[RFC 7348] about VXLAN in the introduction says:

Data centers are often required to host multiple tenants, each with their own isolated network domain. Since it is not economical to realize this with dedicated infrastructure, network administrators opt to implement isolation over a shared network.

I imagine a rack with multiple servers, each one running multiple virtual machines(VMs). All VMs owned by a single server/tenant, compose its own isolated network domain? What is not economical to realize?

  • Unfortunately, questions about hosts/servers/VMs are off-topic here. The problem is about the infrastructure is about the network infrastructure, not hosts or servers. It is not economical to install separate switches and routers for each customer.
    – Ron Maupin
    Oct 16, 2017 at 20:54
  • Additionally, it may not be economical to co-locate newly installed machines with previously present ones. VLAN and VXLAN can be used to group these machines into their own network regardless of physical location.
    – Zac67
    Oct 16, 2017 at 21:03
  • @Zac67 Ok, and VLAN can be deployed only on a single server, since the MAC address generated when a VM starts may be duplicate of an existing one in some other server?
    – glc78
    Oct 16, 2017 at 21:11
  • Of course, MAC addresses need to be unique but there are various mechanisms to ensure this in virtual environments. That problem also exists with VXLAN.
    – Zac67
    Oct 17, 2017 at 5:15
  • @RonMaupin I tought here was fine. So, the right place for the informatic side of network things is Stackoverflow?
    – glc78
    Oct 17, 2017 at 20:58

3 Answers 3


There are a number of difficulties with physically separate networks.

  1. Resources for a tenant may be spread out through the datacenter due to gradual growth over time or a desire not to "put all your eggs in one basket". Running long dedicated cables for each client gets expensive.
  2. Resources are likely to be reallocated over time. Physical re-patching when resources are reallocated gets expensive and time consuming.
  3. One VM host may host VMs for many different clients. Fitting a seperate NIC to the VM host for each client would get prohibitively expensive.
  4. There is a certain minimum cost for a router or switch. Having switches with only a handful of ports used gets expensive.

So customers want logically separate Ethernet networks but physically separate networks end up being prohibitively expensive. So we need to build logically separate Ethernet networks over the top of a common physical network.

VLANs provide a method for doing this but they have scalability problems. VXLAN aims to provide a more scalable solution (at the cost of substantially higher encapsulation overhead).

  • A cost of about 50 byte if I remember. I miss something on point 3 but it's ok. I can think two limits for VLANs: ID range number of 4094, and MAC address that can't go through layer 2.
    – glc78
    Oct 17, 2017 at 20:52
  • The other big limit on VLANs is that Ethenet is designed as a tree. Trees are a poor soloution for building large reliable high-capacity networks. Because VXLAN works on top of IP it can work with non-tree topologies. Oct 17, 2017 at 21:06
  • So VXLAN is a frame of layer 2 but being on top of layer 3 it can allow non-tree topologies, taking advantage for example from ECMP strategy.
    – glc78
    Oct 20, 2017 at 8:55

If you read more you can find this in 3.2. Multi-tenant Environments

Cloud computing involves on-demand elastic provisioning of resources
for multi-tenant environments. The most common example of cloud
computing is the public cloud, where a cloud service provider offers
these elastic services to multiple customers/tenants over the same
physical infrastructure.

The vms for different users/tenants might be placed in a single server.


There are various reasons when servers that should be in a single segment are geographically remote, including:

  • hosted servers are often not deployed at the same time; later deployment usually means another rack, possibly even another data center
  • servers are put into different fire zones or data centers on purpose for availability/fail-over reasons
  • hosted servers or services need to be combined with on-premise installations

When servers are physically remote to each other there might still be good reasons to arrange them very tightly logically. Without virtual network connections this means running separate network links for each zone. This increases cost and can be prohibitively expensive.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.