VXLAN explained: extending your L2 networks beyond the datacenter

As soon as a datacenter grows — several rooms, several sites, thousands of virtual machines — classic VLANs show their limits. VXLAN (Virtual Extensible LAN) is the answer that became the standard: an overlay protocol that extends Layer 2 networks over an IP fabric, without the constraints of the legacy model.

The VLAN problem

The VLAN has two structural limits. First, its identifier is 12 bits: you cap at 4096 VLANs, which quickly becomes insufficient for a hosting provider or a multi-tenant cloud. Second, a VLAN remains a Layer 2 domain: it doesn't naturally cross IP routing, so extending the same network between two rooms or two sites requires large-scale L2 — fragile and hard to operate.

The VXLAN principle

VXLAN encapsulates Ethernet frames inside UDP/IP packets: the Layer 2 network becomes an "overlay" running on top of a routed IP network (the "underlay"). Each segment is identified by a 24-bit VNI (VXLAN Network Identifier) — more than 16 million possible segments, versus 4096. Encapsulation and decapsulation are performed by VTEPs (VXLAN Tunnel Endpoints), in hardware or software.

What it changes in practice

• L2 extension without geographic limit: the same segment can span racks, rooms and even sites, as long as there's IP between them.
• Multi-tenant at scale: tens of thousands of isolated networks, essential in shared hosting and cloud.
• VM mobility: a virtual machine can migrate without changing address or logical network.
• Robust underlay: the routed IP core (often a spine-leaf design) stays simple, stable and easy to scale.

VXLAN and EVPN: the modern pair

On its own, VXLAN carries the frames but has to "learn" where MAC addresses are, often by flooding. It is therefore paired with EVPN (Ethernet VPN, via BGP), which cleanly distributes MAC and IP reachability across the fabric. It is the VXLAN/EVPN pair that today underpins most modern datacenter fabrics.

Points to watch

Encapsulation adds bytes: you need a sufficient MTU on the underlay (jumbo frames) to avoid fragmentation. The underlay design (routing, ECMP, redundancy) determines overlay performance. Finally, monitoring must cover both layers — an underlay issue shows up as confusing symptoms on the overlay.

The operator's role

Designing and operating a VXLAN/EVPN fabric — from the IP underlay to multi-site integration — requires deep networking expertise. That is what our managed IT covers, backed by our IP transit for interconnection and our hosting offerings. To link several sites upstream of an overlay, see also our telecom offering.