But hopefully this makes sense.
Let's talk about overlay, underlay and fabrics.
So overlay networks go back a long way in time.
So the example I use when I spoke about the exam and I like that example is in the old days we had a
traditional telephone network, the intelligence was in the telephone network, so the public switched
telephone network that AT&T would have built or British Telecom would have built.
Here in the UK.
The phones were dumb.
They didn't even have dial tone without the network giving dial tone to the phone.
So the phones were essentially stupid.
But then that could revolutionized with voiceover IP.
Then suddenly we were using the internet as a dumb core, and I shouldn't say it's totally dumb, but
from a telephone switching point of view, it was dumb.
We were basically setting up calls across the Internet and the devices in the core Internet didn't understand
what the calls were doing.
They were just routing IP packets.
So I phoned you using Skype or WhatsApp today.
I phone you.
The Internet doesn't understand what we're doing.
I mean, WhatsApp calls are encrypted, so we're setting up a tunnel across the dumb central Internet.
So the intelligence is now in the endpoints rather than in the core network.
So notice the difference.
In the old days, intelligence was in the network, end devices were dumb.
That switched round.
Now core network is just high speed forwarding.
That's what the Internet should be doing.
High speed switching, routing of traffic intelligence is in the edge, not in the core.
So that was a whole industry that got revolutionized.
The PSTN public switch telephone network was intelligent, endpoints were dumb, intelligence was moved
to the edge to the endpoints, call became dumb.
All it was doing is high speed forwarding of traffic from A to B.
So if I made a call from the UK to the US, the core internet routers are just trying to move the traffic
as quickly as possible from the UK to the US.
They don't understand the call setup process.
I mean, WhatsApp again is setting up encrypted calls.
The telephone system in WhatsApp or in Skype is out of the control of the core Internet.
Okay, so that's great.
But in networking for many years, enterprise networking, it didn't work that way.
We would have say Cisco IP phones on a network and they would mark their traffic as important.
But then the network had the intelligence of saying, okay, this traffic is more important than that
traffic.
And then we try to implement all kinds of clever stuff on the network.
So the applications were still done, but the network was intelligent.
Notice where I'm going with this network was intelligent.
Applications were dumb from the point of view that a PC just sent traffic to its default gateway and
then the network took care of things.
Intelligence and the network endpoints were done.
VMware and others change this entirely.
So VMware purchased a company called Nazara.
This hero almost got bought by Cisco.
But in a data center, when we using iSCSI as an example from VMware, they said, okay, we don't need
an intelligent network.
We will put the intelligence in the iSCSI service in the service because the servers have visibility
of the applications running on them.
The server, iSCSI server has visibility of the VMs and the applications running on the server.
The network can't see the VMs like the iSCSI server can.
So rather than having an intelligent network, we make the network dumb, just like the internet.
It doesn't have visibility of the applications and the VMs on the ESXi server.
And what we do is we set up tunnels across the core network.
So you could have and it doesn't matter, it could be Cisco routers, could be HPE switches, it doesn't
matter.
Your core network is simply there to route as quickly as possible from one iSCSI server to another iSCSI
server.
And we build what they call here an overlay network.
So we have our IP network, traditional, say IP version four, and then we build a whole new network
on top of that called an overlay network.
This underlay network, the physical network doesn't understand what's going on because all it sees
is tunnels.
Think of WhatsApp, think of IPsec tunnels that you use across the Internet.
You can have the Internet and you build encrypted tunnels across the Internet that connect various sites
of your company.
So your company may have sites in the US and the UK, in Canada, in Japan, whatever.
You set up these VPNs across the Internet.
You would be very upset if the Internet routers could actually see inside your IP tunnel.
The whole idea of encryption is to hide the internal network information from the core Internet network.
Same principle here.
Now, we're not using typically encryption in a data center they use rather than IP seq tunnels or tunnels
they use VXLAN tunnels.
The whole idea of a VXLAN is think of a restriction in traditional switching.
We have a 2.1.
Q It's restricted to just over 4000 VLANs.
You can only have 4000 VLANs in a network now if you running big.
S Z service and you have lots of customers and then you have lots of departments for lots of customers
and they want a whole bunch of VLANs.
You run out of 4000 VLANs very, very quickly.
So VXLAN supports 16 million VLANs and I say VLANs because that concept no longer exists, 16 million
subnets rather than 4000 subnets in 82.1.
Q So in a traditional switching network, we would create up to 4000 VLANs.
That's how we would implement security, let's say, by restricting who can talk to who based on VLANs
or subnets.
But in a traditional switched environment, we kind of limited that doesn't scale to a data center.
So in a data center, they want to use this whole concept and let me go over it again just to make sure
that it's clear we have a core network could be Cisco routers, Cisco switches.
Now notice the politics.
Yeah, because VMware and Nazara basically changed the game.
The core network now doesn't have to be fancy because it's going to be like the internet.
I just need the core routers to route traffic from one ESXi server, so one VMware server to another
VMware server.
And just assume you've got a whole bunch of VMware servers.
These VMware servers will set up tunnels to each other automatically.
They're not encrypted, but it's the same concept.
They will set up a tunnel from one iSCSI server to another iSCSI server and they will use a totally
different subnet, totally different network.
Just like you, if you're setting up a VPN across the internet will use a different subnet, different
IP addresses to the core internet.
You can route all RFC 1918 addresses across the Internet.
Agreed if you use a tunnel.
So the outside IP address would be a public IP address when you're writing from one router to another
using an IPsec tunnel across the Internet.
But the inside IP addresses could be RFC 1918 addresses.
The core Internet doesn't see that data because it's encrypted.
So the whole idea in a data center is the core network could be very simple, basic subletting.
We don't need VLANs, we can run routing everywhere.
So this solved another problem because let's say we want to have a VM on one iSCSI server and another
VM on another iSCSI server, but we want them in the same VLAN, same VLAN, same broadcast domain.
They must be layer two connection between these two VMs that are in different servers.
Now you might say, why would you want to do that?
Now think about the motion.
The motion is something that allows you to move a VM automatically, if you want, from one physical
iSCSI server to another iSCSI server.
So when the load on the server gets too high, it can automatically migrate the VM to another iSCSI
server to use resources on this iSCSI server.
But the problem is you've now moved the VM from one server to another server, but you want to keep
them in the same VLAN.
So what happens if I move it to that server over there using the motion across a network?
Now traditionally we would have to run layer two across this because that VM and this VM are in the
same subnet.
So we need to have a layer two connection across.
But with this overlay network and this concept of doing away with a clever core, the core network can
run routing protocols.
So we don't need spanning tree, we just run OSPF everywhere as an example.
So it's a layer three network, but this VM running on this ESX server and this VM running on this ESXi
server can be in the same subnet because they are connected across a tunnel.
So this PC could have an IP address of ten one one to this piece.
You could have an IP address of ten 111 slash 24.
Let's say when a broadcast is sent by this PC, it goes into the tunnel, sent across the tunnel to
that PC.
On the other side, it gets complicated with broadcasts and multicast, but just think of the concept
that these two devices are in the same VLAN when in actual fact they are not same VLAN because this
infrastructure is routed.
So we are basically pulling a cable logically from that VM on that ESXi server to this VM on this ESXi
server.
So logically, you've got an Ethernet cable from one side to the other, but it's just a tunnel created
using VXLAN.
Now I went into a lot of detail here.
Let me just summarize overlay network is a network that's built on top of an underlay network, underlay
network of physical devices, which could be Cisco routers and switches iSCSI so from VMware will bold
and it's actually NSX it's not iSCSI it's NSX is the product that does this.
NSX will build a whole new network, an overlay network across the underlay network.
This underlay network doesn't understand what's going on with this overlay network.
As an analogy, again, think of this underlay as the internet and the overlay network.
Your VPN tunnels going across the Internet.
The core routers don't have visibility of the traffic that you encrypting through your IPsec tunnels.
The core Cisco routers and switches in a data center don't have visibility of the VM traffic going through
a VXLAN tunnel.
All they see is this ESXi server wants to talk to this iSCSI server or this iSCSI server wants to talk
to that year SCSI server.
They don't understand that it's actually a VM running within the CSC server that's talking to VM within
that ESXi server.
So we basically tunneling traffic across.
Now I'm going to add some videos from my NSX and overlays course.
There are other vendors that also do this.
Again, it's optional.
So if you want to watch that stuff, then feel free to see this more practically.
I've been dealing with this stuff for a long time, but it's now great to see that it's coming to the
CCNA.