← All chapters

In this video, we'll explore the advanced control plane features that make VXLAN more scalable and secure, specifically the use of multi protocol BGP EVPN. VXLAN or virtual extensible LAN is widely used to create scalable and flexible layer two networks over layer three infrastructure. However, as environments grow, traditional VXLAN implementations can encounter scalability and security challenges. This is where MPBGP EVPN comes into play. MPBGP EVPN stands for Multi Protocol Border Gateway Protocol Ethernet VPN. It extends the capabilities of traditional VXLAN by providing a robust, scalable and secure control plane for VXLAN overlay networks. Each VXLAN tunnel endpoint in your data center runs MPBGP. This protocol serves two main purposes. The first is authentication. MPBGP ensures that only authorized VTEPs participate in the VXLAN fabric. The second purpose is MAC address learning. Instead of relying solely on data plane learning, VTEPs exchange MAC address reachability information through the BGP control plane. For example, when VTEP one learns about a new MAC address on its local network, say from system a, it advertises this information to its BGP neighbors such as VTEP two and VTEP three. Now, if VTEP two needs to send traffic to that MAC address, it already knows via BGP to encapsulate and forward the packet to VTEP one. VTEP peer discovery and authentication depend on BGP neighbor configurations. This means that only VTEPs with established BGP sessions are allowed to participate in the VXLAN environment. If VXLAN encapsulated traffic is received from a non BGP neighbor, that traffic is automatically discarded, protecting the network from unauthorized or malicious devices. With EVPN, each VTEP can serve as a default gateway for its local virtual network identifier. This enables the Anycast gateway feature where every VTEP offers the same gateway IP address for a given VNI. As a result, traffic needing to move between VNIs or exit the VXLAN environment can be efficiently routed eliminating the need for traditional first hop redundancy protocols like HSRP or VRRP. One of the key advantages of MPBGP EVPN is the reduction of broadcast traffic. Instead of flooding the network with ARP requests, VTEPs use information learned via BGP to respond directly to ARP queries. This proxy ARP behavior reduces unnecessary broadcast traffic and improves network efficiency. Classic Ethernet learning still occurs on local interfaces, but MAC address information is shared and synchronized across the VXLAN fabric through BGP, ensuring seamless communication between all segments. By leveraging MPBGP EVPN, VXLAN networks become more scalable, secure, and efficient. Authentication of VTEPs, optimized MAC address learning, integrated Anycast gateway functionality, and reduced broadcast traffic are just some of the benefits that make MPBGP EVPN the modern choice for large, dynamic data center environments. Thank you for watching.

Layer 2 and Layer 3 VXLAN Overlay

Overlay networks can share underlying infrastructure and be applied only to specific segments. In traditional networks, they provide flexibility while remaining completely invisible to end protocols. When transferring data over an overlay network, the source and destination hosts do not need to support the specific overlay protocol or transport.

As shown in the image, the overlay is established between network devices and does not include the end hosts. Similarly, physical devices do not need to be aware of the overlay running over them to transfer overlay packets. Encapsulation enables this functionality.

Overlays are independent of the underlying infrastructure technologies and services. They typically do not impose any restrictions on the underlying infrastructure, as long as it can transport IP packets.

Network Overlays can take advantage of all the capabilities of the underlying transport network because they rely on the underlying infrastructure for traffic forwarding. This includes fast convergence, load balancing, and multicast replication. But the overlays can have their own rules on how the traffic gets redirected on top of the underlying infrastructure.

This ability to have traffic processing capability that is not dependent by the underlying infrastructure provides the ability to extend networks over third-party infrastructure, while maintaining your own traffic characteristics. For example, you can send Ethernet traffic encapsulated VXLAN over an ISP Layer 3 infrastructure to connect two locations together on Layer 2.

You can deploy overlay networks in private, public, and hybrid cloud environments in the data center to support these use cases:

Simplified management

Use a single point of management to provide network resources for multitenant clouds without the need to change the physical network.

Multitenancy at scale

Provide scalable Layer 2 networks for a multitenant cloud that extends beyond 4000 VLANs. This capability is very important for private and public cloud-hosted environments.

Workload-anywhere capability (mobility and reachability)

Optimally use server resources by placing the workload anywhere and moving the workload anywhere in the server farm as needed.

Forwarding-topology flexibility

Add arbitrary forwarding topologies on top of a fixed routed underlay topology.

Software-defined networking (SDN)

SDN Leverages the overlay network transport and integrates it with an external control plane, such as Cisco APIC or Cisco Nexus Dashboard to create intent-based solutions.

Automation and orchestration

Network overlays enable dynamic changes of traffic patterns by changing the settings of the software overlay. Compared to traditional networks, it adds high levels of flexibility, since no physical topology changes are necessary.

VXLAN Benefits over VLAN

The ability to transfer Layer 2 traffic over VXLAN enables network segmentation similar to that of VLAN. However it doesn't need to rely on the switch broadcast domains and specific network topologies. These topologies provide connectivity between specific endpoints according to traditional device-level switching.

VLANs have been used in networking infrastructures for many years now to solve different problems. You can use VLANs to enforce Layer 2 isolation, as policy enforcement points, and as routing interface identifiers. Network services such as firewalls have used VLANs to steer traffic. Support for VLANs is now available in most operating systems, NICs, network equipment (for example, switches, routers, firewalls, and so on), and in most virtualization solutions.

VXLAN can serve as an alternative to the more traditional VLANs, by still allowing VLAN tags to be used at the source and destination.

The image shows a traditional VLAN-tagged Ethernet frame and the VLAN tag in a traditional Layer 2 Ethernet. This frame will get forwarded according to the VLAN configuration on switch ports in a traditional physical topology. Ports can either forward a frame or not, according to VLAN tags and different switched-network mechanisms such as STP.

When designing virtualized data centers, you begin to face some shortcomings of VLANs. The IEEE 802.1Q standard specifies the VLAN ID length as 12 bits, which restricts the number of VLANs in a single switched Layer 2 domain to a maximum of 4096. In addition, some VLAN IDs are usually reserved for well-known uses, which further restricts this range.

To support multi-tenant environments in the same underlying physical infrastructure, each tenant must be able to create multiple Layer 2 and Layer 3 networks within their own slice of the virtualized data center. This requirement drives the need for more Layer 2 networks.

Although the VLAN Trunking Protocol (VTP) exists as a protocol for creating, disseminating, and deleting VLANs, and for pruning them for optimal extent, most networks disable it. In a data center that supports cloud tenancies, some sort of manual coordination is required between the network administrator and the tenant administrator to transport VLANs over existing switches.

You cannot easily use VLANs for virtual data centers when there are physical constraints of distance and deployment. Although the VLAN concept provides a level of network virtualization, you should consider the extended features that VXLAN offers when you need to address a large environment that requires virtualization.

VXLAN encapsulation preserves the original Layer 2 frame inside a VXLAN header that is then sent over the physical network.

As the name VXLAN implies, the technology is meant to provide the same services to connected Ethernet end systems that VLANs provide today, but in a more extensible manner. Compared to VLANs, VXLANs are extensible regarding the scale and the reach of a deployment.

While the 802.1Q VLAN ID space is only 12 bits, the VXLAN ID space is 24 bits. This doubling in size allows the VXLAN ID space to increase by over 400,000 percent to over 16 million unique identifiers. It should also provide sufficient room for expansion for years to come.

VXLANs use IP (both unicast and multicast) as the transport medium. The ubiquity of IP networks and equipment allows you to extend the end-to-end reach of a VXLAN segment far beyond the typical reach of VLANs using 802.1Q today.

Each VXLAN segment can be highly distributed among the networking nodes. With so many segments, the number of end systems that are connected to any one segment is expected to be relatively low. Therefore, the percentage of networking nodes that participate in any one segment will also be low.

The benefits of using VXLAN are as follows:

Highly dynamic end systems

End systems that are connected to VXLANs can be very dynamic in terms of creation, deletion, and power-on and -off, and in terms of mobility across the network nodes.

VXLANs work with existing, widely deployed network equipment

This benefit translates into Ethernet switches and IP routers. A single administrative domain administers the network infrastructure. This aspect is consistent with operation within a data center, and not across the Internet.

Low network node overhead and simple implementation

With the requirement to support very large numbers of network nodes, the resource requirements on each node should not be excessive in terms of a memory footprint or processing cycles. This requirement also considers hardware offload.

Centralized management and provisioning capability

Since overlays are software-defined and not hardware-defined, it is possible to configure and manage them through systems such as Cisco Nexus Dashboard.

Although overlays are not hardware-defined, you need to keep in mind that the limitations of the underlying hardware still exist. When you are using encapsulation, the external Ethernet frame is much bigger than the standard encapsulated original Ethernet frame. VXLAN encapsulation causes 50-byte overhead in transmission with no VLAN tagging, or 54-byte overhead with 802.1Q VLAN tagging on the external frame.

For a frame to be transferred over a switched network successfully, it must be below the Maximum Transmission Unit (MTU) of all the interfaces involved in communication. The default MTU on most network devices is 1500 bytes. However, VXLAN-encapsulated frames are typically 1550 bytes (or 1554 bytes of VLAN tags are used), since they encapsulate the original 1500-byte frame.