A city security board asks whether enabling VXLAN by itself encrypts tenant traffic across the fabric. What is the accurate data-plane security statement?
Select an answer to reveal the explanation.
Short Explanation
Wrapping a postcard in a bigger envelope doesn’t lock it—anyone who opens the truck can still read it. VXLAN is encapsulation, not a cipher. If the city needs confidentiality, add real crypto (IPsec, MACsec, or another approved layer)—don’t assume the VNI is a padlock.
Full Explanation
VXLAN provides multi-tenancy segmentation identifiers and tunneling, but the encapsulated payload is not confidential by virtue of VXLAN alone. Security teams must apply separate mechanisms such as MACsec on links, IPsec, or other approved encryption when policy requires confidentiality. Confusing segmentation with encryption leads to false assurance in municipal risk reviews. Design documents should state clearly that VXLAN ≠ encryption.