L2 segmentation at both scales: 802.1Q VLANs (access/trunk/native, QinQ, inter-VLAN routing, the 4094 limit) and VXLAN (MAC-in-UDP, VTEP/VNI, BUM handling, flood-and-learn vs BGP EVPN, distributed anycast gateway).
VLANs slice one physical switch into many broadcast domains; VXLAN stretches those domains over an L3 fabric and lifts the 4094-segment ceiling to 16 million. Same goal — isolate L2 — at two very different scales. This is the theory to explain both, and why the data center moved from one to the other.
A VLAN = one broadcast domain, tagged with a 12-bit ID, confined to an L2 network. VXLAN = an L2 frame tunneled in UDP across an L3 underlay, tagged with a 24-bit VNI — L2 anywhere the IP fabric reaches.
A VLAN is a logical broadcast domain. Frames carry the 802.1Q tag (see Protocol Headers): a 12-bit VID → 0–4095, with 0 and 4095 reserved, so ~4094 usable.
The tag is inserted right after the source MAC, before the EtherType/Length — that's the only change to a normal Ethernet II frame (+4 bytes):
untagged Ethernet II frame:
+-------------+-------------+-----------+--------------------+-----+
| Dst MAC (6) | Src MAC (6) | EtherType | Payload (46-1500) | FCS |
+-------------+-------------+-----------+--------------------+-----+
802.1Q-tagged frame (tag = 4 bytes, inserted after Src MAC):
+-------------+-------------+===============+-----------+---------+-----+
| Dst MAC (6) | Src MAC (6) | 802.1Q tag(4) | EtherType | Payload | FCS |
+-------------+-------------+===============+-----------+---------+-----+
| |
v v
+-------------------+---+---+------------------+
| TPID = 0x8100 (16)|PCP|DEI| VID (12 bits) |
+-------------------+---+---+------------------+
\_____ 2 bytes ____/ \______ TCI: 2 bytes ____/
PCP = 3-bit priority (802.1p CoS) DEI = 1-bit drop-eligible VID = VLAN 0-4095| Concept | Meaning |
|---|---|
| Access port | Belongs to one VLAN; frames are untagged to the host. The port's VLAN = its PVID. |
| Trunk port | Carries many VLANs, tagged (802.1Q), between switches. Prune with an allowed-VLAN list. |
| Native VLAN | The one VLAN sent untagged on a trunk. A native-VLAN mismatch merges two domains — a classic bug. |
| Voice VLAN | An access port tags voice while data stays untagged — phone + PC on one port. |
| Ranges | Normal 1–1005, extended 1006–4094 (Cisco). |
interface vlan10) — the scalable way. VRFs isolate routing tables per tenant.Stack two tags — an outer provider S-tag (0x88A8) plus the customer
C-tag (0x8100) — so a carrier can transport customer VLANs transparently and scale
past 4094 at the edge. The outer (S) tag is pushed in front; order is outermost first:
+-------------+-------------+===============+===============+-----------+---------+-----+
| Dst MAC (6) | Src MAC (6) | S-tag 0x88A8 | C-tag 0x8100 | EtherType | Payload | FCS |
+-------------+-------------+===============+===============+-----------+---------+-----+
\__ provider __/ \__ customer __/
(outer VID) (inner VID)Still L2, still bounded by the L2 domain — QinQ scales the edge, not the whole fabric.
MAC-in-UDP: a full Ethernet frame is encapsulated in an 8-byte VXLAN header + UDP (dst 4789) + outer IP/Ethernet, and forwarded across a routed L3 underlay. The 24-bit VNI identifies the segment — ~16 million vs 4094.
Read the encapsulation from the wire inward — the underlay headers come first, the tenant's original frame is the payload:
|<----------------- added by the VTEP (~50 bytes) ---------------->|<-- original -->|
+-----------+----------+----------+------------+---------------------+---------------+
| Outer Eth | Outer IP | Outer UDP| VXLAN hdr | Inner Ethernet | ... payload |
| 14 (+4) | 20 | 8, dst= | 8 | (the tenant frame, | (L3/L4/app) |
| | VTEP IPs | 4789 | VNI here | Dst/Src MAC ...) | |
+-----------+----------+----------+------------+---------------------+---------------+
\___ outer, routed across the underlay ______/ \___ carried opaquely, unchanged ___/
VXLAN header (8 bytes):
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-----------------------------------------------+
|R R R R I R R R| Reserved (24 bits) |
+-+-+-+-+-+-+-+-+-----------------------------------------------+
| VNI (24 bits) | Reserved (8) |
+-----------------------------------------------+---------------+
Flags: the I bit = 1 means the VNI field is valid; all R = reserved (0).So the field order on the wire is: outer MACs → outer IPs (VTEP→VTEP) → UDP:4789 → VNI → the whole original frame. Transit routers only ever see the outer IP/UDP; the tenant frame is opaque.
| Term | Meaning |
|---|---|
| VTEP | VXLAN Tunnel Endpoint — encaps/decaps frames. On a switch ASIC (hardware) or a hypervisor/host (software). |
| VNI | 24-bit segment ID; an L2VNI maps to a bridge domain, an L3VNI to a VRF. |
| Underlay | The routed IP fabric (usually a leaf-spine Clos with ECMP) that carries VTEP-to-VTEP traffic. |
| Overlay | The tenant L2/L3 networks riding on top. |
L2 relies on flooding; over an L3 underlay you need a way to replicate BUM to all VTEPs in a VNI:
| Flood-and-learn | BGP EVPN | |
|---|---|---|
| MAC learning | Data plane (flood, learn on arrival) | Control plane — MP-BGP advertises MAC/IP |
| VTEP discovery | Manual / multicast | Automatic (Type 3 routes) |
| Flooding | Lots of BUM | Reduced — ARP suppression, known unicast |
| Scale/robustness | Limited | The standard for production fabrics |
MP-BGP EVPN (L2VPN EVPN AFI/SAFI) is the modern VXLAN control plane. Key route types:
For the full field-by-field breakdown of every route type (1–5) and the extended communities they carry, see EVPN — Theory. Also MP-BGP and Life of a Packet — Advanced.
| VLAN | VXLAN | |
|---|---|---|
| Segment ID | 12-bit (~4094) | 24-bit (~16M) |
| Transport | L2 only | L2 over an L3 (routed) underlay |
| Reach | Within an L2 domain | Anywhere the IP fabric reaches |
| Multipathing | STP blocks links | L3 ECMP (all links active) |
| Overhead | 4-byte tag | ~50-byte encap (needs jumbo MTU) |
| Control plane | Flood/learn (+STP) | Flood/learn or BGP EVPN |