Cisco N7K-C7010 Configuration Guide - Page 278

Information About Q-in-Q Tunnels Chapter 9 Configuring Q-in-Q VLAN Tunnels Send document comments to [email protected] Note Q-in-Q is supported on port channels and vPC. To configure a port channel as an asymmetrical link, all ports in the port channel must have the same tunneling configuration. Using the 802.1Q tunneling feature, service providers can use a single VLAN to support customers who have multiple VLANs. Customer VLAN IDs are preserved and traffic from different customers is segregated within the service-provider infrastructure even when they appear to be on the same VLAN. The 802.1Q tunneling expands VLAN space by using a VLAN-in-VLAN hierarchy and tagging the tagged packets. A port configured to support 802.1Q tunneling is called a tunnel port. When you configure tunneling, you assign a tunnel port to a VLAN that is dedicated to tunneling. Each customer requires a separate VLAN, but that VLAN supports all of the customer's VLANs. Customer traffic tagged in the normal way with appropriate VLAN IDs come from an 802.1Q trunk port on the customer device and into a tunnel port on the service-provider edge switch. The link between the customer device and the edge switch is an asymmetric link because one end is configured as an 802.1Q trunk port and the other end is configured as a tunnel port. You assign the tunnel port interface to an access VLAN ID unique to each customer. See Figure 9-1. Note Selective Q-in-Q tunneling is not supported. All frames entering the tunnel port will be subject to Q-in-Q tagging. Figure 9-1 802.1Q-in-Q Tunnel Ports Customer A VLANs 1 to 100 80820.21.Q1Qtrturnuknkpoprotrt 880022..11QQ ttrruunnkk ppoorrtt Tunnel port VLAN 30 Tunnel port VLAN 30 Trunk ports Service provider Tunnel port VLAN 30 Trunk ports 802.1Q trunk port Tunnel port VLAN 40 Tunnel port VLAN 40 Customer A VLANs 1 to 100 80820.21.Q1Qtrturnuknkpoprotrt 80820.21.Q1Qtrturnuknkpoprotrt 74016 Customer B VLANs 1 to 200 Trunk Asymmetric link Customer B VLANs 1 to 200 Packets entering the tunnel port on the service-provider edge switch, which are already 802.1Q-tagged with the appropriate VLAN IDs, are encapsulated with another layer of an 802.1Q tag that contains a VLAN ID unique to the customer. The original 802.1Q tag from the customer is preserved in the encapsulated packet. Therefore, packets that enter the service-provider infrastructure are double-tagged. Cisco Nexus 7000 Series NX-OS Interfaces Configuration Guide, Release 5.x 9-2 OL-23435-03