Skip to content
My Docs

Network Virtualization

Category: Advanced Networking Concepts
Type: Network Concepts
Generated on: 2025-07-10 09:10:46
For: Network Engineering, Administration & Technical Interviews

Network Virtualization Cheat Sheet

Section titled “Network Virtualization Cheat Sheet”

What is Network Virtualization?

Network virtualization is the process of abstracting network resources (hardware and software) and presenting them as logical, software-defined entities. It decouples network functions from the underlying physical infrastructure, allowing for greater flexibility, scalability, and efficiency in network management. Essentially, it’s about creating virtual networks on top of physical networks.

Why is it Important?

  • Increased Agility: Faster provisioning and deployment of network services.
  • Improved Resource Utilization: Optimizes the use of existing hardware.
  • Reduced Costs: Lower capital and operational expenses.
  • Enhanced Scalability: Easily scale network resources up or down as needed.
  • Simplified Management: Centralized control and automation of network functions.
  • Enhanced Security: Micro-segmentation and isolation of network traffic.
ConceptDefinitionExample
Virtual NetworkA logical network created on top of a physical network. It can have its own addressing scheme, routing policies, and security configurations.VLANs, VXLANs, GRE tunnels.
Network OverlayA virtual network that runs on top of an existing physical network (the underlay). It encapsulates packets from the virtual network and transmits them over the physical network.VXLAN, GRE, NVGRE.
Network UnderlayThe physical network infrastructure that provides the connectivity for the virtual networks.Physical switches, routers, and cabling.
SDN (Software-Defined Networking)A network architecture that separates the control plane (decision-making) from the data plane (forwarding). The control plane is centralized and programmable, allowing for dynamic configuration and management of the network.OpenFlow, ONOS, Ryu.
NFV (Network Functions Virtualization)Virtualizes network functions (e.g., firewalls, load balancers, routers) as software running on commodity hardware. This eliminates the need for dedicated hardware appliances.Virtualized firewalls (vFW), virtualized load balancers (vLB).
HypervisorSoftware that creates and manages virtual machines (VMs). It allows multiple VMs to share the same physical hardware. In network virtualization, hypervisors often provide virtual switching capabilities.VMware ESXi, KVM, Hyper-V.
VLAN (Virtual LAN)A logical grouping of network devices that behave as if they are on the same physical LAN, even if they are geographically dispersed. VLANs are typically configured on switches.VLAN 10 for the Sales department, VLAN 20 for the Engineering department.
VXLAN (Virtual Extensible LAN)A network virtualization technology that encapsulates Ethernet frames within UDP packets, allowing for the creation of virtual networks that span multiple physical networks (Layer 2 over Layer 3). Provides greater scalability than VLANs.Enables VM mobility across data centers.
GeneveAnother network virtualization technology, similar to VXLAN, but more flexible in terms of the metadata it can carry.Can carry more complex network context information.
GRE (Generic Routing Encapsulation)A tunneling protocol that encapsulates network packets within IP packets, allowing for the creation of virtual private networks (VPNs) and other types of tunnels.Creating a VPN between two offices.
Micro-segmentationA security technique that divides a network into small, isolated segments. This limits the blast radius of a security breach and prevents attackers from moving laterally across the network.Implementing security policies that only allow specific VMs to communicate with each other.

3.1 VLANs

Section titled “3.1 VLANs”
  1. Configuration: VLANs are configured on switches. Each switch port is assigned to a specific VLAN.
  2. Tagging: When a frame enters a switch port assigned to a VLAN, the switch adds a VLAN tag (802.1Q header) to the frame.
  3. Forwarding: The switch forwards the frame only to other ports that are members of the same VLAN.
  4. Untagging: When the frame exits a switch port, the VLAN tag is removed.
+------------------+    +------------------+    +------------------+
| Host A (VLAN 10) |----| Switch A         |----| Switch B         |----| Host B (VLAN 10) |
+------------------+    +------------------+    +------------------+    +------------------+
        |                       | (Adds VLAN tag)    | (Forwards based  |                       |
        |                       |                    | on VLAN tag)     |                       |
        |                       |                    | (Removes VLAN tag)|                       |
        |                       |                    |                  |                       |
+------------------+    +------------------+    +------------------+    +------------------+
| Host C (VLAN 20) |----| Switch A         |    | Switch B         |----| Host D (VLAN 20) |
+------------------+    +------------------+    +------------------+    +------------------+

3.2 VXLANs

Section titled “3.2 VXLANs”
  1. Encapsulation: A VM sends a packet to its virtual switch. The virtual switch encapsulates the original Ethernet frame within a VXLAN header, a UDP header, and an IP header. The IP header contains the IP addresses of the VTEPs (VXLAN Tunnel Endpoints).
  2. Tunneling: The encapsulated packet is forwarded over the underlay network to the destination VTEP.
  3. Decapsulation: The destination VTEP decapsulates the packet and forwards the original Ethernet frame to the destination VM.
+-------+     +----------+      +-----------+       +----------+     +-------+
| VM A  |-----| VTEP A   |------| Underlay  |-------| VTEP B   |-----| VM B  |
+-------+     +----------+      +-----------+       +----------+     +-------+
          (Encapsulation)       (Network)        (Decapsulation)
          Original Frame -> VXLAN/UDP/IP Packet -> Original Frame

3.3 SDN (Software-Defined Networking)

Section titled “3.3 SDN (Software-Defined Networking)”
  1. Control Plane Separation: The control plane (routing decisions) is separated from the data plane (packet forwarding).
  2. Centralized Controller: A central controller manages the network devices.
  3. Programmability: The controller is programmable, allowing for dynamic configuration and management of the network.
  4. OpenFlow Protocol: The controller communicates with the network devices using protocols like OpenFlow.
+---------------------+
| SDN Controller      |
+---------------------+
        ^
        | OpenFlow
        |
+-------+-------+   +-------+-------+   +-------+-------+
| Switch A        |   | Switch B        |   | Switch C        |
+-------+-------+   +-------+-------+   +-------+-------+
  (Data Plane)        (Data Plane)        (Data Plane)

4.1 802.1Q (VLAN Tagging)

Section titled “4.1 802.1Q (VLAN Tagging)”
  • Header Location: Inserted between the Source MAC Address and EtherType fields in the Ethernet frame.
  • Length: 4 bytes
  • Fields:
    • TPID (Tag Protocol Identifier): 0x8100 (identifies the frame as an 802.1Q tagged frame)
    • Priority Code Point (PCP): 3 bits (used for QoS)
    • Drop Eligible Indicator (DEI): 1 bit (used for QoS)
    • VLAN ID (VID): 12 bits (specifies the VLAN to which the frame belongs)

4.2 VXLAN Header

Section titled “4.2 VXLAN Header”
  • Outer IP Header:
    • Source IP: VTEP Source IP Address
    • Destination IP: VTEP Destination IP Address
    • Protocol: UDP (17)
  • UDP Header:
    • Source Port: Typically a high-numbered ephemeral port
    • Destination Port: 4789 (default VXLAN port)
  • VXLAN Header (8 bytes):
    • Flags: 8 bits (I flag indicates valid VNI)
    • Reserved: 24 bits (must be zero)
    • VNI (VXLAN Network Identifier): 24 bits (identifies the VXLAN segment)
    • Reserved: 8 bits (must be zero)
  • Original Ethernet Frame: The original Layer 2 Ethernet frame.

4.3 GRE Header

Section titled “4.3 GRE Header”

  • GRE Header (4 bytes minimum):

    • Flags: Various control flags.
    • Protocol Type: Specifies the protocol of the encapsulated payload (e.g., 0x0800 for IPv4).

  • Encapsulated Payload: The original packet being tunneled.

  • Data Center Network Virtualization: Using VXLAN to create virtual networks for different tenants in a multi-tenant data center.

  • Cloud Computing: Using SDN to automate the provisioning and management of network resources in a cloud environment.

  • Branch Office Connectivity: Using GRE tunnels to create VPNs between branch offices and the headquarters.

  • Network Security: Using micro-segmentation to isolate critical applications and data from unauthorized access.

  • NFV for Service Providers: Virtualizing network functions like firewalls and load balancers to reduce hardware costs and improve agility.

IssueTroubleshootingSolution
VLAN Connectivity Problems* Verify VLAN configuration on switches (VLAN ID, port membership). * Check trunk links for proper VLAN tagging. * Use ping and traceroute to identify connectivity issues. * Examine switch logs for errors.* Correct VLAN configuration on switches. * Ensure trunk links are configured correctly. * Verify routing between VLANs (if applicable).
VXLAN Connectivity Problems* Verify VTEP configuration (IP addresses, VNI). * Check underlay network connectivity. * Use ping and traceroute to identify connectivity issues. * Capture packets on the VTEPs to examine VXLAN encapsulation.* Correct VTEP configuration. * Ensure the underlay network is properly configured. * Verify routing between VTEPs. * Check firewall rules to allow UDP traffic on port 4789 (or the configured VXLAN port).
SDN Controller Connectivity Issues* Verify connectivity between the controller and the network devices. * Check OpenFlow configuration on the switches. * Examine controller logs for errors. * Use ping and traceroute to identify connectivity issues.* Correct network connectivity between the controller and the devices. * Ensure OpenFlow is properly configured on the switches. * Restart the controller or the switch agents.
Performance Issues (Overhead)* Network virtualization introduces overhead due to encapsulation. * Monitor network performance metrics (latency, throughput). * Optimize MTU settings. * Use hardware offloading (if available).* Minimize encapsulation overhead by optimizing network configuration. * Adjust MTU settings to avoid fragmentation. * Utilize hardware offloading for VXLAN or other encapsulation protocols to reduce CPU load.
Security Concerns (Tunneling)* Ensure proper encryption of tunneled traffic. * Implement access control policies to restrict access to virtual networks. * Monitor network traffic for malicious activity.* Use IPsec or other encryption protocols to secure tunneled traffic. * Implement strong authentication and authorization mechanisms. * Use intrusion detection systems (IDS) and intrusion prevention systems (IPS) to monitor network traffic.

7.1 VLAN Configuration (Cisco IOS)

Section titled “7.1 VLAN Configuration (Cisco IOS)”
! Create VLAN 10
vlan 10
 name Sales


! Assign port Fa0/1 to VLAN 10
interface FastEthernet0/1
 switchport mode access
 switchport access vlan 10


! Configure a trunk port (Fa0/2) allowing VLANs 10 and 20
interface FastEthernet0/2
 switchport mode trunk
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 10,20

7.2 VXLAN Configuration (Linux with iproute2)

Section titled “7.2 VXLAN Configuration (Linux with iproute2)”
Terminal window
# Create a VXLAN interface (vni 100, remote IP 192.168.1.2, local IP 192.168.1.1)
ip link add vxlan0 type vxlan id 100 dstport 4789 remote 192.168.1.2 local 192.168.1.1
ip link set dev vxlan0 up
ip addr add 10.1.1.1/24 dev vxlan0 # Assign an IP to the VXLAN interface
ip link set dev eth0 up # Ensure the physical interface is up


# Add a route to the VXLAN interface
ip route add 10.1.1.0/24 dev vxlan0

7.3 OpenFlow Configuration (Simple Example using Mininet and Ryu Controller)

Section titled “7.3 OpenFlow Configuration (Simple Example using Mininet and Ryu Controller)”
  1. Start Mininet: sudo mn --topo single,2 --controller=remote,ip=127.0.0.1 (creates a simple topology with 2 hosts and a remote controller)
  2. Start Ryu Controller: ryu-manager --verbose ryu.app.simple_switch_13 (starts a basic L2 learning switch controller)
  3. Verify Connectivity: From one Mininet host, ping the other. The Ryu controller will learn the MAC addresses and install flow rules to enable connectivity.

Q1: What is network virtualization and why is it important?

Answer: Network virtualization is the abstraction of network resources (hardware and software) into logical entities. It’s important because it provides agility, scalability, cost savings, and simplified management by decoupling network functions from the underlying physical infrastructure.

Q2: Explain the difference between VLANs and VXLANs.

Answer: VLANs are Layer 2 technologies that segment a network within a single broadcast domain. They have a limited scalability (4096 VLANs). VXLANs are Layer 2 over Layer 3 technologies that encapsulate Ethernet frames within UDP packets, allowing for the creation of virtual networks that span multiple physical networks. VXLANs offer greater scalability (16 million VNIs) and enable VM mobility across data centers.

Q3: What is SDN and how does it work?

Answer: SDN is a network architecture that separates the control plane from the data plane. A centralized controller manages the network devices through protocols like OpenFlow. This allows for dynamic configuration and management of the network.

Q4: What is NFV and what are its benefits?

Answer: NFV virtualizes network functions (e.g., firewalls, load balancers) as software running on commodity hardware. Its benefits include reduced hardware costs, improved agility, faster service deployment, and scalability.

Q5: Explain the concept of micro-segmentation.

Answer: Micro-segmentation is a security technique that divides a network into small, isolated segments. This limits the blast radius of a security breach and prevents attackers from moving laterally across the network.

Q6: What are the key components of a VXLAN architecture?

Answer: Key components include: VTEPs (VXLAN Tunnel Endpoints), the underlay network, and the overlay network. VTEPs encapsulate and decapsulate VXLAN packets. The underlay network provides the physical connectivity, and the overlay network is the virtual network created by VXLAN.

Q7: How can you troubleshoot VXLAN connectivity issues?

Answer: Troubleshooting steps include verifying VTEP configuration, checking underlay network connectivity, using ping and traceroute, capturing packets on the VTEPs, and verifying firewall rules.

Q8: What are the security considerations when implementing network virtualization?

Answer: Security considerations include ensuring proper encryption of tunneled traffic, implementing access control policies, monitoring network traffic for malicious activity, and securing the SDN controller.

  • Cloud Computing: Network virtualization is a key enabler of cloud computing.
  • Data Center Networking: Network virtualization is widely used in data centers to improve resource utilization and scalability.
  • Network Automation: Network virtualization can be combined with network automation tools to automate network provisioning and management.
  • SD-WAN (Software-Defined Wide Area Network): Extends SDN principles to wide area networks, providing centralized control and optimization of network traffic across geographically dispersed locations.
  • Network Slicing (5G): A form of network virtualization used in 5G networks to create multiple virtual networks with different characteristics (e.g., latency, bandwidth) to support different applications.

Further Reading:

  • RFC 7348: VXLAN: A Framework for Overlaying Virtualized Layer 2 Networks over Layer 3 Networks
  • Open Networking Foundation (ONF) Documentation: Provides information on SDN and OpenFlow.
  • ETSI NFV Documentation: Provides information on NFV standards and architectures.