Keep an overlay separate from its IP underlay
01VXLAN means Virtual eXtensible Local Area Network. It carries Ethernet frames across an existing network. A VXLAN Tunnel End Point (VTEP) adds and removes the tunnel wrapper.
Separate input: a packet labeled VNI 200 arrives at a VTEP with only the illustrated VNI 100 destination. It is stopped before this local VM is given a frame; a matching MAC alone does not select a different overlay.
Source for this drawing: RFC 7348 · Read RFC section 4 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
The 24-bit VNI identifies an overlay; it is not an IP address or a security credential.
- A VXLAN Network Identifier (VNI) scopes the inner Ethernet frame. Different overlays may reuse MAC addresses without merging their Layer-2 networks. MAC means Media Access Control; a MAC address identifies an Ethernet interface.
- A VTEP associates a local virtual machine (VM) with a VNI. The VM sends ordinary Ethernet frames and need not know that VXLAN is used.
- For the known-unicast case, the remote VTEP checks the VNI and the presence of the inner destination MAC on that VNI before removing the wrapper and delivering the frame.
The examples use VNI 100/200 and documentation IP addresses 192.0.2.1/192.0.2.2. The 24-bit field has 2^24 possible bit patterns; this is not a promise that every product allocates every value. RFC 7348 is Informational and records a deployed protocol, not an Internet Standard.
Read the RFC section ↗