Hot answers tagged

17 votes
Accepted

VXLAN vs VLAN over layer 3

Yes, from the packet switching point-of-view, VXLAN is just a matter of sticking some encapsulation on top of an L2 frame: something that other protocols do as well. The real difference it makes is ...
mere3ortal's user avatar
  • 2,416
12 votes
Accepted

Encapsulation: can a higher protocol encapsulate a lower protocol?

Yes, encapsulation hide the details of what is encapsulated and doesn't really care about the payload nature. VxLAN is a sensible example of this, with layer2 (VLAN) being encapsulated in layer 4 (UDP)...
JFL's user avatar
  • 19.6k
9 votes

Encapsulation: can a higher protocol encapsulate a lower protocol?

Consider a package delivery service, like UPS or DHL. They don't care what's inside the box - they just make sure it gets to its destination. Similarly, the protocol doesn't care what the payload ...
Ron Trunk's user avatar
  • 67.3k
7 votes

VXLAN vs VLAN over layer 3

As you've already stated, VXLAN is L2 tunneling over IP. It's a solution to use any L3 network for creating a L2 segment. While this is also possible with other protcols, VXLAN doesn't require ...
Zac67's user avatar
  • 83.9k
7 votes

Difference between WAN and VPN(tunnels)

Originally, WANs were mostly defined by specific layer 1/2 protocols (Frame Relay, HDLC, SONET, etc) that they used, but Ethernet has taken over, and the others are rapidly fading into history. The ...
Ron Trunk's user avatar
  • 67.3k
6 votes

Tunneling query

I've also read that it's possible to make it appear as a flat network i.e. everything on the same LAN. This is the piece i am missing, can someone help me to understand how this is possible? Some ...
Everton's user avatar
  • 1,636
6 votes

MTU/MSS Oddness?

Cisco has a nice IPSec Overhead calculator (CCO Login required, unfortunately). https://cway.cisco.com/ipsec-overhead-calculator/ From where we can draw, based on your IPSec settings and a few common ...
Marc 'netztier' Luethi's user avatar
5 votes
Accepted

Could accessed sites over an SSH tunnel be tracked by ISP?

The DNS is issued by default from your local host, not from the proxy, when using SOCKS (probably because SOCKS4 didn't support other way). Make sure you have checked the checkbox "Remote DNS" in the ...
Jakuje's user avatar
  • 168
5 votes
Accepted

Tunnel interface bandwidth?

Cisco IOS/NX-OS/etc. software does not configure the bandwidth for a virtual tunnel interface based on the physical interface to which it is assigned; instead, it applies a default "bandwidth" ...
halfmetaljacket's user avatar
5 votes
Accepted

What are the correct protocol versions (v4 vs v6) for packets inside DS-Lite tunnels?

The consensus of the comments is The segments are inside IPv4 The protocol of TCP happens to be 6 and it's not its IP version number As you say, if you're looking for 4s vs 6s for protocol versions, ...
jonathanjo's user avatar
  • 16.2k
5 votes
Accepted

How IPsec tunnel mode work without GRE

So what's the difference between GRE+IPsec and IPsec only? In GRE+IPsec the original IP packet is encapsulated in a GRE tunnel packet. The GRE packet is then encapsulated in the IPSec packet. The ...
Ron Trunk's user avatar
  • 67.3k
5 votes
Accepted

What are the differences between tunneling and regular encapsulation?

Encapsulation is the normal method of using a lower layer mechanism for moving your data. E.g. HTTP is encapsulated by TCP, TCP is encapsulated by IPv4, IPv4 is encapsulated by an Ethernet frame. ...
Zac67's user avatar
  • 83.9k
5 votes
Accepted

VPNs are working in which layer of the OSI model?

Off the top of my head, the most common would be: IPSEC (Internet Protocol SECurity) SSL (Secure Sockets Layer) PPTP (Point-to-Point Tunnelling Protocol) L2TPv3 (Layer 2 Tunnelling Protocol) As for ...
Benjamin Dale's user avatar
5 votes

What's the difference between L2TP and L2TPv3?

Let's say that it is a 'new protocol heavily based on L2TPv2'. It shares a lot of the messages, constructs, flows with L2TPv2 but it is not strictly backwards compatible. It does have an L2TP '...
KillianDS's user avatar
  • 1,029
4 votes

Is the Nth ports on 127.0.0.1 and 127.0.0.2 same ?

Can I use the same port numbers for both but binding one of them to 127.0.0.1:N and the other to 127.0.0.2:N ? Yes, you can use the same port number on two different 127.X.X.X addresses. Are ...
Everton's user avatar
  • 1,636
4 votes

Tunneling query

Yes it is possible, and Everton gave you some features that help you do that, but... ...please don't do it ! I know a single LAN over two (or more) distant sites seems nice for machine migration (it ...
Benjamin A.'s user avatar
  • 1,687
4 votes

IPv6 tunneling over IPv4

Tunneling involves encapsulating the packets to be tunneled inside an outer packet. The tunneled packets are the payload of the encapsulating packets. You will be creating a new IPv4 packet header to ...
Ron Maupin's user avatar
  • 99.4k
4 votes
Accepted

Which VPN Types/Protocols inherently support Multicast Traffic?

IKE is (in massively simplified terms/practically explained) just a way of establishing an IPSec VPN tunnel, and IPSec VPN tunnels don't inherently support multicast. You can put a GRE tunnel inside ...
neoakris's user avatar
  • 287
4 votes

OSPF on tunnel interfaces

Yes, what's important to the router is layer 3 interfaces. You can think of a layer 3 interface as a logical construct, which can be be tied to a VLAN, physical or tunnel interface.
JFL's user avatar
  • 19.6k
4 votes
Accepted

Scaling VXLAN tunnels in openvswitch

You could solve this by running VXLAN on the hypervisor using software like FRR. That would imply that you run a full mesh BGP setup between your hypervisors, or use route reflectors. Then, you can ...
Teun Vink's user avatar
  • 17.1k
4 votes

Security implications of IPv6 tunneling over IPv4

I've read that IPv6 over IPv4 tunnels are a security risk because IPv6 traffic cannot be intercepted by Intrusion Detection Systems and Firewalls. That's completely untrue. Maybe some specific, very ...
Teun Vink's user avatar
  • 17.1k
4 votes

Why do all the intermediary routers need to run iBGP without tunneling?

You are confusing a couple of concepts. In your example: edge -R1 - R2 - R3 - R4 -edge You could have an iBGP problem because if all the routers run iBGP then each router would need an iBGP ...
Ron Maupin's user avatar
  • 99.4k
4 votes
Accepted

What does a VPN Tunnel offers other than encryption?

Tunnels change the network topology. They let routers A and B be logically adjacent even if they don’t have a physical connection. They also let you run one type of network over another type of ...
Darrell Root's user avatar
  • 2,193
4 votes
Accepted

MTU/MSS Oddness?

REALLY REALLY late update, but I got busy with other tasks (MS365 migrations, recent software vulnerabilities, etc.), so whoops that i left this unsolved. The MTU information helped guide us down a ...
Thomas Ward's user avatar
4 votes

What are the benefits of using a transport label in L3VPN?

Two main reasons for using labels: It makes the transport layer independent of the customer addressing scheme. Multiple customers can have overlapping addressing. The transport doesn't care ...
Ron Trunk's user avatar
  • 67.3k
4 votes
Accepted

Cisco IOS -> ASA VTI tunnel not routing traffic

I found the solution to this eventually, with some help. The issue was that on the ASR side, the tunnel was in its default configuration which uses GRE, which the ASA doesn't support. The solution was ...
btongeorge's user avatar
4 votes
Accepted

In tunneling, how destination routers identify if a packet is encapsulated?

Encapsulation requires a protocol. Depending on the protocol, an encapsulating packet is uniquely identified by either EtherType (in layer 2), IP protocol number (in layer 3), transport-layer port ...
Zac67's user avatar
  • 83.9k
4 votes

dynamic mac address added all hosts through the Do1Q tunnel

we must only see one mac-address of edge customer Switch That's not how Q-in-Q works. When forwarded across the service provider's backbone, the frames will still have the original Src and DstMac ...
Marc 'netztier' Luethi's user avatar
3 votes
Accepted

BGP VPN created, how do I give access to internet

There are a few different ways to achieve what you are after. In my experience the easiest way to do this is to use vlans between the Service Provider "PE" router and the Customer "CE" router. One ...
Firebirdnz's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible