Cisco Systems 3750E manual 17-2, Ieee 802.1Q Tunnel Ports in a Service-Provider Network

Chapter 17 Configuring IEEE 802.1Q and Layer 2 Protocol Tunneling

Understanding IEEE 802.1Q Tunneling

tagged packets. A port configured to support IEEE 802.1Q tunneling is called a tunnel port. When you configure tunneling, you assign a tunnel port to a VLAN ID that is dedicated to tunneling. Each customer requires a separate service-provider VLAN ID, but that VLAN ID supports all of the customer’s VLANs.

Customer traffic tagged in the normal way with appropriate VLAN IDs comes from an IEEE 802.1Q trunk port on the customer device and into a tunnel port on the service-provider edge switch. The link between the customer device and the edge switch is asymmetric because one end is configured as an IEEE 802.1Q trunk port, and the other end is configured as a tunnel port. You assign the tunnel port interface to an access VLAN ID that is unique to each customer. See Figure 17-1.

Figure 17-1 IEEE 802.1Q Tunnel Ports in a Service-Provider Network

Customer A

VLANs 1 to 100

Customer A

VLANs 1 to 100

		Service
	Tunnel port	provider
	VLAN 30	Tunnel port
Tunnel port		VLAN 30
VLAN 30	Trunk	Trunk
	ports	ports
	Tunnel port	Tunnel port
	VLAN 40	VLAN 40

74016

Customer B	Trunk	Customer B
VLANs 1 to 200		VLANs 1 to 200
	Asymmetric link

Packets coming from the customer trunk port into the tunnel port on the service-provider edge switch are normally IEEE 802.1Q-tagged with the appropriate VLAN ID. The the tagged packets remain intact inside the switch and when they exit the trunk port into the service-provider network, they are encapsulated with another layer of an IEEE 802.1Q tag (called the metro tag) that contains the VLAN ID that is unique to the customer. The original customer IEEE 802.1Q tag is preserved in the encapsulated packet. Therefore, packets entering the service-provider network are double-tagged, with the outer (metro) tag containing the customer’s access VLAN ID, and the inner VLAN ID being that of the incoming traffic.

When the double-tagged packet enters another trunk port in a service-provider core switch, the outer tag is stripped as the switch processes the packet. When the packet exits another trunk port on the same core switch, the same metro tag is again added to the packet. Figure 17-2shows the tag structures of the double-tagged packets.

Catalyst 3750-E and 3560-E Switch Software Configuration Guide

17-2 OL-9775-02