Cisco Connected Grid Ethernet Switch Module Interface Card Software Configuration Guide

IEEE 802.1Q and Layer 2 Protocol Tunneling Configuration

---

Virtual private networks (VPNs) provide enterprise-scale connectivity on a shared infrastructure, often Ethernet-based, with the same security, prioritization, reliability, and manageability requirements of private networks.

Tunneling is a feature designed for service providers who carry traffic of multiple customers across their networks and are required to maintain the VLAN and Layer 2 protocol configurations of each customer without impacting the traffic of other customers. The CGR 2010 ESM supports IEEE 802.1Q tunneling and Layer 2 protocol tunneling when it is running the IP services image.

Note For complete syntax and usage information for the commands used in this chapter, see the command reference for this release.

This chapter contains the following topics:

• Understanding IEEE 802.1Q Tunneling
• Configuring IEEE 802.1Q Tunneling
• Understanding Layer 2 Protocol Tunneling
• Configuring Layer 2 Protocol Tunneling
• Monitoring and Maintaining Tunneling Status

Understanding IEEE 802.1Q Tunneling

Business customers of service providers often have specific requirements for VLAN IDs and the number of VLANs to be supported. The VLAN ranges required by different customers in the same service-provider network might overlap, and traffic of customers through the infrastructure might be mixed. Assigning a unique range of VLAN IDs to each customer would restrict customer configurations and could easily exceed the VLAN limit (4096) of the IEEE 802.1Q specification.

Using the IEEE 802.1Q tunneling feature, service providers can use a single VLAN to support customers who have multiple VLANs. Customer VLAN IDs are preserved, and traffic from different customers is segregated within the service-provider network, even when they appear to be in the same VLAN. Using IEEE 802.1Q tunneling expands VLAN space by using a VLAN-in-VLAN hierarchy and retagging the tagged packets. A port configured to support IEEE 802.1Q tunneling is called a tunnel port . When you configure tunneling, you assign a tunnel port to a VLAN ID that is dedicated to tunneling. Each customer requires a separate service-provider VLAN ID, but that VLAN ID supports all of the customer’s VLANs.

Customer traffic tagged in the normal way with appropriate VLAN IDs comes from an IEEE 802.1Q trunk port on the customer device and into a tunnel port on the service-provider edge switch module. The link between the customer device and the edge switch module is asymmetric because one end is configured as an IEEE 802.1Q trunk port, and the other end is configured as a tunnel port. You assign the tunnel port interface to an access VLAN ID that is unique to each customer. See Figure 13-1.

Figure 13-1 IEEE 802.1Q Tunnel Ports in a Service-Provider Network

Packets coming from the customer trunk port into the tunnel port on the service-provider edge switch module are normally IEEE 802.1Q-tagged with the appropriate VLAN ID. The the tagged packets remain intact inside the switch module and when they exit the trunk port into the service-provider network, they are encapsulated with another layer of an IEEE 802.1Q tag (called the metro tag ) that contains the VLAN ID that is unique to the customer. The original customer IEEE 802.1Q tag is preserved in the encapsulated packet. Packets entering the service-provider network are double-tagged, with the outer (metro) tag containing the customer’s access VLAN ID, and the inner VLAN ID being that of the incoming traffic.

When the double-tagged packet enters another trunk port in a service-provider core switch module, the outer tag is stripped as the switch module processes the packet. When the packet exits another trunk port on the same core switch module, the same metro tag is again added to the packet. Figure 13-2 shows the tag structures of the double-tagged packets.

Note Remove the Layer 2 protocol configuration from a trunk port because incoming encapsulated packets change that trunk port to error disabled. The outgoing encapsulated VTP (CDP and STP) packets are dropped on that trunk.

Figure 13-2 Original (Normal), IEEE 802.1Q, and Double-Tagged Ethernet Packet Formats

When the packet enters the trunk port of the service-provider egress switch module, the outer tag is again stripped as the switch module internally processes the packet. The metro tag is not added when the packet is sent out the tunnel port on the edge switch module into the customer network. The packet is sent as a normal IEEE 802.1Q-tagged frame to preserve the original VLAN numbers in the customer network.

In Figure 13-1, Customer A was assigned VLAN 30, and Customer B was assigned VLAN 40. Packets entering the edge switch module tunnel ports with IEEE 802.1Q tags are double-tagged when they enter the service-provider network, with the outer tag containing VLAN ID 30 or 40, appropriately, and the inner tag containing the original VLAN number, for example, VLAN 100. Even if both Customers A and B have VLAN 100 in their networks, the traffic remains segregated within the service-provider network because the outer tag is different. Each customer controls its own VLAN numbering space, which is independent of the VLAN numbering space used by other customers and the VLAN numbering space used by the service-provider network.

At the outbound tunnel port, the original VLAN numbers on the customer’s network are recovered. It is possible to have multiple levels of tunneling and tagging, but the switch module supports only one level in this release.

If traffic coming from a customer network is not tagged (native VLAN frames), these packets are bridged or routed as normal packets. All packets entering the service-provider network through a tunnel port on an edge switch module are treated as untagged packets, whether they are untagged or already tagged with IEEE 802.1Q headers. The packets are encapsulated with the metro tag VLAN ID (set to the access VLAN of the tunnel port) when they are sent through the service-provider network on an IEEE 802.1Q trunk port. The priority field on the metro tag is set to the interface class of service (CoS) priority configured on the tunnel port. (The default is zero if none is configured.)

Configuring IEEE 802.1Q Tunneling

These sections contain this configuration information:

• Default IEEE 802.1Q Tunneling Configuration
• IEEE 802.1Q Tunneling Configuration Guidelines
• IEEE 802.1Q Tunneling and Other Features
• Configuring an IEEE 802.1Q Tunneling Port

Native VLANs

When configuring IEEE 802.1Q tunneling on an edge switch module, you must use IEEE 802.1Q trunk ports for sending packets into the service-provider network. However, packets going through the core of the service-provider network can be carried through IEEE 802.1Q trunks, ISL trunks, or nontrunking links. When IEEE 802.1Q trunks are used in these core switches, the native VLANs of the IEEE 802.1Q trunks must not match any native VLAN of the nontrunking (tunneling) port on the same switch module because traffic on the native VLAN would not be tagged on the IEEE 802.1Q sending trunk port.

See Figure 13-3. VLAN 40 is configured as the native VLAN for the IEEE 802.1Q trunk port from Customer X at the ingress edge switch module in the service-provider network (Switch B). Switch A of Customer X sends a tagged packet on VLAN 30 to the ingress tunnel port of Switch B in the service-provider network, which belongs to access VLAN 40. Because the access VLAN of the tunnel port (VLAN 40) is the same as the native VLAN of the edge-switch module trunk port (VLAN 40), the metro tag is not added to tagged packets received from the tunnel port. The packet carries only the VLAN 30 tag through the service-provider network to the trunk port of the egress-edge switch module (Switch C) and is misdirected through the egress switch module tunnel port to Customer Y.

These are some ways to solve this problem:

• Use the vlan dot1q tag native global configuration command to configure the edge switch module so that all packets going out an IEEE 802.1Q trunk, including the native VLAN, are tagged. If the switch module is configured to tag native VLAN packets on all IEEE 802.1Q trunks, the switch module accepts untagged packets, but sends only tagged packets.
• Ensure that the native VLAN ID on the edge-switch module trunk port is not within the customer VLAN range. For example, if the trunk port carries traffic of VLANs 100 to 200, assign the native VLAN a number outside that range.

Figure 13-3 Potential Problem with IEEE 802.1Q Tunneling and Native VLANs

 

Understanding Layer 2 Protocol Tunneling

Customers at different sites connected across a service-provider network need to use various Layer 2 protocols to scale their topologies to include all remote sites, as well as the local sites. STP must run properly, and every VLAN should build a proper spanning tree that includes the local site and all remote sites across the service-provider network. Cisco Discovery Protocol (CDP) must discover neighboring Cisco devices from local and remote sites. VLAN Trunking Protocol (VTP) must provide consistent VLAN configuration throughout all sites in the customer network.

When protocol tunneling is enabled, edge switches on the inbound side of the service-provider network encapsulate Layer 2 protocol packets with a special MAC address and send them across the service-provider network. Core switches in the network do not process these packets but forward them as normal packets. Layer 2 protocol data units (PDUs) for CDP, STP, or VTP cross the service-provider network and are delivered to customer switches on the outbound side of the service-provider network. Identical packets are received by all customer ports on the same VLANs with these results:

• Users on each of a customer’s sites can properly run STP, and every VLAN can build a correct spanning tree based on parameters from all sites and not just from the local site
• CDP discovers and shows information about the other Cisco devices connected through the service-provider network
• VTP provides consistent VLAN configuration throughout the customer network, propagating to all switches through the service provider

Note To provide interoperability with third-party vendors, you can use the Layer 2 protocol-tunnel bypass feature. Bypass mode transparently forwards control PDUs to vendor switches that have different ways of controlling protocol tunneling. You implement bypass mode by enabling Layer 2 protocol tunneling on the egress trunk port. When Layer 2 protocol tunneling is enabled on the trunk port, the encapsulated tunnel MAC address is removed and the protocol packets have their normal MAC address.

Layer 2 protocol tunneling can be used independently or can enhance IEEE 802.1Q tunneling. If protocol tunneling is not enabled on IEEE 802.1Q tunneling ports, remote switches at the receiving end of the service-provider network do not receive the PDUs and cannot properly run STP, CDP, and VTP. When protocol tunneling is enabled, Layer 2 protocols within each customer’s network are totally separate from those running within the service-provider network. Customer switches on different sites that send traffic through the service-provider network with IEEE 802.1Q tunneling achieve complete knowledge of the customer’s VLAN. If IEEE 802.1Q tunneling is not used, you can still enable Layer 2 protocol tunneling by connecting to the customer switch module through access ports and by enabling tunneling on the service-provider access port.

For example, in Figure 13-4, Customer X has four switches in the same VLAN, that are connected through the service-provider network. If the network does not tunnel PDUs, switches on the far ends of the network cannot properly run STP, CDP, and VTP. For example, STP for a VLAN on a switch module in Customer X, Site 1, will build a spanning tree on the switches at that site without considering convergence parameters based on Customer X’s switch module in Site 2. This could result in the topology shown in Figure 13-5.

Figure 13-4 Layer 2 Protocol Tunneling

Figure 13-5 Layer 2 Network Topology without Proper Convergence

In aservice-provider network, you can use Layer 2 protocol tunneling to enhance the creation of EtherChannels by emulating a point-to-point network topology. When you enable protocol tunneling (LACP) on the SP switch module, remote customer switches receive the PDUs and can negotiate the automatic creation of EtherChannels.

For example, in Figure 13-6, Customer A has two switches in the same VLAN that are connected through theservice-provider network. When the network tunnels PDUs, switches on the far ends of the network can negotiate the automatic creation of EtherChannels without needing dedicated lines. See the “Configuring Layer 2 Tunneling for EtherChannels” section for instructions.

Figure 13-6 Layer 2 Protocol Tunneling for EtherChannels

Configuring Layer 2 Protocol Tunneling

You can enable Layer 2 protocol tunneling (by protocol) on the ports that are connected to the customer in the edge switches of the service-provider network. The service-provider edge switches connected to the customer switch module perform the tunneling process. Edge-switch module tunnel ports are connected to customer IEEE 802.1Q trunk ports. Edge-switch module access ports are connected to customer access ports. The edge switches connected to the customer switch module perform the tunneling process.

You can enable Layer 2 protocol tunneling on ports that are configured as access ports or tunnel ports. You cannot enable Layer 2 protocol tunneling on ports configured in either switchport mode dynamic auto (the default mode) or switchport mode dynamic desirable.

The switch module supports Layer 2 protocol tunneling for CDP, STP, and VTP. For emulated point-to-point network topologies, it also supports LACP and UDLD protocols. The switch module does not support Layer 2 protocol tunneling for LLDP.

Caution LACP and UDLD protocol tunneling is only intended to emulate a point-to-point topology. An erroneous configuration that sends tunneled packets to many ports could lead to a network failure.

---

When the Layer 2 PDUs that entered the service-provider inbound edge switch module through a Layer 2 protocol-enabled port exit through the trunk port into the service-provider network, the switch module overwrites the customer PDU-destination MAC address with a well-known Cisco proprietary multicast address (01-00-0c-cd-cd-d0). If IEEE 802.1Q tunneling is enabled, packets are also double-tagged; the outer tag is the customer metro tag, and the inner tag is the customer’s VLAN tag. The core switches ignore the inner tags and forward the packet to all trunk ports in the same metro VLAN. The edge switches on the outbound side restore the proper Layer 2 protocol and MAC address information and forward the packets to all tunnel or access ports in the same metro VLAN. The Layer 2 PDUs remain intact and are delivered across the service-provider infrastructure to the other side of the customer network.

See Figure 13-4, with Customer X and Customer Y in access VLANs 30 and 40, respectively. Asymmetric links connect the customers in Site 1 to edge switches in the service-provider network. The Layer 2 PDUs (for example, BPDUs) coming into Switch 2 from Customer Y in Site 1 are forwarded to the infrastructure as double-tagged packets with the well-known MAC address as the destination MAC address. These double-tagged packets have the metro VLAN tag of 40, as well as an inner VLAN tag (for example, VLAN 100). When the double-tagged packets enter Switch D, the outer VLAN tag 40 is removed, the well-known MAC address is replaced with the respective Layer 2 protocol MAC address, and the packet is sent to Customer Y on Site 2 as a single-tagged frame in VLAN 100.

You can also enable Layer 2 protocol tunneling on access ports on the edge switch module connected to access or trunk ports on the customer switch module. In this case, the encapsulation and decapsulation process is the same as described in the previous paragraph, except that the packets are not double-tagged in the service-provider network. The single tag is the customer-specific access VLAN tag.

These sections contain this configuration information:

• Default Layer 2 Protocol Tunneling Configuration
• Layer 2 Protocol Tunneling Configuration Guidelines
• Configuring Layer 2 Protocol Tunneling
• Configuring Layer 2 Tunneling for EtherChannels

Configuring the SP Edge Switch Module

Beginning in privileged EXEC mode, follow these steps to configure a SP edge switch module for Layer 2 protocol tunneling for EtherChannels:

 

	Steps	Command
Step 1	Enter global configuration mode.	configure terminal
Step 2	Enter interface configuration mode, and enter the interface to be configured as a tunnel port. This should be the edge port in theservice-provider network that connects to the customer switch module. Valid interfaces are physical interfaces.	interface interface-id
Step 3	Configure the interface as an IEEE 802.1Q tunnel port.	switchport mode dot1q-tunnel
Step 4	(Optional) Enable point-to-point protocol tunneling for the desired protocol. If no keyword is entered, tunneling is enabled for all three protocols. Caution To avoid a network failure, make sure that the network is a point-to-point topology before you enable tunneling for LACP or UDLD packets.	l2protocol-tunnel point-to-point [ lacp | udld ]
Step 5	(Optional) Configure the threshold for packets-per-second accepted for encapsulation. The interface is disabled if the configured threshold is exceeded. If no protocol option is specified, the threshold applies to each of the tunneled Layer 2 protocol types. The range is 1 to 4096. The default is to have no threshold configured. Note If you also set a drop threshold on this interface, the shutdown-threshold value must be greater than or equal to the drop-threshold value.	l2protocol-tunnel shutdown-threshold [ point-to-point [ lacp | udld ]] value
Step 6	(Optional) Configure the threshold for packets-per-second accepted for encapsulation. The interface drops packets if the configured threshold is exceeded. If no protocol option is specified, the threshold applies to each of the tunneled Layer 2 protocol types. The range is 1 to 4096. The default is to have no threshold configured. Note If you also set a shutdown threshold on this interface, the drop-threshold value must be less than or equal to the shutdown-threshold value.	l2protocol-tunnel drop-threshold [ point-to-point [ lacp | udld ]] value
Step 7	Disable CDP on the interface.	no cdp enable
Step 8	Enable BPDU filtering on the interface.	spanning-tree bpdufilter enable
Step 9	Return to global configuration mode.	exit
Step 10	(Optional) Configure the recovery mechanism from a Layer 2 maximum-rate error so that the interface is re-enabled and can try again. Errdisable recovery is disabled by default; when enabled, the default time interval is 300 seconds.	errdisable recovery cause l2ptguard
Step 11	(Optional) Configure the CoS value for all tunneled Layer 2 PDUs. The range is 0 to 7; the default is the default CoS value for the interface. If none is configured, the default is 5.	l2protocol-tunnel cos value
Step 12	Return to privileged EXEC mode.	end
Step 13	Display the Layer 2 tunnel ports on the switch module, including the protocols configured, the thresholds, and the counters.	show l2protocol
Step 14	(Optional) Save your entries in the configuration file.	copy running-config startup-config

 

• To disable point-to-point protocol tunneling for one of the Layer 2 protocols or for all three, use the no l2protocol-tunnel [ point-to-point [ lacp | udld ]] interface configuration command.
• To return the shutdown and drop thresholds to the default settings, use the no l2protocol-tunnel shutdown-threshold [ point-to-point [ lacp | udld ]] and the no l2protocol-tunnel drop-threshold [ [ point-to-point [ lacp | udld ]] commands.

Monitoring and Maintaining Tunneling Status

Table 13-2 shows the privileged EXEC commands for monitoring and maintaining IEEE 802.1Q and Layer 2 protocol tunneling.

For detailed information about these displays, see the command reference for this release.