Virtualization · Topic 4 of 4

LISP and VXLAN Network Virtualization

Learn how LISP separates identity from location with EIDs and RLOCs, and how VXLAN carries Layer 2 frames over a Layer 3 network using VNIs and VTEPs.

  • 6 min
  • Includes a diagram
In a nutshell
  • LISP separates the endpoint identifier (EID) from the routing locator (RLOC).
  • An ITR encapsulates, an ETR decapsulates, and the Map Server holds the registrations.
  • The Map Resolver answers map requests from ITRs.

What it is

LISP and VXLAN are overlay technologies that let virtual networks run on top of a routed network.

LISP (Locator/ID Separation Protocol) solves a routing problem. An IP address normally says both who a host is and where it is. LISP splits these into two, so a host can move without changing its identity.

VXLAN (Virtual Extensible LAN) solves a switching problem. It carries Layer 2 frames across a Layer 3 network, which lets one VLAN style segment reach across many routed hops. Both are used inside Cisco SD-Access.

HostEID identitysent toEdge routerencapsulatesover the underlay toRemote edgeRLOC locationdeliversDestination hostEID

How it works

Each technology adds an outer header and a mapping system.

LISP terms

LISP uses two kinds of address.

  • EID (Endpoint Identifier): the address of the host, which stays the same.
  • RLOC (Routing Locator): the address of the router that sits in front of the host, which is where the host can be reached.

A mapping system links each EID to the RLOC that serves it. The devices have clear roles.

RoleWhat it does
ITR (Ingress Tunnel Router)Encapsulates traffic from its site toward a remote RLOC
ETR (Egress Tunnel Router)Decapsulates traffic arriving for its site
xTRA router that does both jobs
Map ServerHolds the EID to RLOC registrations
Map ResolverAnswers the map requests that ITRs send
Proxy xTRConnects LISP sites to non LISP networks

LISP operation

An ITR asks the Map Resolver where a destination EID is, receives the RLOC in a map reply, and sends the encapsulated packet over the underlay to the ETR. The ETR registers its EIDs with the Map Server. When a host sends traffic to an unknown destination, the ITR does not flood it. It sends a map request to ask where the EID is. The reply gives the RLOC, and the ITR encapsulates the packet to that RLOC.

An ETR registers the EIDs it serves with the Map Server. This is the map register message. Because the database is queried on demand, the underlay does not need to carry a route for every host.

LISP data packets use UDP port 4341, and LISP control messages use UDP port 4342. When a host moves, the new ETR registers it and the mapping is updated, while the host keeps its address.

ITRno entry for EIDmap requestMap Resolverasks the databasemap reply with RLOCITRcaches the mappingencapsulated packetETRdelivers to host

VXLAN terms

Two leaf switches act as VTEPs. A VLAN 10 frame from Host A is wrapped in UDP port 4789 with VNI 10010, carried across the Layer 3 underlay and unwrapped at the far VTEP for Host B. VXLAN wraps an original Ethernet frame in UDP, so a Layer 2 segment can cross a Layer 3 network.

  • VNI (VXLAN Network Identifier): a 24 bit number that identifies the segment. It allows about 16 million segments, against 4094 usable VLANs.
  • VTEP (VXLAN Tunnel Endpoint): the device that encapsulates and decapsulates. It may be a leaf switch or a virtual switch.
  • Underlay: the routed network that carries the outer packets between VTEPs.
  • UDP port 4789: the standard destination port for VXLAN.

The encapsulation adds about 50 bytes. The underlay MTU must be raised enough to carry full size frames without fragmentation.

How VTEPs learn MAC addresses

There are two common methods.

MethodHow it works
Flood and learnUnknown traffic is flooded to the other VTEPs, usually using multicast, and VTEPs learn from the traffic
BGP EVPNMAC and IP information is advertised by BGP, so flooding is reduced

BGP EVPN is the common control plane in modern data centres.

Example on NX-OS

This NX-OS sketch maps VLAN 10 to VNI 10010 using BGP EVPN for host reachability. A complete design also needs the underlay, the BGP EVPN configuration and a Layer 3 VNI where routing is required.

Leaf1(config)# feature nv overlay
Leaf1(config)# nv overlay evpn
Leaf1(config)# feature vn-segment-vlan-based
Leaf1(config)# vlan 10
Leaf1(config-vlan)# vn-segment 10010
Leaf1(config)# interface nve1
Leaf1(config-if-nve)# no shutdown
Leaf1(config-if-nve)# source-interface loopback0
Leaf1(config-if-nve)# host-reachability protocol bgp
Leaf1(config-if-nve)# member vni 10010
Leaf1(config-if-nve-vni)# ingress-replication protocol bgp

The nve1 interface is the VTEP. Its source address is the loopback, which the underlay must advertise. Check the result with:

Leaf1# show nve peers
Leaf1# show nve vni

LISP and VXLAN together

In SD-Access, LISP is the control plane and VXLAN is the data plane. LISP answers where an endpoint is, and VXLAN carries the packet there. In a data centre, VXLAN is more often paired with BGP EVPN.

What to remember for the exam

Eight facts cover most questions on this topic.

  • LISP separates the endpoint identifier (EID) from the routing locator (RLOC).
  • An ITR encapsulates, an ETR decapsulates, and the Map Server holds the registrations.
  • The Map Resolver answers map requests from ITRs.
  • LISP data uses UDP 4341, and control uses UDP 4342.
  • VXLAN carries Layer 2 frames in UDP over a Layer 3 network, on UDP port 4789.
  • The VNI is 24 bits, and a VTEP encapsulates and decapsulates.
  • VXLAN adds about 50 bytes of overhead, so the underlay MTU must allow for it.
  • SD-Access uses LISP for control and VXLAN for data.
Exam tip

LISP is about where a host is. VXLAN is about carrying a segment. Keep the two jobs separate and the roles become easier.

Common mistakes

These four mistakes appear often.

Swapping EID and RLOC. The EID is the host identity, and the RLOC is the router location.

Treating VXLAN as a routing protocol. It is an encapsulation. The routing underneath is a separate thing.

Ignoring MTU. The extra header means a full size frame will not fit without a larger underlay MTU.

Mixing up VNI and VLAN ID. A VLAN ID has 12 bits, while a VNI has 24.

Watch out

A VTEP loopback that the underlay does not advertise leaves the tunnel without a path, so check underlay reachability first.

Check yourself

Work through these three questions.

  • What do EID and RLOC stand for in LISP?

    EID is the endpoint identifier, which identifies the host, and RLOC is the routing locator, which is the address of the router serving it.

  • How many bits does a VNI have, and what port does VXLAN use?

    A VNI has 24 bits, and VXLAN uses UDP port 4789.

  • Which technology does SD-Access use for its data plane?

    SD-Access uses VXLAN for the data plane, with LISP as the control plane.

Topic 4 of 4 in Virtualization

Test yourself on Virtualization

The full Cisco CCNP 350-401 ENCOR question bank has 854 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.