Cloud Networking
Cloud Networking tests your ability to connect workloads across underlays, overlays, and provider constructs. Expect questions on VXLAN/EVPN, VPC or VNet routing, hybrid connectivity, and Juniper’s Contrail and virtual router portfolio.
Underlay and overlay
An IP fabric underlay commonly uses a Clos topology with BGP. The overlay carries tenant or workload traffic in tunnels. VXLAN is the data-plane encapsulation: a VTEP adds a VXLAN header with a VNI, then outer IP/UDP. EVPN is the control plane that advertises MAC and IP reachability and supports multihoming with Ethernet Segment Identifiers (ESI). EVPN and VXLAN are complementary, not synonyms.
Provider constructs
In public clouds you work with VPCs or VNets, subnets, route tables, internet/NAT gateways, security groups, network ACLs, peering, transit gateways, VPN gateways, and dedicated interconnects. VPC peering is typically non-transitive: if A peers with B and B peers with C, A does not automatically reach C. A transit gateway or hub-and-spoke design solves many-to-many and transitive routing. Overlapping CIDRs block peering.
Juniper specifics
Contrail Networking uses an SDN controller and vRouter forwarding to build overlays, commonly with BGP EVPN, and supports service chaining. vMX and Cloud-Native Router provide routing in virtual and containerized environments.
Worked example
Three VPCs need any-to-any private routing, and all traffic must pass through a central inspection VPC. VPC peering alone fails because it is non-transitive and does not naturally insert a shared inspection point. Use a transit gateway (or an SDN overlay with service chaining), attach each VPC and the inspection VPC, and program route tables so spokes send traffic to the inspection attachment. For only two non-overlapping VPCs, direct peering would be simpler.
Traps that cost marks
Do not claim VXLAN provides control-plane learning by itself; EVPN does that. Do not assume peering is transitive. Do not confuse stateful security groups with stateless network ACLs. Do not assume an overlay fixes an underlay MTU problem-VXLAN adds overhead, so underlay MTU must accommodate it. Do not expect cloud route tables to propagate automatically without configuration.
Key points
- VXLAN is the overlay data plane; EVPN is the control plane for MAC/IP reachability.
- VPC peering is non-transitive; transit gateways or hub-and-spoke designs provide transitive routing.
- Security groups are stateful; network ACLs are stateless.
- Contrail uses an SDN controller plus vRouter and commonly BGP EVPN for overlay networking.
- Overlay encapsulation increases MTU requirements on the underlay.