RFC 7348 / START HERE
VXLAN overlays, before the details
VXLAN means Virtual eXtensible Local Area Network. It carries Ethernet frames inside UDP/IP packets so that virtual machines on different hosts can share a logical Layer-2 network. RFC 7348 is an Informational description of this deployed protocol, not an Internet Standard.
A VXLAN Tunnel End Point (VTEP) adds the wrapper at one end and removes it at the other. The inner frame has Media Access Control (MAC) addresses identifying Ethernet interfaces. The outer packet uses Internet Protocol (IP) addresses to reach tunnel endpoints and the User Datagram Protocol (UDP) to carry the data. A 24-bit VXLAN Network Identifier (VNI) selects the logical overlay.
Why it exists
Virtualized data centers need many separate tenant networks and may prefer to route their physical infrastructure using IP. VXLAN lets those logical Ethernet networks cross that shared infrastructure. This publication explains data-plane learning and multicast; other control-plane schemes are separate. Its fetched metadata lists no formal updates or obsoletions.
A familiar example
Imagine two VMs in VNI 100 on different hosts. Their VTEPs wrap and unwrap the Ethernet conversation while another VNI stays separate, even if it reuses a MAC address. Follow that frame through learning, header checks, byte budgets and gateway rules. A VNI is not a credential: VXLAN alone neither authenticates the sender nor encrypts the frame.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Keep an overlay separate from its IP underlayVXLAN means Virtual eXtensible Local Area Network. It carries Ethernet frames across an existing network. A VXLAN Tunnel End Point (VTEP) adds and removes the tunnel wrapper.→
- Wrap the whole inner Ethernet frameThe inner Ethernet frame becomes data inside VXLAN and the User Datagram Protocol (UDP). The outer Internet Protocol (IP) addresses identify tunnel endpoints, while outer Ethernet addresses serve the current physical link.→
- Learn return paths from multicast trafficRFC 7348 describes a data-plane learning scheme. A broadcast, multicast or unknown-destination Ethernet frame follows an IP multicast tree; received source addresses teach the return path.→
- Check the actual VXLAN header and checksum rulesThe VXLAN header is 8 bytes: flags, reserved fields, a 24-bit VNI and one final reserved byte. Format validity, checksum handling and local membership are separate gates.→
- Budget for the extra bytes without VTEP fragmentationEncapsulation makes the underlay IP packet larger. Maximum Transmission Unit (MTU) is the largest IP packet a link can carry without fragmentation in this example.→
- Separate gateway policy from tunnel securityA gateway can connect a VXLAN overlay to a conventional Ethernet network using a Virtual Local Area Network (VLAN). Its VLAN policy and the trustworthiness of tunnel endpoints are separate from VNI parsing.→
This introduction explains RFC 7348 (2014). Read the original RFC ↗