The Envelope Inside an Envelope
VXLAN (Virtual Extensible LAN), defined in RFC 7348, is the industry-standard protocol for building overlay networks. Its core mechanism is encapsulation — wrapping one complete network packet inside another.
Think of it like mailing a letter internationally. You write your letter (the original Ethernet frame). Instead of mailing it directly — which might not work because the postal system doesn't understand your local addressing — you put that letter inside a larger, standardized international envelope with a proper address the postal system understands. The postal system (the underlay) delivers the outer envelope. The recipient opens it, pulls out your original letter, and reads it as if it arrived directly.
How VXLAN works technically:
VXLAN takes a complete Layer 2 Ethernet frame — including the source and destination MAC addresses — and wraps it inside a UDP packet on port 4789. This UDP packet is then routed across the physical IP network like any other traffic. The receiving end strips the outer headers and delivers the original Ethernet frame to the destination virtual machine.
The critical addition is the VNI (VXLAN Network Identifier), a 24-bit field that identifies which virtual network this frame belongs to. This is the direct replacement for the VLAN tag:
| Protocol | Identifier Bits | Maximum Networks |
|---|---|---|
| VLAN | 12 bits | 4,096 |
| VXLAN | 24 bits | 16,777,216 (~16 million) |
That is a 4,000× increase in the number of isolatable networks — enough for any cloud provider operating today.
The full encapsulated packet structure looks like this:
[ Outer Ethernet Header ] ← Physical NIC MAC addresses
[ Outer IP Header ] ← Physical server IP addresses
[ Outer UDP Header ] ← Destination port 4789
[ VXLAN Header ] ← Contains the 24-bit VNI
[ Inner Ethernet Frame ] ← Original VM-to-VM traffic (MAC + IP + payload)
Key Point: VXLAN encapsulation multiplies the number of isolatable networks by over 4,000× compared to VLANs, while remaining fully compatible with existing IP infrastructure because it uses standard UDP transport.