we have a nexus switch, we configure two customer ports in different switches with (mode Dot1Q tunnel) as all traffic must have two VLAN tags, an inner tag, and an outer tag, in our network, we defined only one VLAN (outer tag) to connect two ports of one customer (different location) the customer has more than 1000 Host in his network, a when I check the mac-address-table of my switch we notice all host's mac address of the customer is added to our mac-table as do1q tunnel, we must only see one mac-address of edge customer Switch, but why my switch add all mac-address of the host's customer to my mac-address-table

3 Answers 3


we must only see one mac-address of edge customer Switch

That's not how Q-in-Q works.

When forwarded across the service provider's backbone, the frames will still have the original Src and DstMac from the client's original ethernet frame, complemented by the the service provider's additional VLAN Tag.

With Q-in-Q, the customers tagged ethernet frame is not fully encapsulated into another full Ethernet frame; only the service provider's VLAN tag is inserted.

By consequence, the CAM tables on the the service provider's Q-in-Q providing switches must scale to accomodate as many MAC adresses as the customer throws at it. On some hardware platforms, a limit can be configured per port or per VLAN.

If that is undesirable, then the service provider will have to look into other technologies than Q-in-Q, most of which will do some form of full encapsulation of the customer's (tagged) frames.


we must only see one mac-address of edge customer Switch

No. QinQ is still bridging and bridging requires MAC addresses - the source for learning, the destination for forwarding. With learning the source MAC addresses, the switch wouldn't know whether or where to forward a frame.

QinQ is basically the same as classic 802.1Q tagging, just with two levels of tags, each possibly controlled by a different entity.

QinQ enables you to tag all customer frames with an outer (S-)tag that you control whole allowing them any inner (C-)tag that they like. There's no additional/encapsulating MAC header, so the original header is used.

This is in contrast to e.g. VXLAN which tunnels and encapsulates frames inside the tunnel (using UDP over IP), hiding the inner frame. Only the tunnel endpoints (VTEPs) see the end-to-end MAC addresses and VLANs, any intermediate node just sees the VTEPs' MAC addresses (switches) or IP addresses (routers).


I believe the issue is that you only used the outer VLAN when you need to use the inner VLAN or both outer and inner (Q in Q) for encapsulating the traffic. The outer VLAN exists for your network infrastructure, hence why you see their MAC addresses on your infrastructure. Keep their traffic encapsulated in the inner VLAN and it should isolate their MAC addresses from your infrastructure.

  • Neither tag encapsulates anything - tags are just added to the frame. All MACs stay visible and are required for bridging.
    – Zac67
    Commented Oct 31, 2022 at 15:56
  • Sorry if my terminology is confusing or unclear, Cisco generally refers to it as Q-in-Q Tunneling or Encapsulation so that is what I am used to. Adding additional frame headers is often called encapsulation (as opposed to encryption where the payload is modified to be unreadable). Here are some additional links that may be helpful with the configuration: cisco.com/en/US/docs/ios/lanswitch/configuration/guide/… networkdirection.net/articles/routingandswitching/… You can disable MAC Address Learning on a VLAN as well. Commented Oct 31, 2022 at 17:53
  • Here is the command for Cisco switches using IOS: no mac address-table learning vlan [1-4094] Commented Oct 31, 2022 at 17:54
  • If you turn off MAC learning in a VLAN you need to use static associations. A P2MP link-layer network does not work without MAC addresses or similar.
    – Zac67
    Commented Oct 31, 2022 at 18:09
  • Disabling MAC learning for a given S-VLAN on the service provider network will force the provider switches to do flooding (much link unknown unicast flooding) throughout the said VLAN (unless some static mappings are added, see Zac67's comment). Disabling MAC learning is a tool to use with great caution - the provider must really know what they're doing and consider the consequences thereof. Commented Nov 1, 2022 at 8:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.