Virtualization
This chapter covers device and network virtualization, including virtual machines versus containers, VRFs for path isolation, and tunneling technologies such as GRE. Virtualization lets one physical infrastructure host many logical networks and services.
Compute virtualization: VMs and containers
A virtual machine runs a full guest operating system on a hypervisor, providing strong isolation. A container shares the host OS kernel and packages only the application and its dependencies, making it lighter and faster to start. Both are used to host network functions and applications in modern infrastructures.
Network path isolation with VRF
Virtual Routing and Forwarding maintains multiple independent routing tables on the same device, so different VRFs stay logically separate and can even use overlapping address space. VRF-lite extends this segmentation across links, and MPLS VPNs extend it across a provider network. VRFs are a core tool for multitenancy and segmentation.
Tunneling with GRE
Generic Routing Encapsulation builds a point-to-point virtual link that can carry many passenger protocols across an IP network, but it provides no encryption or authentication by itself. When confidentiality is required, GRE is commonly combined with IPsec. Understanding what a tunnel does and does not secure is important for design.