The Limitation of Layer 2
In traditional data centers, network isolation was achieved using VLANs (Virtual Local Area Networks) — a mechanism that tags Ethernet frames with a numeric identifier so that traffic from different customers or departments stays separated even when sharing the same physical switches. If you worked at a hosting company, Customer A got VLAN 10, Customer B got VLAN 20, and the switch ensured they never saw each other's traffic.
The Problem: The VLAN standard encodes the identifier in a 12-bit field, which means you can only have 4,096 unique VLAN IDs (2¹² = 4,096). For a small enterprise, that's plenty. For a massive cloud provider like AWS or Google Cloud serving millions of tenants — each of whom may need multiple isolated networks — 4,096 is a hard ceiling that was hit years ago.
The Solution: Stop relying on physical switches to carry the isolation boundary. Instead, build a virtual network (overlay) on top of the physical network (underlay). The overlay creates the illusion of a direct Ethernet cable between two virtual machines, even if those VMs are running on servers in different racks or even different buildings. The physical network underneath just sees ordinary IP packets — it has no idea that virtual networks are riding inside them. This approach allows cloud providers to create millions of isolated tenant networks over the same physical infrastructure.
Key Point: Overlay networks solve the VLAN scalability problem by encapsulating virtual traffic inside physical packets, decoupling the virtual network topology from the physical one entirely.