Q in Q decapsulation

[neogn8]

Hello, 

When the double tag frame reaches the destination switch in the 802.1q tunnel, where does it begin to decapsulate the outer tag of the frame as it reaches the end of the tunnel? Does it start at the ingress switchport trunk, or the egress switchport access? or does it even happen at these individual ports at all? 

Hope that makes sense. Thank you in advance!

[MHM Cisco World]

ingress SW (config with QinQ) add outer tag and egress(config with QinQ) remove the outer tag 

[M02@rt37 · Accepted solution]

Hello @neogn8 

In an 802.1Q tunneling environment, the decapsulation of the outer VLAN tag occurs at the egress switchport of the tunnel, which is typically configured as an access port.

Step by Step process:

Ingress Switchport (Trunk Port):

At the ingress switchport, which is usually configured as a trunk port, the original 802.1Q tagged frame enters the network. This switchport adds an additional (outer) VLAN tag to the frame, encapsulating the original frame within a new VLAN context. This outer tag is used within the service provider's network to distinguish between different customers or different traffic flows.

Through the Network:

As the double-tagged frame traverses the provider's network, the switches within the network forward the frame based on the outer VLAN tag. The inner tag remains intact and is not examined or modified by the intermediate switches.

Egress Switchport (Trunk Port):

When the frame reaches the egress switchport, which is also typically configured as a trunk port, the switch removes (decapsulates) the outer VLAN tag. This process exposes the original (inner) VLAN tag.

From client and Provider perspective, inner Tag is the c-VLAN and outer Tag is s-VLAN.

[neogn8]

Thank you so much M02@rt37 ! This is exactly what I needed to confirm. Your explanation is perfect right down to the switchport level.