# A Micro-Segmentation Method Based on VLAN-VxLAN Mapping Technology
## 3 Proposed Method
### Micro-Segmentation
#### 3.1.2 VxLAN
Due to its inherent characteristics, VxLAN is extensively employed in cloud data centre environments, primarily for tenant isolation and virtual machine migration scenarios. The seamless migration capabilities of VxLAN make it particularly well-suited for micro-segmentation applications. In our proposed solution, we aim to ensure that only north-south traffic occurs within the vSwitch, eliminating any east-west traffic. By enforcing this design, all traffic must be routed through the L3 gateway, which facilitates subsequent traffic mirroring for enhanced monitoring and security. In typical vSwitch operations, horizontal traffic forwarding is contingent on the consistency of VLAN IDs. To address this, we implemented a VLAN-to-VxLAN many-to-one mapping strategy, wherein each virtual machine is assigned a unique VLAN. This approach effectively prevents direct horizontal traffic forwarding. Figure 4: Traffic flow on same-VxLAN and cross-VxLANs networks in VxLAN distributed gateway deployment mode. Figure 3: Traffic flow on same-VxLAN and cross-VxLANs networks in VxLAN centralised gateway deployment mode. traffic forwarding between virtual machines within the vSwitch, thereby meeting our requirement for controlled traffic flows and enabling more effective micro-segmentation. Table 1 presents the relevant details of specific cyberspace assets that have undergone micro-segmentation using the VLAN-VxLAN mapping technique. This technique involves assigning a unique VLAN identification number to each existing IP address within the VLAN and mapping them to the same Virtual Network Identifier (VNI) as the original VLAN. The mapping relationships between the newly created VLAN and its corresponding VNI are provided in Table 2.  
Upon implementing the micro-segmentation modification, the network topology of assets within the same subnet has been transformed from a bus-based topology to a star-based topology. This implies that all traffic between these assets must pass through the VxLAN L3 Gateway, and direct virtual machine access is no longer permitted, as depicted in Figure 5.  
A distinct advantage of this method lies in its non-intrusive nature, as it requires no interruption to ongoing business operations and only necessitates configuration adjustments on the L3 gateway. This makes it particularly advantageous for applications with stringent continuity requirements. Our subsequent experiments confirmed the feasibility of this approach. It is important to note, however, that employing the L3 gateway for \begin{table}
\begin{tabular}{c c c c} \hline \hline
**IP Address** & **VLAN ID** & **VxLAN ID** & **Gateway** \\ \hline
10.0.0.1 & 10 & 10 & 10.0.0.254 \\ \hline
10.0.0.2 & 10 & 10 & 10.0.0.254 \\ \hline
10.1.0.1 & 20 & 20 & 10.1.0.254 \\ \hline
10.2.0.1 & 30 & 30 & 10.2.0.254 \\ \hline
10.0.0.3 & 10 & 10 & 10.0.0.254 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Network information for cyberspace assets. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**IP Address** & **Original VLAN ID** & **New VLAN ID** & **VxLAN ID** & **Gateway** \\ \hline
10.0.0.1 & 10 & 101 & 10 & 10.0.0.254 \\ \hline
10.0.0.2 & 10 & 102 & 10 & 10.0.0.254 \\ \hline
10.1.0.1 & 20 & 111 & 20 & 10.1.0.254 \\ \hline
10.2.0.1 & 30 & 121 & 30 & 10.2.0.254 \\ \hline
10.0.0.3 & 10 & 103 & 10 & 10.0.0.254 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Network information for newly planned cyberspace assets. Figure 5: Illustration of the logical topology of the network with and without the micro-segmentation. micro-segmentation does impose an additional load on the gateway. Our measurements indicate that this load increases by approximately 1.5 to 2 times. Despite this additional burden, we believe that the enhanced security benefits justify the modest increase in load.