Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
Does VXLAN always require UDP for encapsulation, cant it just send packet with only IP header?
UDP port 4079 may be required for identification, but is there not any other way to identify, like the VNI field?
How can hosts communicate directly with each other once The two NVEs process the address learning and have each other’s MAC address in the NVE’s mapping table, i think they will still require IP network for communication as they dont have a direct connection, can be miles apart
Does VXLAN always require UDP for encapsulation,
Yes. VXLAN encapsulates (Ethernet) frames using UDP datagrams.
cant it just send packet with only IP header?
That's not VXLAN, that's some other protocol. The point of tunneling is to hide "inner" addressing from the "outer" forwarding protocols. In VXLAN's case, the inner addressing is MAC + VLAN ID, the outer is UDP over IP.
UDP port 4079 may be required for identification, but is there not any other way to identify, like the VNI field?
The VNID provides inner addressing, you cannot use it to direct an encapsulating datagram.
There are various implementation variants. Check your device's documentation. If you plan to use VXLAN over the Internet I'd very strongly suggest VPN for authentication and privacy. Usually you shouldn't require L2 connectivity over VPN though, so you'd just route and use firewall rules to control connectivity.
How can hosts communicate directly with each other once The two NVEs process the address learning and have each other’s MAC address in the NVE’s mapping table, i think they will still require IP network for communication as they dont have a direct connection, can be miles apart
A VXLAN tunnel provides a network bridge between two potentially widely separated endpoints. Frames are tunneled through like they were connected to the same switch/VLAN. Switches connected to the VXLAN bridges learn source MAC addresses in the same way as with any other bridge.
Of course, you require a working IP network between the VXLAN endpoints to create the tunnel.
