What is VTEP?

A VTEP (VXLAN Tunnel Endpoint) is the switch or host that wraps Ethernet frames in VXLAN to cross an IP network, and unwraps them at the far end.

VXLAN builds layer-2 segments on top of a routed network, and the VTEPs are where the two worlds meet. When a host sends a frame to a host behind another switch, the local VTEP looks up the destination MAC address, finds which remote VTEP it lives behind, and encapsulates the frame: a VXLAN header carrying the segment's VNI, then UDP to port 4789, then an outer IP header from its own address to the remote VTEP's address. The routed underlay just sees ordinary UDP packets between two addresses. The receiving VTEP strips the outer headers and delivers the original frame into the right segment. Broadcasts and unknown destinations, such as ARP requests, are sent either over multicast in the underlay or by copying the frame to every VTEP in a flood list (head-end replication). The UDP source port is usually derived from a hash of the inner frame, so different flows can take different ECMP paths through the fabric.

In a leaf-spine data centre the leaves are VTEPs and the spines are plain IP routers. A VTEP normally uses a loopback address as its tunnel source, so the tunnel survives the failure of any one uplink, and that loopback must be reachable through the underlay. VTEPs can also be software, in a Linux host or hypervisor. Two things catch people out. First, encapsulation adds about 50 bytes with an IPv4 underlay, so the underlay MTU has to be raised or large frames are dropped. Second, if a VTEP learns remote MACs only from traffic, flooding grows, which is why EVPN is used to tell VTEPs where each MAC lives. The EVPN and VXLAN lesson builds two VTEPs on loopbacks and captures their traffic.