City operators tag VLAN 40 on a VDS port group and treat that as identical to an NSX overlay segment. How should those two constructs be distinguished?
Select an answer to reveal the explanation.
Short Explanation
A VLAN tag is paint on the street; an overlay segment is a tunnel under the street. VLAN 40 on a VDS port group is 802.1Q on the wire. An NSX overlay segment uses Geneve and is not “just another VLAN ID.”
Full Explanation
City operators who treat VLAN 40 on a VDS port group as identical to an NSX overlay segment are collapsing two different Layer-2 models. A VLAN-backed VDS port group tags 802.1Q on the physical wire; an NSX overlay segment uses Geneve encapsulation between tunnel endpoints and is not merely another VLAN ID with a different display name. In civic terms, a VLAN tag is paint on the street, while an overlay segment is a tunnel under the street—both can connect VMs, but they are not the same construct. Claiming both constructs are the same VLAN ID on the VDS with different names is false. An overlay segment is not only a vSphere Standard Switch whose MTU was raised; raising MTU does not create Geneve overlay. VLAN tagging on a port group is also not an NSX Distributed Firewall policy—tagging separates broadcast domains on the wire, while DFW enforces allow or deny decisions at the vNIC. Exam caveat: NSX also has VLAN-backed segments; those still map to underlay VLANs and must not be confused with Geneve overlay segments. Associate depth is distinguishing 802.1Q port-group tagging from Geneve overlay, not memorizing every Geneve field. Operational check: for a VLAN 40 port group, verify the ToR trunk allows VLAN 40 and that frames leave tagged; for an overlay segment, verify TEPs, transport zone, and Geneve encapsulation between hosts rather than expecting VLAN 40 alone to define the overlay.