Which Entity Maintains VXLAN Layer 2 Isolation?

350-401 By islever Editorial Last updated

Describe network virtualization concepts Configure and verify data path virtualization technologies

Short answer

A The 24-bit VNID identifies each Layer 2 segment and maintains isolation between VXLAN segments.

Question

Which entity is responsible for maintaining Layer 2 isolation between segments in a VXLAN environment?
  1. VNID Correct Answer
  2. switch fabric
  3. VTEP
  4. host switch

Key Takeaways

The question tests the distinction between the identifier that defines isolation (VNID) and the device that carries traffic (VTEP), and the trap is choosing the more familiar 'entity' VTEP over the actual isolation mechanism.

This 350-401 question asks which VXLAN component keeps Layer 2 segments isolated from one another. The answer is the VNID, the 24-bit segment identifier that functions like a VLAN ID and defines each separate broadcast domain in the VXLAN overlay.

Common mistake: Option C (VTEP) is the most tempting wrong pick because it is a real device-like entity that encapsulates traffic; however, VTEP only applies and forwards based on the VNID — it does not itself define or maintain the boundary between segments.

Expert Analysis

Why the Answer Is Correct

The 24-bit VNID (VXLAN Network Identifier) is precisely what identifies each Layer 2 segment and maintains isolation between those segments, exactly as a VLAN ID does in a traditional switched network. Cisco Press describes the VNID as the value used "to identify Layer 2 segments and to maintain Layer 2 isolation between the segments," and it scales VXLAN to roughly 16 million distinct broadcast domains. Every frame entering the overlay is stamped with a VNID, and no traffic crosses segment boundaries unless it is routed, so the isolation property resides in the VNID itself. This matches the question's wording almost verbatim, making A the intended and technically defensible answer.

Why the Other Options Are Wrong

Option C, the VTEP, is the encapsulating/decapsulating endpoint (usually an NVE on a leaf or host) that reads and applies the VNID — it is the courier that reads the label, not the label that defines the segment. Option B, the switch fabric, refers to the underlay spine/leaf transport that carries encapsulated packets and provides no L2 segment separation on its own. Option D, the host switch, is a generic term for an access device and has no defined role in VXLAN segmentation. Choosing any of these confuses the forwarding mechanism with the isolation identifier that the question asks about.

Community Comment Notes

Most commenters landed on A, with Rockford simply noting "VNID - VXLAN Network IDentifier" and chakspear insisting "It's VNID guys." ShadyAbdekmalek backed A with a Cisco Press citation that mirrors the question wording, and achille5 offered a shipping analogy in which "VNID = tracking number" while the VTEP is only "the courier hub." nightstalker pushed back that a VNID is not an entity and that "the entity that enforces isolation based on the VNID is the VTEP," and 074a077 similarly argued for C — but their own explanations confirm the VTEP merely applies the VNID. tumajay documented how an AI assistant flip-flopped between VNI and VTEP, which shows why the distinction is a classic trap on this exam.

Official Reference

https://www.ciscopress.com/articles/article.asp?p=2999385&seqNum=3

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question uses the phrase "maintaining Layer 2 isolation between segments," look for the identifier value (VNID/VNI) rather than the forwarding device — similar to how a VLAN ID, not the switch port, defines the broadcast domain boundary.

Frequently Asked Questions

Why isn't the VTEP the answer for VXLAN Layer 2 isolation?

The VTEP only encapsulates and decapsulates frames and forwards them using the VNID. It applies the segmentation value, but the VNID itself defines and maintains the segment boundary.

Is a VNID an entity or just an identifier?

VNID is the 24-bit VXLAN Network Identifier — a segment ID rather than a device. In this question's wording, however, it is the component responsible for keeping Layer 2 segments isolated.

More 350-401 FAQ →

Discussion 27 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 27

  1. Rockford 👍 15
    A: VNID - VXLAN Network IDentifier.
  2. 074a077 👍 6 Answered C
    In Cisco VXLAN, the VXLAN Tunnel Endpoint (VTEP) is the key entity that maintains Layer 2 isolation by encapsulating/decapsulating traffic and using the VNI (VXLAN Network Identifier) to segment different Layer 2 domains, treating each VNI as a separate broadcast domain for traffic forwarding
  3. nightstalker 👍 5
    VNID is not an entity, is a technology (see also Question #85) the entity that enforces isolation based on the VNID is the VTEP
  4. kldoyle97 👍 4
    VXLAN (Virtual Extensible LAN) - The technology that provides the same Ethernet Layer 2 network services as VLAN does today, but with greater extensibility and flexibility. VNID (Vxlan Network Identifier) - 24 bit segment ID that defines the broadcast domain. Interchangeable with "VXLAN Segment ID". VTEP (Virtual Tunnel Endpoint) - This is the device that does the encapsulation and de-encapsulation. NVE (Network Virtual Interface) - Logical interface where the encapsulation and de-encapsulation occur.
  5. ShadyAbdekmalek 👍 4 Answered A
    A is correct : The 24-bit VNID is used to identify Layer 2 segments and to maintain Layer 2 isolation between the segments. With all 24 bits in VNID, VXLAN can support 16 million LAN segments. Source : https://www.ciscopress.com/articles/article.asp?p=2999385&seqNum=3#:~:text=The%2024%2Dbit%20VNID%20is,support%2016%20million%20LAN%20segments.
Show 22 more comments
  1. tumajay 👍 3 Answered D
    i asked chatgpt this question and initially gave the following answer: 'In a VXLAN (Virtual Extensible LAN) environment, the entity responsible for maintaining Layer 2 isolation between segments is the VNI (VXLAN Network Identifier). i now asked again "Is VNID an entity?" then chatgpt now replied with this "You're absolutely correct to point out that VNID (VXLAN Network Identifier) is not an "entity" but rather a logical construct or identifier. Let me refine the explanation: Clarified Answer: The entity responsible for maintaining Layer 2 isolation between segments in a VXLAN environment is the VXLAN Tunnel Endpoint (VTEP)." so we need to be careful with the way cisco choose their words. please note that i didn't give any options for chatgpt to choose from, I just asked the question. so i go with D
  2. Jcap 👍 2 Answered A
    In a VXLAN environment, the VXLAN Network Identifier (VNID) is a 24-bit segment ID used to identify individual Layer 2 broadcast domains. Much like a traditional VLAN ID, the VNID is the specific mechanism responsible for maintaining Layer 2 isolation between different segments, ensuring that traffic does not cross between different VXLAN overlay networks unless explicitly routed.
  3. achille5 👍 2 Answered A
    VNID - Defines the isolated Layer 2 segment VTEP - Maps VLAN ↔ VNID and forwards traffic Simple analogy: Think of it like shipping: VNID = tracking number (defines which package belongs to whom) VTEP = courier hub (reads label and routes correctly) The courier moves the package… but the label is what keeps shipments from getting mixed up.
  4. iwanta 👍 2 Answered A
    VNID = separation VTEP = encaps/decaps
  5. djedeen 👍 2 Answered C
    VTEP maintains the isolation
  6. chakspear 👍 2 Answered A
    It's VNID guys
  7. c728f00 👍 1 Answered A
    VTEP (VXLAN Tunnel Endpoint) and VNID (VXLAN Network Identifier) are both key concepts in a VXLAN-based network, but they serve very different purposes: VTEP: A device (physical switch or hypervisor-based virtual switch) that terminates the VXLAN tunnel. Performs encapsulation/decapsulation of Layer 2 Ethernet frames into/from VXLAN packets. Think of it as the “edge” of the VXLAN overlay network that connects end hosts to the VXLAN fabric. VNID: A 24-bit identifier (sometimes called a “segment ID”) carried in the VXLAN header. Logically separates traffic into different “broadcast domains” or “overlay segments” within the same VXLAN fabric. Roughly analogous to VLAN IDs, but with a much larger ID space (up to 16 million vs. 4094 VLANs).
  8. uhljeb 👍 1
    Unlike the VLAN ID, which has only 12 bits and allows for 4000 VLANs, VXLAN has a 24-bit VXLAN network identifier (VNI), which allows for up to 16 million VXLAN segments (more commonly known as overlay networks) to coexist within the same infrastructure. The VNI is located in the VXLAN shim header that encapsulates the original inner MAC frame originated by an endpoint. The VNI is used to provide segmentation for Layer 2 and Layer 3 traffic. Source: CCNP and CCIE Enterprise Core: ENCOR 350-401 Official Cert Guide
  9. Shri_Fcb10 👍 1
    The correct ans is VTEP. VNID is a unique identifier assigned to each VXLAN segment, but it is used for identification purposes rather than for enforcing isolation between segments.
  10. zbeugene7 👍 1 Answered C
    VNID is hardly an entity, its a tag, a name an ID that facilitates the overlay arcitecture , I wonder what is an answer to this question supposed to prove ? The answer is C
  11. AlfHer1991 👍 1 Answered C
    In a VXLAN environment, the VXLAN Tunnel Endpoint (VTEP) is the physical or virtual entity responsible for maintaining and enforcing Layer 2 isolation between segments
  12. tumajay 👍 1 Answered C
    Q85 clarifies the confusion. VNI is the technology (Q85 ) while VTEP is the entity - C is the correct answer
  13. Priscysamissone 👍 1
    The 24-bit VNID is used to identify Layer 2 segments and to maintain Layer 2 isolation between the segments.
  14. andyforreg 👍 1 Answered C
    VNID is not an entity. It's a technology. VTEP is the entity that uses the VNID to enforce isolation.
  15. ktha1427 👍 1 Answered A
    VNID= Segmentation VTEP = encapsulates and de-encapsulates VXLAN traffic
  16. Loi2525 👍 1 Answered B
    VTEP is the Entity that enforces the isolation using the VNI
  17. ciscolessons 👍 1 Answered A
    voting. provided answer is correct
  18. Delamorte 👍 1 Answered C
    Entity is something physical
  19. Poba 👍 1
    Correct answer is C. VTEP
  20. Hadakka 👍 1 Answered C
    i go for C_ VTEP
  21. techriese 👍 1 Answered A
    A is correct
  22. respectively 👍 1
    I agree

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What is a primary characteristic of traffic shaping?

S-grade

What is a Key Characteristic of Cisco vManage?

S-grade

What Is Achieved by This Python NETCONF XML Parsing Code?

S-grade

How to Configure VTY Lines for Idle Session Termination

S-grade

Practice All 350-401 Questions

Access 218 questions with complete answers and detailed explanations.

View Full 350-401 Practice Test →

← Back to 350-401 Study Guide