What is VXLAN?

Virtual Extensible LAN (VXLAN) is an encapsulation protocol that carries Layer 2 Ethernet frames over a Layer 3 IP network by wrapping them inside UDP packets, using a 24-bit network identifier to scale far past traditional VLANs. Versa SD-WAN combines VXLAN with EVPN and IPsec to build encrypted overlay tunnels between sites.

Key takeaways

• VXLAN tunnels Ethernet frames inside UDP packets over an IP network.
• A 24-bit VNI supports up to 16 million segments, versus VLAN’s 4,094.
• VTEPs encapsulate and decapsulate traffic at each tunnel endpoint.
• EVPN uses MP-BGP to distribute MAC and IP reachability for VXLAN.
• Versa combines VXLAN with EVPN and IPsec for SD-WAN and LAN overlays.

On this page: Why it matters · How it works · Types · VXLAN & Versa · FAQ

Why is VXLAN important?

Traditional VLANs identify a Layer 2 segment with a 12-bit tag, capping a network at 4,094 usable segments – a limit multitenant data centers and cloud environments outgrew years ago. VXLAN replaces that tag with a 24-bit network identifier, room for over 16 million isolated segments, while preserving the same broadcast-domain isolation VLANs provide. Just as important, VXLAN decouples Layer 2 reachability from physical topology: two hosts on the same virtual segment can sit behind different routers, in different racks, or in different data centers, connected only by ordinary IP routing.

That decoupling makes VXLAN the standard substrate for modern overlay networks. Cloud providers use it to give each tenant an isolated network on shared infrastructure; enterprise fabrics use it to extend Layer 2 across a routed leaf-spine core without flooding the underlay. Paired with EVPN for control-plane distribution, VXLAN scales in ways flat, spanning-tree-bound VLANs cannot – why it now sits underneath both data-center fabrics and SD-WAN overlays, including Versa’s.

What is VXLAN?

VXLAN operates in two planes. In the data plane, a VXLAN Tunnel Endpoint (VTEP) – a physical or virtual switch, router, or host – takes an original Ethernet frame and wraps it in an 8-byte VXLAN header carrying the 24-bit VXLAN Network Identifier (VNI – not to be confused with the vni- interface names on VOS appliances, a separate glossary entry), an 8-byte outer UDP header (IANA-assigned destination port 4789, though implementations may use others), and an outer IP header addressed to the remote VTEP. The receiving VTEP strips those headers and delivers the original frame onto the correct local segment, identified by the VNI.

In the control plane, VXLAN is commonly paired with EVPN, which uses Multiprotocol BGP (MP-BGP) – extended with the Layer 2 VPN address family and the EVPN subsequent address family – to distribute MAC addresses and IP routing information between VTEPs. This lets a VTEP learn where a remote MAC address lives before traffic arrives, avoiding the flood-and-learn behavior that plain VXLAN (without EVPN) relies on.

Types of VXLAN

EVPN defines two ways to map VLANs to VXLAN segments. A VLAN-based service maps a single VNI to one EVPN instance and maintains one MAC table per VNI – simple, but each VLAN needs its own instance. A VLAN-aware bundle maps multiple VNIs to a single EVPN instance while keeping a separate bridge table per VNI, which reduces per-VLAN configuration overhead in larger deployments.

EVPN also defines five route types that carry VXLAN’s control-plane information: Type 1 (Ethernet auto-discovery, for multihomed sites), Type 2 (MAC/IP advertisement), Type 3 (inclusive multicast routes, which set up delivery paths for broadcast, unknown-unicast, and multicast traffic), Type 4 (Ethernet segment routes, used to elect a designated forwarder in multihoming), and Type 5 (IP prefix routes, which decouple IP reachability from MAC/IP advertisements). Broadcast, unknown-unicast, and multicast (BUM) traffic is handled through ingress replication rather than underlay multicast.

VXLAN & Versa

Versa Operating System (VOS) devices run EVPN VXLAN for SD-WAN, building Layer 2 overlays between customer-edge devices across the Layer 3 WAN underlay: a virtual switch (MAC-VRF) is configured with a VNI-mapped bridge domain, EVPN is enabled with VXLAN encapsulation, and MP-BGP peers between VTEPs distribute MAC and IP reachability. The same mechanism underlies EVPN VXLAN for ZT-LAN, where VTEPs sit on leaf and spine devices inside a Zero Trust LAN fabric rather than on WAN-facing edge devices.

On the wire, Versa’s overlay uses UDP port 4790 for VXLAN communication between branch, hub, and Controller devices – not the IANA default of 4789 – so firewall rules along the path must permit UDP 4790 for the overlay to come up. VXLAN also appears in campus switch fabrics: SD-LAN workflow templates let an administrator enable VXLAN per switch port, assign a VTEP IP address, and configure a VXLAN virtual switch and VRF once at least one Layer 3 port exists. Across all three paths, VOS supports the VLAN-based and VLAN-aware bundle EVPN service types and Type 1–5 EVPN routes; Type 5 route support was added in release 22.1.1, with the broader feature set available since 21.2.1.

Frequently asked questions

What is the difference between VXLAN and a VLAN?

A VLAN tags frames with a 12-bit ID, capping a network at 4,094 segments and typically staying within one Layer 2 domain. VXLAN encapsulates frames with a 24-bit VNI and routes them over Layer 3, supporting over 16 million segments and letting a segment span routed networks and data centers.

What is a VXLAN Tunnel Endpoint (VTEP)?

A VTEP is the device that encapsulates and decapsulates VXLAN traffic – adding the VXLAN, UDP, and outer IP headers on the way out, and stripping them on the way in. A VTEP can be a physical switch or router, or a virtual one running on a hypervisor.

How does EVPN work with VXLAN?

EVPN is the control plane most commonly paired with VXLAN’s data plane. It uses Multiprotocol BGP to advertise MAC and IP reachability between VTEPs before traffic flows, so remote hosts are known in advance instead of being discovered through flood-and-learn, and it defines route types for multihoming, BUM delivery, and IP prefix advertisement.

What is BUM traffic in a VXLAN network?

BUM stands for broadcast, unknown-unicast, and multicast traffic – frames that cannot be forwarded to a single known destination. VXLAN deployments typically handle BUM traffic through ingress replication, where the ingress VTEP sends a copy to every other VTEP in the segment.

What UDP port does VXLAN use?

The IANA-assigned VXLAN destination port is UDP 4789, but implementations can and do use other values – Versa’s SD-WAN overlay carries VXLAN between branch, hub, and Controller devices over UDP 4790. When building firewall rules for a Versa deployment, permit UDP 4790 for the overlay; 4789 appears in Versa environments only for unrelated uses such as Docker overlay networking between Director cluster nodes.

More on VXLAN

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about VXLAN, these are worth looking at next.