VXLAN

VXLAN carries a logical Ethernet network across routed IP infrastructure, allowing workloads in different racks or locations to remain within the same network segment.

At each end, a VXLAN tunnel endpoint wraps the original Ethernet frame inside UDP and IP information, then removes it on arrival. This separates the logical network from the physical switching layout, making expansion and workload placement easier to manage.

VXLAN is used when VLANs cannot provide enough segments, flexibility or reach for large virtualised, multi-tenant or distributed data centre environments.

VLANs remain suitable for simpler networks but offer approximately 4,000 usable identifiers and are closely tied to the physical topology. VXLAN supports millions of logical segments across routed infrastructure, giving stronger separation and workload mobility without extending one Layer 2 network across the estate.

VXLAN carries workload traffic across the routed network, while EVPN commonly tells participating switches where workloads and logical network segments are located.

Used together, VXLAN provides the virtual network and EVPN distributes the reachability information needed to find connected endpoints efficiently. This reduces reliance on widespread traffic discovery and helps larger fabrics scale with better operational control, although simpler VXLAN deployments may use another control method.

VXLAN requires compatible switches or virtual network devices, a reliable routed underlay and sufficient capacity to carry encapsulated traffic between tunnel endpoints.

Addressing, gateways, segmentation, packet size, routing and monitoring also affect whether the overlay operates reliably. Steel City Consulting can validate platform support and design these dependencies together, helping avoid fragmentation, unreachable workloads or an overlay that exceeds underlay capabilities.

VXLAN separates workloads into logical network segments, but firewalls, identity controls and security policies are still needed to govern communication between them.

The segmentation can isolate applications, departments, tenants or security zones across shared infrastructure. However, gateway placement and inter-segment policies determine what can communicate, so the design must align each VXLAN segment with the organisation’s actual access and security requirements.

VXLAN may be unnecessary when existing VLANs already provide sufficient segmentation, scale and workload connectivity within a relatively simple physical network.

Overlay networking adds routing, monitoring and troubleshooting considerations that some environments do not need. Steel City Consulting can compare the current architecture with expected growth and mobility requirements, establishing whether VXLAN addresses a real limitation or whether conventional VLANs remain more manageable.