QnQ VLAN

[hs08]

Hello,

I order QnQ WAN connection to the provider to distribute / extend my existing VLAN from one Datacenter to another Datacenter.

Today the QnQ link is ready so on the core switch 1st datacenter i set the port connected to the provider as trunk, also port on the 2nd datacenter connected to the provider configure as trunk port. But the result is i can't access from 2nd datacenter to the 1st datacenter. I try to ping from my workstation (access to VLAN 303) from 2nd datacenter to the workstation (access VLAN 303) in 1st datacenter but unreachable.

The provider say the QnQ configuration from their side is no issue. So need help for this scenario are just enough we set the port which connected to the provider as trunk mode, or need some another config? How we can debug or troubleshoot this to give evidence that our configuration is okay and need check from provider side.

[Joseph W. Doherty]

You didn't identify the Cisco device, I'm don't recall if all support QinQ, or all configured alike, but this may help https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SXF/native/configuration/guide/swcg/dot1qtnl.html and https://www.letsconfig.com/how-to-configure-q-in-q-tunneling-in-cisco/

[hs08]

Hi @Joseph W. Doherty 

here the topology where i have nexus 7700 and C9500 and both port which connected to the provider set as trunk port

[Joseph W. Doherty]

Did you look at the references I provided in my first reply?  The following seems very similar.

Now that I know the devices, for the 9500:

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9500/software/release/17-16/configuration_guide/lyr2/b_1716_lyr2_9500_cg/configuring_ieee_802_1q_tunneling.html?bookSearch=true

And for the 7700:

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus7000/sw/interfaces/config/cisco_nexus7000_interfaces_config_guide_8x/config-q-in-q-vlan-tunnels.html

BTW, ports are not configured as "normal" trunk ports.

[M02@rt37]

Hello @hs08 

Do you please share your config ?

If your provider is doing QinQ, they expect tagged frames from your side, but their QiQ encapsulation will add a second outer VLAN (their service VLAN). If you only configured trunk mode, your switch might be dropping packets because the provider’s outer VLAN is stripping your inner VLAN...

[paul driver]

Hello
TBH nothing for you to really to do on the CE side of things apart from creating the trunk or if you are using L3 subinterfaces you just need to make sure you do not have any native vlan within the range of the tagged SP qinq access vlan

[MHM Cisco World]

Only config port connect to provider with access port. 

That what you need. 

MHM

[Joseph W. Doherty]

Interesting replies from others.

I've only done real-world QinQ once, a couple of decades ago, with a MetroE provider.  I don't recall the individual interface statements, but I do recall, it wasn't the usual access or trunk port configuration.  I further recall, the provider gave me the VLAN ID to use on both ends for my connections to them.  QinQ allowed me to use any VLAN ID embedded under the provider's.  Basically and effectively, I was able to trunk between my two sites.

Perhaps, from the other replies, providers expect something different now days.  So, I suggest you contact your provider to determine whether they or you should be doing the initial/final QinQ encapsulation/decapsulation.

[paul driver]

Hello Joseph
TBH Ive never done it in production-- only  inlab simulation and POC reviews, but then obviously we had administrative control of both customer/service provider and the question required from the customer edge is if they are to be extending  a single/multiple vlan and in both scenarios the link connecting into the SP can be a trunk or ROAS port making sure the untaaged doesn't not conflict with the SP access port

[hs08]

Hi All,

The connection now was established. Previously i'm only configure the port connected to the provider as trunk port and the connection can't established. Then i try to add switch port trunk allow vlan 303 in both port and the connection established.

Still not understand why i must add allow vlan since if we not define this mean all vlan is allowed.

[Joseph W. Doherty]

From what you describe, unclear how it would work because if a standard trunk port configuration, only frames tagged with VLAN 303 should be sent to your provider.

In the setup I did decades ago, my frames sent to my provider had an outer VLAN tag, using a VLAN number they told me to use, like your 303.  But the frames had an inner VLAN tag, that I used internally.  The provider VLAN didn't have to exist on my network, but if it did, it wasn't the same VLAN.

So, to confirm, you can ping between your sites on any of your internal VLANs?

[Ramblin Tech]

Not knowing where you are located, I am not sure what documentation is required by your local telecomm regulators, but in the USA market, regulated/tariffed Ethernet services will usually have a service description filed somewhere that describes the behavior of their offered services. An example of this is AT&T Switched Ethernet Service Guide which contains the service description.

Generically, service descriptions more or less describe, in MEF terms, under what conditions Ethernet frames from a local CE are accepted across the local UNI to be transported by an EVC to the remote UNI and CE. These conditions are defined by the attributes of the service, which would include: port vs vlan service; p2p vs mp; c-tag preservation or not; L2CP transport, peering, or discard; etc. It is then up to the CE to only send traffic that conforms to the subscribed service description, with conforming traffic being delivered in accordance with any applicable SLS/SLA.

TLDR: Your Ethernet SP should be able to provide you with a technical description of the service you are subscribing to, as it is insufficient for them to just say “QinQ”. They should be able to tell you which VLAN IDs are accepted and which are not, what changes, if any, are made to VLAN tags, and what happens to L2 Control Protocol frames when you send one.