A useful VXLAN interview answer starts with one question: how can two hosts share an Ethernet segment when the network between their switches is routed?
Short answer: VXLAN carries an Ethernet frame inside UDP/IP between VXLAN Tunnel Endpoints (VTEPs); its VNI identifies the virtual segment.[1] An overlay is the logical network presented to endpoints, while the underlay supplies IP transport between tunnel endpoints.[2]
Underlay vs overlay vs EVPN
Keep three jobs separate: transporting packets, identifying the virtual network, and learning where destinations live.
| Component | Job | Interview distinction |
|---|---|---|
| Underlay | IP reachability between tunnel endpoints | Carries outer packets, not a stretched access VLAN.[2] |
| VXLAN overlay | Encapsulation and segment identification | VTEPs add/remove headers; the VNI is 24 bits.[1] |
| EVPN control plane | Distributes endpoint reachability using BGP | EVPN and VXLAN are complementary, not synonyms.[2] |
VXLAN does not require EVPN: the original specification describes flood-and-learn operation, while EVPN adds control-plane distribution of MAC and IP information.[1][2] Do not infer that every BGP session in a fabric is an EVPN session; identify which address family and reachability information you are examining.
Follow one frame across a routed network
Illustrative topology, not an executed lab: Host A and Host B are in one subnet and one Layer-2 VNI, 10100; Leaf A and Leaf B are VTEPs with documentation addresses 192.0.2.11 and 192.0.2.22. Assume ARP and remote MAC learning have already completed, so this is known unicast rather than the first packet after startup.
Host A -- Leaf A/VTEP -- routed underlay -- Leaf B/VTEP -- Host B
192.0.2.11 192.0.2.22
logical L2 segment: VNI 10100
Outer Ethernet | Outer IP | UDP | VXLAN | Inner Ethernet frame
- Host A sends the original Ethernet frame toward Host B.
- Leaf A associates the local segment with VNI 10100 and looks up the remote destination.
- Leaf A encapsulates it with outer source 192.0.2.11 and destination 192.0.2.22; the standard VXLAN UDP destination port is 4789.[1]
- The underlay forwards toward the outer destination; Leaf B removes the tunnel headers and delivers the inner frame in the matching segment.[1]
For the whiteboard, draw inner and outer addresses in different colors. Ask yourself: “Which destination is this device using at this point?” That question is more useful than memorizing a diagram.
What happens before the destination is known?
Broadcast, unknown-unicast and multicast traffic is often called BUM; EVPN overlay designs can use ingress replication or underlay multicast for its delivery.[2] With ingress replication, the ingress endpoint sends separate tunnel copies to participating endpoints; multicast instead uses a distribution tree in the transport network.[2] EVPN can reduce reliance on flooding, but it does not mean all BUM traffic disappears.[2]
Interview follow-up: ask whether the scenario is known unicast, ARP discovery or unknown unicast before describing the forwarding path. In your answer, state the assumed replication design rather than silently assuming multicast everywhere.
VLAN, VNI and routing: avoid mixing the scopes
A local VLAN and a VNI are different identifiers; a common VLAN-based EVPN service maps a bridge domain to one VNI, but their numeric values do not have to match.[2] The walkthrough above deliberately covers same-subnet bridging; communication between subnets requires a routing function, not simply another VXLAN header.[2]
For a design interview, ask where the gateway resides and which routing model is used. Do not present the same-subnet diagram as a complete explanation of distributed inter-subnet routing.
Troubleshooting checklist: prove each dependency
Use this as a proposed investigation order, not as output from a tested fabric.
| Check | Evidence to collect | Question to answer |
|---|---|---|
| Local attachment | Port state, VLAN membership, local MAC entry | Does the source reach the intended local segment? |
| Underlay | Route to the remote VTEP, correctly sourced reachability test | Can the tunnel endpoints reach each other? |
| Overlay mapping | Local VLAN/VNI association and remote membership | Are both hosts in the intended service? |
| Endpoint learning | Destination MAC, remote VTEP and relevant EVPN route if used | Does the forwarding entry point to the right endpoint? |
| Encapsulation | Capture of outer destination, UDP port and VNI | Does the observed packet match the design? |
| Delivery | Remote decapsulation counters and destination attachment | Where is the first missing frame? |
| Return direction | Repeat the checks from the other host | Does the reverse path have equivalent evidence? |
MTU warning: encapsulation increases packet size; RFC 7348 says VTEPs must not fragment VXLAN packets and recommends an underlay MTU large enough for the encapsulated traffic.[1] Test a range of sizes instead of accepting one small ping as completion. Record the selected source interface, packet size convention and actual path before interpreting results.
An illustrative capture filter for a Linux capture point with visibility of the outer traffic is:
sudo tcpdump -ni <capture-interface> 'udp dst port 4789'
This is a proposed diagnostic command, not a command run on a production network. Replace the placeholder and obtain authorization before capturing traffic; treat captures as potentially sensitive.
Common interview pitfalls
- “VXLAN encrypts the traffic.” Encapsulation is not encryption; VXLAN's security considerations call for additional protections where required.[1]
- “EVPN and VXLAN are the same protocol.” Explain control-plane reachability versus data-plane encapsulation.[2]
- “The VNI number proves connectivity.” Ask for endpoint, transport and forwarding evidence, not merely matching configuration.
- “A working VTEP ping proves the application works.” Continue through the overlay and both host attachments.
- “Every VXLAN deployment has the same routing and replication model.” State assumptions before describing a packet path.
A short interview answer
“VXLAN provides a logical Ethernet segment across an IP network using VTEP encapsulation and a VNI.[1] EVPN can supply BGP-based endpoint learning, but VXLAN can exist without it.[1][2] I would troubleshoot local attachment, VTEP reachability, overlay membership, endpoint learning, packet size and return traffic separately.”
Related reading
- VXLAN MTU troubleshooting: why ping works but applications fail
- EVPN/VXLAN BUM traffic: head-end replication vs multicast
- Data center networking topic hub
Summary and practice
Remember the three questions: what carries the packet, which virtual segment does it belong to, and how was the destination learned? For your next network engineering interview, sketch the example from memory, label inner and outer addresses, and explain how you would locate the first missing packet.
Post a Comment