Differences Between VXLAN and Other Virtualization Technologies

VXLAN (Virtual Extensible LAN) is the core technology for campus network virtualization, fundamentally changing the design and operational model of traditional campus networks.

Why is it needed, what is it, how does it work, and what benefits does it bring are the aspects that comprehensively explain the relationship between VXLAN and campus network virtualization.

1. Challenges of Traditional Campus Networks (Why is virtualization needed?)

Traditional campus networks typically adopt a three-layer hierarchical architecture (Access – Aggregation – Core) and use VLAN (Virtual Local Area Network) based technologies for service isolation. This architecture faces significant challenges in today’s era:

1. Limitations on the number of VLANs:

The IEEE 802.1Q standard has a 12-bit VLAN ID, supporting a maximum of 4094 VLANs. This is far from sufficient for large enterprises, campuses, and Internet of Things (IoT) scenarios that require massive isolation.

2. Geographic limitations:

VLANs are layer 2 technologies and typically cannot cross layer 3 network boundaries. This means a VLAN can only be confined to a physical location or a single building, making flexible business deployment across data centers and campuses impossible.

3. Network rigidity:

Business is strongly bound to the physical network. Creating a new service or adjusting a user’s network permissions may require manual configuration of multiple switches’ VLANs and ACLs, which is labor-intensive, error-prone, and cannot be automated.

4. Difficulty in multi-tenant support:

It is challenging to provide a fully logically isolated network environment for different departments or external customers (tenants) on shared physical infrastructure.

2. What is VXLAN?

VXLAN is an Overlay network technology that addresses all the above challenges.

Core Idea:

On top of the existing Underlay (physical) IP network, a virtual, large-scale layer 2 network is constructed using “tunneling” technology.

Like a “delivery service”:

Your package (original data frame) is packed into a standard box (VXLAN header + UDP header + IP header) and then delivered through the existing, efficient, and extensive road network (IP Underlay network). The recipient opens the box to retrieve the original package inside. This “box” is the VXLAN tunnel.

Key technical points of VXLAN:

1. VXLAN Network Identifier (VNI):

This is the core of VXLAN. The VNI is 24 bits long, supporting up to 16 million (2^24) isolated network segments, completely solving the problem of insufficient VLAN numbers. Each VNI acts like an independent virtual network (tenant).

2. Encapsulation and Decapsulation:

Encapsulation (Ingress):

The VTEP (VXLAN Tunnel Endpoint) encapsulates the original layer 2 Ethernet frame into a UDP packet, adding the VXLAN header (containing the VNI) and the external IP header.

Decapsulation (Egress):

The destination VTEP receives the UDP packet, strips off the outer header, and forwards the original data frame to the corresponding virtual network based on the VNI.

3. VTEP (VXLAN Tunnel Endpoint):

This is the device that performs encapsulation and decapsulation. It can be a virtual switch (such as vSphere’s vSwitch, Linux Bridge), a physical switch (TOR switches that support VXLAN), or a network card of a hardware server (smart NIC offload).

4. Underlay Network:

This is the underlying IP network on which the VXLAN tunnel is established. It typically uses SPF (Shortest Path First) protocols (such as OSPF, IS-IS) to build a high-speed, loop-free, highly available physical network, providing optimal transmission paths for the Overlay network.

3. How does VXLAN achieve campus network virtualization?

VXLAN shifts campus networks from being “location-centric” to being “business/user/policy-centric”.

1. Building a large layer 2 domain:

No matter where users are located, as long as they connect to the network, they can be assigned to the same VNI through the VXLAN tunnel. This allows operations like virtual machine migration (vMotion/Live Migration) that require maintaining the same IP address to be seamlessly conducted across the entire campus or even between data centers.

2. Extreme business/tenant isolation:

Each department, project, or even customer can be assigned an independent VNI. Communication between these VNIs is entirely controlled by policies on the gateway (firewalls, ACLs), achieving true logical isolation that is secure and flexible.

3. Integration with SDN (Software Defined Networking):

This is the way to unleash the full power of VXLAN. Typically managed by an SDN controller (such as Cisco DNA Center, VMware NSX, Huawei iMaster NCE) for centralized management.

Control Plane:

The controller centrally learns and distributes the addresses of VTEPs, MAC addresses, IP addresses, and the mapping of VNIs through protocols like BGP EVPN, replacing traditional flooding learning.

Management Plane:

Administrators define business policies (e.g., allowing the finance department’s VNI 10001 to access the internet but prohibiting access to the R&D department’s VNI 10002) through a graphical interface on the controller. The controller automatically distributes the policies to relevant devices across the network.

Data Plane:

Network devices (VTEPs) are only responsible for data forwarding based on the controller’s instructions, making them simple and efficient.

4. Advantages of VXLAN Campus Virtualization:

Feature	Traditional Campus Network (VLAN)	VXLAN Virtualized Campus Network
Scalability	Up to 4094 isolated segments	16 million isolated segments (VNI)
Flexibility	Network is strongly bound to physical location	Decoupling of business and location, users can access the same network anytime, anywhere
Automation	Manual configuration, time-consuming and error-prone	SDN controller automatically deploys, policies can be pushed with one click
Multi-tenancy	Complex to implement, poor isolation	Inherent support, clear and secure logical isolation
Operation and Maintenance	Difficult fault localization, complex troubleshooting	Centralized visual management, easy monitoring and troubleshooting

Conclusion

VXLAN is not just a tunneling technology; it is the cornerstone for building a new generation of software-defined campus networks. Through VXLAN, campus networks achieve:

Large-scale:

Overcoming the limitations of VLAN numbers.

Wide range:

Breaking the geographical boundaries of layer 2 networks.

Flexibility:

Decoupling of network and physical, supporting rapid business innovation and deployment.

Automation:

Achieving intelligent and automated operation and maintenance of networks through integration with SDN.

VXLAN makes campus networks as flexible, elastic, and manageable as the cloud, and is the inevitable direction for future enterprise network development.

As an Overlay network virtualization technology, VXLAN has essential differences and specific application scenarios compared to other technologies.

To better understand their relationships and evolution, we present the following diagram:

Here are the detailed differences between them:

1. Differences from Traditional VLAN Technology

Feature	VLAN (Virtual LAN)	VXLAN (Virtual Extensible LAN)
Technical Standard	IEEE 802.1Q layer 2 protocol	Overlay technology, encapsulated in UDP/IP (L2 over L4)
Identifier Length	12-bit VLAN ID (VID)	24-bit VXLAN Network Identifier (VNI)
Scale Limitations	Up to 4094 isolated networks	Up to 16 million isolated networks, completely solving the quantity bottleneck
Network Scope	Limited to a single layer 2 domain, complex configuration needed to cross layer 3 boundaries	Inherently based on IP networks, easily crosses layer 3 networks, building a large layer 2 domain
Core Issue	Solves the broadcast isolation issue within layer 2 networks	Solves the issues of large-scale, multi-tenant, and cross-layer 3 network expansion in data centers/campus

Summary:

VXLAN does not replace VLAN, but rather extends and enhances it. In a VXLAN network, access layer ports can still be divided into VLANs, which are mapped to different VNIs, thus extending across the entire network. VLANs are typically used at the access layer, while VXLAN plays a role at the core/aggregation layer.

2. Differences from Other Overlay Technologies (NVGRE, STT)

VXLAN, NVGRE, and STT were introduced around the same time as overlay technologies aimed at solving similar problems but implemented differently.

Feature	VXLAN	NVGRE	STT
Encapsulation Protocol	UDP	GRE	TCP-like (but stateless)
Load Balancing	Utilizes UDP source port hashing, supports ECMP	Uses GRE Key, but network devices have inconsistent support for GRE, with poor ECMP support	Utilizes TCP source port, sequence number, etc., with good ECMP support
Vendor Support	Industry de facto standard, supported by almost all mainstream network and virtualization vendors	Mainly driven by Microsoft for Hyper-V network virtualization, with a narrow ecosystem	Initially proposed by VMware, but later shifted to VXLAN, now largely deprecated
Key Advantages	Best universality, high compatibility with existing network devices and security policies	Tighter integration with the Microsoft ecosystem	Utilizes NIC TOE (TCP Offload Engine) to enhance performance

Summary:

VXLAN has gained the widest industry support due to its simplicity based on UDP and excellent ECMP support, becoming the de facto standard for overlay technologies. NVGRE and STT have relatively narrow application scopes.

3. Differences from VPN Technologies (IPsec, MPLS VPN)

VPN technologies are also used to create virtual networks, but their core purposes and application scenarios differ from VXLAN.

Feature	VXLAN	IPsec VPN	MPLS VPN
Core Objective	Network expansion and multi-tenant isolation	Secure encryption and private communication	Business isolation and traffic engineering
Working Layer	Layer 2/3 (carrying Ethernet frames or IP packets)	Layer 3 (encrypting IP packets)	Layer 2.5 (based on label forwarding)
Typical Scenarios	Internal data center, internal campus network virtualization	Secure tunnels over public networks (e.g., remote access, site interconnection)	Carrier networks, enterprise backbone networks for multi-tenant isolation
Encryption Capability	Does not provide encryption natively (can be combined with IPsec for implementation)	Provides strong encryption and authentication natively	Does not provide encryption natively

Summary:

VXLAN is primarily used to build virtual networks within data centers and campuses, while VPN is mainly used for secure connections across public networks. They are sometimes used in conjunction, for example, using IPsec to encrypt VXLAN traffic for secure extension of layer 2 domains over untrusted networks.

4. Relationship with SDN/OpenFlow

This is a common point of conceptual confusion. They are not similar technologies but rather have a complementary and synergistic relationship.

SDN/OpenFlow: is a network architecture concept that separates the control plane from the forwarding plane, with a central controller (Controller) managing, programming, and controlling network devices.

VXLAN: is a specific data plane encapsulation technology used to implement Overlay functionality at the packet level.

Relationship:

VXLAN is the perfect carrier of the SDN concept. The SDN controller can centrally manage all VTEPs and distribute flow table rules, instructing devices on how to encapsulate and forward VXLAN packets.

The control plane of VXLAN initially relied on multicast but now commonly uses the BGP EVPN protocol to distribute VTEP and MAC/IP address information. This control plane can itself be implemented and enhanced by the SDN controller.

VXLAN provides strong “muscle” (data layer implementation) for SDN, while SDN provides the intelligent “brain” (control layer management) for VXLAN.

Conclusion and Selection

Technology	Core Value	Typical Application Scenarios
VLAN	Simple layer 2 network isolation	Small local area networks, office networks
VXLAN	Large-scale, cross-layer 3 network virtualization and multi-tenant isolation	Modern data centers, large campus networks, cloud platforms
NVGRE	Network virtualization within the Microsoft ecosystem	Hyper-V virtualization environments
IPsec VPN	Secure remote access and site-to-site communication	Employee remote work, branch interconnection
MPLS VPN	Carrier-grade multi-tenant business isolation	Service providers offering dedicated line services to enterprises
SDN	Network programmability and automated control	Any network environment requiring flexible, automated operations

How to Choose?

If you need to achieve massive tenant isolation, large-scale virtual machine migration, and flexible network policies within a large data center or campus, VXLAN + SDN (BGP EVPN) is the current standard answer.

If you only need to segment a few different networks within a building, using VLAN is sufficient.

If you need to allow employees to securely access the company intranet from home, use IPsec VPN.

Weather Assistant – Download the Weather App to check the weather

https://promoter.weahunter.cn/promotion-page/?id=4ec36ea826d64f679d5f0a7b009bc2a9

Original Statement: This article is for learning and communication purposes only and may not be used for commercial purposes without the author’s written permission.Chaoyang Huimingda Electronic Technology Co., Ltd.