VXLAN Overlay
Due to their hardware-independent nature, overlays can provide connectivity configurations that would otherwise cause networkwide problems. This especially applies to Layer 2 domain limitations, where having large Layer 2 domains pose greater risk of loops. There are also risks of potential issues with STP convergence and device MAC address table size. Any errors that happen within a Layer 2 domain will affect more devices if a given domain is large.
In proper data center design, a VLAN contains only a single Layer 3 subnetwork. Because of this, migrations between different parts of the data center require the same VLAN to be present and reachable at the source and the destination system. This would mean that VLANs would have to extend over the core network, creating large Layer 2 domains.
A key benefit of virtualization is the ability to move VMs among data center servers while the VM is in service. IP address changes when a VM migrates are often not possible, therefore the VLAN that contains that IP address also needs to be available after migration. If VLANs are define in a traditional way on the hardware level, this would mean a suboptimal design.
To support mobility, VMs must remain in their native IP subnet, which ensures continuous network connectivity from the VM to users. The three drivers for VXLAN in traditional networks are great scalability, isolation for multitenancy, and any-to-any Layer 2 communications.
VXLAN overlay can provide Layer 2 connectivity over the data center core without actually extending an additional VLAN through the core.
VXLAN provides a unique network ID called a VXLAN Network Identifier (VNI), or virtual network identifier, which provides a tunnel for transporting the original payload. The VXLAN VNI tunnel (or overlay) keeps the traffic within it separate from other traffic in other VXLANs, similar to a VRF or VPN isolation. This approach provides multitenancy in terms of security and scale.
VXLAN creates LAN segments by using an overlay approach with MAC-in-UDP encapsulation and a 24-bit segment identifier in the form of a VXLAN ID.
This course covers the hardware options available for fabric interconnects and the connectivity provided by them. You will learn the different port types, including unified ports, and the role of VLANs and VSANs within a Cisco UCS domain.
VXLAN technology has the following characteristics:
It uses MAC-in-UDP/IP encapsulation.
It can work on hypervisor-based virtual switches and on physical switches.
It uses ECMP to achieve optimal path usage over the transport network.
The VXLAN overlay lends itself well to policy-driven configuration creating full SDN environments.
Due to its ability to create any-to-any communication without causing issues on the lower layers, it can be incredibly flexible.
VXLAN Tunnel Endpoint
Not all systems support VXLAN encapsulation/decapsulation, and you do not want to process VXLAN on hardware that is not optimized to do so. Instead, you can use the intermediate devices between the source and destination to perform VXLAN functions. The VXLAN encapsulation creates an encapsulated virtual tunnel between VXLAN Tunnel Endpoints (VTEPs).
VXLAN encapsulation carries the original Layer 2 traffic over a tunnel. A VTEP is an entity that originates or terminates a VXLAN tunnel.
The VTEP encapsulates the frame and sends it through the transport network to the destination VTEP. VTEP decapsulates the frame and sends it to the final destination. From the transport network perspective, you can use any IP-capable device to send a VXLAN-encapsulated Layer 2 frame.
Each VTEP has two interfaces: one interface provides a bridging function for local hosts (can be a trunk port to the access switch); the other has an IP identification in the core network for VXLAN encapsulation and decapsulation. A VTEP is commonly implemented in a hypervisor, but can exist on a physical switch or physical server and can be implemented in software or hardware. Each VTEP has one or more IP addresses. These addresses work as the source IP address in the packet that contains the original Layer 2 frame and goes through the transport network. The encapsulation carries the VXLAN identifier to isolate each Layer 2 network from another Layer 2 network.
The actual receivers and senders do not need to support VXLAN, they receive Layer 2 traffic that is decapsulated at the remote VTEP.
You can implement VXLAN technology on both hypervisor-based virtual switches and on physical switches. On a hypervisor, it provides scalable VM deployments. On physical switches, it allows you to bridge VXLAN segments back into VLAN segments. In these cases, the physical switch instantiates a VTEP and functions as a VXLAN gateway. A physical switch that acts as a VXLAN gateway allows overlays to be extended between virtual machines and bare metal servers.
Because VXLAN uses UDP or IP encapsulation, you can apply Equal Cost Multipathing (ECMP) and load-balance network workload using all available paths with the same route metric.