Cisco Systems 4500 About 802.1Q Tunneling

25-2
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 25 Configuring 802.1Q Tunneling, VLAN Mapping, and Layer 2 Protocol Tunneling
About 802.1Q Tunneling
About 802.1Q Tunneling
The VLAN ranges required by different customers in the same service provider network might overlap,
and customer traffic through the infrastructure might be mixed. Assigning a unique range of VLAN IDs
to each customer restricts customer configurations and could easily exceed the VLAN limit (4096) of
the 802.1Q specification.
802.1Q tunneling enables service providers to use a single VLAN to support customers who have
multiple VLANs, while preserving customer VLAN IDs and keeping traffic in different customer
VLANs segregated.
A port configured to support 802.1Q tunneling is called a tunnel port. When you configure tunneling,
you assign a tunnel port to a VLAN ID that is dedicated to tunneling. Each customer requires a separate
service provider VLAN ID, but that service provider VLAN ID supports VLANs of all the customers.
Customer traffic tagged in the normal way with appropriate VLAN IDs comes from an 802.1Q trunk port
on the customer device and into a tunnel port on the service provider edge switch. The link between the
customer device and the edge switch is asymmetric because one end is configured as an 802.1Q trunk
port, and the other end is configured as a tunnel port. You assign the tunnel port interface to an access
VLAN ID that is unique to each customer (Figure 25-1).
Figure 25-1 802.1Q Tunnel Ports in a Service Provider Network
Packets coming from the customer trunk port into the tunnel port on the service provider edge switch are
normally 802.1Q-tagged with the appropriate VLAN ID. When the tagged packets exit the trunk port
into the service provider network, they are encapsulated with another layer of an 802.1Q tag (called the
metro tag) that contains the VLAN ID that is unique to the customer. The original customer 802.1Q tag
is preserved in the encapsulated packet. Packets entering the service provider network are double-tagged,
with the metro tag containing the customer’s access VLAN ID, and the inner VLAN ID being that of the
incoming traffic.
When the double-tagged packet enters another trunk port in a service provider core switch, the metro tag
is stripped as the switch processes the packet. When the packet exits another trunk port on the same core
switch, the same metro tag is again added to the packet. Figure 25-2 shows the tag structures of the
Ethernet packets starting with the original, or normal, frame.
74017
Customer A
virtual network
VLANs 1 to 100