newbie here with a very similar question to one that was posted a couple of years back ... only slightly different (so, as the original question was asked so perfectly, I've copied it nearly verbatim and just edited it slightly ... terribly lazy I know!)

How do I tell Juniper EX4200 to push specific S-VLAN based on C-VLAN on q-in-q (dot1q-tunneling) port?

For instance I want to instruct EX4200 to perform Q-in-Q using these rules:

1) If a single-tag frame is received on ge-0/0/0 with C-VLAN=41, DO NOT PUSH S-VLAN*

2) If a single-tag frame is received on ge-0/0/0 with C-VLAN=42, push S-VLAN=5.

3) If a single-tag frame is received on ge-0/0/0 with C-VLAN=51, push S-VLAN=5.

4) If a single-tag frame is received on ge-0/0/0 with C-VLAN=52, push S-VLAN=5.

Conversely, whenever a double-tag frame is to be sent out on ge-0/0/0, the outer S-VLAN ought to be removed (popped).

"DO NOT PUSH S-VLAN" means "leave as a single tagged frame with vlan-id 41 as the only tag"

Can this be done on a Juniper EX4200? If so, please point out the specific configuration commands.

1 Answer 1


Q-in-Q on the 4200 is super non-intuitive, but here is the configuration that will work for you:

If you're mixing Q-in-Q and dot1q, you need to set the dot1q tunnelling ethertype to be 0x8100

set ethernet-switching-options dot1q-tunneling ether-type 0x8100

Now, configure the interface you'll be receiving the C-TAGs on - note that you will only configure it as an untagged interface (very non-intuitive):

set interfaces ge-0/0/7 unit 0 family ethernet-switching

Now create your S-VLAN 5 and "C-VLAN" 41 and apply them to interface ge-0/0/7.0 - note that because the interface is not tagged in the previous step, you have to apply the interface within the VLAN configuration as per below (other interfaces in VLAN 41 can be applied in the normal way):

set vlans SV5 vlan-id 5
set vlans SV5 interface ge-0/0/7.0
set vlans SV5 dot1q-tunneling customer-vlans 42
set vlans SV5 dot1q-tunneling customer-vlans 51
set vlans SV5 dot1q-tunneling customer-vlans 52
set vlans CV41 vlan-id 41
set vlans CV41 interface ge-0/0/7.0 

The last piece is how to deal with the dot1q tag being received; if you leave things as they are, the dot1q traffic for VLAN 41 will be dropped on ingress to port ge-0/0/7.0, so you need to create a VLAN swap action which essentially swaps 41 with 41 (like I said, it's super non-intuitive):

set vlans CV41 interface ge-0/0/7.0 mapping 41 swap

Now you should be able to handle both dot1q and q-in-q frames on the same interface.

One caveat to be aware of is that you can't have an S-VLAN ID the same as any of your C-VLAN IDs, since you need to create the VLAN on the switch to tunnel.

  • Thanks very much Benjamin - that's very helpful. Just one more question: do I need to create C-VLANs 42, 51 and 52 in order for them to be recognised by the switch (in the same way that CV41 was created in your config -.e.g. 'set vlans CV42 vlan-id 42' 'set vlans CV51 vlan-id 51' etc) ... or is simply listing them under the 'set vlans SV5 dot1q-tunneling customer-vlans xx' command enough for the switch to recognise these c-vlan-id's on ingress to interface ge-0/0/7.0 ?
    – Julian
    Feb 18, 2019 at 10:35
  • 1
    No, these C-VLANs you'll be carrying within the S-VLAN aren't "terminated" on the switch eg: there aren't separate forwarding tables created for each of them, just a single forwarding table for the S-VLAN itself, so no need to configure them. Feb 19, 2019 at 0:14
  • Great stuff, that's what I thought, but had to ask just in case! (especially considering how counter-intuitive QinQ on EX4200's appears to be!). Many thanks Benjamin - you've been a great help, it's much appreciated.
    – Julian
    Feb 19, 2019 at 10:13
  • np - if you mark my answer as accepted, it'll help others down the line too (and probably future me when I hit this same issue in 6 months time) Feb 20, 2019 at 7:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.