> ## Content Index > Fetch the complete content index at: https://www.pinglabz.com/llms.txt > Use this file to discover other available public pages before exploring further. # VRF, VLAN, VXLAN, LISP: Choosing the Right Segmentation Layer - URL: https://www.pinglabz.com/vrf-vlan-vxlan-lisp-segmentation/ - Published: 2026-07-12T02:30:09.000Z - Updated: 2026-08-24T09:42:55.000Z - Description: VRFs, VLANs, VXLAN, and LISP all segment a network at different layers. This decision framework shows what each one actually separates and when to use it, so you do not reach for a fabric when a VLAN would do. - Author: Jaime - Tags: Overlay Networking, #Import 2026-08-01 19:54 By the time you have read this cluster, you have four different ways to segment a network: VRFs, VLANs, VXLAN, and LISP. They overlap, they are often used together, and choosing the wrong one (or reaching for a fabric when a VLAN would do) is a real and expensive mistake. This article is the decision framework: what each one actually separates, at which layer, and when to use it. It ties together the whole [Network Virtualization and Overlays cluster](https://www.pinglabz.com/network-virtualization/). ## The Four, at a Glance VLAN Layer2 Separates broadcast domains on a switch. The oldest, simplest, most local tool. Scale\~4094 VRF Layer3 Separates routing tables. Two VRFs can use the same IP space and never see each other. ScaleMany VXLAN Layer2 over 3 Stretches an L2 segment across a routed fabric. Solves the VLAN ceiling and scale. Scale16M LISP Layer3 mapping Separates identity from location. The control plane for mobility and fabrics. ScaleVery large The first insight: these are not competitors on the same layer. A VLAN separates Layer 2\. A VRF separates Layer 3\. VXLAN is a transport that carries Layer 2 (or 3) across a Layer 3 fabric. LISP is a control plane that maps endpoints to locations. In a modern fabric you use *all four at once*, each doing its own job. ## VLAN: Start Here, Stay Here If You Can A [VLAN](https://www.pinglabz.com/vlans-layer-2-switching/) separates broadcast domains within a switched network. It is the right answer for the vast majority of segmentation needs: separating voice from data, guests from staff, one department from another, within a building or a campus. When a VLAN is enough, use a VLAN. The mistake this whole cluster can accidentally encourage is reaching for a fabric because it is interesting, when the requirement is "keep the guest Wi-Fi off the corporate network," which a VLAN and an ACL solve completely. VLANs run out of room at two points: the \~4094 ID ceiling (real multi-tenancy) and the scale limits of large flat Layer 2 (big failure domains, spanning-tree fragility). Below those limits, VLANs are simpler, cheaper, and easier to operate than anything else here. ## VRF: Separation at Layer 3 A [VRF](https://www.pinglabz.com/vrf-lite-configuration-cisco-ios-xe/) gives a router multiple independent routing tables. The killer feature is that two VRFs can use overlapping IP address space and remain completely isolated: a route in one is invisible to the other, so no traffic crosses without an explicit leak. Reach for a VRF when the separation you need is at Layer 3: keeping two customers' routing separate on shared infrastructure, isolating a management network, or carving a guest network that must not route to the corporate one even though both are Layer 3\. VRF-Lite does this hop by hop on a single or small set of routers; when the VRFs must scale across a whole backbone, you promote to [MPLS L3VPN](https://www.pinglabz.com/mpls-l3vpn/) (VRFs carried by MP-BGP) or a VXLAN-EVPN fabric (VRFs carried as L3VNIs). The VRF is the unit of macro-segmentation everywhere from a two-router VRF-Lite setup to an SD-Access Virtual Network. ## VXLAN: When VLANs Run Out of Room [VXLAN](https://www.pinglabz.com/vxlan-deep-dive/) is the answer to two specific VLAN limits: you need more than 4094 segments (real multi-tenancy, a service provider or large enterprise data center), or you need to stretch a Layer 2 segment across a routed network without the fragility of large flat Layer 2 (VM mobility across a fabric). The signal that you have outgrown VLANs and need VXLAN: you are trying to stretch VLANs across your whole data center for VM mobility, or you have hit the segment ceiling, or spanning tree across a big flat domain has become an operational hazard. If none of those apply, VXLAN is complexity you do not need. When they do apply, VXLAN with [BGP EVPN](https://www.pinglabz.com/vxlan-bgp-evpn-explained/) is the standard, and it carries VLANs (as L2VNIs) and VRFs (as L3VNIs) across the fabric, so it does not replace them, it transports them. ## LISP: When Location Must Change but Identity Must Not [LISP](https://www.pinglabz.com/lisp-explained/) is different in kind from the other three: it is not a segmentation construct, it is a mapping control plane. It separates *who* (the EID) from *where* (the RLOC), so an endpoint can move and keep its identity while its location changes underneath. You use LISP when the requirement is mobility or scalable multihoming: campus-wide roaming where a device keeps its policy wherever it plugs in, ingress traffic engineering without polluting global BGP, or, most commonly, as the control plane of [Cisco SD-Access](https://www.pinglabz.com/sd-access-architecture/). You rarely deploy LISP by hand for its own sake in an enterprise; you encounter it as the machinery inside the fabric. But understanding it explains why the fabric can move an endpoint seamlessly. ## The Decision, Compressed Separate broadcast domains in a building**VLAN.** Do not overthink it. Isolate routing / overlapping IP space**VRF** (VRF-Lite locally, MPLS L3VPN or EVPN L3VNI at scale). More than 4094 segments, or L2 across a routed DC**VXLAN** (with BGP EVPN). Endpoint mobility / campus fabric**LISP** (usually as the SD-Access control plane). A modern fabric**All four together:** VLANs at the edge, VRFs for tenants, VXLAN for transport, LISP or EVPN for control. ## FAQ ### Do VXLAN and VLANs compete? No. VXLAN carries VLANs (mapped to L2VNIs) across a fabric. Locally you still use VLANs; VXLAN extends them beyond the reach and scale of a physical VLAN. ### Is a VRF the same as a VLAN? No. A VLAN separates Layer 2 (broadcast domains). A VRF separates Layer 3 (routing tables). You often pair them: a VLAN per subnet, a VRF grouping subnets into a tenant. ### When do I actually need LISP? Rarely by hand. You encounter it as the control plane of SD-Access. Standalone, it is for endpoint mobility and scalable multihoming. ### Can I just use VLANs and VRFs forever? For many networks, yes. VXLAN and fabrics earn their complexity at scale (large multi-tenant data centers, big campuses with mobility and segmentation needs). Below that, VLANs and VRFs are the right, simpler answer. ### What is the biggest mistake here? Reaching for a fabric because it is modern when a VLAN and an ACL solve the actual requirement. Match the tool to the need, not to the trend. ## Key Takeaways - The four operate at **different layers** and are used together, not instead of each other: VLAN (L2), VRF (L3), VXLAN (L2-over-L3 transport), LISP (identity/location mapping). - **VLAN** for broadcast-domain separation in a building. When it is enough, use it. Ceiling: \~4094 and flat-L2 scale. - **VRF** for Layer 3 isolation and overlapping IP space. VRF-Lite locally; MPLS L3VPN or EVPN L3VNI at scale. - **VXLAN** when you exceed 4094 segments or need L2 across a routed fabric (VM mobility). It carries VLANs and VRFs, does not replace them. - **LISP** when location must change but identity must not: mobility, multihoming, and the SD-Access control plane. - A modern fabric uses **all four at once**. The mistake is reaching for a fabric when a VLAN would do. This closes the Network Virtualization cluster. Back to the [cluster guide](https://www.pinglabz.com/network-virtualization/) for the full reading order.