-bit VLAN ID, which gives you about 16 million segments instead of 4094. To find out where a MAC address lives, VTEPs either flood and learn, with static ingress replication or multicast, or use a control plane like MP-BGP EVPN.
Who uses VXLAN? It’s the standard overlay in modern data centers, usually on a spine and leaf fabric with BGP EVPN as the control plane. Cloud and hosting providers use it to give many tenants their own isolated networks. You’ll also find VXLAN in campus fabrics like Cisco SD-Access, where it’s the data plane.
VXLAN Learning Roadmap
This roadmap follows the course units. Each topic has a short explanation and links to the lessons where we cover it in detail.
Overlay Networks and Data Center Fabrics
Before we look at VXLAN, it helps to understand why we need it. An overlay network is a virtual network on top of a physical underlay network, built with encapsulation. Data center fabrics started with tree-like layer 2 networks where spanning tree blocked redundant links. We moved through workarounds like vPC and replacements like FabricPath to spine and leaf fabrics with a VXLAN overlay, where every server is at most two hops away from another leaf.
VXLAN Fundamentals
VXLAN solves three issues of traditional layer 2 networks: spanning tree, the 4094 VLAN limit, and large MAC address tables. VTEPs encapsulate Ethernet frames in UDP, and the VNI identifies the segment. There are four control plane options: static unicast, multicast flood and learn, MP-BGP EVPN, and LISP. We start with a simple flood and learn example on Cisco IOS XE routers so you can see VXLAN in a packet capture.
Flood and Learn on Cisco Nexus
With flood and learn, VTEPs learn remote MAC addresses on the data plane, just like a switch. BUM (broadcast, unknown unicast, and multicast) traffic has to reach every VTEP in the VNI. With static ingress replication, you configure the remote VTEPs by hand, which is easy but doesn’t scale. With a multicast underlay, each VNI maps to a multicast group, and anycast RP on the spine switches removes the single point of failure.
VXLAN MP-BGP EVPN
MP-BGP EVPN separates the control plane from the data plane: leaf switches advertise MAC and IP addresses with BGP instead of flooding to learn them. It uses route distinguishers and route targets, similar to MPLS VPN. With an L2 VNI, we bridge traffic within a VNI. With an L3 VNI, VTEPs route between VNIs and advertise prefixes with type 5 routes. ARP suppression uses the learned bindings to answer ARP requests locally, which reduces flooding.
VXLAN Underlay Routing
The underlay advertises the loopback addresses of the VTEPs so they can reach each other. OSPF and IS-IS are simple choices; use point-to-point links so there’s no DR or DIS election. eBGP takes more work to configure, but it scales well and lets you use one routing protocol for the underlay and overlay. You can put all leaf switches in one AS (two-AS model) or give each leaf its own AS (multi-AS model), and each has its own quirks to solve.
Frequently Asked Questions
VXLAN (Virtual Extensible LAN) is a tunneling protocol that carries layer 2 Ethernet frames over a layer 3 IP network. It lets you stretch layer 2 segments across a routed network without spanning tree, and supports about 16 million segments. Read our introduction to VXLAN.
A VTEP (VXLAN Tunnel Endpoint) receives an Ethernet frame from a host, adds a VXLAN header with the VNI, and encapsulates it in UDP and IP. The underlay routes the packet to the remote VTEP, which removes the encapsulation and forwards the original frame to the destination host.
A VLAN uses a 12-bit ID, so you can have 4094 VLANs, and it relies on a layer 2 network with spanning tree. VXLAN uses a 24-bit VNI, which gives you about 16 million segments, and tunnels layer 2 traffic over a routed layer 3 network where all links can be used.
A VTEP (VXLAN Tunnel Endpoint) is the device that encapsulates and de-encapsulates VXLAN traffic. It can be a hardware device like a leaf switch or router, or software running in a hypervisor. Each VTEP has an IP address in the underlay network, usually on a loopback interface.
The VNI (VXLAN Network Identifier) is a 24-bit value in the VXLAN header that identifies the segment, similar to a VLAN ID. VTEPs map local VLANs to VNIs. An L2 VNI is used for bridging within a segment, and an L3 VNI for routing between segments.
VXLAN EVPN uses MP-BGP EVPN as the control plane for VXLAN. Instead of flooding traffic to learn where MAC addresses are, leaf switches advertise MAC and IP addresses to each other with BGP. This is more efficient and scales better than flood and learn. Learn how to configure MP-BGP EVPN.
The official VXLAN port is UDP 4789. Some older implementations use port 8472.
Both build overlay networks. VXLAN encapsulates Ethernet frames in UDP and IP, so it runs on any IP network, and it’s mostly used in data centers. MPLS uses labels, needs label switching in the core, and is mostly used by service providers. Learn more about MPLS.
Ready to master VXLAN?
Get access to all 14 VXLAN lessons and every other course on NetworkLessons.com.