17
votes
Accepted
VXLAN vs VLAN over layer 3
Yes, from the packet switching point-of-view, VXLAN is just a matter of sticking some encapsulation on top of an L2 frame: something that other protocols do as well.
The real difference it makes is ...
- 2,426
12
votes
Accepted
Encapsulation: can a higher protocol encapsulate a lower protocol?
Yes, encapsulation hide the details of what is encapsulated and doesn't really care about the payload nature.
VxLAN is a sensible example of this, with layer2 (VLAN) being encapsulated in layer 4 (UDP)...
- 19.8k
9
votes
Encapsulation: can a higher protocol encapsulate a lower protocol?
Consider a package delivery service, like UPS or DHL. They don't care what's inside the box - they just make sure it gets to its destination.
Similarly, the protocol doesn't care what the payload ...
- 68k
7
votes
VXLAN vs VLAN over layer 3
As you've already stated, VXLAN is L2 tunneling over IP. It's a solution to use any L3 network for creating a L2 segment.
While this is also possible with other protcols, VXLAN doesn't require ...
- 88.1k
7
votes
Difference between WAN and VPN(tunnels)
Originally, WANs were mostly defined by specific layer 1/2 protocols (Frame Relay, HDLC, SONET, etc) that they used, but Ethernet has taken over, and the others are rapidly fading into history. The ...
- 68k
6
votes
Accepted
VPNs are working in which layer of the OSI model?
Off the top of my head, the most common would be:
IPSEC (Internet Protocol SECurity)
SSL (Secure Sockets Layer)
PPTP (Point-to-Point Tunnelling Protocol)
L2TPv3 (Layer 2 Tunnelling Protocol)
As for ...
- 9,565
6
votes
MTU/MSS Oddness?
Cisco has a nice IPSec Overhead calculator (CCO Login required, unfortunately).
https://cway.cisco.com/ipsec-overhead-calculator/
From where we can draw, based on your IPSec settings and a few common ...
- 8,876
5
votes
Accepted
What are the correct protocol versions (v4 vs v6) for packets inside DS-Lite tunnels?
The consensus of the comments is
The segments are inside IPv4
The protocol of TCP happens to be 6 and it's not its IP version number
As you say, if you're looking for 4s vs 6s for protocol versions, ...
- 16.4k
5
votes
Accepted
Could accessed sites over an SSH tunnel be tracked by ISP?
The DNS is issued by default from your local host, not from the proxy, when using SOCKS (probably because SOCKS4 didn't support other way).
Make sure you have checked the checkbox "Remote DNS" in the ...
- 168
5
votes
Accepted
How IPsec tunnel mode work without GRE
So what's the difference between GRE+IPsec and IPsec only?
In GRE+IPsec the original IP packet is encapsulated in a GRE tunnel packet. The GRE packet is then encapsulated in the IPSec packet.
The ...
- 68k
5
votes
Accepted
What are the differences between tunneling and regular encapsulation?
Encapsulation is the normal method of using a lower layer mechanism for moving your data. E.g. HTTP is encapsulated by TCP, TCP is encapsulated by IPv4, IPv4 is encapsulated by an Ethernet frame.
...
- 88.1k
5
votes
What's the difference between L2TP and L2TPv3?
Let's say that it is a 'new protocol heavily based on L2TPv2'. It shares a lot of the messages, constructs, flows with L2TPv2 but it is not strictly backwards compatible. It does have an L2TP '...
- 1,039
4
votes
Accepted
Which VPN Types/Protocols inherently support Multicast Traffic?
IKE is (in massively simplified terms/practically explained) just a way of establishing an IPSec VPN tunnel, and IPSec VPN tunnels don't inherently support multicast.
You can put a GRE tunnel inside ...
- 297
4
votes
OSPF on tunnel interfaces
Yes, what's important to the router is layer 3 interfaces.
You can think of a layer 3 interface as a logical construct, which can be be tied to a VLAN, physical or tunnel interface.
- 19.8k
4
votes
Accepted
Scaling VXLAN tunnels in openvswitch
You could solve this by running VXLAN on the hypervisor using software like FRR. That would imply that you run a full mesh BGP setup between your hypervisors, or use route reflectors. Then, you can ...
- 17.4k
4
votes
Security implications of IPv6 tunneling over IPv4
I've read that IPv6 over IPv4 tunnels are a security risk because IPv6 traffic cannot be intercepted by Intrusion Detection Systems and Firewalls.
That's completely untrue. Maybe some specific, very ...
- 17.4k
4
votes
Why do all the intermediary routers need to run iBGP without tunneling?
You are confusing a couple of concepts. In your example:
edge -R1 - R2 - R3 - R4 -edge
You could have an iBGP problem because if all the routers run iBGP then each router would need an iBGP ...
- 101k
4
votes
Accepted
What does a VPN Tunnel offers other than encryption?
Tunnels change the network topology. They let routers A and B be logically adjacent even if they don’t have a physical connection. They also let you run one type of network over another type of ...
- 2,243
4
votes
Accepted
MTU/MSS Oddness?
REALLY REALLY late update, but I got busy with other tasks (MS365 migrations, recent software vulnerabilities, etc.), so whoops that i left this unsolved.
The MTU information helped guide us down a ...
- 181
4
votes
What are the benefits of using a transport label in L3VPN?
Two main reasons for using labels:
It makes the transport layer independent of the customer addressing scheme. Multiple customers can have overlapping addressing. The transport doesn't care
...
- 68k
4
votes
Accepted
Cisco IOS -> ASA VTI tunnel not routing traffic
I found the solution to this eventually, with some help.
The issue was that on the ASR side, the tunnel was in its default configuration which uses GRE, which the ASA doesn't support.
The solution was ...
- 193
4
votes
Accepted
In tunneling, how destination routers identify if a packet is encapsulated?
Encapsulation requires a protocol. Depending on the protocol, an encapsulating packet is uniquely identified by either EtherType (in layer 2), IP protocol number (in layer 3), transport-layer port ...
- 88.1k
4
votes
dynamic mac address added all hosts through the Do1Q tunnel
we must only see one mac-address of edge customer Switch
That's not how Q-in-Q works.
When forwarded across the service provider's backbone, the frames will still have the original Src and DstMac ...
- 8,876
3
votes
Accepted
Help understanding "tunneling"
What tunneling does is wrap a packet inside another packet. This could be used for something like allowing a protocol such as multicast to cross the public Internet, which doesn't support multicast, ...
- 101k
3
votes
Accepted
"Gateway of last resort is not set" even though I have a default route to a tunnel interface
If the interface to which your static route points is not up, then the route is withdrawn from the routing table. You can only route to an UP/UP interface.
Apparently, both tunnels to which your ...
- 101k
3
votes
What are the correct protocol versions (v4 vs v6) for packets inside DS-Lite tunnels?
Turns out, Wireshark confirms what our engine said - that the packet inside IPv4 layer is indeed TCPv6.
As jonathanjo already wrote: The (6) is the IPv4 (!) protocol number which is 6 for TCP and 17 ...
- 2,356
3
votes
Accepted
Why is L2TP based on PPP and not PPPoE?
PPP is independent of the underlying transport, PPPoE requires to be run on Ethernet (or a like tunnel). But of course, you can also run L2TP with PPPoE (RFC 3817).
- 88.1k
3
votes
Accepted
Cisco QinQ - More than one provider vlan (s-vlan) on dot1q-tunnel port
Sounds like you need "Selective Q-in-Q" documented here
E.g.
interface GigabitEthernet1/23
switchport mode trunk
switchport vlan mapping 21 dot1q-tunnel 211
switchport vlan mapping 31 dot1q-...
- 2,426
3
votes
Accepted
Cisco, No dot1q tunnel mode on switchport
As QinQ is ISP feature the key was in Not in Use entservice license state:
show license all
...
StoreIndex: 1 Feature: entservices Version: 1.0
License Type: PermanentRightToUse
License ...
- 41
Only top scored, non community-wiki answers of a minimum length are eligible