Virtualization
Virtualization (about 10%) tests the abstraction layers: hypervisors and virtual switches, network-function virtualization, and the device-level overlays that let one physical topology carry many logical networks.
Virtualization fundamentals
- A Type 1 hypervisor runs directly on hardware (ESXi, Hyper-V); Type 2 runs on a host OS. A virtual switch provides Layer 2 switching for VM NICs and can carry VLAN tags, including trunked tags to a VM.
- NFV separates a network function (firewall, router, WAN optimizer) from proprietary hardware. The software instance is a VNF. Containers share the host kernel and are lighter than VMs but less isolated.
- A VRF is a separate routing and forwarding table on one device. VRF-lite uses VRFs without MPLS; overlapping addresses are fine because each VRF has its own table. VRFs do not encrypt or tunnel traffic by themselves.
- GRE encapsulates many protocols and supports multicast, but it has no confidentiality. IPsec provides authentication/encryption. VXLAN encapsulates Layer 2 frames in UDP, uses a 24-bit VNI, and needs an IP underlay; it is not encryption.
- Data-center fabrics commonly use VXLAN with EVPN as the control plane; Cisco ACI uses a policy model with APIC and a spine-leaf fabric.
Worked example
Two hosts in VLAN 10 on different leaf switches must communicate over VXLAN VNI 10100. Each leaf has a VTEP loopback reachable in the underlay. The ingress VTEP learns the remote VTEP for the destination MAC through EVPN or flood-and-learn, encapsulates the original Ethernet frame, and sends it over the underlay. The return path uses the reverse mapping. If a 1500-byte frame is sent with DF set and the underlay path MTU is 1500, the encapsulated packet exceeds the path MTU and is dropped. Reasoning: VXLAN adds outer headers (commonly about 50 bytes), so the underlay must support a larger MTU or the inner MTU must be reduced.
Traps
- Saying VXLAN or GRE provides encryption; only IPsec/MACsec do.
- Confusing a VLAN with a VRF: VLAN is Layer 2 segmentation, VRF is Layer 3 table separation.
- Assuming VRF-lite requires MPLS; it does not.
- Forgetting that a virtual switch still needs correct VLAN/trunk configuration and that promiscuous mode is needed for some capture/monitoring cases.
- Treating containers as full VMs with separate kernels.