Generic Network Virtualization Encapsulation (GENEVE) is an encapsulation protocol standardized in RFC 8926. It wraps an original payload in a GENEVE header, UDP header, and outer IP header so that an underlying network can transport it between tunnel endpoints. The standard destination port is UDP 6081. The outer addresses identify the tunnel endpoints, while the encapsulated packet retains the addressing information that an appliance or destination needs to process the original traffic.
GENEVE provides a common encapsulation format rather than a complete network virtualization system. Its header includes a 24-bit virtual network identifier and supports variable-length options for metadata. Those options allow implementations to carry additional context without defining a different tunnel protocol for every requirement. However, tunnel endpoints must support the particular payload format and options in use; supporting generic GENEVE does not automatically make an appliance compatible with every cloud implementation.
A practical cloud application is transparent security inspection. Instead of configuring each application to use a proxy, routing directs traffic through an inspection path. A load-balancing component encapsulates packets and distributes them to compatible firewall or intrusion-prevention appliances. Each appliance decapsulates the traffic, applies its policy, and returns permitted traffic using the required encapsulation. This approach allows the appliance fleet to scale independently of the applications it protects.
In AWS, Gateway Load Balancer uses GENEVE on UDP port 6081 to exchange traffic with registered appliances. Its target groups use the GENEVE protocol and port 6081, rather than a TCP target-group protocol. Target type is a separate setting: instance targets are registered by instance ID, while IP targets are registered by IP address. Selecting IP targets does not change the encapsulation protocol, and selecting GENEVE does not mean the original application traffic must use UDP. An encapsulated packet can contain a TCP connection or other supported IP traffic.
For example, an organization can route application-subnet internet traffic through a Gateway Load Balancer endpoint to a fleet of firewalls. The firewalls must implement the AWS-specific GENEVE integration, not merely accept ordinary TCP connections. Appliance security controls must permit UDP 6081 from the appropriate load-balancer infrastructure, plus the separately configured health-check traffic. Gateway Load Balancer health checks use TCP, HTTP, or HTTPS; they are not GENEVE health checks. A healthy management listener alone does not prove that the inspection data path works.
Encapsulation introduces overhead and operational complexity. Account for outer headers and metadata when validating maximum transmission unit, fragmentation behavior, and appliance throughput. Packet captures on the underlay show outer tunnel traffic, so troubleshooting may require decoding GENEVE to inspect the original flow. GENEVE itself does not provide encryption or peer authentication; isolation and confidentiality require additional controls where necessary.
Finally, GENEVE does not by itself provide high availability, balanced traffic distribution, routing symmetry, or firewall state replication. Those depend on the surrounding service and architecture. Deploy appliances across failure domains, validate forward and return routing, and test failure behavior with established connections. Moving a flow to a healthy appliance can still interrupt a session if that appliance lacks the original connection state.
Amazon EC2
Amazon VPC