Unlike Wireless Local Area Network (Wi‑Fi) and Wireless Wide Area Network (4G/5G), the iMAX wireless metropolitan private network supports richer and more practical network technologies. Built upon high‑bandwidth, high‑reliability, ultra‑long‑distance wireless transmission architecture, the iMAX wireless MAN is widely deployed for campus security, port dispatching, emergency command, mine monitoring and other scenarios. Thanks to its high bandwidth and large capacity, it can concurrently carry multiple services including video surveillance, remote control and voice intercom.

For multi‑service converged “multi‑network‑in‑one” scenarios, security isolation technologies are mandatory to satisfy network isolation requirements for mixed transmission of diverse services (video, control, etc.). VLAN (Virtual Local Area Network) and VXLAN (Virtual Extensible LAN) are the most typical representatives.

VLAN is the core virtual isolation technology operating at Layer 2 of the OSI model. VXLAN, by contrast, is a Layer‑2 overlay tunnel technology running over an IP‑based Layer‑3 underlay network. The iMAX system natively supports IEEE 802.1Q VLAN, QinQ and VXLAN, which resolve challenges such as service isolation and cross‑region private network interconnection and play a vital role in stable and secure operation of wireless metropolitan area networks. Centered on VXLAN, this paper elaborates on technical principles, values, advantages, security and management aspects.

I. Basic Principles and Advantages of VLAN and VXLAN

1. Brief Introduction to VLAN (Virtual Local Area Network)

Complying with the IEEE 802.1Q standard, VLAN divides a physical network into multiple independent logical broadcast domains by adding a 4‑byte VID tag to Ethernet frames on shared physical switches and wireless gateways.

VLAN Port Types

Core Benefits of VLAN

• Low‑cost multi‑service bearing: Multiple services run on one set of hardware without deploying separate physical (wired/wireless) private networks.
• Reduced broadcast domains: Suppress broadcast storms and prevent network‑wide outages triggered by single‑point failures. For wireless private networks, VLAN also reduces air‑interface bandwidth consumption of iMAX radios and lowers network latency.
• Access isolation: Traffic of different VIDs are Layer‑2 isolated by default, forming native basic security boundaries to enhance network security.
• Fine‑grained QoS scheduling: Bandwidth priorities can be assigned per VLAN in multi‑service mixed networking, enabling preferential forwarding for video streams and control commands.

2. Brief Introduction to VXLAN (Virtual Extensible Local Area Network)

VXLAN is a network virtualization technology. It establishes Layer‑2 tunnels over Layer‑3 IP networks to realize cross‑geography VM interconnection and large Layer‑2 network extension, primarily addressing the shortage of network identifiers imposed by traditional VLANs in large‑scale cloud computing data centers.

The VXLAN frame structure is shown below:

VXLAN is a MAC‑in‑UDP tunneling technique. Its key component is the VTEP (VXLAN Tunnel Endpoint), which can be implemented by iMAX wireless gateways or core switches. It constructs a virtual large Layer‑2 network atop a Layer‑3 IP infrastructure and uses 24‑bit VNI to identify isolation domains. Compared with the VLAN limit of merely 4094 IDs, VXLAN supports up to 16.77 million independent virtual networks.

VXLAN Encapsulation‑Decapsulation Workflow

1. Original inner Layer‑2 frames arrive at the local VTEP.
2. The VTEP appends outer VXLAN header, UDP header (standard port 4789) and IP header, encapsulating Layer‑2 data into Layer‑3 IP packets.
3. Encapsulated packets traverse the iMAX wireless metropolitan private network via Layer‑3 routing for cross‑region transmission.
4. The remote VTEP performs decapsulation to restore original Layer‑2 frames and forwards them to target end‑devices, which remain completely unaware of underlying cross‑Layer‑3 transmission.

Major Advantages of VXLAN over VLAN

• Vast identifier pool: Eliminates the 4094‑ID bottleneck of VLAN, suitable for large‑scale wireless metropolitan private networks covering multiple plants and diverse services.
• Layer‑2 communication across Layer‑3 boundaries: iMAX wireless nodes spread across different plants and IP subnets can belong to the same virtual Layer‑2 segment without modifying end‑device IP addresses. This delivers great convenience for use‑cases such as autonomous vehicle roaming within port areas.
• IP address reuse: Identical IP subnets can be deployed in different service zones with isolation enforced solely by VNI, greatly lowering network‑planning complexity.
• Elastic networking expansion: New plants or radio base‑stations can be onboarded by adding VXLAN tunnels without re‑engineering underlying routing.

3. Complement and Comparison between VLAN and VXLAN

VLAN provides service isolation for local wireless access within a single zone. Lightweight and high‑performance, it fits small‑size, simple‑topology networks.

VXLAN enables large‑scale Layer‑2 connectivity across plants and Layer‑3 routed domains, overcoming VLAN limitations in long‑haul cross‑Layer‑3 interworking and scarce ID resources.

iMAX wireless metropolitan private networks can adopt VLAN‑only, VXLAN‑only or hybrid deployments to satisfy diverse networking requirements and resolve various network challenges.

II. Deployment of VLAN and VXLAN in iMAX Wireless Metropolitan System

Most commercial wireless APs and wireless bridges (compliant with IEEE 802.11a/b/g/n/ac/ax) only perform raw data pass‑through. They lack support for basic VLAN features, let alone VXLAN.

For wireless systems, VXLAN support is conditional upon routing‑protocol capability (RIP / OSPF / BGP, etc.). The iMAX private network natively implements routing together with VLAN and VXLAN — a key differentiator from ordinary wireless bridges.

For further information on why routing matters and which routing protocols are supported in iMAX private networks, please refer to the article How Significant Is Routing‑Protocol Support for Wireless Systems?.

Thanks to built‑in VLAN and VXLAN capabilities, iMAX wireless private networks demonstrate prominent strengths in real‑world deployments, especially multi‑service convergence, parallel service isolation, high‑security government‑enterprise applications and fault mitigation. Key technical merits are summarized below.

1. Optimized Utilization of Wireless Air‑Interface Bandwidth

Wireless spectrum is a scarce resource; broadcast packets consume substantial air‑interface capacity. VLAN partitions broadcast domains so broadcast frames are forwarded only inside each respective virtual LAN. VXLAN tunnels implement ARP proxy for cross‑area broadcast traffic, mitigating frame flooding over wireless links, reducing packet loss and latency and guaranteeing stable delivery for industrial control and real‑time video streams.

2. Reduced Hardware Investment and Lower Network Complexity

The iMAX wireless metropolitan system natively supports VLAN, QinQ double‑tagged VLAN and VXLAN tunnel encapsulation. Extra managed VLAN switches and similar hardware are not mandatory, cutting user‑side capital expenditure and network complexity.

Under VXLAN deployment, VNI mapping can be centrally configured via the web‑based network‑management system. Tags are transparently carried over wireless links. VXLAN interoperates with other networking technologies including MLDM (Multi‑Link Data Mirroring), VRRP redundant hot‑standby and RSTP link backup.

3. Unified Networking for Distributed Base Stations

Take an iMAX‑based factory deployment as an example: one service such as video surveillance is distributed across factory premises, warehouses, checkpoints and dispatching centers with independent underlying IP subnets at each site. By establishing VXLAN tunnels, cameras, PLC controllers and peer devices at geographically dispersed locations can reside within the same virtual Layer‑2 domain without IP‑address reconfiguration (to avoid IP conflicts), simplifying field installation and commissioning.

4. Parallel Bearing of Multiple Services and Multiple Users

A single iMAX wireless metropolitan private network can host multiple service‑specific VLANs simultaneously, e.g. industrial‑control VLAN, security‑video VLAN and office‑intranet VLAN. VLAN handles isolation for small‑scale deployments, while VXLAN differentiates tenants across multi‑campus large‑scale projects, ensuring full isolation and non‑interference among distinct services.

5. Partial Network‑Fault Containment

If a broadcast storm originates within one subnet under VXLAN deployment, the failure only impacts its corresponding VID/VNI logical domain instead of propagating to other services across the whole network, preventing full‑system collapse and improving reliability for industrial environments.

III. Significance of VLAN and VXLAN for Network Security and Administration

VLAN and VXLAN play an important role in enhancing network security and facilitating network operation & maintenance (O&M).

1. Network‑Security Perspective: Building Multi‑Layer Isolation Defenses

In large unsegmented networks, any guest terminal gaining Layer‑2 access can potentially reach industrial controllers and servers, giving rise to risks of data theft and command tampering.

• Hard local‑service isolation by VLAN: Control network, video network and office network are assigned separate VIDs with Layer‑2 interconnection blocked by default. Cross‑domain access must traverse gateway firewalls; ACL whitelists/blacklists can be deployed to block unauthorized access.
• Cross‑site isolation by VXLAN: VNI domains are independent for different factory sites. Even if overlapping underlying IP subnets exist at two ends, virtual networks remain completely isolated. Malicious external traffic cannot penetrate VXLAN tunnels to reach internal services. iMAX devices support tunnel packet validation to drop forged VXLAN attack packets.
• Restricted attack blast radius and mitigated wireless risks: iMAX wireless metropolitan private networks employ proprietary transmission protocols, greatly lowering risks of radio eavesdropping and unauthorized access. After VLAN partitioning, rogue access devices are confined to isolated guest VLANs and cannot touch mission‑critical production or dispatching services. Should one service suffer DoS or broadcast‑storm attacks, the disturbance stays within its virtual domain and does not exhaust overall wireless bandwidth, keeping key services online.
• Independent transmission for sensitive data to satisfy cybersecurity compliance requirements: Private networks deployed in mines, chemical parks and public‑safety emergency scenarios carry sensitive payloads such as classified video feeds and equipment control commands. Dedicated VLANs and isolated VXLAN tunnels can be provisioned together with tailored wireless‑encryption and traffic‑auditing policies, fulfilling the mandatory “service‑zone isolation” requirement specified in Cybersecurity Classified Protection standards.

2. O&M Perspective: Streamlined Network Control and Lower Troubleshooting Costs

• Hierarchical service management with granular permissions: Administrators can segregate privileges by VLAN. Security staff manage only surveillance VLANs, equipment‑maintenance personnel access only industrial‑control VLANs, and office administrators maintain intranet VLANs, implementing the principle of least privilege. Through centralized network management, mass configuration and monitoring of homogeneous end‑devices across multiple plants can be performed per VNI without logging‑on to dispersed wireless hardware individually.
• Precise fault localization shortening wireless troubleshooting cycles: When stalling or frame drops occur in an unsegmented wireless MAN, mixed aggregated traffic obscures fault origins. With VLAN/VXLAN deployed, traffic can be filtered by VID and VNI for rapid fault‑source identification. If the surveillance VLAN experiences degradation, inspect only cameras and video‑oriented wireless links; for control‑network anomalies, examine radio‑signal quality and tunnel status of PLC‑associated VLANs. The management system can capture packets filtered to specific VLAN/VNI, excluding irrelevant background traffic and drastically reducing field‑inspection workload for outdoor base‑stations.
• Fine‑grained bandwidth and traffic governance optimizing wireless resources: Given limited iMAX air‑interface capacity, QoS priorities can be bound to VLANs. For instance, emergency‑dispatching and industrial‑control VLANs receive highest priority whereas guest networks get lowest priority; core services are preferentially serviced during bandwidth congestion. VNI‑based traffic statistics report aggregate throughput for each plant, giving visibility into regional wireless load to guide proactive base‑station capacity expansion.
• Zero‑touch network expansion and retrofitting lowering O&M overhead: New workshops or checkpoints are onboarded by creating corresponding VLANs and connecting to nearby iMAX radio base‑stations. New factory campuses are added by instantiating additional VXLAN tunnels; existing end‑device IP addresses and service configurations remain unchanged with no full‑network routing re‑planning required.
• Standardized O&M across the whole network with unified configuration templates: The iMAX management system supports bulk push of VLAN/VXLAN configuration templates to all wireless MAN nodes. Service IDs for control, video, office and guest services are standardized. New sites directly apply templates to minimize human‑configuration errors and simplify unified multi‑project operation.

Compared with VLAN, VXLAN covers broader use‑cases and addresses networking challenges that traditional VLAN cannot resolve.

IV. Typical Application Scenarios of VXLAN

VLAN is widely adopted in local‑area‑network configurations and will not be exemplified herein. VXLAN is a relatively newer technology with high promotion value. Its representative use‑cases are described below.

1. Layer‑3 Infrastructure Carrying Layer‑2 Services: Unified IP Subnet for Front‑end and Back‑end with Ring‑Routing Intermediate Transport

Take a typical iMAX‑8000AI‑series wireless metropolitan private‑network deployment as an example. Two Base‑Stations (BS) plus multiple dual‑mode wireless CPE clients construct a highly‑reliable wireless ring‑routing private network. Dual links leverage VRRP virtual hot‑standby routing and MLDM multi‑link data mirroring to meet roaming, redundancy and load‑balancing requirements.

By building Layer‑2 tunnels atop Layer‑3 IP networks, VXLAN places front‑end data acquisition and back‑end data analytics within a common Layer‑2 broadcast domain. Multicast traffic can therefore be transported over Layer‑3 infrastructure, solving incompatibility issues for certain protocols such as Profinet deployed on PLCs. In short, VXLAN readily overcomes deployment obstacles that prevent traditional VLAN from running across Layer‑3 boundaries.

Schematic Diagram of VXLAN Technology Application for Typical iMAX Private Network Networking：

In this wireless‑networking setup, two iMAX base‑stations are deployed at the command center to deliver overlapping radio coverage over target zones. On the mobile front‑end side, each host is fitted with one dual‑mode wireless CPE. Leveraging iMAX wireless‑MAN ring‑routing redundancy, both wireless links operate concurrently and perform load‑balancing on demand (routing services according to priority and traffic volume).

It is well‑known that Layer 2 (Data‑Link Layer) of the OSI TCP/IP stack cannot tolerate network loops without special loop‑breaking mechanisms such as STP (Spanning Tree Protocol). Ring topologies nevertheless deliver superior reliability compared with tree‑shaped architectures.

Layer 3 (Network Layer) is routing‑driven. For reliability purposes, Layer‑3 networks are commonly built as rings. Unfortunately, VLAN — the prevailing Layer‑2 technology — cannot span Layer‑3 boundaries, a limitation elegantly solved by VXLAN.

Layer‑3 routing also isolates broadcast domains and mitigates risks introduced by large flat Layer‑2 networks (broadcast storms, ARP flooding, MAC‑address‑table overflow, wide‑spread fault propagation, etc.). Layer‑3 segmentation truncates broadcast packets at gateways, containing broadcasts and faults within subnets, alleviating switch‑processing pressure and facilitating inter‑subnet security governance. VXLAN achieves effective trade‑offs for hybrid Layer‑2 / Layer‑3 networking.

It should be emphasized that Guoxin Loongson ring‑routing solutions employ multiple technologies (RSTP / VRRP / MLDM, etc.). Regardless of which ring‑routing technique is used on transport links, VXLAN tunnels can make front‑end data‑acquisition devices and back‑end centralized‑control equipment reside inside the same Layer‑2 network.

2. Cloud‑Service Scenarios: Seamless VM Live Migration for Flexible Data‑Center Scaling; Multi‑tenant Isolation for Public Clouds to Serve Mass Users on Shared Physical Infrastructure; Cross‑Data‑Center Interconnection for Robust Dual‑Site‑Three‑Data‑Center Architectures

VXLAN is highly capable and sees its widest adoption within cloud‑service ecosystems. Representative use‑cases include:

• Seamless virtual‑machine live migration enabling flexible data‑center expansion: Servers operated by enterprises and cloud providers run virtualization platforms. One physical server can host multiple virtual machines for different business workloads.
  • Multi‑tenant isolation for public clouds to serve massive tenants on shared hardware: This is the technical foundation for VPC private networks on public clouds such as Alibaba Cloud and Tencent Cloud. Cloud operators build one unified physical fabric and provision isolated virtual LANs for each tenant via VXLAN. Even when tenants’ servers, databases and storage share physical hosts or reside in the same data‑center hall, they remain logically isolated without mutual access, guaranteeing secure and independent tenant data at network level. This constitutes core technical enabler for multi‑tenant cloud platforms.
  • Cross‑data‑center remote networking to implement resilient dual‑site‑three‑data‑center architectures: Large enterprises, financial institutions and internet operators build multi‑site redundancy to guard against service outages caused by fire, earthquake, power failure and other disasters, which is commonly known as the dual‑site‑three‑data‑center architecture, distributing workloads and data across geographically‑separated facilities.

  VXLAN builds virtual Layer‑2 tunnels across data‑centers running over standard carrier Layer‑3 IP private lines or internet links. It satisfies requirements for same‑subnet communication and data synchronization among geographically‑dispersed equipment while confining failures within underlying Layer‑3 domains to avoid network‑wide fault spreading, securely realizing multi‑data‑center interconnection.

  With native VXLAN support, the iMAX wireless metropolitan private‑network system addresses complex networking challenges for government and enterprise customers that many competing wireless systems cannot or can hardly handle. Native feature support eliminates third‑party Layer‑3‑switch procurement costs in certain scenarios and improves overall network security, reliability and cost‑effectiveness.

  V. Conclusion

  Traditional networks face a classic dilemma: Layer‑2 networks offer flexibility and ease of service mobility yet suffer oversized broadcast domains prone to full‑network collapse. Layer‑3 networks deliver stability, fault containment and stronger security but lack flexibility; device cross‑region movement requires network disconnection and IP‑address reconfiguration.

  VXLAN resolves this contradiction perfectly: stable Layer‑3 physical infrastructure forms the underlay, while virtual tunnels construct agile logical Layer‑2 overlays. In simple terms, the physical deployment adopts robust Layer‑3 architecture, yet end‑devices communicate and migrate freely as if they belonged to one single LAN, with traditional large‑Layer‑2 hazards including broadcast storms and cascading faults fully avoided.

  Comprehensive VLAN and VXLAN support equips the iMAX wireless metropolitan private network with versatile networking capabilities for greater agility, efficiency, security and stability.

  From the security perspective, virtual Layer‑2 networks establish horizontal isolation barriers, shrink attack surfaces, protect mission‑critical industrial and security data and satisfy industry compliance criteria.

  From the O&M perspective, service‑zone governance, fast fault‑location and elastic network expansion are realized, substantially reducing administration complexity for outdoor wireless metropolitan private networks.

  For large‑scale iMAX wireless‑MAN projects covering factory campuses, ports and mines, VLAN and VXLAN are optional technical measures to guarantee secure‑stable network operation and cut O&M expenditure. They represent important technical differentiators that grant iMAX wireless‑MAN superior availability, reliability and security compared with ordinary Wi‑Fi WLANs.

  Besides VXLAN‑based isolation for iMAX private‑networks, firewalls constitute another optimal solution for service segregation. Please refer to the article Introduction to Firewall Technology in iMAX Wireless Systems.

  For practical deployment and configuration guidance for VLAN and VXLAN, please contact the Technical Department of Guoxin Loongson. We will customize optimal configuration schemes according to your requirements. Inquiries are welcome.