# A Micro-Segmentation Method Based on VLAN-VxLAN Mapping Technology
## 3 Proposed Method
### Micro-Segmentation
#### 3.1.2 VxLAN  
VxLAN is a tunneling technology that facilitates Layer 2 interconnection across physical locations by establishing a Layer 2 network tunnel over a Layer 3 network. It achieves this by encapsulating original Ethernet packets within User Datagram Protocol (UDP) packets for transmission. The packet format of VxLAN is illustrated in Figure 1.  
The key component in a VxLAN environment is the VTPP, which is responsible for encapsulating VxLAN packets and serves as both the starting and ending point of a VxLAN tunnel. The process of encapsulating VxLAN packets belonging to the same VxLAN Network Identifier (VNI) is illustrated in Figure 2. Let us consider an example where Server A and Server B, located in different physical locations, need to communicate. Server A sends a traditional Ethernet message (with VLAN TAG) to VTPP1. VTPP1, based on its table of mapping relationships between VLANs and VxLANs, adds the corresponding VxLAN header to the message, encapsulating it into a VxLAN packet. This encapsulated packet traverses the physical network and reaches VTPP2, which then sends it through the VxLAN tunnel to its destination. Upon receiving the packet, VTPP2 sequentially removes the outer Ethernet, outer IP header, and UDP header. It checks the VNI and inner Ethernet header information of the packet, verifies the receiver's association with VTPP2, removes the VxLAN header, and forwards the data frame to Server B.  
Figure 1: VxLAN packet format. In a VxLAN environment, hosts need to communicate within the same VNI, between different VNI's, and between VxLAN networks and non-VxLAN networks. To fulfill these requirements, VxLAN introduces the concept of Layer 2 and Layer 3 gateways. Layer 2 gateways enable client access to VxLAN networks and facilitate host communication within the same VNI. Layer 3 gateways, on the other hand, enable host communication between different VNI's and provide access to external networks. The deployment of Layer 3 gateways in a VxLAN environment can be done in two ways: centralized gateway and distributed gateway. The centralized gateway is illustrated in Figure 3. The advantage of a centralized gateway is that it allows centralized management of network traffic across VxLANs and is relatively simple to configure. The disadvantages are that the network scale is limited by Address Resolution Protocol (ARP) table entries, and that some traffic forwarding may not be optimized. As Figure 3 shows, when traffic on different VxLAN networks needs to communicate, even if they are physically located under the same VxLAN L2 Gateway, the traffic needs to be uploaded to the VxLAN L3 Gateway before it can reach its destination. According to the encapsulation protocol of VxLAN, it is easy to observe that VxLAN loses some performance in the encapsulation process and increases the overhead of the network equipment. Therefore, centralized gateways are mostly used in scenarios where north-south traffic is high. On the other hand, the distributed gateway deployment model, as depicted in Figure 4, provides a solution to the limitations of the centralized gateway. In this approach, each node only needs to learn a part of the ARP table entries, which solves the drawback of network scale scalability. Additionally, when traffic from different VxLAN networks needs to communicate, it can be forwarded directly. However, the disadvantage of this deployment model is that each node needs to be configured, which could make operation and maintenance relatively complex. To address this challenge, using SDN controllers to manage VxLAN network devices is recommended. The distributed gateway deployment model is suitable for scenarios with high east-west traffic and the need for network expansion. In data centre environments, a distributed gateway deployment model is commonly adopted. Figure 2: Packet encapsulation and decapsulation from ServerA to ServerB via VxLAN network.