How QinQ Encapsulation and Termination Work: C-TAG, S-TAG and Typical Configurations

1. How QinQ encapsulation and termination work: first determine which layer the service is at

The outer S-TAG and inner C-TAG each have fields such as TPID, priority, and VID. Tunnel QinQ uniformly adds the outer tag, selective QinQ can map the outer tag by port, VLAN, or traffic classification, and termination strips the corresponding tag at the egress.

Protocol functions work as expected only when the role, instance, control packets, and protected objects are consistent. Illustrated explanation of QinQ double VLAN tags, tunnel QinQ, selective QinQ, termination stripping, and the TPID and VID fields. This article revolves around “QinQ, QinQ encapsulation, QinQ termination, C-TAG”. During implementation, mark the role of each interface and path in the drawings, record the differences between normal and fault states, and confirm the solution boundary with measured results.

3. How QinQ encapsulation and termination work: why cross-layer configuration is prone to errors

QinQ was originally mainly created to expand the VLAN ID space, but with the development of metro Ethernet and carriers’ requirements for refined operation, QinQ’s double tags have further use scenarios. Its inner and outer tags can represent different information, such as the inner tag representing the user and the outer tag representing the service. In addition, QinQ data frames carry two tags across the carrier network, with the inner tag transmitted transparently, which can also be seen as a simple and practical VPN technology. Therefore, it can also serve as an extension of core MPLS VPN in metro Ethernet VPN, ultimately forming an end-to-end VPN technology. Because QinQ is convenient and easy to use, it has now been widely applied by carriers, such as QinQ technology combined with multiple services in metro Ethernet solutions. In particular, the emergence of selective QinQ (Selective QinQ/VLAN Stacking) has made QinQ services attractive to carriers.

We know that a VLAN tag in an ordinary VLAN is used to distinguish users, but what if you want to distinguish both users and service types at the same time? As shown in Figure 7-11, a head office connects two branch subsidiaries, and each branch subsidiary already uses VLANs to distinguish employees in different departments, but the department VLAN ID plans of the two subsidiaries overlap. In this way, if only one layer of VLAN tag is used in the data frame, the head office cannot distinguish which subsidiary the data comes from, and therefore cannot perform any processing on the data from different subsidiaries. Figure 7-11 Typical QinQ application example. To solve this problem, we can imagine creating different VLANs for each subsidiary on the head office’s switch. In this way, when the head office switch port connected to the corresponding subsidiary

receives a data frame, it adds another layer of VLAN tag outside the data frame (at this time the data frame has two layers of VLAN tags; the original VLAN tag is called the inner VLAN tag, and the newly added one is called the outer VLAN tag). For example, the outer VLAN tags added for the data frames of subsidiary 1 and subsidiary 2 are VLAN 10 and VLAN 20 respectively. This makes it possible to distinguish data from different subsidiaries in the head office, and also to provide different services, that is, differentiated services, for the data from these two subsidiaries. In addition, in the traditional Layer 2 LAN interconnection mode based on the 802.1Q protocol, when two user networks need to access each other through a service provider (ISP) (such as in metro Ethernet), the ISP must create different VLANs for each access user. On the one hand, this configuration method makes the user’s VLAN visible on the backbone network

, posing a certain security risk. At the same time, because of the one-to-one VLAN ID mapping, it also consumes a large amount of the service provider’s VLAN ID resources. This is unbearable for larger ISPs, because only 4094 VLAN IDs are available. When the number of access users is large, the ISP network may run out of VLAN IDs. In addition, under this ordinary VLAN deployment method, different ISP access users cannot use the same VLAN ID; otherwise, isolation between different access users cannot be achieved. In this case, the user’s VLAN ID can only be planned uniformly by the ISP, resulting in users having no right to plan their own VLANs. QinQ technology can effectively solve the above problems, because it can use the same outer VLAN tag to encapsulate many users with different inner VLAN tags, solving the ISP’s VLAN ID resource

4. How QinQ encapsulation and termination work: cross-verify with packets, counters, and alarms

Protocol functions work as expected only when the role, instance, control packets, and protected objects are consistent. Illustrated explanation of QinQ double VLAN tags, tunnel QinQ, selective QinQ, termination stripping, and the TPID and VID fields. This article revolves around “QinQ, QinQ encapsulation, QinQ termination, C-TAG”. During implementation, mark the role of each interface and path in the drawings, record the differences between normal and fault states, and confirm the solution boundary with measured results.