Configuring Packet Bridging Between Different QinQ S-TAG/C-TAG Pairs on the Same Bridge Domain Port
Starting from NetVisor OS release 7.0.2, an enhancement is implemented to support packet bridging between bridge domain logical ports, i.e., between different QinQ S-TAG/C-TAG pairs on the same physical port for a given bridge domain. This capability allows configurations to use different (S-TAG, C-TAG) BD pairs on the same port and to enable connected endpoints to communicate with each other (even if using different TAG pairs). Ports that support multiple TAG pair combinations (currently up to two) can be host ports as well as redundant trunk or vLAG ports (as shown in the figures below).
Note: This capability requires newer forwarding ASICs for the rewriting of both the S-TAG and C-TAG packet fields while performing packet bridging. So it is supported only on the NRU03, NRU-S0301, AS7726-32X/F9432-C, AS7326-56X/F9480-V, AS5835-54X/F9460-X, AS5835-54T/F9460-T platforms and on the Dell S5200 Series.
Note: For QinQ ports the default TPID is 0x88a8.
To add up to two TAG pairs (i.e., inner and outer VLAN ID pairs), you can use the command sequence shown in the following example:
CLI (network-admin@switch*) > bridge-domain-port-add name BD1 port 17 outer-vlan 106 inner-vlan 41
CLI (network-admin@switch*) > bridge-domain-port-add name BD1 port 17 outer-vlan 107 inner-vlan 42
Trying to add an additional pair to the same port and to the same BD yields an error (since the limit has been reached):
CLI (network-admin@switch*) > bridge-domain-port-add name BD1 port 17 outer-vlan 108 inner-vlan 43
bridge-domain-port-add: cannot add BD port as max Q-in-Q BD port number 2 exceeded for bridge-domain BD1 on port 17
The configuration for BD1 can be displayed like so:
CLI (network-admin@switch*) > bridge-domain-port-show name BD1
name port outer-vlan single-bum-domain inner-vlan l2-learning
------- ---- ---------- ----------------- ---------- -----------
BD1 17 900 false 880 none
BD1 17 901 false 881 none
To remove the BD port configuration:
CLI (network-admin@switch*) > bridge-domain-port-remove name BD1 port 17
Note: This feature is supported with the auto or remove-tags mode of bridge domains. Transparent mode configuration is rejected in conjunction with this feature, as it is not applicable.
CLI (network-admin@switch*) > bridge-domain-create name BD1 scope fabric vxlan 300900 rsvd-vlan 4009 vxlan-inner-packet transparent
CLI (network-admin@switch*) > bridge-domain-port-add name BD1 port 17 outer-vlan 1060 inner-vlan 410
bridge-domain-port-add: bridge-domain BD1 in TRANSPARENT mode, does not support Untagged or QinQ port with both tags
Applicable Network Topologies
This feature’s main use case is to interconnect different endpoints (for example VMs on the same server) configured with different S-TAGs and C-TAGs. The endpoints are configured in the same subnet and can communicate at Layer 2 by bridging traffic between them.
A server may be connected to the leaf switch with a single link as shown below:
Figure 9-7: Single-homed Host Connected to a BD with Multiple (S-TAG, C-TAG) Pairs
Two endpoints within the same subnet can communicate using the following configuration:
CLI (network-admin@switch) > bridge-bridge-domain-create name BD1 scope fabric vxlan 300300 rsvd-vlan 4002
CLI (network-admin@switch) > bridge-domain-port-add name BD1 port 17 outer-vlan 106 inner-vlan 41
CLI (network-admin@switch) > bridge-domain-port-add name BD1 port 17 outer-vlan 107 inner-vlan 42
The inter-endpoint unicast and BUM traffic is bridged within BD1 and is tagged with the (106, 41) and (107, 42) TAG pairs accordingly based on the destination:
CLI (network-admin@switch) > l2-table-show bd BD1
mac bd vlan inner-vlan vxlan ip ports state status
----------------- ---- ---- ---------- ------ ---------- ----- ------ ------
00:12:c0:80:36:a1 BD1 107 42 300300 100.1.1.61 17 active host
00:12:c0:80:33:1e BD1 106 41 300300 100.1.1.51 17 active host
Instead of a single link, a multi-link trunk can be used too for single-homed devices and can be configured like so:
CLI (network-admin@switch*) > trunk-show name trunk1 format name,ports,hash-mode,enable,lacp-mode,lacp-timeout,status
trunk-id name ports hash-mode enable lacp-mode lacp-timeout status
-------- ------ ----- --------- ------ --------- ------------ -------------------------------
272 trunk1 1,125 enhanced on off slow up,PN-switch,PN-other,STP-BPDUs
CLI (network-admin@switch*) > bridge-domain-create name BD1 scope fabric vxlan 12000004 auto-vxlan rsvd-vlan 4019
CLI (network-admin@switch*) > bridge-domain-port-add name BD1 port 272 outer-vlan 510 inner-vlan 61
CLI (network-admin@switch*) > bridge-domain-port-add name BD1 port 272 outer-vlan 610 inner-vlan 51
CLI (network-admin@switch*) > l2-table-show bd BD1
mac bd vlan inner-vlan vxlan ip ports state status
----------------- --- ---- ---------- -------- ---------- ----- ------ ------
00:12:c0:80:33:1e BD1 510 61 12000004 109.1.1.51 1,125 active host
00:12:c0:80:36:a1 BD1 610 51 12000004 109.1.1.61 1,125 active host
For redundancy purposes, a switch cluster pair can be configured with two QinQ ports as a vLAG for the same BD, as shown below, to connect to a dual-homed server:
Figure 9-8: Dual-homed Host Connected to a BD with Multiple (S-TAG, C-TAG) Pairs
Note: This BD configuration works also with Cluster-over-Layer 3.
Alternatively, instead of a server, a switch can also be connected to the vLAG member ports as shown below:
Figure 9-9: Dual-homed Switch Connected to a BD with Multiple (S-TAG, C-TAG) Pairs
Supported TAG Pairings on a Port for a Given BD
Not all TAG pairing schemes are supported:
1) Using different S-TAGs and C-TAGs in the pairings is supported as shown in this example:
CLI (network-admin@switch*) > bridge-domain-create name BD1 scope fabric vxlan 12000001 auto-vxlan rsvd-vlan 4002
CLI (network-admin@switch*) > bridge-domain-port-add name BD1 port 17 outer-vlan 106 inner-vlan 41
CLI (network-admin@switch*) > bridge-domain-port-add name BD1 port 17 outer-vlan 107 inner-vlan 42
CLI (network-admin@switch*) > l2-table-show bd BD1
mac bd vlan inner-vlan vxlan ip ports state status
----------------- --- ---- ---------- -------- ---------- ----- ------ ------
00:12:c0:80:33:1e BD1 106 41 12000001 100.1.1.51 17 active host
00:12:c0:80:36:a1 BD1 107 42 12000001 100.1.1.61 17 active host
2) Using the same CTAG with different S-TAGs in the pairings is supported:
CLI (network-admin@switch*) > bridge-domain-create name BD1 scope fabric vxlan 12000002 auto-vxlan rsvd-vlan 4003
CLI (network-admin@switch*) > bridge-domain-port-add name BD1 port 17 outer-vlan 206 inner-vlan 32
CLI (network-admin@switch*) > bridge-domain-port-add name BD1 port 17 outer-vlan 207 inner-vlan 32
CLI (network-admin@switch*) > l2-table-show bd BD1
mac bd vlan inner-vlan vxlan ip ports state status
----------------- --- ---- ---------- -------- ---------- ----- ------ ------
00:12:c0:80:36:a1 BD1 207 32 12000002 102.1.1.61 17 active host
00:12:c0:80:33:1e BD1 206 32 12000002 102.1.1.51 17 active host
3) On the other hand, reusing the same S-TAG is not a valid configuration:
CLI (network-admin@switch*) > bridge-domain-create name BD1 scope fabric auto-vxlan rsvd-vlan 4009
CLI (network-admin@switch*) > bridge-domain-port-add name BD1 port 17 outer-vlan 306 inner-vlan 33
Trying to add another BD port with same S-TAG/outer VLAN ID is rejected (regardless of the chosen inner VLAN ID):
CLI (network-admin@switch*) > bridge-domain-port-add name BD1 port 17 outer-vlan 306 inner-vlan 35
bridge-domain-port-add: out-vlan 306 for BD port already configured for bridge-domain BD1 on port 17
CLI (network-admin@switch*) > bridge-domain-port-add name BD1 port 17 outer-vlan 306 inner-vlan 33
bridge-domain-port-add: out-vlan 306 for BD port already configured for bridge-domain BD1 on port 17
Configuration of Single and Double TAG on the Same Port
It is also possible to configure on the same port a combination of a single C-TAG and a dual (S-TAG, C-TAG) pairing for the same BD.
In this case, the BD mode needs to be vxlan-inner-packet remove-tags. In other words, in auto or transparent mode the configuration is rejected with an error.
Here is an example of configuration of single and double TAG on the same port:
CLI (network-admin@switch*) > bridge-domain-create name BD1 scope fabric auto-vxlan rsvd-vlan 4005 vxlan-inner-packet remove-tags
CLI (network-admin@switch*) > bridge-domain-port-add name BD1 port 17 outer-vlan 109 inner-vlan 45
CLI (network-admin@switch*) > bridge-domain-port-add name BD1 port 17 vlans 81
CLI (network-admin@switch*) > l2-table-show bd BD1
mac bd vlan inner-vlan vxlan ip ports state status
----------------- --- ---- ---------- -------- ---------- ----- ------ ------
00:12:c0:80:33:1e BD1 109 45 12000000 200.1.1.51 17 active host
00:12:c0:80:36:a1 BD1 81 12000000 200.1.1.61 17 active host
Outer TPID Setting
The standard TPID value for IEEE 802.1ad is 0x88a8 (default setting). In some cases, though, another TPID may be needed (such as 0x8100, called dot1q). Such configuration change means that all the BD ports with QinQ configuration can use 0x8100 as outer TPID. This is possible using port-level configuration like so:
CLI (network-admin@switch*) > port-tpid-modify ports 17 outer-tpid dot1q
CLI (network-admin@switch*) > bridge-domain-create name BD1 scope fabric vxlan 12000004 auto-vxlan rsvd-vlan 4019
CLI (network-admin@switch*) > bridge-domain-port-add name BD1 port 17 outer-vlan 510 inner-vlan 61
CLI (network-admin@switch*) > bridge-domain-port-add name BD1 port 17 outer-vlan 610 inner-vlan 51