17
votes
Accepted
VXLAN vs VLAN over layer 3
Yes, from the packet switching point-of-view, VXLAN is just a matter of sticking some encapsulation on top of an L2 frame: something that other protocols do as well.
The real difference it makes is ...
- 2,416
12
votes
Accepted
Encapsulation: can a higher protocol encapsulate a lower protocol?
Yes, encapsulation hide the details of what is encapsulated and doesn't really care about the payload nature.
VxLAN is a sensible example of this, with layer2 (VLAN) being encapsulated in layer 4 (UDP)...
- 19.5k
9
votes
Encapsulation: can a higher protocol encapsulate a lower protocol?
Consider a package delivery service, like UPS or DHL. They don't care what's inside the box - they just make sure it gets to its destination.
Similarly, the protocol doesn't care what the payload ...
- 67.1k
7
votes
VXLAN vs VLAN over layer 3
As you've already stated, VXLAN is L2 tunneling over IP. It's a solution to use any L3 network for creating a L2 segment.
While this is also possible with other protcols, VXLAN doesn't require ...
- 82.7k
7
votes
Difference between WAN and VPN(tunnels)
Originally, WANs were mostly defined by specific layer 1/2 protocols (Frame Relay, HDLC, SONET, etc) that they used, but Ethernet has taken over, and the others are rapidly fading into history. The ...
- 67.1k
6
votes
Tunneling query
I've also read that it's possible to make it appear as a flat network i.e. everything on the same LAN. This is the piece i am missing, can someone help me to understand how this is possible?
Some ...
- 1,636
6
votes
MTU/MSS Oddness?
Cisco has a nice IPSec Overhead calculator (CCO Login required, unfortunately).
https://cway.cisco.com/ipsec-overhead-calculator/
From where we can draw, based on your IPSec settings and a few common ...
- 8,826
5
votes
Accepted
Tunnel interface bandwidth?
Cisco IOS/NX-OS/etc. software does not configure the bandwidth for a virtual tunnel interface based on the physical interface to which it is assigned; instead, it applies a default "bandwidth" ...
- 389
5
votes
Accepted
Could accessed sites over an SSH tunnel be tracked by ISP?
The DNS is issued by default from your local host, not from the proxy, when using SOCKS (probably because SOCKS4 didn't support other way).
Make sure you have checked the checkbox "Remote DNS" in the ...
- 168
5
votes
Accepted
What are the correct protocol versions (v4 vs v6) for packets inside DS-Lite tunnels?
The consensus of the comments is
The segments are inside IPv4
The protocol of TCP happens to be 6 and it's not its IP version number
As you say, if you're looking for 4s vs 6s for protocol versions, ...
- 16.2k
5
votes
Accepted
How IPsec tunnel mode work without GRE
So what's the difference between GRE+IPsec and IPsec only?
In GRE+IPsec the original IP packet is encapsulated in a GRE tunnel packet. The GRE packet is then encapsulated in the IPSec packet.
The ...
- 67.1k
5
votes
Accepted
What are the differences between tunneling and regular encapsulation?
Encapsulation is the normal method of using a lower layer mechanism for moving your data. E.g. HTTP is encapsulated by TCP, TCP is encapsulated by IPv4, IPv4 is encapsulated by an Ethernet frame.
...
- 82.7k
5
votes
Accepted
VPNs are working in which layer of the OSI model?
Off the top of my head, the most common would be:
IPSEC (Internet Protocol SECurity)
SSL (Secure Sockets Layer)
PPTP (Point-to-Point Tunnelling Protocol)
L2TPv3 (Layer 2 Tunnelling Protocol)
As for ...
- 9,421
5
votes
What's the difference between L2TP and L2TPv3?
Let's say that it is a 'new protocol heavily based on L2TPv2'. It shares a lot of the messages, constructs, flows with L2TPv2 but it is not strictly backwards compatible. It does have an L2TP '...
- 1,009
4
votes
Tunneling query
Yes it is possible, and Everton gave you some features that help you do that, but...
...please don't do it !
I know a single LAN over two (or more) distant sites seems nice for machine migration (it ...
- 1,687
4
votes
Is the Nth ports on 127.0.0.1 and 127.0.0.2 same ?
Can I use the same port numbers for both but binding one of them to
127.0.0.1:N and the other to 127.0.0.2:N ?
Yes, you can use the same port number on two different 127.X.X.X addresses.
Are ...
- 1,636
4
votes
IPv6 tunneling over IPv4
Tunneling involves encapsulating the packets to be tunneled inside an outer packet. The tunneled packets are the payload of the encapsulating packets.
You will be creating a new IPv4 packet header to ...
- 98.8k
4
votes
Accepted
Which VPN Types/Protocols inherently support Multicast Traffic?
IKE is (in massively simplified terms/practically explained) just a way of establishing an IPSec VPN tunnel, and IPSec VPN tunnels don't inherently support multicast.
You can put a GRE tunnel inside ...
- 287
4
votes
OSPF on tunnel interfaces
Yes, what's important to the router is layer 3 interfaces.
You can think of a layer 3 interface as a logical construct, which can be be tied to a VLAN, physical or tunnel interface.
- 19.5k
4
votes
Accepted
Scaling VXLAN tunnels in openvswitch
You could solve this by running VXLAN on the hypervisor using software like FRR. That would imply that you run a full mesh BGP setup between your hypervisors, or use route reflectors. Then, you can ...
- 17.1k
4
votes
Security implications of IPv6 tunneling over IPv4
I've read that IPv6 over IPv4 tunnels are a security risk because IPv6 traffic cannot be intercepted by Intrusion Detection Systems and Firewalls.
That's completely untrue. Maybe some specific, very ...
- 17.1k
4
votes
Why do all the intermediary routers need to run iBGP without tunneling?
You are confusing a couple of concepts. In your example:
edge -R1 - R2 - R3 - R4 -edge
You could have an iBGP problem because if all the routers run iBGP then each router would need an iBGP ...
- 98.8k
4
votes
Accepted
What does a VPN Tunnel offers other than encryption?
Tunnels change the network topology. They let routers A and B be logically adjacent even if they don’t have a physical connection. They also let you run one type of network over another type of ...
- 2,183
4
votes
Accepted
MTU/MSS Oddness?
REALLY REALLY late update, but I got busy with other tasks (MS365 migrations, recent software vulnerabilities, etc.), so whoops that i left this unsolved.
The MTU information helped guide us down a ...
- 181
4
votes
What are the benefits of using a transport label in L3VPN?
Two main reasons for using labels:
It makes the transport layer independent of the customer addressing scheme. Multiple customers can have overlapping addressing. The transport doesn't care
...
- 67.1k
4
votes
Accepted
Cisco IOS -> ASA VTI tunnel not routing traffic
I found the solution to this eventually, with some help.
The issue was that on the ASR side, the tunnel was in its default configuration which uses GRE, which the ASA doesn't support.
The solution was ...
- 193
4
votes
Accepted
In tunneling, how destination routers identify if a packet is encapsulated?
Encapsulation requires a protocol. Depending on the protocol, an encapsulating packet is uniquely identified by either EtherType (in layer 2), IP protocol number (in layer 3), transport-layer port ...
- 82.7k
4
votes
dynamic mac address added all hosts through the Do1Q tunnel
we must only see one mac-address of edge customer Switch
That's not how Q-in-Q works.
When forwarded across the service provider's backbone, the frames will still have the original Src and DstMac ...
- 8,826
3
votes
Understanding the PDU at router when using Tunneling
It's quite obvious.
For inbound traffic, the packet analyzer shows you already decapsulated traffic. That's why you're seeing real IPs in the header, so essentially it's already decrypted.
For ...
- 4,030
Only top scored, non community-wiki answers of a minimum length are eligible