Which Entity Maintains VXLAN Layer 2 Isolation?
Describe network virtualization concepts
Configure and verify data path virtualization technologies
Which entity is responsible for maintaining Layer 2 isolation between segments in a VXLAN environment?
Answer
Correct answer: A — the 24-bit VNID identifies each Layer 2 segment and maintains isolation between VXLAN segments.
Community Insight
The question tests the distinction between the identifier that defines isolation (VNID) and the device that carries traffic (VTEP), and the trap is choosing the more familiar 'entity' VTEP over the actual isolation mechanism.
This 350-401 question asks which VXLAN component keeps Layer 2 segments isolated from one another. The answer is the VNID, the 24-bit segment identifier that functions like a VLAN ID and defines each separate broadcast domain in the VXLAN overlay.
Option C (VTEP) is the most tempting wrong pick because it is a real device-like entity that encapsulates traffic; however, VTEP only applies and forwards based on the VNID — it does not itself define or maintain the boundary between segments.
Community Discussion (28 comments)
Jcap
👍 2
Selected: A
In a VXLAN environment, the VXLAN Network Identifier (VNID) is a 24-bit segment ID used to identify individual Layer 2 broadcast domains. Much like a traditional VLAN ID, the VNID is the specific mechanism responsible for maintaining Layer 2 isolation between different segments, ensuring that traffic does not cross between different VXLAN overlay networks unless explicitly routed.
andyforreg
👍 1
Selected: C
VNID is not an entity. It's a technology. VTEP is the entity that uses the VNID to enforce isolation.
iwanta
👍 2
Selected: A
VNID = separation VTEP = encaps/decaps
achille5
👍 2
Selected: A
VNID - Defines the isolated Layer 2 segment VTEP - Maps VLAN ↔ VNID and forwards traffic Simple analogy: Think of it like shipping: VNID = tracking number (defines which package belongs to whom) VTEP = courier hub (reads label and routes correctly) The courier moves the package… but the label is what keeps shipments from getting mixed up.
ktha1427
👍 1
Selected: A
VNID= Segmentation VTEP = encapsulates and de-encapsulates VXLAN traffic
AlfHer1991
👍 1
Selected: C
In a VXLAN environment, the VXLAN Tunnel Endpoint (VTEP) is the physical or virtual entity responsible for maintaining and enforcing Layer 2 isolation between segments
Delamorte
👍 1
Selected: C
Entity is something physical
074a077
👍 6
Selected: C
In Cisco VXLAN, the VXLAN Tunnel Endpoint (VTEP) is the key entity that maintains Layer 2 isolation by encapsulating/decapsulating traffic and using the VNI (VXLAN Network Identifier) to segment different Layer 2 domains, treating each VNI as a separate broadcast domain for traffic forwarding
Loi2525
👍 1
Selected: B
VTEP is the Entity that enforces the isolation using the VNI
SanchezEldorado
👍 1
Selected: C
VNID is not an entity. It's a technology. VTEP is the entity that uses the VNID to enforce isolation.
Hadakka
👍 1
Selected: C
i go for C_ VTEP
chakspear
👍 2
Selected: A
It's VNID guys
zbeugene7
👍 1
Selected: C
VNID is hardly an entity, its a tag, a name an ID that facilitates the overlay arcitecture , I wonder what is an answer to this question supposed to prove ? The answer is C
c728f00
👍 1
Selected: A
VTEP (VXLAN Tunnel Endpoint) and VNID (VXLAN Network Identifier) are both key concepts in a VXLAN-based network, but they serve very different purposes: VTEP: A device (physical switch or hypervisor-based virtual switch) that terminates the VXLAN tunnel. Performs encapsulation/decapsulation of Layer 2 Ethernet frames into/from VXLAN packets. Think of it as the “edge” of the VXLAN overlay network that connects end hosts to the VXLAN fabric. VNID: A 24-bit identifier (sometimes called a “segment ID”) carried in the VXLAN header. Logically separates traffic into different “broadcast domains” or “overlay segments” within the same VXLAN fabric. Roughly analogous to VLAN IDs, but with a much larger ID space (up to 16 million vs. 4094 VLANs).
tumajay
👍 1
Selected: C
Q85 clarifies the confusion. VNI is the technology (Q85 ) while VTEP is the entity - C is the correct answer
tumajay
👍 3
Selected: D
i asked chatgpt this question and initially gave the following answer: 'In a VXLAN (Virtual Extensible LAN) environment, the entity responsible for maintaining Layer 2 isolation between segments is the VNI (VXLAN Network Identifier). i now asked again "Is VNID an entity?" then chatgpt now replied with this "You're absolutely correct to point out that VNID (VXLAN Network Identifier) is not an "entity" but rather a logical construct or identifier. Let me refine the explanation: Clarified Answer: The entity responsible for maintaining Layer 2 isolation between segments in a VXLAN environment is the VXLAN Tunnel Endpoint (VTEP)." so we need to be careful with the way cisco choose their words. please note that i didn't give any options for chatgpt to choose from, I just asked the question. so i go with D
Priscysamissone
👍 1
The 24-bit VNID is used to identify Layer 2 segments and to maintain Layer 2 isolation between the segments.
Shri_Fcb10
👍 1
The correct ans is VTEP. VNID is a unique identifier assigned to each VXLAN segment, but it is used for identification purposes rather than for enforcing isolation between segments.
djedeen
👍 2
Selected: C
VTEP maintains the isolation
kldoyle97
👍 4
VXLAN (Virtual Extensible LAN) - The technology that provides the same Ethernet Layer 2 network services as VLAN does today, but with greater extensibility and flexibility. VNID (Vxlan Network Identifier) - 24 bit segment ID that defines the broadcast domain. Interchangeable with "VXLAN Segment ID". VTEP (Virtual Tunnel Endpoint) - This is the device that does the encapsulation and de-encapsulation. NVE (Network Virtual Interface) - Logical interface where the encapsulation and de-encapsulation occur.
nightstalker
👍 5
VNID is not an entity, is a technology (see also Question #85) the entity that enforces isolation based on the VNID is the VTEP
respectively
👍 1
I agree
Poba
👍 1
Correct answer is C. VTEP
techriese
👍 1
Selected: A
A is correct
uhljeb
👍 1
Unlike the VLAN ID, which has only 12 bits and allows for 4000 VLANs, VXLAN has a 24-bit VXLAN network identifier (VNI), which allows for up to 16 million VXLAN segments (more commonly known as overlay networks) to coexist within the same infrastructure. The VNI is located in the VXLAN shim header that encapsulates the original inner MAC frame originated by an endpoint. The VNI is used to provide segmentation for Layer 2 and Layer 3 traffic. Source: CCNP and CCIE Enterprise Core: ENCOR 350-401 Official Cert Guide
ShadyAbdekmalek
👍 4
Selected: A
A is correct : The 24-bit VNID is used to identify Layer 2 segments and to maintain Layer 2 isolation between the segments. With all 24 bits in VNID, VXLAN can support 16 million LAN segments. Source : https://www.ciscopress.com/articles/article.asp?p=2999385&seqNum=3#:~:text=The%2024%2Dbit%20VNID%20is,support%2016%20million%20LAN%20segments.
ciscolessons
👍 1
Selected: A
voting. provided answer is correct
Rockford
👍 15
A: VNID - VXLAN Network IDentifier.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The 24-bit VNID (VXLAN Network Identifier) is precisely what identifies each Layer 2 segment and maintains isolation between those segments, exactly as a VLAN ID does in a traditional switched network. Cisco Press describes the VNID as the value used "to identify Layer 2 segments and to maintain Layer 2 isolation between the segments," and it scales VXLAN to roughly 16 million distinct broadcast domains. Every frame entering the overlay is stamped with a VNID, and no traffic crosses segment boundaries unless it is routed, so the isolation property resides in the VNID itself. This matches the question's wording almost verbatim, making A the intended and technically defensible answer.Why the Other Options Are Wrong
Option C, the VTEP, is the encapsulating/decapsulating endpoint (usually an NVE on a leaf or host) that reads and applies the VNID — it is the courier that reads the label, not the label that defines the segment. Option B, the switch fabric, refers to the underlay spine/leaf transport that carries encapsulated packets and provides no L2 segment separation on its own. Option D, the host switch, is a generic term for an access device and has no defined role in VXLAN segmentation. Choosing any of these confuses the forwarding mechanism with the isolation identifier that the question asks about.Community Comment Notes
Most commenters landed on A, with Rockford simply noting "VNID - VXLAN Network IDentifier" and chakspear insisting "It's VNID guys." ShadyAbdekmalek backed A with a Cisco Press citation that mirrors the question wording, and achille5 offered a shipping analogy in which "VNID = tracking number" while the VTEP is only "the courier hub." nightstalker pushed back that a VNID is not an entity and that "the entity that enforces isolation based on the VNID is the VTEP," and 074a077 similarly argued for C — but their own explanations confirm the VTEP merely applies the VNID. tumajay documented how an AI assistant flip-flopped between VNI and VTEP, which shows why the distinction is a classic trap on this exam.Official Reference
Exam Strategy
When a question uses the phrase "maintaining Layer 2 isolation between segments," look for the identifier value (VNID/VNI) rather than the forwarding device — similar to how a VLAN ID, not the switch port, defines the broadcast domain boundary.
Frequently Asked Questions
Why isn't the VTEP the answer for VXLAN Layer 2 isolation?
The VTEP only encapsulates and decapsulates frames and forwards them using the VNID. It applies the segmentation value, but the VNID itself defines and maintains the segment boundary.
Is a VNID an entity or just an identifier?
VNID is the 24-bit VXLAN Network Identifier — a segment ID rather than a device. In this question's wording, however, it is the component responsible for keeping Layer 2 segments isolated.
Related Analysis
Practice All 350-401 Questions
Access 218 questions with complete answers and detailed explanations.
View Full 350-401 Practice Test →