For most of networking's history, an address meant a place. A subnet lived on a wire, a VLAN lived on a switch, and moving a device meant renumbering it. Network virtualization breaks that assumption. It decouples the logical network from the physical one, so a segment can span a data centre, a tenant can have their own private routing over shared infrastructure, and a virtual machine can migrate across a building while keeping its address. The technologies that make this possible, VRF, VLAN, VXLAN, and LISP, are the foundation of every modern data centre and campus fabric.
This is the hub for the PingLabz Network Virtualization and Overlays cluster, mapping to ENCOR domains 1.3 (SD-Access), 2.1 (device virtualization), and 2.3 (LISP, VXLAN). Every protocol that can be labbed here was, with real captures: LISP with a live map-cache resolving on the wire, and VXLAN with a genuine byte-level encapsulation. Where a technology cannot be labbed without a controller (SD-Access needs Catalyst Center), that is stated plainly and the article stays conceptual, with no fabricated output.
The Overlay Idea
Everything in this cluster is a variation on one theme: separate the logical from the physical. The pieces divide by what they separate and at which layer:
LISP: Separating Identity from Location
An IP address does two jobs, identity and location, and that overload is why moving a device is hard. LISP splits them into EIDs (endpoints, who) and RLOCs (routers, where), with a mapping system in between. The core routes only on RLOCs; a map-server answers "which RLOC for this EID?" on demand.
LISP explained proves it on real IOS XE, capturing the signature behaviour: the first pings drop while the map-request resolves (60% success), then flow cleanly once cached (100%), with lig showing the mapping arriving via map-reply from the remote RLOC. LISP is not a niche protocol; it is the control plane of Cisco SD-Access, so understanding it here is understanding the fabric later.
VXLAN: The Overlay Data Plane
VXLAN wraps the original Ethernet frame in UDP (port 4789) and IP, and routes it between VTEPs across a Layer 3 underlay. A 24-bit VNI gives 16 million segments against the VLAN's 4094, and because the fabric is routed, there is no spanning tree across it. VXLAN deep dive takes the encapsulation apart at the byte level using a real crafted packet: you can see the outer VTEP addresses, UDP destination port 0x12B5 (4789), the 8-byte VXLAN header with the Instance flag, VNI 0x271A (10010), and the tenant frame intact inside.
The data plane is only half the story. A VTEP needs to know which remote VTEP a destination lives behind, and the modern answer is a proper control plane: VXLAN with BGP EVPN replaces the old flood-and-learn model with MP-BGP advertising MAC and IP reachability. Type 2 routes advertise hosts (and enable ARP suppression, eliminating fabric-wide flooding); Type 5 routes carry subnets. If you know MPLS L3VPN's MP-BGP, you already know most of EVPN.
SD-Access: The Two Planes Packaged
Strip away the branding and Cisco SD-Access is LISP (control plane) plus VXLAN (data plane) plus Catalyst Center (automation and policy). SD-Access architecture maps the fabric roles onto the LISP roles you already know: Fabric Edge = xTR, Control Plane node = map-server, Border = fabric exit. It adds two levels of segmentation, macro (Virtual Networks = VRFs) and micro (Scalable Group Tags), enforced by the fabric rather than device by device.
Because SD-Access needs Catalyst Center, it is covered conceptually. SD-Access and the traditional campus then addresses the real engineering challenge, the border where fabric meets non-fabric, and how to migrate an existing campus without a big-bang cutover while preserving segmentation across the boundary.
Device Virtualization
The network no longer stops at the physical switch port. Hypervisors, virtual switches, and VMs for network engineers covers the virtual switch inside every hypervisor (where your VLANs actually terminate), the east-west traffic between VMs on the same host that the physical network never sees, and why VM mobility drove the entire move to VXLAN overlays.
Choosing the Right Layer
With four segmentation tools that overlap, the meta-skill is knowing which to reach for. VRF, VLAN, VXLAN, LISP: choosing the right segmentation layer is the decision framework: VLAN for broadcast domains, VRF for Layer 3 isolation, VXLAN when you exceed 4094 segments or need L2 across a routed fabric, LISP for mobility. The most important lesson in it is restraint: a modern fabric uses all four at once, but the common mistake is reaching for a fabric when a VLAN and an ACL solve the actual requirement.
The Full Network Virtualization Cluster
Adjacent clusters: VLANs and Layer 2 switching (the foundation VXLAN transports), BGP and MPLS (EVPN reuses their MP-BGP machinery), and IP Routing for the VRF-Lite foundation.
The SD-Access Deep Series (CCIE level)
SD-Access is roughly 12.5% of the CCIE Enterprise Infrastructure lab, and it is the one domain a home lab cannot fully build - it requires Cisco Catalyst Center. So this is an honest concept-and-components series: we describe the architecture, and where a protocol SD-Access rides on is real and standalone (LISP, VXLAN, 802.1X, TrustSec) we ground the explanation in captures PingLabz has taken on IOS XE. We are explicit throughout about what needs the controller and what does not.
Studying for the CCIE?
This cluster is part of the full CCNA to CCNP to CCIE Enterprise ladder on PingLabz, every rung built on real Cisco output. For expert-level depth across every EI v1.1 blueprint domain - and the four integration Super Labs - see the CCIE Enterprise Infrastructure study hub.
Frequently Asked Questions
Is VXLAN a replacement for VLANs?
No. VXLAN carries VLANs (mapped to L2VNIs) across a routed fabric, solving the 4094 ceiling and the scale limits of flat Layer 2. Locally you still use VLANs.
What is the difference between LISP and EVPN?
Both are overlay control planes. LISP maps endpoint identity to location and is the SD-Access control plane; BGP EVPN advertises MAC/IP reachability and is the data-centre VXLAN control plane. They solve the same "where is this destination" problem in different worlds.
Can I lab all of this?
LISP and VXLAN, yes, and this cluster does with real captures. SD-Access requires Catalyst Center and is covered conceptually. No device output is ever fabricated.
Do I need a fabric?
Often not. VLANs and VRFs handle most segmentation needs. Fabrics (VXLAN-EVPN, SD-Access) earn their complexity at scale: large multi-tenant data centres, big campuses with mobility and segmentation requirements.
How does this relate to BGP and MPLS?
Closely. BGP EVPN is an MP-BGP address family using the same RD/RT machinery as MPLS L3VPN. If you know those clusters, the EVPN control plane will feel familiar.
Key Takeaways
- Network virtualization decouples the logical network from the physical. VRF (L3), VLAN (L2), VXLAN (L2-over-L3), and LISP (identity/location) each do a different part.
- LISP separates identity (EID) from location (RLOC) and is the SD-Access control plane. The lab captured the first-packet-drop-then-resolve behaviour live.
- VXLAN is the overlay data plane (UDP 4789, 24-bit VNI). A real byte-level capture shows the exact encapsulation.
- BGP EVPN is the modern VXLAN control plane, replacing flood-and-learn with MP-BGP route advertisement.
- SD-Access = LISP + VXLAN + Catalyst Center. Concept-level here (needs a controller); the underlying protocols are labbed.
- Choose the right layer, and use restraint: a fabric is powerful, but a VLAN and an ACL solve most real requirements.