3

Is it possible to map C-VLANs from single-tagged interface to S-VLANs on double-tagged interface while retaining capability for all customers to access the service on different tagged switch port?

The figure below probably better illustrates what I'm trying to achieve here. I've been told by multiple people that this is not quite possible without secondary switch, but they couldn't really explain why. The switch in place is Cisco Nexus 3548, but I'd like know the opinion in general what are possibilities to do all this on a single machine.

enter image description here

Improve this question
2
  • This is kind of really odd. Note, this is off topic on server fault and I won't post an answer. But, using any Cisco with full CLI interface, the behavior you is actually fairly simple to accomplish. That said, I can't say I understand the exact reasoning for this to be hard.
    – Naryna
    Mar 9, 2016 at 22:12
  • I requested to transfer this question to NE. Well, it appeared simple to me at first when I decided to take a look at this matter. I'm not really a Cisco guy, but I haven't had any success doing it on other brand switches also. Mainly because of you cannot bundle the same C-VLAN to multiple S-VLANs (orange line in the picture). I'm not really asking to provide final configuration, just anything to put me on path or to know if it's really possible.
    – squirrely
    Mar 10, 2016 at 7:25

2 Answers 2

Reset to default
4
+50

What you're proposing is not going to be possible in a single box.

If we focus just on C-TAG 300, then from the switch port perspective traffic on the Customer-facing/left-most port in your diagram will require ingress frames to have the outer (S-Tag) popped off and traffic dropped into C-VLAN 300 on the switch (so it can be passed to other tagged member interfaces).

When traffic is returning towards this interface however, you will only be able to push a single S-TAG onto C-TAG 300 frames that egress this port either 500 OR 600. The switch has no way of differentiating traffic back to each customer, as any MAC being learnt from this port would be in VLAN 300 from the switch point of view, and not an associated S-VLAN.

It would be possible using two switches (or dare I suggest it, one switch with a cable looped back to itself), but not particularly scalable as the number of S-Tags increases.

Below is a very ghetto ASCII network diagram of how this would work: 

                           Switch 1           Switch 2
                         +----------+         +-------+
 --[600 300]--[500 300]--|-+-(500)--|--[300]--|-(300)-|---[ ]---
     Customer-facing     | +-(600)--|--[300]--|-(   )-|--[300]-- 
                         +----------+         +-------+

From the left, You would have the port facing your customers trunked for both S-Tags, and then define VLANs on the switch for both S-VLANs (500 and 600).

You would then have a port in each S-VLAN untagged connected to Switch 2 - this would send out frames with only the payload of each Q-in-Q frame which in this example would be a frame with single C-Tag 300 on it.

On switch 2, you would define VLAN 300 (and other C-VLANs) and have tagged-ports allowing VLAN 300 facing Switch 1.

It may not be immediately obvious from my masterpiece diagram, but Switch 2 has just one big VLAN 300 with four physical interfaces.

Now you can have your other ports with VLAN 300 singly tagged (or untagged) going off to your various services.

As it turns out, it doesn't look like the Nexus 3548 is capable of Q-in-Q:

From Cisco Documentation:

The ability to configure Q-in-Q is available only for Cisco Nexus 3000 and 3100 Series switches. Q-in-Q is automatically enabled when you configure a VLAN ID for an edge port, if the VLAN ID is maintained on the edge port.

Improve this answer
5
  • Thanks for the answer Benjamin! Well, I did have an idea of putting intermediary switch on that leftmost trunk port, but I'd like to use single 10G uplink between them instead of multiple connections. Could I somehow use that secondary switch to "flatten out" C-VLANs from inside S-VLANs to the port connected to 3548, so that way I'd basically have single level VLANs that I can easily deal with on 3548? Or am I stuck to that same limitation of using C-VLAN 300 on multiple S-VLANs?
    – squirrely
    Mar 18, 2016 at 7:41
  • I mean would it be possible to do this: --[600 300]--[500 300]--(Switch 1)--[300]--(Switch 2)--[300]-- along with other unique C-VLANs carried within S-VLANs. Since the reconfiguration of these switches will be quite rare, I see no problem of remapping C-VLAN 300 to any other unique VLAN IDs if that solves anything. I prefer to interconnect these switches using a single 10G uplink.
    – squirrely
    Mar 18, 2016 at 7:47
  • That's just it though - you won't be able to use a single link, as you need a way of distinguishing traffic heading out with S-TAG 600 and S-TAG 500. Consider a broadcast frame in VLAN 300 - it will only be sent once out each physical port. To send it to both your customers, you would need to have them appear on two distinct ports - the switch will not send the frame twice down a single port with different S-TAGs on it.
    – Benjamin Dale
    Mar 19, 2016 at 20:59
  • So, based on this, my best solution would be to use a secondary switch to terminate S-VLAN's to separate physical ports and use multiple physical connections to primary switch where I can do with C-VLANs whatever I want.
    – squirrely
    Mar 19, 2016 at 21:20
  • Yes - it's not pretty, but that's pretty much the only solution I see
    – Benjamin Dale
    Mar 19, 2016 at 21:56
1

If I understand you correctly, this is possible with a single switch, but it's not pretty. As Benjamin suggested, you can loop a cable back onto the switch. One interface is configured as an 802.1q tunnel, while the other interface is configured as a trunk to only allow the C-VLANs. The 802.1q tunnel interface will push/pop the S-VLAN as appropriate. It's definitely not scalable. Cisco offers this feature on their Metro gear. In the past it's been referred to flexible VLAN matching and allows for the the manipulation of the tags in several ways.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.