H3C S9500 Series User manual

Operation Manual – QinQ
H3C S9500 Series Routing Switches Table of Contents
i
Table of Contents
Chapter 1 QinQ Configuration .....................................................................................................1-1
1.1 QinQ Overview...................................................................................................................1-1
1.1.1 Introduction to QinQ................................................................................................1-1
1.1.2 Implementation of QinQ..........................................................................................1-2
1.1.3 Adjusting TPID Values of QinQ Packets.................................................................1-2
1.2 Configuring VLAN VPN on a Port......................................................................................1-3
1.2.1 Configuration Prerequisites.....................................................................................1-3
1.2.2 Configuration Procedure.........................................................................................1-3
1.3 Configuring Traffic Classification-Based Nested VLAN.....................................................1-4
1.3.1 Configuration Prerequisites.....................................................................................1-4
1.3.2 Configuration Procedure.........................................................................................1-4
1.4 Configuring the TPID to Be Used in the Outer Tag...........................................................1-6
1.4.1 Configuration Prerequisites.....................................................................................1-6
1.4.2 Configuration Procedure.........................................................................................1-7
1.5 Configuring VLAN-VPN Tunneling.....................................................................................1-7
1.5.1 Introduction to VLAN-VPN Tunneling......................................................................1-7
1.5.2 Configuring VLAN-VPN tunneling...........................................................................1-8
1.6 Displaying and Maintaining QinQ Configuration................................................................1-9
1.7 QinQ Configuration Examples...........................................................................................1-9
1.7.1 Traffic Classification-Based Nested VLAN Configuration Example........................1-9
1.7.2 TPID Value Configuration Example ...................................................................... 1-11
1.7.3 VLAN-VPN Tunneling Configuration Example......................................................1-13

Operation Manual – QinQ
H3C S9500 Series Routing Switches Chapter 1 QinQ Configuration
1-1
Chapter 1 QinQ Configuration
When configuring QinQ, go to these sections for the information you are interested in:
zQinQ Overview
zConfiguring VLAN VPN on a Port
zConfiguring Traffic Classification-Based Nested VLAN
zConfiguring the TPID to Be Used in the Outer Tag
zConfiguring VLAN-VPN Tunneling
zDisplaying and Maintaining QinQ Configuration
1.1 QinQ Overview
1.1.1 Introduction to QinQ
QinQ is a technique that enables packets to be transmitted across the operators’
backbone networks with VLAN tags of private networks nested in those of public
networks. In public networks, packets of this type are transmitted by their outer VLAN
tags (that is, the VLAN tags of public networks). And those of private networks, which
are nested in the VLAN tags of public networks, remain intact.
Figure 1-1 shows the structure of a single-tagged frame and a double-tagged frame.
Figure 1-1 Single-tagged frame structure vs. double-tagged Ethernet frame structure
Compared with MPLS-based L2VPN, QinQ has the following features:
zLayer 2 VPN tunnels that are simpler.
zQinQ can be implemented without the support of signaling protocols. You can
enable QinQ by static configuring.
As QinQ is implemented through trunk port defined in 802.1Q, all devices along tunnels
with QinQ employed must be 802.1Q-enabled. Therefore, QinQ is suitable for

Operation Manual – QinQ
H3C S9500 Series Routing Switches Chapter 1 QinQ Configuration
1-2
small-sized metropolitan area networks (MANs) or intranets with Layer 3 switches
operate as the core layer devices.
QinQ provides you with the following benefits:
zSaves public network VLAN IDs.
zYou can have VLAN IDs of your own, which do not conflict with public network
VLAN IDs.
zProvide simple Layer 2 VPN solutions for small-sized MANs or intranets.
1.1.2 Implementation of QinQ
QinQ can be implemented on S9500 series switches in the following ways:
1) Enabling VLAN VPN on ports
With VLAN VPN enabled, a received packet is tagged with the default VLAN tag of the
port no matter whether or not the packet carries a VLAN tag. Otherwise, the packet is
transmitted with the default VLAN tag carried.
2) Configuring traffic classification-based nested VLANs
Traffic classification-based nested VLANs is also called flexible QinQ. It is a kind of
QinQ implemented in a more flexible way. You can specify to perform the following
operations on packets that match specifiedACL rules:
zSetting the outer VLAN tags
zModifying the outer VLAN tags
1.1.3 Adjusting TPID Values of QinQ Packets
Tag protocol identifier (TPID) is a portion of the VLAN tag field. IEEE 802.1Q specifies
the value of TPID to be 0x8100.
The structure of the Tag field of an Ethernet frame defined by IEEE 802.1Q is as
follows:
Figure 1-2 The structure of the VLAN Tag field of an Ethernet frame
By default, a S9500 series switch uses 0x8100 as the value of the TPID field, which is
defined by IEEE 802.1Q. But S9500 series switches can also adjust the TPID values of
QinQ packets. This ensures S9500 series switches are compatible with devices coming
from other vendors even through the later use other TPID values (such as 0x9100 or
0x9200) in the outer tags of QinQ packets.

Operation Manual – QinQ
H3C S9500 Series Routing Switches Chapter 1 QinQ Configuration
1-3
To modify the TPID values of packets, you need to set the ports connecting to the public
networks to be VLAN-VPN uplink ports, whose TPID value can be configured by users.
After you configure a TPID value for a VLAN-VPNuplink port, the switch substitutes the
new TPID values for those VLAN-VPN uplink ports in the outer tags carried by received
packets before transmitting the packet through the VLAN-VPN uplink ports to enable
these packets to be accepted by devices of other vendors.
1.2 Configuring VLAN VPN on a Port
1.2.1 Configuration Prerequisites
zGARP VLAN registration protocol (GVRP), spanning tree protocol (STP), and
802.1x protocol are disabled on the port.
zIGMP Snooping is disabled in the VLAN to which the port belongs.
zIGMP is disabled in the VLAN to which the port belongs.
1.2.2 Configuration Procedure
Table 1-1 Configure VLAN VPN on a port
Operation Command Remarks
Enter system view system-view —
Enter Ethernet port view interface {interface-type interface-number |
interface-name } —
Enable VLAN VPN vlan-vpn enable By default, VLAN VPN is
disabled on a port.
Display VLAN VPN
configuration information
about all ports in the
system
display port vlan-vpn
Information about the
current TPID value,
VLAN-VPN ports,
VLAN-VPN uplink ports is
displayed.

Operation Manual – QinQ
H3C S9500 Series Routing Switches Chapter 1 QinQ Configuration
1-4
Caution:
zVLAN VPN is unavailable to ports on which GVRP, STP, NTP, 802.1x, or RRPP is
enabled.
zVLAN VPN cannot be enabled on a port if the VLAN which the port belongs to has
IGMP Snooping enabled or its VLAN interface has IGMP enabled. Similarly, if a port
is VLAN VPN-enabled, you cannot enable IGMP Snooping in the VLAN to which the
port belongs or enable IGMP on the VLAN interface of the VLAN.
zIf you have enabled VLAN VPN for the ports in the VLAN, the VLAN cannot be
removed.
zAfter you enable the QinQ function, the configured ACL may fail to function.
1.3 Configuring Traffic Classification-Based Nested VLAN
1.3.1 Configuration Prerequisites
zACLs and corresponding rules to be applied already exist.
zThe VLANs to be specified by the nested-vlanid argument already exist.
1.3.2 Configuration Procedure
Table 1-2 Configure traffic classification-based nest vlan
Operation Command Remarks
Enter system view system-view —
Enter Ethernet port view
or port group view
interface {interface-type
interface-number | interface-name }
or port-group index —

Operation Manual – QinQ
H3C S9500 Series Routing Switches Chapter 1 QinQ Configuration
1-5
Operation Command Remarks
Deliver a
Layer 3
traffic
classification
rule
traffic-redirect inbound ip-group
{ acl-number | acl-name } [ rule rule
[ system-index index ] ]
nested-vlan nested-vlanid
[ interface interface-type
interface-number destination-vlan
l2-vpn ] | link-aggregation group
groupid destination-vlan |
smart-link group groupid
destination-vlan ]
Deliver both
Layer 2 and
Layer 3
traffic
classification
rules
traffic-redirect inbound ip-group
{ acl-number | acl-name } [ rule
rule ]link-group { acl-number |
acl-name } [ rule rule ] nested-vlan
nested-vlanid [ interface
interface-type interface-number
destination-vlan l2-vpn ]|
link-aggregation group groupid
destination-vlan | smart-link group
groupid destination-vlan ],
or, traffic-redirect inbound
ip-group { acl-number | acl-name }
link-group { acl-number |
acl-name } rule rule nested-vlan
nested-vlanid [ interface
interface-type interface-number
destination-vlan [ l2-vpn ] |
link-aggregation group groupid
destination-vlan | smart-link group
groupid destination-vlan ]
Set outer
VLAN
tags for
the
packets
matching
the ACL
rules
Deliver a
Layer 2
traffic
classification
rule
traffic-redirect inbound
link-group { acl-number |
acl-name } [ rule rule
[ system-index index ] ]
nested-vlan nested-vlanid
[ interface interface-type
interface-number }destination-vlan
l2-vpn ] | link-aggregation group
groupid destination-vlan |
smart-link group groupid
destination-vlan ]
Make sure the
Nested-VLAN
already exists to
prevent
otherwise the
packets from
being discarded.

Operation Manual – QinQ
H3C S9500 Series Routing Switches Chapter 1 QinQ Configuration
1-6
Operation Command Remarks
Deliver a
Layer 3
traffic
classification
rule
traffic-redirect inbound ip-group
{ acl-number | acl-name } [ rule rule
[ system-index index ] ]
modified-vlan modified-vlanid
Deliver both
Layer 2 and
Layer 3
traffic
classification
rules
traffic-redirect inbound ip-group
{ acl-number | acl-name } [ rule
rule ]link-group { acl-number |
acl-name } [ rule rule ]
modified-vlan modified-vlanid, or,
traffic-redirect inbound ip-group
{ acl-number | acl-name }
link-group { acl-number |
acl-name } rule rule modified-vlan
modified-vlanid
Modify
outer
VLAN
tags for
the
packets
matching
the ACL
flow rules
Deliver a
Layer 2
traffic
classification
rule
traffic-redirect inbound
link-group { acl-number |
acl-name } [ rule rule
[ system-index index ] ]
modified-vlan modified-vlanid
This command
modifies the
outer VLAN tag
of the packets.
Caution:
At present, the traffic-redirect { nested-vlan | modified-vlan } command is only
supported on boards with a suffix of DB or DC.
1.4 Configuring the TPID to Be Used in the Outer Tag
1.4.1 Configuration Prerequisites
As VLAN-VPN uplink ports typically works with the VLAN VPN ports, make sure that
VLAN VPN is disabled on the port before proceeding with the following configuration.

Operation Manual – QinQ
H3C S9500 Series Routing Switches Chapter 1 QinQ Configuration
1-7
1.4.2 Configuration Procedure
Table 1-3 Configure the TPID to be used in the outer tag
Operation Command Remarks
Enter system view system-view —
Configure the TPID value vlan-vpn tpid value
The value argument
ranges from 1 to 0xFFFF
and defaults to 0x8100.
Do not set the TPID value
to a value that may cause
a conflict, such as that of
known protocol type.
The TPID value can be
modified only on
VLAN-VPN uplink egress
ports.
Enter Ethernet port view interface {interface-type interface-number |
interface-name } —
Set the port to be a
VLAN-VPN uplink port. vlan-vpn uplink enable By default, a port is not a VLAN-VPN uplink port.
Display VLAN VPN
configuration information
about all ports in the
system
display port vlan-vpn
Information about the
current TPID value,
VLAN-VPN ports and
VLAN-VPN uplink ports is
display.
Caution:
zAt present, LSB1XP4 and LSB1TGX1 cards do not support this configuration.
zThe vlan-vpn uplink enable and the vlan-vpn enable command are mutual
exclusive. That is, you cannot used the vlan-vpn enable command while on a port
the vlan-vpn uplink enable command is in effect on the same port, and vice versa.
1.5 Configuring VLAN-VPN Tunneling
1.5.1 Introduction to VLAN-VPN Tunneling
VLAN-VPN tunneling enables customer networks in different geographic regions to
transmit BPDU packets to each other transparently through the designated VLAN VPN
over the service provider network.

Operation Manual – QinQ
H3C S9500 Series Routing Switches Chapter 1 QinQ Configuration
1-8
As shown in Figure 1-3, the service provider network comprises packet input and
output devices. The customer networks include network A and network B. Through the
configuration on the devices at both ends of the service provider network, the
destination MAC address of the BPDU packet is replaced with a MAC address in a
special format at one end, and the MAC address is converted back to the original
destination MAC address at the other end. In this way the packet is transmitted
transparently over the service provider network.
Figure 1-3 VLAN-VPN tunneling network hierarchy
1.5.2 Configuring VLAN-VPN tunneling
Perform the following configuration to configure VLAN-VPN tunneling.
Table 1-4 Configure VLAN-VPN tunneling
Operation Command Remarks
Enter system view system-view —
Enable VLAN-VPN
tunneling vlan-vpn tunnel Required
Enter Ethernet port view interface interface-type
interface-number —
Enable VLAN VPN of the
port vlan-vpn enable Required
By default, VLAN VPN is
disabled on a port.

Operation Manual – QinQ
H3C S9500 Series Routing Switches Chapter 1 QinQ Configuration
1-9
1.6 Displaying and Maintaining QinQ Configuration
To do … Use the command … Remarks
Display the configuration
information of VLAN
VPN-enabled PVCs of an
ATM primary interface or
subinterface.
display atm vlan-vpn
[interface atm
interface-number [ pvc
{pvc-name | vpi/vci } ] ]
Available in any view
Display VLAN
VPN-related configuration
information in the system display port vlan-vpn Available in any view
Monitor packets of
specified users in the
inbound direction of a
specified interface.
traceuser interface
interface-type
interface-number [ mac
mac-address ] [ vlan vlan-id ]
[ number number ]
Available in any view
1.7 QinQ Configuration Examples
1.7.1 Traffic Classification-Based Nested VLAN Configuration Example
I. Network requirements
zAs shown in Figure 1-4, two types of services run on the S9512 switch: common
internet access and on-demand multicast video. Traffic classification-based
nested VLAN encapsulates different tags at the exterior layer to distinguish the
two services based on the packet tag sent by the digital subscriber line access
multiplexer (DSLAM).
zVLAN 100 to VLAN 512 comprise home users that have access to the Internet. For
the packets in this VLAN range, S9512 needs to encapsulate another external tag
of VLAN 1000, and then sends the packets to BRAS.
zVLAN 600 is a multicast VLAN. Whenreceiving a packet with the tag of VLAN 600,
S9512 does not process the packet.