# Data Center Networking Concepts

> Chapter 6 of the Courseiva CISCO-CCNP-DATACENTER curriculum — https://courseiva.com/learn/cisco-ccnp-datacenter/data-center-networking-concepts

**Official objective:** 1.2 — Describe data center networking protocols (e.g., VLAN, VxLAN, OTV, LISP)

## Introduction

Data centre networking protocols are the rules that allow servers and storage to communicate across vast distances while keeping traffic separate and secure. For the 350-601 exam, you must understand how VLANs, VXLAN, OTV, and LISP solve the fundamental problem of connecting thousands of virtual machines without running out of network capacity or creating chaos. This chapter gives you the plain-English foundation so you can confidently answer exam questions about these protocols.

## The Apartment Mail System Analogy

Because a building manager installs a central mailroom with numbered slots for each apartment, the incoming postal mail gets sorted and delivered without hassle. First, the manager assigns each apartment a unique number, just like a VLAN tag gets assigned to a virtual local area network. This ensures that mail meant for apartment 4A cannot end up in apartment 3B — the same way a VLAN keeps traffic from one department completely separate from another department's traffic inside the same switch.

Now imagine the building is part of a large housing estate spanning several city blocks. The postal service cannot use the same simple mailroom approach across blocks because the mail would mix and get lost. So the building manager installs a special inter-block mail system that wraps each letter in an outer envelope with the destination block and apartment number. This is exactly what VXLAN does: it wraps an original Ethernet frame inside a new packet with a VXLAN Network Identifier, allowing the traffic to travel across separate physical networks while keeping its internal addressing intact.

Next, the housing estate merges with another estate across town. The manager uses a long-range courier service that delivers mail between the two estates without changing any internal apartment numbers — just like OTV extends Layer 2 connectivity across a Layer 3 network using MAC address routing. Finally, the manager realises that some apartments move to a different block but want to keep receiving their old mail. The manager puts a forwarding rule in place so mail for that old block gets redirected to the new block — this mirrors LISP, which separates the endpoint identifier (the apartment) from its location (the block), so devices can move without changing their identity.

## Core explanation

Data centre networking is all about moving data between servers, storage systems, and virtual machines quickly, securely, and without interference. To understand the protocols that make this possible, you first need to know that a traditional network uses a Layer 2 switch to forward frames based on MAC addresses. A MAC address is a unique hardware identifier burned into every network interface card. Early networks were flat: all devices on the same physical cable saw all traffic, which caused security problems and performance bottlenecks.

The solution was VLAN — Virtual Local Area Network. A VLAN splits a physical switch into many smaller logical networks. Each VLAN gets a numeric tag (1 to 4094) inserted into the Ethernet frame. When a switch receives a frame with VLAN 10, it knows that traffic belongs to the sales department and must not cross into VLAN 20 used by engineering. This separation stops broadcast traffic — messages sent to every device — from flooding the entire network. VLANs solved the isolation problem but introduced a new limitation: there are only 4094 possible VLAN IDs, and data centres today run thousands of virtual machines that need more segments. Also, VLANs do not work across different physical locations unless you use complicated trunking.

VXLAN — Virtual Extensible LAN — was created to solve both the scale and the distance problems. VXLAN uses a 24-bit identifier called a VXLAN Network Identifier (VNI), which gives you over 16 million possible segments. That means you can support millions of isolated virtual networks inside one data centre. More importantly, VXLAN encapsulates the original Layer 2 Ethernet frame inside a UDP packet. This encapsulation allows the frame to travel across a Layer 3 IP network — the internet or a routed core — as if it were a regular IP packet. At the destination, the VXLAN tunnel endpoint removes the outer header and delivers the original frame to the target virtual machine. This is how you extend a Layer 2 network across a Layer 3 boundary.

OTV — Overlay Transport Virtualisation — is a Cisco-proprietary protocol that also extends Layer 2 across a Layer 3 network, but it works differently from VXLAN. OTV uses MAC address routing instead of flooding. Each OTV edge device learns which MAC addresses exist on its local side and advertises those to other edge devices. This way, when a server on one site needs to send traffic to a server on another site, the edge device already knows the destination MAC and can forward it directly. OTV avoids the inefficiency of flooding all unknown traffic across the WAN, which is critical because WAN links can be slow and expensive. OTV also supports multi-homing — connecting a site to multiple edge devices for redundancy — and avoids loops by design.\

LISP — Locator/ID Separation Protocol — solves a different fundamental problem. In traditional networking, a device's IP address serves two roles: it identifies the device itself, and it tells the network where that device is located. When a virtual machine moves from one data centre to another, its IP address cannot change without breaking connections. LISP separates these two roles. The Endpoint Identifier (EID) stays with the device forever, like a person's name. The Routing Locator (RLOC) represents the device's current location, like a temporary address. A mapping system keeps track of which EID is associated with which RLOC. When a server wants to send data to a virtual machine that moved, the ingress tunnel router asks the mapping system for the current RLOC, then encapsulates the packet and sends it to the correct location. This makes VM mobility seamless across data centres without renumbering IP addresses.

To sum up: VLAN provides basic segmentation inside a switch. VXLAN scales segmentation to millions of networks and spans Layer 3 boundaries. OTV extends Layer 2 across a routed core without flooding. LISP decouples identity from location so devices can roam freely between sites. Each protocol serves a different purpose, but together they form the backbone of modern data centre networking.

## Real-world context

An IT professional working in a large financial services company needs to extend a specific Layer 2 VLAN between two data centres located in London and Frankfurt. The company runs a trading application that requires all servers to be on the same broadcast domain — meaning any server can send a broadcast frame and have every other server receive it — even though the servers are physically hundreds of miles apart. The company cannot use VLANs alone because VLAN tags do not survive a routed hop between data centres.

The engineer first identifies which VLAN needs to be extended. The trading application uses VLAN 100, which contains about 50 servers. The engineer then decides to use VXLAN because it is an open standard, works with existing IP routing infrastructure, and provides 16 million VNI segments. The engineer configures two Cisco Nexus 9000 series switches as VXLAN Tunnel Endpoints (VTEPs), one in London and one in Frankfurt. Each VTEP has an IP address on the underlay network — the underlying physical or routed network that carries encapsulated traffic. The engineer assigns VNI 10100 to map to VLAN 100. Any frame that arrives at the London VTEP tagged with VLAN 100 gets encapsulated with VNI 10100 and sent to the Frankfurt VTEP over UDP port 4789. The Frankfurt VTEP strips off the encapsulation and delivers the original frame into VLAN 100 on its side.

The trading application now functions as if all 50 servers are on the same physical switch. Broadcast traffic from a server in London, such as an ARP request asking 'who has IP 10.0.100.50?', is encapsulated by the London VTEP and sent to the Frankfurt VTEP. The Frankfurt VTEP floods it into VLAN 100 on its side, and the target server responds.

Later, the company decides to migrate some servers to a new data centre in Amsterdam without changing their IP addresses. The engineer implements LISP on the core routers. The London data centre keeps its existing EID prefix, and the Amsterdam site gets a new RLOC. The engineer configures the mapping system so that when a server in London tries to reach a server that moved to Amsterdam, the ingress tunnel router looks up the current RLOC and forwards the traffic correctly. This migration happens without any downtime because the servers retain their original IP addresses.

Throughout this whole project, the engineer also uses OTV for a disaster recovery scenario where the Frankfurt site needs to be a backup for London without requiring routing changes. OTV allows the backup site to remain in the same Layer 2 domain as the primary site, so when a failure triggers a failover, the backup servers can take over with the same IP and MAC addresses. The engineer notes that OTV is simpler for small-scale disaster recovery because it automatically learns MAC addresses and does not require the same amount of manual mapping as VXLAN in some deployments.

## Exam focus

The 350-601 exam tests Data Center Networking Concepts heavily. Expect 8 to 12 exam items on this topic out of approximately 100 total questions. The exam writers love to create questions that look like they are asking about one protocol when they are actually testing your knowledge of another. You need to know the exact differences between VLAN, VXLAN, OTV, and LISP cold.

Key exam topics include:
- The VLAN ID range: 1 to 4094, with 0 and 4095 reserved. Expect a question that asks which VLAN range is valid for user traffic.
- The VXLAN VNI range: 1 to 16,777,215 (24-bit). Traps include asking about an invalid VNI number.
- Encapsulation details: VXLAN uses UDP port 4789. OTV uses IP protocol 4 (GRE encapsulation). LISP uses UDP ports 4341 (data) and 4342 (control).
- The difference between control plane and data plane. LISP has a separate control plane (mapping system). OTV uses IS-IS in the control plane. VXLAN traditionally uses flood-and-learn, but with EVPN it uses a control plane.
- MAC address learning: OTV does not flood unknown unicast across the overlay. Instead it uses MAC advertisement. VXLAN floods by default unless you enable EVPN.
- Deployment use cases: VLAN is for within a single switch or small site. VXLAN is for multi-tenant large-scale data centres. OTV is for data centre interconnect (stretching a VLAN between two DCs). LISP is for mobility and multi-homing.

Common question traps include:
- Giving a scenario where all four protocols could theoretically work, but only one is the Cisco-best-practice for that exact use case. The correct answer is often the one that is most scalable or most efficient for the described problem.
- Asking 'which protocol extends Layer 2 across a Layer 3 network?' without specifying whether you need to support millions of tenants. Both VXLAN and OTV can do it, but VXLAN is the scalable answer, while OTV is the simpler answer for small-scale DC interconnect.
- Using outdated terminology like 'Layer 2 VLAN stretch' — that is an OTV concept, not VXLAN.
- Mixing up the number of bits: VLAN ID is 12 bits, VXLAN VNI is 24 bits.

You must memorise the port numbers and protocol numbers exactly. The exam will present a line of configuration or a packet capture and ask you to identify which protocol is being used based on the UDP destination port. If you see UDP 4789, it is VXLAN. If you see UDP 4341, it is LISP data. If you see IP protocol 4, it is OTV.

Also, pay close attention to the use case of LISP vs OTV. Many students confuse these because both are used in multi-site environments. The tip: LISP is about endpoint mobility and IP address preservation; OTV is about Layer 2 extension without changing IP topology. If the scenario mentions a VM moving between data centres, lean toward LISP. If the scenario mentions stretching a VLAN so that two sites appear as one broadcast domain, lean toward OTV.

## Step by step

1. **Identify the Need for Network Segmentation** — The first step is recognising that a data centre must isolate traffic between tenants or departments. Without segmentation, broadcasts and security threats affect every connected device. VLAN is the simplest solution for a single switch or small site.
2. **Configure VLANs on the Access Switch** — On a Cisco Nexus switch, you create a VLAN using 'vlan <id>' in global configuration mode. You assign access ports to that VLAN using 'switchport access vlan <id>'. This separates traffic locally. The exam will ask about valid VLAN IDs (1-4094).
3. **Assess the Need for Layer 2 Extension Across Sites** — When servers in different data centres need to share the same broadcast domain, VLAN alone fails because VLAN tags are stripped at Layer 3 boundaries. At this point, you must choose between VXLAN and OTV based on scale, vendor preference, and multi-tenancy requirements.
4. **Deploy VXLAN Tunnel Endpoints (VTEPs)** — You configure VTEPs on the devices that sit at the edge of each location. Each VTEP has an IP address on the underlay network and an NVE (Network Virtualisation Edge) interface set to encapsulate VLAN traffic into VXLAN. You map the VLAN to a VNI. This allows traffic to traverse the routed core.
5. **Implement a Control Plane for MAC Learning** — Initially, VXLAN learns MAC addresses by flooding. For production scalability, you integrate EVPN (MP-BGP) as the control plane. EVPN advertises MAC-to-VNI mappings so that VTEPs learn remote MAC addresses without flooding. This step is critical for exam questions about VXLAN efficiency.
6. **Configure OTV for Simple Data Centre Interconnect** — If you need a quick, Cisco-only solution for stretching a single VLAN, you enable OTV on a Nexus 7000 or ASR 1000. You configure the overlay interface, join it to the OTV site, and enable the VLANs to be extended. OTV automatically advertises local MAC addresses via IS-IS.
7. **Set Up LISP for Virtual Machine Mobility** — For scenarios where VMs move between data centres, you configure LISP on the border routers. You define the EID prefix for the local site and the RLOC for the site's routers. You set up a mapping server that allows ingress tunnel routers to query the current location of any EID.

## Comparisons

### VLAN vs VXLAN

**VLAN:**
- 12-bit tag limits to 4094 segments
- Works within a single Layer 2 domain
- No encapsulation; simple 802.1Q tagging

**VXLAN:**
- 24-bit VNI allows 16 million segments
- Encapsulates in UDP and traverses Layer 3 networks
- Requires VTEPs and underlay IP routing

### VXLAN vs OTV

**VXLAN:**
- Open standard (RFC 7348)
- Default flood-and-learn; optional EVPN control plane
- Scales to multi-tenant environments (16M VNIs)

**OTV:**
- Cisco proprietary
- Uses IS-IS for MAC routing, no flooding of unknown unicast
- Simpler for few VLANs between two DCs

### LISP vs OTV

**LISP:**
- Separates endpoint identity (EID) from location (RLOC)
- Uses mapping database for control plane
- Primarily designed for VM mobility across sites

**OTV:**
- Extends Layer 2 without changing location identity
- Uses IS-IS to advertise MAC addresses
- Primarily designed for data centre interconnect (DCI)

## Diagram

_Flowchart showing the relationships and use cases of VLAN, VXLAN, OTV, and LISP in a data centre context._

```mermaid
flowchart TD
    A[VLAN: Segmentation inside one switch] --> B[Limitation: 4094 IDs, no cross-site]
    B --> C[VXLAN: Layer 2 over Layer 3 using UDP encapsulation]
    C --> D[16 million VNIs, flood-and-learn or EVPN]
    B --> E[OTV: Layer 2 extension without flooding]
    E --> F[Uses IS-IS for MAC advertising, Cisco-proprietary]
    A --> G[LISP: Identity vs Location separation]
    G --> H[EID stays fixed, RLOC changes on move]
    H --> I[Enables VM mobility across data centres]
    C --> J[VTEP on Nexus 9000, UDP 4789]
```

## Common misconceptions

- **Misconception:** VXLAN and VLAN are interchangeable — they both create separate networks, so you can use one instead of the other anywhere. **Reality:** VLAN works only within a single Layer 2 domain (usually one switch or a stack). VXLAN is an overlay that tunnels through a Layer 3 network, allowing separation across multiple sites and providing far more segments (16 million vs 4094). (Beginners see the word 'LAN' in both names and think they solve the same problem. They overlook that one is a simple tagging mechanism and the other is an encapsulation-based overlay.)
- **Misconception:** OTV and VXLAN are the same thing because both stretch Layer 2 across Layer 3. **Reality:** OTV is Cisco-proprietary, uses MAC address routing to avoid flooding, and is designed specifically for data centre interconnect. VXLAN is an open standard, uses flood-and-learn by default, and supports 16 million segments for multi-tenancy. (Students focus on the similarity of 'Layer 2 extension' and skip the details of MAC learning, control plane, and vendor support. The exam punishes this by giving a scenario with multi-tenancy requirements.)
- **Misconception:** LISP changes the IP address of a device when it moves to another data centre. **Reality:** LISP deliberately does NOT change the EID. The device keeps its original IP as its EID, and only the RLOC (routing locator) changes to reflect the new location. The mapping system translates EID to RLOC. (Beginners assume that because the device physically moves, its IP must change. They miss the whole point of LISP: separating identity from location.)
- **Misconception:** VLAN is obsolete and nobody uses it in modern data centres. **Reality:** VLAN is still widely used as the basis for local segmentation. VXLAN overlays still map to underlying VLANs on the access layer. The exam tests VLAN concepts as a foundation. (Students focus on the new, shiny technologies and dismiss the older ones. The exam explicitly includes VLAN configuration and theory.)
- **Misconception:** An OTV edge device learns MAC addresses by flooding unknown traffic across the overlay. **Reality:** OTV uses IS-IS in the control plane to advertise MAC addresses proactively. It explicitly does NOT flood unknown unicast frames across the WAN. This is a key differentiator from VXLAN flood-and-learn. (Beginners assume all Layer 2 extensions use the same MAC learning mechanism. They do not study the OTV control plane, which the exam tests directly.)

## Key takeaways

- VLAN uses a 12-bit tag allowing up to 4094 networks, while VXLAN uses a 24-bit VNI supporting over 16 million isolated segments.
- VXLAN encapsulates Ethernet frames in UDP packets on port 4789 to transport Layer 2 traffic across a Layer 3 IP network.
- OTV uses MAC address routing via IS-IS to avoid flooding unknown unicast traffic over WAN links, unlike VXLAN's default flood-and-learn.
- LISP separates the Endpoint Identifier (EID) from the Routing Locator (RLOC) so devices can move between data centres without changing IP addresses.
- OTV is Cisco-proprietary and best for simple Layer 2 extensions between two data centres, while VXLAN is open standard and best for multi-tenant scale.
- The exam expects you to identify a protocol from its port number: UDP 4789 is VXLAN, UDP 4341 is LISP data, and IP protocol 4 indicates OTV.
- LISP uses a separate mapping database for control plane operations, while VXLAN traditionally relies on data plane flood-and-learn unless EVPN is used.

## FAQ

**What is the difference between a VLAN and a VXLAN?**

A VLAN is a logical segmentation within a single switch or a local network, using a 12-bit tag for up to 4094 segments. VXLAN is an overlay protocol that encapsulates Ethernet frames in UDP packets, allowing up to 16 million segments and working across routed IP networks.

**Does OTV require a specific routing protocol?**

Yes. OTV uses IS-IS as its control plane protocol to exchange MAC address reachability information between edge devices. IS-IS runs specifically for the overlay and does not interfere with the underlay routing.

**Can LISP work with IPv6?**

Yes. LISP supports both IPv4 and IPv6 as EIDs and RLOCs. The device's endpoint identifier (EID) can be an IPv6 address, and the routing locators (RLOCs) can also be IPv6. The mapping system handles both address families.

**What happens to a VXLAN frame when it reaches the destination VTEP?**

The destination VTEP receives the UDP packet on port 4789, removes the outer IP and UDP headers, extracts the inner Ethernet frame, and forwards it into the local VLAN that corresponds to the VNI. The receiving server sees only the original frame.

**Why would you choose OTV over VXLAN?**

You would choose OTV when you need a simple, Cisco-proprietary solution for extending a small number of VLANs between two data centres without the complexity of multi-tenancy. OTV automatically handles MAC learning, avoids flooding, and does not require a separate control plane protocol like EVPN.

**Is it possible to use LISP and VXLAN together?**

Yes. LISP can provide the control plane for mobility while VXLAN provides the data plane encapsulation. In some architectures, the ingress tunnel router (LISP) encapsulates traffic and then passes it to a VTEP for VXLAN encapsulation across the fabric.

**How many VXLAN VNIs can you use on a single VTEP?**

There is no hard limit defined by the protocol, but hardware resources on the switch (TCAM memory, NVE interface limits) constrain the actual number. High-end Nexus 9000 switches can support thousands of VNIs per VTEP.

## Check your understanding

1. **Which protocol encapsulates an Ethernet frame inside a UDP packet on port 4789 to extend a Layer 2 network across a Layer 3 network?**

   Answer: VXLAN (Virtual Extensible LAN) uses UDP port 4789 for encapsulation.

2. **How many VLANs are possible using the standard 802.1Q tag?**

   Answer: 4094 user VLANs are possible because the tag is 12 bits, minus two reserved values (0 and 4095).

3. **What is the main advantage of LISP over traditional routing when a virtual machine moves between data centres?**

   Answer: LISP separates the endpoint identifier (EID) from the routing locator (RLOC), so the VM keeps its IP address (EID) unchanged even as its physical location (RLOC) changes.

4. **Which protocol uses IS-IS in its control plane to advertise MAC addresses and prevent flooding of unknown unicast across the WAN?**

   Answer: OTV (Overlay Transport Virtualisation) uses IS-IS to advertise MAC reachability between edge devices.

5. **How does VXLAN differ from VLAN in terms of the number of available segments?**

   Answer: VXLAN uses a 24-bit VNI providing up to 16 million segments, while VLAN uses a 12-bit tag providing only 4094 segments.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/cisco-ccnp-datacenter/data-center-networking-concepts