port,and the other end is configured as a tunnel port. You assign the tunnel port interface to an access VLAN
IDthat is uniqueto eachcustomer.
Figure 9: IEEE 802.1Q Tunnel Ports in a Service-Provider Network
Packetscoming from the customer trunk port into the tunnel port on the service-provider edge switch are
normallyIEEE 802.1Q-tagged with theappropriate VLAN ID.The tagged packetsremain intact inside the
switchand when they exit the trunk port into the service-provider network, they are encapsulated with another
layerof an IEEE 802.1Q tag (called the metro tag) that contains the VLAN ID that is unique to the customer.
Theoriginal customerIEEE 802.1Q tagis preservedin the encapsulatedpacket. Therefore, packets entering
theservice-provider network are double-tagged, with the outer (metro) tag containing the customer’s access
VLANID, andthe inner VLAN ID beingthat of the incoming traffic.
Whenthe double-tagged packet enters another trunk port in a service-provider core switch, the outer tag is
strippedas the switch processes the packet. When the packet exits another trunk port on the same core switch,
thesame metro tag is again added to the packet.
Catalyst 2960-XR Switch VLAN Configuration Guide, Cisco IOS Release 15.0(2)EX1
OL-29440-01 125
Configuring IEEE 802.1Q and Layer 2 Protocol Tunneling
IEEE 802.1Q Tunneling