By the time you have read this cluster, you have four different ways to segment a network: VRFs, VLANs, VXLAN, and LISP. They overlap, they are often used together, and choosing the wrong one (or reaching for a fabric when a VLAN would do) is a real and expensive mistake. This article is the decision framework: what each one actually separates, at which layer, and when to use it.
It ties together the whole Network Virtualization and Overlays cluster.
The Four, at a Glance
The first insight: these are not competitors on the same layer. A VLAN separates Layer 2. A VRF separates Layer 3. VXLAN is a transport that carries Layer 2 (or 3) across a Layer 3 fabric. LISP is a control plane that maps endpoints to locations. In a modern fabric you use all four at once, each doing its own job.
VLAN: Start Here, Stay Here If You Can
A VLAN separates broadcast domains within a switched network. It is the right answer for the vast majority of segmentation needs: separating voice from data, guests from staff, one department from another, within a building or a campus.
When a VLAN is enough, use a VLAN. The mistake this whole cluster can accidentally encourage is reaching for a fabric because it is interesting, when the requirement is "keep the guest Wi-Fi off the corporate network," which a VLAN and an ACL solve completely. VLANs run out of room at two points: the ~4094 ID ceiling (real multi-tenancy) and the scale limits of large flat Layer 2 (big failure domains, spanning-tree fragility). Below those limits, VLANs are simpler, cheaper, and easier to operate than anything else here.
VRF: Separation at Layer 3
A VRF gives a router multiple independent routing tables. The killer feature is that two VRFs can use overlapping IP address space and remain completely isolated: a route in one is invisible to the other, so no traffic crosses without an explicit leak.
Reach for a VRF when the separation you need is at Layer 3: keeping two customers' routing separate on shared infrastructure, isolating a management network, or carving a guest network that must not route to the corporate one even though both are Layer 3. VRF-Lite does this hop by hop on a single or small set of routers; when the VRFs must scale across a whole backbone, you promote to MPLS L3VPN (VRFs carried by MP-BGP) or a VXLAN-EVPN fabric (VRFs carried as L3VNIs). The VRF is the unit of macro-segmentation everywhere from a two-router VRF-Lite setup to an SD-Access Virtual Network.
VXLAN: When VLANs Run Out of Room
VXLAN is the answer to two specific VLAN limits: you need more than 4094 segments (real multi-tenancy, a service provider or large enterprise data centre), or you need to stretch a Layer 2 segment across a routed network without the fragility of large flat Layer 2 (VM mobility across a fabric).
The signal that you have outgrown VLANs and need VXLAN: you are trying to stretch VLANs across your whole data centre for VM mobility, or you have hit the segment ceiling, or spanning tree across a big flat domain has become an operational hazard. If none of those apply, VXLAN is complexity you do not need. When they do apply, VXLAN with BGP EVPN is the standard, and it carries VLANs (as L2VNIs) and VRFs (as L3VNIs) across the fabric, so it does not replace them, it transports them.
LISP: When Location Must Change but Identity Must Not
LISP is different in kind from the other three: it is not a segmentation construct, it is a mapping control plane. It separates who (the EID) from where (the RLOC), so an endpoint can move and keep its identity while its location changes underneath.
You use LISP when the requirement is mobility or scalable multihoming: campus-wide roaming where a device keeps its policy wherever it plugs in, ingress traffic engineering without polluting global BGP, or, most commonly, as the control plane of Cisco SD-Access. You rarely deploy LISP by hand for its own sake in an enterprise; you encounter it as the machinery inside the fabric. But understanding it explains why the fabric can move an endpoint seamlessly.
The Decision, Compressed
FAQ
Do VXLAN and VLANs compete?
No. VXLAN carries VLANs (mapped to L2VNIs) across a fabric. Locally you still use VLANs; VXLAN extends them beyond the reach and scale of a physical VLAN.
Is a VRF the same as a VLAN?
No. A VLAN separates Layer 2 (broadcast domains). A VRF separates Layer 3 (routing tables). You often pair them: a VLAN per subnet, a VRF grouping subnets into a tenant.
When do I actually need LISP?
Rarely by hand. You encounter it as the control plane of SD-Access. Standalone, it is for endpoint mobility and scalable multihoming.
Can I just use VLANs and VRFs forever?
For many networks, yes. VXLAN and fabrics earn their complexity at scale (large multi-tenant data centres, big campuses with mobility and segmentation needs). Below that, VLANs and VRFs are the right, simpler answer.
What is the biggest mistake here?
Reaching for a fabric because it is modern when a VLAN and an ACL solve the actual requirement. Match the tool to the need, not to the trend.
Key Takeaways
- The four operate at different layers and are used together, not instead of each other: VLAN (L2), VRF (L3), VXLAN (L2-over-L3 transport), LISP (identity/location mapping).
- VLAN for broadcast-domain separation in a building. When it is enough, use it. Ceiling: ~4094 and flat-L2 scale.
- VRF for Layer 3 isolation and overlapping IP space. VRF-Lite locally; MPLS L3VPN or EVPN L3VNI at scale.
- VXLAN when you exceed 4094 segments or need L2 across a routed fabric (VM mobility). It carries VLANs and VRFs, does not replace them.
- LISP when location must change but identity must not: mobility, multihoming, and the SD-Access control plane.
- A modern fabric uses all four at once. The mistake is reaching for a fabric when a VLAN would do.
This closes the Network Virtualization cluster. Back to the cluster guide for the full reading order.
