Table of Contents

1 QinQ Configuration· 1-1

Introduction to QinQ·· 1-1

Background· 1-1

QinQ Mechanism and Benefits· 1-1

QinQ Frame Structure· 1-2

Implementations of QinQ·· 1-3

Modification of TPID Value of QinQ Frames· 1-3

Configuring Basic QinQ·· 1-4

Configuring Selective QinQ·· 1-5

Configuring MAC Address Synchronization· 1-6

Configuring the TPID to Be Used in the Outer Tag· 1-7

QinQ Configuration Example· 1-7

 

When configuring QinQ, go to these sections for information you are interested in:

l          Introduction to QinQ

l          Configuring Basic QinQ

l          Configuring Selective QinQ

l          Configuring MAC Address Synchronization

l          Configuring the TPID to Be Used in the Outer Tag

l          QinQ Configuration Example

Introduction to QinQ

Background

In the VLAN tag field defined in IEEE 802.1Q, only 12 bits are used for VLAN IDs, so a device can support a maximum of 4094 VLANs. In actual applications, however, a large number of VLANs are required to isolate users, especially in metropolitan area networks (MANs), and 4094 VLANs are far from satisfying such requirements.

QinQ Mechanism and Benefits

The QinQ feature is a flexible, easy-to-implement Layer 2 VPN technique. It enables the edge device on the service provider network to encapsulate an outer VLAN tag in Ethernet frames from customer networks (private networks), so that the Ethernet frames will travel across the service provider network (public network) with double VLAN tags.

The devices in the public network forward a frame only according to its outer VLAN tag and learn its source MAC address into the MAC address table of the outer VLAN. The inner VLAN tag of the frame is transmitted as the payload.

QinQ enables a service provider to use a single SVLAN to serve customers who have multiple CVLANs. As shown in Figure 1-1, customer network A has CVLANs 1 through 10, while customer network B has CVLANs 1 through 20. The SVLAN allocated by the service provider for customer network A is SVLAN 3, and that for customer network B is SVLAN 4. When a tagged Ethernet frame of customer network A enters the service provider network, it is tagged with outer VLAN 3; when a tagged Ethernet frame of customer network B enters the service provider network, it is tagged with outer VLAN 4. In this way, there is no overlap of VLAN IDs among customers, and traffic from different customers does not become mixed.

Figure 1-1 Schematic diagram of the QinQ feature

 

By tagging tagged frames, QinQ expands the available VLAN space from 4094 to 4094 × 4094 and thus satisfies the requirement for VLAN space in MAN. It mainly addresses the following issues:

l          Releases the stress on the SVLAN resource.

l          Enables customers to plan their CVLANs without conflicting with SVLANs.

l          Provides an easy-to-implement Layer 2 VPN solution for small-sized MANs or intranets.

QinQ Frame Structure

A QinQ frame is transmitted double-tagged over the service provider network. The inner VLAN tag is the CVLAN tag while the outer one is the SVLAN tag that the service provider has allocated to the customer. Figure 1-2 shows the structure of single-tagged and double-tagged Ethernet frames.

Figure 1-2 Single-tagged frame structure vs. double-tagged Ethernet frame structure

 

Implementations of QinQ

There are two types of QinQ implementations: basic QinQ and selective QinQ.

1)        Basic QinQ

Basic QinQ is a port-based feature, which is implemented through VLAN VPN.

With the VLAN VPN feature enabled on a port, when a frame arrives at the port, the switch will tag it with the port’s default VLAN tag, regardless of whether the frame is tagged or untagged. If the received frame is already tagged, this frame becomes a double-tagged frame; if it is an untagged frame, it is tagged with the port’s default VLAN tag.

2)        Selective QinQ

Selective QinQ is a more flexible, VLAN-based implementation of QinQ. In addition to all the functions of basic QinQ, selective QinQ can tag the frame with different outer VLAN tags based on different inner VLAN IDs.

Modification of TPID Value of QinQ Frames

A VLAN tag uses the tag protocol identifier (TPID) field to identify the protocol type of the tag. The value of this field, as defined in IEEE 802.1Q, is 0x8100.

Figure 1-3 sows the 802.1Q-defined tag structure of an Ethernet frame.

Figure 1-3 VLAN Tag structure of an Ethernet frame

 

The device determines whether a received frame carries a SVLAN tag or a CVLAN tag by checking the corresponding TPID value. Upon receiving a frame, the device compares the configured TPID value with the value of the TPID field in the frame. If the two match, the devices considers that the frame carries the corresponding VLAN tag. For example, if a frame carries a SVLAN tag with the TPID value 0x9100 and a CVLAN tag with the TPID value 0x8100 while the configured TPID value of the SVLAN tag is 0x9100 and that of the CVLAN tag is 0x8200, the device considers that the frame carries only the SVLAN tag but not the CVLAN tag.

In addition, the systems of different vendors may set the TPID of the outer VLAN tag of QinQ frames to different values. For compatibility with these systems, you can modify the TPID value so that the QinQ frames, when sent to the public network, carry the TPID value identical to the value of a particular vendor to allow interoperability with the devices of that vendor.

The TPID in an Ethernet frame has the same position with the protocol type field in a frame without a VLAN tag. To avoid problems in packet forwarding and handling in the network, you cannot set the TPID value to any of the values in the table below.

Table 1-1 Reserved protocol type values

Protocol type	Value
ARP	0x0806
PUP	0x0200
RARP	0x8035
IP	0x0800
IPv6	0x86DD
PPPoE	0x8863/0x8864
MPLS	0x8847/0x8848
IPX/SPX	0x8137
IS-IS	0x8000
LACP	0x8809
802.1x	0x888E
Cluster	0x88A7
Reserved	0xFFFD/0xFFFE/0xFFFF

 

Configuring Basic QinQ

Follow these steps to configure basic QinQ:

To do...		Use the command...	Remarks
Enter system view		system-view	—
Enter Ethernet port view or port group view	Enter Ethernet port view	interface interface-type interface-number	Required Use either command. Configurations made in Ethernet port view will take effect on the current port only; configuration made in port group view will take effect on all ports in the port group.
	Enter interface group view	port-group { manual port-group-name | aggregation agg-id }
Enable QinQ on the port(s)		qinq enable	Required Disabled by default.

 

 

Configuring Selective QinQ

The outer VLAN tag added to a frame by the basic QinQ feature is the VLAN tag corresponding to the port’s default VLAN ID, while the selective QinQ feature allows adding different outer VLAN tags based on different inner VLAN tags.

With selective QinQ configured on a port, the device will add different outer VLAN tags based on the inner VLAN tags; frames with a VLAN ID out of the range specified in the raw-vlan-id inbound command will be forwarded unchanged.

 

 

Follow these steps to configure selective QinQ:

To do...		Use the command...	Remarks
Enter system view		system-view	—
Enter Ethernet port view or port group view	Enter Ethernet port view	interface interface-type interface-number	Required Use either command. Configurations made in Ethernet port view will take effect on the current port only; configurations made in port group view will take effect on all ports in the port group.
	Enter interface group view	port-group { manual port-group-name | aggregation agg-id }
Enter QinQ view and configure the outer VLAN tag for the port to add		qinq vid vlan-id	Required
Configure inner VLAN tags corresponding to the outer VLAN tags		raw-vlan-id inbound { all | vlan-id-list }	Required

 

 

Configuring MAC Address Synchronization

When a selective QinQ-enabled port receives a packet, it learns the source MAC address of the packet, stores the MAC address in the MAC address table of the inner VLAN of the packet, tags the packet with an outer VLAN tag, and then sends the packet to the uplink port for transmission. When the returned packet arrives at the uplink port, the switch searches the MAC address table of the outer VLAN for the packet’s downlink MAC address but can find none. As a result, the switch will broadcast the packet in the outer VLAN. This not only consumes bandwidth resources but also brings about security risks in the network.

To address the problem, the S3610&S5510 series provide the MAC address synchronization function to synchronize MAC address entries between inner and outer VLANs. By performing inner-to-outer synchronization on the downlink port and outer-to-inner synchronization on the uplink port, the switch can unicast rather than broadcast the packet returning to the uplink port.

Follow these steps to configure MAC address synchronization:

To do...	Use the command...	Remarks
Enter system view	system-view	—
Enter Ethernet port view	interface interface-type interface-number	—
Configure MAC address synchronization	mac-mirroring index src-vlan source-vlan-list dest-vlan destination-vlan-id	Required Disabled by default
	mac-mirroring index src-vlan source-vlan-id dest-vlan destination-vlan-list

 

 

Configuring the TPID to Be Used in the Outer Tag

Follow these steps to configure the TPID value a port or a group of ports:

To do...		Use the command...	Remarks
Enter system view		system-view	—
Enter Ethernet port view or port group view	Enter Ethernet port view	interface interface-type interface-number	Required Use either command. Configurations made in Ethernet port view will take effect on the current port only; configurations made in port group view will take effect on all ports in the port group.
	Enter interface group view	port-group { manual port-group-name | aggregation agg-id }
Configure the TPID value to be used in the outer tag		qinq ethernet-type hex-value	Optional 0x8100 by default

 

QinQ Configuration Example

Network requirements

l          Provider A and Provider B are service provider network access devices.

l          Customer A, Customer B and Customer C are customer network access devices.

l          Provider A and Provider B are interconnected through a configured trunk port. Provider A belongs to VLAN 1000 of the service provider network, and Provider B belongs to VLAN 2000 of the service provider network.

l          Third-party devices are deployed between Provider A and Provider B, with a TPID value of 0x8200.

After configuration, the network should satisfy the following requirement:

l          Frames of VLAN 10 of Customer A and frames of VLAN 10 of Customer B can be forwarded to each other through VLAN 1000 of the provider network; frames of VLAN 20 of Customer A and frames of VLAN 20 of Customer C can be forwarded to each other through VLAN 2000 of the provider network.

Network diagram

Figure 1-4 Network diagram for QinQ configuration

 

Configuration procedure

 

 

1)        Configuration on Provider A

# Enter system view.

<ProviderA> system-view

l          Configuration on Ethernet 1/0/1

# Configure Ethernet 1/0/1 as a Hybrid port that permits frames of VLAN 1000 and VLAN 2000 to pass, and configure the port to remove the outer tag of the fames when sending them out.

[ProviderA] interface ethernet 1/0/1

[ProviderA-Ethernet1/0/1] port link-type hybrid

[ProviderA-Ethernet1/0/1] port hybrid vlan 1000 2000 untagged

# Configure the port to tag frames from VLAN 10 with an outer tag with the VLAN ID of 1000.

[ProviderA-Ethernet1/0/1] qinq vid 1000

[ProviderA-Ethernet1/0/1-vid-1000] raw-vlan-id inbound 10

[ProviderA-Ethernet1/0/1-vid-1000] quit

# Configure the port to tag frames from VLAN 20 with an outer tag with the VLAN ID of 2000.

[ProviderA-Ethernet1/0/1] qinq vid 2000

[ProviderA-Ethernet1/0/1-vid-2000] raw-vlan-id inbound 20

[ProviderA-Ethernet1/0/1-vid-2000] quit

[ProviderA-Ethernet1/0/1] quit

l          Configuration on Ethernet 1/0/2

# Configure VLAN 1000 as the default VLAN of the port.

[ProviderA] interface ethernet 1/0/2

[ProviderA-Ethernet1/0/2] port access vlan 1000

# Enable basic QinQ so that the port tags frames from VLAN 10 with an outer tag with the VLAN ID of 1000.

[ProviderA-Ethernet1/0/2] qinq enable

[ProviderA-Ethernet1/0/2] quit

l          Configuration on Ethernet 1/0/3.

# Configure Ethernet 1/0/3 as a trunk port, and permit frames of VLAN 1000 and VLAN 2000 to pass.

[ProviderA] interface ethernet 1/0/3

[ProviderA-Ethernet1/0/3] port link-type trunk

[ProviderA-Ethernet1/0/3] port trunk permit vlan 1000 2000

# To enable interoperability with the third-party devices in the public network, set the TPID value to be used in the outer tag to 0x8200.

[ProviderA-Ethernet1/0/3] qinq ethernet-type 8200

2)        Configuration on Provider B

l          Configuration on Ethernet 1/0/1

# Configure Ethernet 1/0/1 as a trunk port, and permit frames of VLAN 1000 and VLAN 2000.

<ProviderB> system-view

[ProviderB] interface ethernet 1/0/1

[ProviderB-Ethernet1/0/1] port link-type trunk

[ProviderB-Ethernet1/0/1] port trunk permit vlan 1000 2000

# To enable interoperability with the third-party devices in the public network, set the TPID value to be used in the outer tag to 0x8200.

[ProviderB-Ethernet1/0/1] qinq ethernet-type 8200

[ProviderB-Ethernet1/0/1] quit

l          Configuration on Ethernet 1/0/2

# Configure VLAN 2000 as the default VLAN of the port.

[ProviderB] interface ethernet 1/0/2

[ProviderB-Ethernet1/0/2] port access vlan 2000

# Enable basic QinQ so as to tag frames from VLAN 20 with an outer tag with the VLAN ID of 2000.

[ProviderB-Ethernet1/0/2] qinq enable

3)        Configuration on devices on the public network

As third-party devices are deployed between Provider A and Provider B, what we discuss here is only the basic configuration that should be made on the devices. Configure that device connecting with Ethernet 1/0/3 of Provider A and the device connecting with Ethernet 1/0/1 of Provider B so that their corresponding ports send tagged frames of VLAN 1000 and VLAN 2000. The configuration steps are omitted here.