What is QinQ and when would you use it?
Show the answer
Say this first
QinQ (802.1ad provider bridging) adds a second, outer VLAN tag in front of the customer's tag, so a
provider can carry all of a customer's VLANs through its network inside one service VLAN. The standard
outer tag uses EtherType 0x88A8; Cisco dot1q-tunnel ports on many Catalyst platforms use 0x8100
for both. Each tag adds 4 bytes, so a full-size customer frame becomes 1526 bytes and the core MTU has to allow it.
Go deeper
Where it fits
- Metro Ethernet: one service VLAN per customer, with the customer's own VLANs untouched inside it.
- Multi-tenant data centers and labs that need to overlap VLAN IDs between tenants.
- Scale: 4094 outer by 4094 inner identifiers.
Catalyst provider edge port
vlan 100
name CUST-A
!
interface GigabitEthernet1/0/10
description Customer A handoff
switchport access vlan 100
switchport mode dot1q-tunnel
l2protocol-tunnel cdp
l2protocol-tunnel stp
l2protocol-tunnel vtp
!
system mtu 1504Every frame from the customer, tagged or not, gets an outer tag of 100 on the provider trunks and loses it again at the far tunnel port.
Layer 2 protocol tunneling
Without l2protocol-tunnel, the provider switch would process or drop the customer's CDP, STP and VTP.
With it, those frames are carried across so the customer's sites see each other as directly connected.
They will ask next
How does QinQ compare with VXLAN?
Both stretch layer 2 for many tenants. VXLAN uses a 24-bit VNI (about 16 million segments) inside UDP over a routed IP underlay, so it gets ECMP and needs no spanning tree in the core. QinQ is simpler but runs over a layer 2 provider network.
Traps
- Forgetting the MTU. Two tags on a 1500-byte payload make a 1526-byte frame.