QinQ was originally created to expand the VLAN ID space. However, with the development of metro Ethernet and the requirements of operators for refined operations, QinQ’s double-layer tags have further usage scenarios. Its inner and outer labels can represent different information. For example, the inner label represents the user, and the outer label represents the business. In addition, QinQ data frames carry two layers of labels across the operator’s network, and the inner labels are transmitted transparently. It can also be regarded as a simple and practical VPN technology. Therefore, it can be used as an extension of the core MPLS VPN in the metropolitan Ethernet VPN, ultimately forming an end-to-end VPN technology. Due to the convenience and ease of use of QinQ, it has now been widely used by various operators. For example, QinQ technology is integrated with multiple services in metropolitan Ethernet solutions. In particular, the emergence of Selective QinQ (Selective QinQ/VLAN Stacking) has made QinQ services more respected and favored by operators.
We know that a VLAN tag in a common VLAN is used to distinguish users, but what if we want to distinguish users and service types at the same time? As shown in Figure 7-11, a head office is connected to two branches and subsidiaries. VLANs have been used to distinguish employees in different departments in each branch, but the department VLAN ID planning of the two subsidiaries overlaps. In this way, if only one layer of VLAN tags is used in the data frame, the head office cannot distinguish which subsidiary the data comes from, and it cannot perform any processing on the data of different subsidiaries.
Figure 7-11 Typical application examples of QinQ
In order to solve this problem, we can imagine that in the head officeswitchDifferent VLANs are created for each subsidiary company. In this way, when the head office switch port connected to the corresponding subsidiary receives the data frame, it adds a layer of VLAN tags outside the data frame (there are two layers of VLAN tags in the data frame at this time, the original VLAN tag is called the inner VLAN tag, and the newly added one is called the outer VLAN tag). For example, the outer VLAN tags added to the data frames of subsidiary 1 and subsidiary 2 are VLAN 10 and VLAN respectively. 20. In this way, the data from different subsidiaries can be distinguished in the head office, and different services can be provided for the data from the two subsidiaries, that is, differentiated services.
In addition, in the Layer 2 LAN interconnection mode based on the traditional 802.1Q protocol, when two user networks need to access each other through the service provider (ISP) (such as in metropolitan Ethernet), the ISP must create different VLANs for each access user. On the one hand, this configuration method makes the user’s VLAN visible on the backbone network, which poses certain security risks. At the same time, because of the one-to-one corresponding VLAN ID, it also consumes a large amount of VLAN ID resources of the service provider. This is unaffordable for larger ISPs (because only 4094 VLAN IDs are available). When a large number of users are connected, the VLAN IDs of the ISP network may not be enough. In addition, with this common VLAN deployment method, different ISP access users cannot use the same VLAN ID, otherwise the isolation between different access users cannot be achieved. In this case, the user’s VLAN ID can only be planned uniformly by the ISP, resulting in users not having the right to plan their own VLANs.
QinQ technology can effectively solve the above problems because it can use the same outer VLAN tag for encapsulation for many users with different inner VLAN tags, solving the problem of insufficient VLAN ID resources of ISPs. In addition, through the shielding effect of the outer VLAN tag on the inner VLAN tag, the user’s own inner VLAN ID deployment can be decided by the user without having to be deployed uniformly by the ISP.
This double-layer VLAN tag can be used as a single-layer VLAN tag, that is, only the newly added outer public network VLAN tag is used, and the inner private network VLAN can be transmitted as data, such as in the 2 to 1 VLAN mapping to be introduced later in this chapter; of course, it can also be used as a double-layer VLAN tag (such as the 2 to 1 VLAN tag to be introduced later in this chapter) 2), the VLAN tag in the entire data frame is determined by the inner and outer double-layer VLAN tags. In this way, the number of VLAN IDs that can be used reaches 4094×4094, in order to achieve the purpose of expanding the VLAN space. Through such double-layer VLAN tag encapsulation, private network VLAN IDs can be transparently transmitted on the public network, which not only solves the security problem of user VLAN IDs and the need for users to plan private network VLAN IDs by themselves, but also solves the problem of insufficient VLAN ID space in ISPs, because the ISP can configure the same outer VLAN for users who need to access each other, and only needs to provide one VLAN ID for different VLANs from the same user network.
7.3.2 QinQ encapsulation and termination
QinQ adds a new layer of 802.1Q VLAN tag header to the traditional 802.1Q VLAN tag header, as shown in Figure 7-12. It can be seen that the QinQ frame has four more bytes than the traditional 802.1Q frame, which is the new 802.1Q VLAN tag.
Figure 7-12 Comparison of traditional 802.1Q frame and QinQ frame formats
The process of QinQ frame encapsulation is to convert the data frame of a single-layer 802.1Q tag into a data frame of a double-layer 802.1Q tag. The encapsulation process mainly occurs on the switch port connected to the user on the metropolitan area network side. According to different VLAN tag encapsulation basis, QinQ can be divided into two types: “basic QinQ” and “flexible QinQ”. Specific instructions are as follows.
1. Basic QinQ packaging
“Basic QinQ encapsulation” encapsulates all traffic entering a port with the same outer VLAN tag. It is a port-based QinQ encapsulation method, also known as “QinQ Layer 2 tunnel”. After the basic QinQ function of a port is enabled, when the port receives a data frame with a VLAN tag, the data frame will be encapsulated into a double-tagged frame; if a data frame without a VLAN tag is received, the data frame will be encapsulated into a single-tagged frame with the port’s default VLAN.
As can be seen from the above introduction, the VLAN tag encapsulation of basic QinQ is not flexible enough and it is difficult to effectively distinguish different user services because it encapsulates the same outer VLAN tag for all data frames entering the same switch port. But when more VLANs are needed, this basic QinQ function can be used, which can reduce the need for VLAN IDs because all data frames entering the same port are encapsulated with the same outer VLAN tag.
As shown in Figure 7-13, in the network shown in Figure 7-13, enterprise department 1 (Department 1) has two office locations, and department 2 (Department 2) has three office locations. Each office location of the two departments is connected to PE1 and PE2 in the network respectively. Department 1 and department 2 can plan their own VLANs arbitrarily. In this way, the QinQ Layer 2 tunnel function can be configured on PE1 and PE2 through the following ideas, so that the office networks of each department can communicate with each other, but the two departments cannot communicate with each other.
On PE1, the data frames of users entering ports Port1 and Port2 (both belong to department 1) are encapsulated with outer VLAN 10, and the data frames of users entering port 3 (belonging to department 2) are encapsulated with outer VLAN 20.
On PE2, the data frames of users entering ports Port1 and Port2 (both belong to department 2) are encapsulated in outer VLAN 20.
Port Port4 on PE1 and port Port3 on PE2 allow user data frames of VLAN 20 to pass through, so that users in Department 2 connected to Port3 of PE1 can communicate with users in Department 2 connected to Port1 and Port2 of PE2.
This basic QinQ encapsulation is equivalent to using an outer VLAN tag to map multiple inner VLAN tags of similar users to reduce the usage of VLAN IDs on ISP devices.
Figure 7-13 Typical application examples of basic QinQ
2. Flexible QinQ packaging
“Flexible QinQ” is a more flexible implementation of QinQ, which is a combination of port-based encapsulation and VLAN-based encapsulation. In addition to realizing all basic QinQ functions, flexible QinQ can also perform different outer label encapsulation based on different inner VLAN labels for data frames received on the same port. It can be divided into the following three subcategories:
Flexible QinQ based on VLAN ID: It adds different outer labels based on the VLAN IDs of different inner labels in the data frame. That is, frames with the same inner label are added with the same outer VLAN label, and frames with different inner labels are added with different outer VLAN labels.This requires that the inner VLAN IDs or VLAN ID ranges of different users must not overlap or cross.. in Huawei S series switchesS2700, S3700, S5700, and S6700 only support the flexible QinQ function based on VLAN ID.。
Flexible QinQ based on 802.1p priority: It adds different outer labels based on the 802.1p priorities of different inner labels in the data frame. That is, frames with the same inner VLAN 802.1p priority are added with the same outer label, and frames with different inner VLAN 802.1p priorities are added with different outer labels.This requires that the 802.1p priorities or 802.1p priority ranges of the inner VLANs of different users must not overlap or cross.Flexible QinQ based on 802.1p priority in Huawei S series switchesOnly supported by S7700, S9300 and S9700 series。
Flexible QinQ based on flow policy: It adds different outer labels to different data frames according to the defined QoS policy. Flexible QinQ based on traffic policies is implemented based on a combination of ports and VLANs, and can provide differentiated services based on business types. Flexible QinQ based on flow policy in Huawei S series switchesOnly supported by S7700, S9300 and S9700 series。
The above three flexible QinQ configuration methods will be introduced in detail later in this chapter.
When different services of the same user need to use different VLAN IDs, traffic can be distributed based on the VLAN ID interval. Now assume that the VLAN ID range for PC Internet access is 101~200; the VLAN ID range for IPTV is 201~300; and the VLAN ID range for large customers is 301~400. After receiving the user data, the user-facing port encapsulates the PC Internet access service with an outer tag of 100, the IPTV with an outer tag of 300, and the large customer with an outer tag of 500 according to the user VLAN ID range.
[Explanation] QinQ encapsulation is generally performed on switched ports, but it can also be performed on routing sub-interfaces (QinQ termination can only be performed on routing sub-interfaces). This method can transparently transmit multiple VLAN IDs identifying users through a sub-interface. This sub-interface is also called QinQ Stacking sub-interface. This encapsulation method is also a flow-based QinQ encapsulation method, but the QinQ Stacking sub-interface is only meaningful when combined with L2VPN services and does not support the Layer 3 forwarding function.
In the network shown in Figure 7-14, department 1 of the enterprise has multiple offices, and department 2 also has multiple offices. The network of department 1 uses VLAN 2~VLAN 500; the network of department 2 uses VLAN 500~VLAN 4094. Port1 of PE1 will receive user data frames from two departments in different VLAN intervals at the same time.
Figure 7-14 Typical application examples of flexible QinQ
At this time, the VLAN-based flexible QinQ function can be configured on PE1 and PE2 according to the user VLAN ID range of each office identified in the figure as follows, so that the networks of each office in each department can communicate with each other, but the two departments cannot communicate with each other. The specific configuration ideas are as follows:
For user data frames entering PE1’s Port1 port, add corresponding outer VLAN tags based on their VLAN IDs. If the VLAN ID is between 2 and 500, encapsulate the outer tag with VLAN ID 10; if the VLAN ID is between 1000 and 2000, encapsulate the outer tag with VLAN ID 20;
For user data frames entering the Port2 port of PE1, if the VLAN ID is between 100 and 500, the outer label with the VLAN ID of 10 is encapsulated;
For user data frames entering the Port1 port of PE2, if the VLAN ID is between 1000 and 4094, the outer label with VLAN ID of 20 is encapsulated;
For user data frames entering the Port2 port of PE2, if the VLAN ID is between 500 and 2500, the outer label with the VLAN ID of 20 is encapsulated;
Allow VLAN 20 frames to pass through the Port3 ports of PE1 and PE2, so that users in Department 2 connected to Port1 of PE1 can communicate with users in Department 2 connected to Port1 and Port2 of PE2.
As can be seen from the above, the outer label encapsulation of flexible QinQ is more flexible than that of basic QinQ. Different outer labels can be encapsulated according to the original VLAN ID range in the user data frame. This makes it more convenient to provide differentiated services for user data flows of different services in the same network.
3. QinQ/Dot1q termination sub-interface
QinQ/Dot1q termination means that the device identifies the double-layer or single-layer VLAN tag of the data frame, strips the double-layer or single-layer VLAN tag from the frame based on subsequent forwarding behavior, and then continues to transmit. That is to say, these VLAN tags are only effective before this, and subsequent data transmission and processing no longer rely on these VLAN tags in the frame.
[Experience] The essence of VLAN termination includes two aspects:
For VLAN packets received by the interface, the VLAN tag is removed and then Layer 3 forwarding or other processing is performed. Whether packets forwarded from other interfaces of the device carry VLAN tags are determined by the corresponding port type and its data sending rules.
For the packets sent by the interface, the corresponding VLAN tag information is added to the packets before sending.
Termination is generally performed on the routing sub-interface, that is, the termination sub-interface. For example, in single-arm routing, we need to configure 802.1Q VLAN termination of the routing sub-interface. If the routing sub-interface terminates the single-layer VLAN tag of the data frame, then the sub-interface is called the Dot1q termination sub-interface; if the routing sub-interface terminates the double-layer VLAN tag of the data frame, then the sub-interface is called the QinQ termination sub-interface. QinQ termination sub-interfaces are usually divided into two types of sub-interfaces based on the type of user VLAN tags terminated:
Explicit QinQ termination sub-interface: the two-layer VLAN tag is a fixed value.
Fuzzy QinQ termination sub-interface: The two-layer VLAN tags are range values, that is, the inner and outer tags of the termination are both a VLAN ID range value.
