How to force tagged traffic to physically leave the switch for later re-entry and keep tags ?

[janrovner1]

Hello,

I have a simple problem that I don't know how to solve. I have a switch interconnecting several VLANs (the traffic is tagged only) and I would like to create something like a virtual/separate/sub-switch(es) (call it as you want) inside this switch, because I need to force the switch to physically leave the traffic on some port and later, after going a L2 filter/shaper device, to re-enter it back on a different port.

I have created a simple image for illustration (see attachment), there are two networks (generating tagged traffic) (with MACs X, Y) physically connected to ports 1 and 4 that need "interconnect via ports 2 and 3" - going through an external device.

Of course, if there were not VLAN tags in the traffic, I would setup just two separate VLANs (port 1+2 and port 3+4, both with access ports), however, the traffic is tagged and the tags must be preserved.

Ports:

network X:1  /  2 <==external device-or cable==> 3  /  4 - network Y

I'd be appreciated for any ideas.

Sincerely,

Jan

[Iulian Vaideanu]

Hello Jan,

What type of switch do you have?  This looks just like the kind of job vlan mapping is good at, but not all switches support it...

[janrovner1]

Hello,

it is Catalyst 3750x... Could you please give me an info about this feature?

Thank you!

Jan

[Iulian Vaideanu]

You would have something like the following (with the L2 filtering / shaping device "shorting" gi1/1 and gi1/2):

interface gi1/1

   switchport mode trunk

   switchport trunk allowed vlan 11,22

   switchport vlan mapping 100 11

   switchport vlan mapping 200 22

interface gi1/2

   switchport mode trunk

   switchport trunk allowed vlan 100,200
 

Basically this means that tagged traffic coming into gi1/1 has tag 100 replaced with tag 11 before being processed, and tagged traffic leaving gi1/1 has tag 11 replaced with tag 100 just before being put on the wire.

We're using this scenario with Cisco SCE devices - unfortunately, the CAT3K line doesn't support vlan mapping (or vlan translation).

[Peter Paluch]

Hi Jan,

What kind of switch are you using? If it is a 3560 or higher, there's a chance that it supports Q-in-Q tunneling which could, at least in theory, help you accomplish what you need.

Best regards,
Peter