Supported Platforms
Related Documentation
Understanding Q-in-Q Tunneling on EX Series Switches
 | Note: This topic applies to Junos OS for EX Series switches with support for the Enhanced Layer 2 Software (ELS) configuration style. If your switch runs software that does not support ELS, see Understanding Q-in-Q Tunneling on EX Series Switches. For ELS details, see Getting Started with Enhanced Layer 2 Software. |
Q-in-Q tunneling enables service providers on Ethernet access networks to extend a Layer 2 Ethernet connection between two customer sites. Using Q-in-Q tunneling, providers can also segregate or bundle customer traffic into fewer VLANs or different VLANs by adding another layer of 802.1Q tags. Q-in-Q tunneling is useful when customers have overlapping VLAN IDs, because the customer’s 802.1Q VLAN tags are prepended by the service-provider VLAN (S-VLAN) tag. The Juniper Networks Junos operating system (Junos OS) implementation of Q-in-Q tunneling supports the IEEE 802.1ad standard.
This topic describes:
How Q-in-Q Tunneling Works
In Q-in-Q tunneling, as a packet travels from a customer VLAN (C-VLAN) to an S-VLAN, a service-provider-specific 802.1Q tag is added to the packet. This additional tag is used to segregate traffic into S-VLANs-. The original customer 802.1Q tag of the packet is retained and is transmitted transparently, passing through the service provider's network. As the packet leaves the S-VLAN in the downstream direction, the additional 802.1Q tag is removed.
When Q-in-Q tunneling is configured on Juniper Networks EX Series Ethernet Switches, trunk interfaces are assumed to be part of the service-provider network and access interfaces are assumed to be part of the customer network. Therefore, this topic also refers to trunk interfaces as S-VLAN interfaces (network-to-network interfaces [NNI]), and to access interfaces as C-VLAN interfaces (user-network interfaces [UNI]). An access interface can receive both tagged and untagged frames in this case.
An interface can be a member of multiple S-VLANs. You can map one C-VLAN to one S-VLAN (1:1) or many C-VLANs to many S-VLANs (N:N). Customer packets that traverse an S-VLAN are double-tagged for an additional layer of segregating or bundling of C-VLANs. C-VLAN and S-VLAN tags are unique—for instance, you can have both a C-VLAN tag of 101 and an S-VLAN tag of 101. You can limit the set of accepted customer tags to a range of tags or to discrete values. Class-of-service (CoS) values of C-VLANs are unchanged in the downstream direction. You may, optionally, copy ingress priority and CoS settings to the S-VLAN.
C-VLAN and S-VLAN interfaces accept priority-tagged packets without any configuration.
| Note: On an EX4300 switch, you can configure multiple logical interfaces on the same Ethernet port, but each logical interface supports only single-tagged packets and that tag must include a different VLAN ID than those supported by the other logical interfaces. Given this situation, you cannot enable Q-in-Q tunneling on Ethernet ports with multiple logical subinterfaces. |
Sending and Receiving Untagged Packets
To enable a C-VLAN or S-VLAN interface to send and receive untagged packets, you must configure a native VLAN for the interface, then specify a VLAN ID for the native VLAN. After performing this configuration, when a C-VLAN or S-VLAN interface receives an untagged packet, it adds the VLAN ID of the native VLAN to the packet and sends the newly tagged packet to the mapped interface.
To specify a native VLAN ID, use the native-vlan-id statement at the [edit interfaces interface-name] hierarchy level. When specifying a native VLAN ID on a C-VLAN or S-VLAN physical interface, the value must match the VLAN ID or be included in the VLAN ID list specified on the C-VLAN or S-VLAN logical interface.
For example, on a logical interface for a C-VLAN interface, you specify a C-VLAN ID list of 100-200. Then, on the C-VLAN physical interface, you specify a native VLAN ID of 150. This configuration will work because the native VLAN of 150 is included in the C-VLAN ID list of 100-200.
We recommend configuring a native VLAN when using any of the approaches to map C-VLANs to S-VLANs. If you do not configure a native VLAN on an interface, untagged packets received by the interface are discarded. See the Mapping C-VLANs to S-VLANs section in this topic for information about the methods of mapping C-VLANs to S-VLANs.
Disabling MAC Address Learning
In a Q-in-Q deployment, customer packets from downstream interfaces are transported without any changes to source and destination MAC addresses. You can disable MAC address learning at the global, interface, and VLAN levels:
At the global level, you disable MAC address learning for the switch.
At the interface level, you disable MAC address learning for all VLANs of which the specified interface is a member.
At the VLAN level, you disable MAC address learning for a specified VLAN. MAC addresses that have already been learned for the VLAN are flushed.
Mapping C-VLANs to S-VLANs
There are three ways to map C-VLANs to S-VLANs:
If you configure multiple mapping methods, the switch gives priority to mapping a specific interface, then to many-to-many bundling, and last to all-in-one bundling. However, for a particular mapping method, setting up overlapping rules for the same C-VLAN is not supported.
All-in-One Bundling
All-in-one bundling maps all packets from all C-VLAN interfaces to an S-VLAN.
The C-VLAN interface accepts untagged and single-tagged packets. An S-VLAN 802.1Q tag is then added to these packets, and the packets are sent to the S-VLAN interface, which accepts untagged, single-tagged, and double-tagged packets.
| Note: The C-VLAN and S-VLAN interfaces accept untagged packets provided that the native-vlan-id statement is configured on these interfaces. |
Many-to-Many Bundling
Many-to-many bundling is used to specify which C-VLANs are mapped to which S-VLANs.
Many-to-many bundling is used when you want a subset of the C-VLANs on the access switch to be part of multiple S-VLANs. With many-to-many bundling, the C-VLAN interfaces accept untagged and single-tagged packets. An S-VLAN 802.1Q tag is then added to these packets, and the packets are sent to the S-VLAN interfaces, which accept untagged, single-tagged, and double-tagged packets.
| Note: The C-VLAN and S-VLAN interfaces accept untagged packets provided that the native-vlan-id statement is configured on these interfaces. |
Mapping a Specific Interface
Use specific interface mapping when you want to assign an S-VLAN to a specific C-VLAN on an interface. The configuration applies only to the specific interface, not to all access interfaces as in the cases of the all-in-one bundling and many-to-many bundling approaches.
Specific interface mapping has two suboptions for treatment of traffic: push and swap. When traffic that is mapped to a specific interface is pushed, the packet retains its tag as it moves from the C-VLAN to the S-VLAN, then an additional S-VLAN tag is added to the packet. When traffic that is mapped to a specific interface is swapped, the incoming tag is replaced with a new VLAN tag, which is also referred to as VLAN rewrite.
It might be useful to have S-VLANs that provide service to multiple customers. Each customer typically has its own S-VLAN plus access to one or more S-VLANs that are used by multiple customers. A specific tag on the customer side is mapped to an S-VLAN. Typically, this functionality is used to keep data from different customers separate or to provide individualized treatment of the packets on a certain interface.
When using specific interface mapping, the C-VLAN interfaces accept untagged and single-tagged packets, while the S-VLAN interfaces accept untagged, single-tagged, and double-tagged packets.
| Note: The C-VLAN and S-VLAN interfaces accept untagged packets provided that the native-vlan-id statement is configured on these interfaces. |
Limitations for Q-in-Q Tunneling
Q-in-Q tunneling does not support most access port security features. There is no per-VLAN (customer) policing or per-VLAN (outgoing) shaping and limiting with Q-in-Q tunneling unless you configure these security features by using firewall filters.
