H3C S9500 Series Manuel utilisateur

Operation Manual – QinQ

H3C S9500 Series Routing Switches Table of Contents

Table of Contents

Chapter 1 QinQ Configuration .....................................................................................................1-1

1.1 QinQ Overview...................................................................................................................1-1

1.1.1 Introduction to QinQ................................................................................................1-1

1.1.2 Implementation of QinQ..........................................................................................1-2

1.1.3 Adjusting TPID Values of QinQ Packets.................................................................1-2

1.2 Configuring VLAN VPN on a Port......................................................................................1-3

1.2.1 Configuration Prerequisites.....................................................................................1-3

1.2.2 Configuration Procedure.........................................................................................1-3

1.3 Configuring Traffic Classification-Based Nested VLAN.....................................................1-4

1.3.1 Configuration Prerequisites.....................................................................................1-4

1.3.2 Configuration Procedure.........................................................................................1-4

1.4 Configuring the TPID to Be Used in the Outer Tag...........................................................1-6

1.4.1 Configuration Prerequisites.....................................................................................1-6

1.4.2 Configuration Procedure.........................................................................................1-7

1.5 Configuring VLAN-VPN Tunneling.....................................................................................1-7

1.5.1 Introduction to VLAN-VPN Tunneling......................................................................1-7

1.5.2 Configuring VLAN-VPN tunneling...........................................................................1-8

1.6 Displaying and Maintaining QinQ Configuration................................................................1-9

1.7 QinQ Configuration Examples...........................................................................................1-9

1.7.1 Traffic Classification-Based Nested VLAN Configuration Example........................1-9

1.7.2 TPID Value Configuration Example ...................................................................... 1-11

1.7.3 VLAN-VPN Tunneling Configuration Example......................................................1-13

Operation Manual – QinQ

H3C S9500 Series Routing Switches Chapter 1 QinQ Configuration

1-1

Chapter 1 QinQ Configuration

When configuring QinQ, go to these sections for the information you are interested in:

zQinQ Overview

zConfiguring VLAN VPN on a Port

zConfiguring Traffic Classification-Based Nested VLAN

zConfiguring the TPID to Be Used in the Outer Tag

zConfiguring VLAN-VPN Tunneling

zDisplaying and Maintaining QinQ Configuration

1.1 QinQ Overview

1.1.1 Introduction to QinQ

QinQ is a technique that enables packets to be transmitted across the operators’

backbone networks with VLAN tags of private networks nested in those of public

networks. In public networks, packets of this type are transmitted by their outer VLAN

tags (that is, the VLAN tags of public networks). And those of private networks, which

are nested in the VLAN tags of public networks, remain intact.

Figure 1-1 shows the structure of a single-tagged frame and a double-tagged frame.

Figure 1-1 Single-tagged frame structure vs. double-tagged Ethernet frame structure

Compared with MPLS-based L2VPN, QinQ has the following features:

zLayer 2 VPN tunnels that are simpler.

zQinQ can be implemented without the support of signaling protocols. You can

enable QinQ by static configuring.

As QinQ is implemented through trunk port defined in 802.1Q, all devices along tunnels

with QinQ employed must be 802.1Q-enabled. Therefore, QinQ is suitable for

Operation Manual – QinQ

H3C S9500 Series Routing Switches Chapter 1 QinQ Configuration

1-2

small-sized metropolitan area networks (MANs) or intranets with Layer 3 switches

operate as the core layer devices.

QinQ provides you with the following benefits:

zSaves public network VLAN IDs.

zYou can have VLAN IDs of your own, which do not conflict with public network

VLAN IDs.

zProvide simple Layer 2 VPN solutions for small-sized MANs or intranets.

1.1.2 Implementation of QinQ

QinQ can be implemented on S9500 series switches in the following ways:

1) Enabling VLAN VPN on ports

With VLAN VPN enabled, a received packet is tagged with the default VLAN tag of the

port no matter whether or not the packet carries a VLAN tag. Otherwise, the packet is

transmitted with the default VLAN tag carried.

2) Configuring traffic classification-based nested VLANs

Traffic classification-based nested VLANs is also called flexible QinQ. It is a kind of

QinQ implemented in a more flexible way. You can specify to perform the following

operations on packets that match specifiedACL rules:

zSetting the outer VLAN tags

zModifying the outer VLAN tags

1.1.3 Adjusting TPID Values of QinQ Packets

Tag protocol identifier (TPID) is a portion of the VLAN tag field. IEEE 802.1Q specifies

the value of TPID to be 0x8100.

The structure of the Tag field of an Ethernet frame defined by IEEE 802.1Q is as

follows:

Figure 1-2 The structure of the VLAN Tag field of an Ethernet frame

By default, a S9500 series switch uses 0x8100 as the value of the TPID field, which is

defined by IEEE 802.1Q. But S9500 series switches can also adjust the TPID values of

QinQ packets. This ensures S9500 series switches are compatible with devices coming

from other vendors even through the later use other TPID values (such as 0x9100 or

0x9200) in the outer tags of QinQ packets.

Operation Manual – QinQ

H3C S9500 Series Routing Switches Chapter 1 QinQ Configuration

1-3

To modify the TPID values of packets, you need to set the ports connecting to the public

networks to be VLAN-VPN uplink ports, whose TPID value can be configured by users.

After you configure a TPID value for a VLAN-VPNuplink port, the switch substitutes the

new TPID values for those VLAN-VPN uplink ports in the outer tags carried by received

packets before transmitting the packet through the VLAN-VPN uplink ports to enable

these packets to be accepted by devices of other vendors.

1.2 Configuring VLAN VPN on a Port

1.2.1 Configuration Prerequisites

zGARP VLAN registration protocol (GVRP), spanning tree protocol (STP), and

802.1x protocol are disabled on the port.

zIGMP Snooping is disabled in the VLAN to which the port belongs.

zIGMP is disabled in the VLAN to which the port belongs.

1.2.2 Configuration Procedure

Table 1-1 Configure VLAN VPN on a port

Operation Command Remarks

Enter system view system-view —

Enter Ethernet port view interface {interface-type

interface-number |

interface-name } —

Enable VLAN VPN vlan-vpn enable By default, VLAN VPN is

disabled on a port.

Display VLAN VPN

configuration information

about all ports in the

system

display port vlan-vpn

Information about the

current TPID value,

VLAN-VPN ports,

VLAN-VPN uplink ports is

displayed.

Operation Manual – QinQ

H3C S9500 Series Routing Switches Chapter 1 QinQ Configuration

1-4

Caution:

zVLAN VPN is unavailable to ports on which GVRP, STP, NTP, 802.1x, or RRPP is

enabled.

zVLAN VPN cannot be enabled on a port if the VLAN which the port belongs to has

IGMP Snooping enabled or its VLAN interface has IGMP enabled. Similarly, if a port

is VLAN VPN-enabled, you cannot enable IGMP Snooping in the VLAN to which the

port belongs or enable IGMP on the VLAN interface of the VLAN.

zIf you have enabled VLAN VPN for the ports in the VLAN, the VLAN cannot be

removed.

zAfter you enable the QinQ function, the configured ACL may fail to function.

1.3 Configuring Traffic Classification-Based Nested VLAN

1.3.1 Configuration Prerequisites

zACLs and corresponding rules to be applied already exist.

zThe VLANs to be specified by the nested-vlanid argument already exist.

1.3.2 Configuration Procedure

Table 1-2 Configure traffic classification-based nest vlan

Operation Command Remarks

Enter system view system-view —

Enter Ethernet port view

or port group view

interface {interface-type

interface-number | interface-name }

or port-group index —

Operation Manual – QinQ

H3C S9500 Series Routing Switches Chapter 1 QinQ Configuration

1-5

Operation Command Remarks

Deliver a

Layer 3

traffic

classification

rule

traffic-redirect inbound ip-group

{ acl-number | acl-name } [ rule rule

[ system-index index ] ]

nested-vlan nested-vlanid

[ interface interface-type

interface-number destination-vlan

l2-vpn ] | link-aggregation group

groupid destination-vlan |

smart-link group groupid

destination-vlan ]

Deliver both

Layer 2 and

Layer 3

traffic

classification

rules

traffic-redirect inbound ip-group

{ acl-number | acl-name } [ rule

rule ]link-group { acl-number |

acl-name } [ rule rule ] nested-vlan

nested-vlanid [ interface

interface-type interface-number

destination-vlan l2-vpn ]|

link-aggregation group groupid

destination-vlan | smart-link group

groupid destination-vlan ],

or, traffic-redirect inbound

ip-group { acl-number | acl-name }

link-group { acl-number |

acl-name } rule rule nested-vlan

nested-vlanid [ interface

interface-type interface-number

destination-vlan [ l2-vpn ] |

link-aggregation group groupid

destination-vlan | smart-link group

groupid destination-vlan ]

Set outer

VLAN

tags for

the

packets

matching

the ACL

rules

Deliver a

Layer 2

traffic

classification

rule

traffic-redirect inbound

link-group { acl-number |

acl-name } [ rule rule

[ system-index index ] ]

nested-vlan nested-vlanid

[ interface interface-type

interface-number }destination-vlan

l2-vpn ] | link-aggregation group

groupid destination-vlan |

smart-link group groupid

destination-vlan ]

Make sure the

Nested-VLAN

already exists to

prevent

otherwise the

packets from

being discarded.

Operation Manual – QinQ

H3C S9500 Series Routing Switches Chapter 1 QinQ Configuration

1-6

Operation Command Remarks

Deliver a

Layer 3

traffic

classification

rule

traffic-redirect inbound ip-group

{ acl-number | acl-name } [ rule rule

[ system-index index ] ]

modified-vlan modified-vlanid

Deliver both

Layer 2 and

Layer 3

traffic

classification

rules

traffic-redirect inbound ip-group

{ acl-number | acl-name } [ rule

rule ]link-group { acl-number |

acl-name } [ rule rule ]

modified-vlan modified-vlanid, or,

traffic-redirect inbound ip-group

{ acl-number | acl-name }

link-group { acl-number |

acl-name } rule rule modified-vlan

modified-vlanid

Modify

outer

VLAN

tags for

the

packets

matching

the ACL

flow rules

Deliver a

Layer 2

traffic

classification

rule

traffic-redirect inbound

link-group { acl-number |

acl-name } [ rule rule

[ system-index index ] ]

modified-vlan modified-vlanid

This command

modifies the

outer VLAN tag

of the packets.

Caution:

At present, the traffic-redirect { nested-vlan | modified-vlan } command is only

supported on boards with a suffix of DB or DC.

1.4 Configuring the TPID to Be Used in the Outer Tag

1.4.1 Configuration Prerequisites

As VLAN-VPN uplink ports typically works with the VLAN VPN ports, make sure that

VLAN VPN is disabled on the port before proceeding with the following configuration.

Operation Manual – QinQ

H3C S9500 Series Routing Switches Chapter 1 QinQ Configuration

1-7

1.4.2 Configuration Procedure

Table 1-3 Configure the TPID to be used in the outer tag

Operation Command Remarks

Enter system view system-view —

Configure the TPID value vlan-vpn tpid value

The value argument

ranges from 1 to 0xFFFF

and defaults to 0x8100.

Do not set the TPID value

to a value that may cause

a conflict, such as that of

known protocol type.

The TPID value can be

modified only on

VLAN-VPN uplink egress

ports.

Enter Ethernet port view interface {interface-type

interface-number |

interface-name } —

Set the port to be a

VLAN-VPN uplink port. vlan-vpn uplink enable By default, a port is not a

VLAN-VPN uplink port.

Display VLAN VPN

configuration information

about all ports in the

system

display port vlan-vpn

Information about the

current TPID value,

VLAN-VPN ports and

VLAN-VPN uplink ports is

display.

Caution:

zAt present, LSB1XP4 and LSB1TGX1 cards do not support this configuration.

zThe vlan-vpn uplink enable and the vlan-vpn enable command are mutual

exclusive. That is, you cannot used the vlan-vpn enable command while on a port

the vlan-vpn uplink enable command is in effect on the same port, and vice versa.

1.5 Configuring VLAN-VPN Tunneling

1.5.1 Introduction to VLAN-VPN Tunneling

VLAN-VPN tunneling enables customer networks in different geographic regions to

transmit BPDU packets to each other transparently through the designated VLAN VPN

over the service provider network.

Operation Manual – QinQ

H3C S9500 Series Routing Switches Chapter 1 QinQ Configuration

1-8

As shown in Figure 1-3, the service provider network comprises packet input and

output devices. The customer networks include network A and network B. Through the

configuration on the devices at both ends of the service provider network, the

destination MAC address of the BPDU packet is replaced with a MAC address in a

special format at one end, and the MAC address is converted back to the original

destination MAC address at the other end. In this way the packet is transmitted

transparently over the service provider network.

Figure 1-3 VLAN-VPN tunneling network hierarchy

1.5.2 Configuring VLAN-VPN tunneling

Perform the following configuration to configure VLAN-VPN tunneling.

Table 1-4 Configure VLAN-VPN tunneling

Operation Command Remarks

Enter system view system-view —

Enable VLAN-VPN

tunneling vlan-vpn tunnel Required

Enter Ethernet port view interface interface-type

interface-number —

Enable VLAN VPN of the

port vlan-vpn enable Required

By default, VLAN VPN is

disabled on a port.

Operation Manual – QinQ

H3C S9500 Series Routing Switches Chapter 1 QinQ Configuration

1-9

1.6 Displaying and Maintaining QinQ Configuration

To do … Use the command … Remarks

Display the configuration

information of VLAN

VPN-enabled PVCs of an

ATM primary interface or

subinterface.

display atm vlan-vpn

[interface atm

interface-number [ pvc

{pvc-name | vpi/vci } ] ]

Available in any view

Display VLAN

VPN-related configuration

information in the system display port vlan-vpn Available in any view

Monitor packets of

specified users in the

inbound direction of a

specified interface.

traceuser interface

interface-type

interface-number [ mac

mac-address ] [ vlan vlan-id ]

[ number number ]

Available in any view

1.7 QinQ Configuration Examples

1.7.1 Traffic Classification-Based Nested VLAN Configuration Example

I. Network requirements

zAs shown in Figure 1-4, two types of services run on the S9512 switch: common

internet access and on-demand multicast video. Traffic classification-based

nested VLAN encapsulates different tags at the exterior layer to distinguish the

two services based on the packet tag sent by the digital subscriber line access

multiplexer (DSLAM).

zVLAN 100 to VLAN 512 comprise home users that have access to the Internet. For

the packets in this VLAN range, S9512 needs to encapsulate another external tag

of VLAN 1000, and then sends the packets to BRAS.

zVLAN 600 is a multicast VLAN. Whenreceiving a packet with the tag of VLAN 600,

S9512 does not process the packet.

Autres manuels pour S9500 Series

Table des matières

Autres manuels H3C Routeur réseau

H3C

H3C S5800-60C-PWR Manuel utilisateur

H3C

H3C MSR810 Manuel d'installation

H3C

H3C SR6600 Series Manuel utilisateur

H3C

H3C S5120-HI Series Mode d’emploi

H3C

H3C MSR 5600 Manuel utilisateur

H3C

H3C S5500-SI Series Manuel utilisateur

H3C

H3C S5510 Series Manuel utilisateur

H3C

H3C S12516CR Manuel d'utilisation et d'entretien

H3C

H3C MSR810 Manuel d'installation

H3C

H3C H3C S5600 Series Manuel utilisateur

H3C

H3C MSR 20 Series Manuel utilisateur

H3C

H3C MSR 5660 Manuel d'utilisation et d'entretien

H3C

H3C SR8800 IM-FW-II Manuel utilisateur

H3C

H3C CR16006-F Guide rapide

H3C

H3C SecPath M9000-S NSQM2MPUD0 Manuel utilisateur

H3C

H3C SR6600 SPE-FWM Manuel utilisateur

H3C

H3C S3100-52P Instructions d'installation

H3C

H3C MSR 2600 Manuel d'utilisation et d'entretien

H3C

H3C AR 18-3XE Series Manuel utilisateur

H3C

H3C S3100-52P Manuel utilisateur

H3C

H3C s5820x series Manuel utilisateur

H3C

H3C SR8800-X Manuel utilisateur

H3C

H3C SecPath F5010 Manuel d'utilisation et d'entretien

H3C

H3C SR6600 SPE-FWM Manuel utilisateur

Manuels Routeur réseau populaires d'autres marques

Allnet

Allnet ALL0333AU Manuel utilisateur

HomeSeer

HomeSeer HT-SEL Manuel utilisateur

Sercomm

Sercomm Genesis OC3505D Manuel utilisateur

Billion

Billion BIPAC 5102 Series Manuel utilisateur

TP-Link

TP-Link TD-8817 Manuel utilisateur

Motorola

Motorola MR1900 Manuel utilisateur

Digi

Digi IX14 Manuel utilisateur

Cisco

Cisco NCS 540 Manuel

XAVi

XAVi X8821e Manuel utilisateur

BEC

BEC 6200WZL Manuel utilisateur

MikroTik

MikroTik hAP ac3 Series Manuel utilisateur

Korenix

Korenix JetNet 5428G Series Manuel utilisateur

NETGEAR

NETGEAR FS526T - Switch Manuel utilisateur

Korenix

Korenix JetNet 5710G Series Manuel utilisateur

Automated Logic

Automated Logic ZN551 Manuel du propriétaire

Cisco

Cisco ASR 1000 Series Manuel de l'opérateur

EnGenius

EnGenius ESR-9710 Manuel utilisateur

Cisco

Cisco 805 Series Instructions d'utilisation et de sécurité