Ethernet inside GRE
NVGRE carries an Ethernet frame in GRE over IP. The outer IP header identifies the tunnel endpoints and indicates GRE with protocol number 47. The GRE Protocol Type value 0x6558 identifies the inner Ethernet frame. This encapsulation does not use UDP.
The upper 24 bits of the GRE Key hold the Virtual Subnet ID (VSID). The receiving endpoint uses it to select the virtual Layer 2 network. The lower eight bits are the FlowID, which can vary across flows within the same VSID to give the underlay more inputs for load distribution. If the sender does not generate a FlowID, those bits are zero.
The GRE Key does not advertise reachability
The VSID identifies the virtual subnet once a frame is encapsulated. An endpoint still needs a way to find the remote tunnel address for the inner destination. RFC 8365 describes how EVPN can provide reachability for an NVGRE overlay. The advertisement and the GRE packet serve different purposes.
Try it in a lab
- Inspect an NVGRE packet from a lab that supports it. Confirm that the outer IP identifies GRE, then locate the GRE Key and the Ethernet payload.
- Compare two flows in the same virtual subnet. The upper 24 bits of the Key should stay the same. The lower eight can differ if the endpoint generates FlowIDs.