VLAN Translation - Cisco

VLAN TranslationVLAN Translation includes the VLAN tunneling feature and the VLAN mapping one to one feature. VLAN tunneling is an enhancement of the QinQ/Nested VLAN/Customer mode VLAN feature. It enables service providers to use a single VLAN to support customers who have multiple VLANs, while preserving customer VLAN IDs and keeping traffic in different customer VLANs segregated. This feature is known as “double tagging” or QinQ, because in addition to the regular 802.1Q tag (Customer VLAN/C-VLAN), the switch adds a second ID tag known as a Service Tag (S-VLAN), to forward traffic over the network. On an edge interface, which is an interface where a customer network is connected to the provider edge switch, C-VLANs are mapped to S-VLANs and the original C-VLAN tags are kept as part of the payload. Untagged frames are dropped. When a frame is sent on a non-edge tagged interface, it is encapsulated with another layer of S-VLAN tag to which the original C-VLAN-ID is mapped. Therefore, packets transmitted on non-edge interfaces frames are double-tagged, with an outer S-VLAN tag and inner C-VLAN tag. The Service VLAN Tag is preserved while traffic is forwarded through the network service provider’s infrastructure. On an egress device, the S-VLAN tag is stripped when a frame is sent out on an edge interface. Untagged frames are dropped.The VLAN tunneling feature uses a different set of commands than the original QinQ/Nested VLAN implementation, and adds the following functionality in addition to the original implementation:• Provides, per edge interface, multiple mappings of different C-VLANs to separate S-VLANs• Allows configuring a drop action for certain C-VLANs received on edge interfaces• Allows configuring the action for C-VLANs not specifically mapped to an S-VLAN (drop or map to certain S-VLANs)• Allows configuring, globally and per NNI interface (network node interfaces – backbone ports) the Ethertype of the S-VLAN tag. In the previous QinQ implementation, only the Ethertype of 0x8100 was supported for a S-VLAN tag.The S-VLAN specified by the user must be created on the device before configuring it on an interface as an S-VLAN. If this VLAN does not exist, the command fails.IPv4/IPv6 forwarding and VLAN tunneling are mutually exclusive. Meaning that if either IPv4 or IPv6 forwarding are enabled, an interface cannot be set to VLAN tunneling mode. And if any interface is set to VLAN tunneling mode, IPv4 and IPv6 forwarding cannot be enabled on that device.The following features are also mutually exclusive with the VLAN tunneling feature:• Auto Voice VLAN• Auto Smartport • Voice VLAN IPv4 and IPv6 interfaces cannot be defined on VLANs containing edge interfaces.The following Layer 2 features are not supported on VLANs containing edge interfaces:• IGMP/MLD snooping• DHCP Snooping• IPv6 First Hop SecurityThe following protocols cannot be enabled on edge interfaces (UNI - user network interfaces):• STP• GVRPThe following features are not supported on edge interfaces (UNI - user network interfaces):• RADIUS VLAN assignment• 802.1x VLAN• SPAN/RSPAN – As a destination port with the network keyword or as a reflector port destination port with the network keyword or reflector port.Applying VLAN tunneling on an interface requires the use of router TCAM rules. If there is not a sufficient number of router TCAM resources, the command will fail. Users can add/remove router TCAM resources allocation for VLAN tunneling (and mapping) purposes via the Administration---> Routing Resources (this requires a system reboot).The original QinQ implementation (customer mode-related commands) continues to exist alongside the new implementation of VLAN tunneling. The customer port mode is a particular case of VLAN-mapping tunnel port mode, and does not require allocation of TCAM resources.In addition to VLAN tunneling, the device supports VLAN One-to-One Mapping. In VLAN One-to-One Mapping, on an edge interface (an edge interface is an interface where a customer network is connected to the provider edge switch), C-VLANs are mapped to S-VLANs and the original C-VLAN tags are replaced by the specified S-VLAN. Untagged frames are dropped. When a frame is sent on non-edge tagged interface, it is sent with a single VLAN tag, namely that of the specified S-VLAN. The Service VLAN Tag is preserved while traffic is forwarded through the service provider’s infrastructure network. On the egress device, the S-VLAN tag is replaced with the C-VLAN tag when a frame is sent to an edge interface.In the VLAN-mapping one-to-one mode, an interface belongs to all S-VLANs for which mapping on this interface is defined as an egress-tagged interface. The interface PVID is set to 4095.