You can allow L4 or L7 services to perform an inspection against the inner ethernet frame. VXLAN is one of the supported protocols and is designed to accommodate most overlay or underlay protocols which require inner inspection. VXLAN traffic is only inspected if there is a security policy configured to perform the inspection.