Table of Contents 1 QinQ Configuration BPDU Tunneling Configuration 2-1

Transcription

1 Table of Contents 1 QinQ Configuration 1-1 Introduction to QinQ 1-1 Understanding QinQ 1-1 Implementations of QinQ 1-2 Modification of TPID Value of QinQ Frames 1-3 Configuring Basic QinQ 1-4 Configuring Selective QinQ 1-4 Configuring the TPID Value to Be Carried in VLAN Tags 1-5 QinQ Configuration Example BPDU Tunneling Configuration 2-1 Introduction to BPDU Tunneling 2-1 Why BPDU Tunneling 2-1 How BPDU Tunneling Works 2-1 Configuring BPDU Isolation 2-2 Configuring BPDU Transparent Transmission 2-3 Configuring Destination Multicast MAC Address for BPDU Tunnel Frames 2-4 BPDU Tunneling Configuration Example 2-4 i

2 1 QinQ Configuration The term switch in this document refers to a switch in a generic sense or an access controller configured with the switching function unless otherwise specified. When configuring QinQ, go to these sections for information you are interested in: Introduction to QinQ Configuring Basic QinQ Configuring Selective QinQ Configuring the TPID Value to Be Carried in VLAN Tags QinQ Configuration Example Introduction to QinQ In the VLAN tag field defined in IEEE 802.1Q, only 12 bits are used for VLAN IDs, so a switch can support a maximum of 4,094 VLANs. In actual applications, however, a large number of VLANs are required to isolate users, especially in metropolitan area networks (MANs), and 4,094 VLANs are far from satisfying such requirements. Understanding QinQ The port QinQ feature is a flexible, easy-to-implement Layer 2 VPN technique, which enables the access point to encapsulate an outer VLAN tag in Ethernet frames from customer networks (private networks), so that the Ethernet frames will travel across the service provider s backbone network (public network) with double VLAN tags. The inner VLAN tag is the customer network VLAN tag while the outer one is the VLAN tag assigned by the service provider to the customer. In the public network, frames are forwarded based on the outer VLAN tag only, with the source MAC address learned as a MAC address table entry for the VLAN indicated by the outer tag, while the customer network VLAN tag is transmitted as part of the data in the frames. Figure 1-1 shows the structure of 802.1Q-tagged and double-tagged Ethernet frames. The QinQ feature enables a device to support up to 4,094 x 4,094 VLANs to satisfy the requirement for the amount of VLANs in the MAN. 1-1

3 Figure 1-1 Single-tagged frame structure vs. double-tagged Ethernet frame structure Advantages of QinQ: Addresses the shortage of public VLAN ID resource. Enables customers to plan their own VLAN IDs, without running into conflicts with public network VLAN IDs. Provides an easy-to-do Layer 2 VPN solution for small-sized MANs or intranets. The QinQ feature requires configurations only on the service provider network, and not on the customer network. Implementations of QinQ There are two types of QinQ implementations: basic QinQ and selective QinQ. 1) Basic QinQ Basic QinQ is a port-based feature, which is implemented through VLAN VPN. With the VLAN VPN feature enabled on a port, when a frame arrives at the port, the switch will tag it with the port s default VLAN tag, regardless of whether the frame is tagged or untagged. If the received frame is already tagged, this frame becomes a double-tagged frame; if it is an untagged frame, it is tagged with the port s default VLAN tag. 2) Selective QinQ Selective QinQ is a more flexible, VLAN-based implementation of QinQ. In addition to all the functions of basic QinQ, selective QinQ can tag the frame with different outer VLAN tags based on different inner VLAN IDs. 1-2

4 For a WX6103 access controller switch interface board with both basic QinQ function and selective QinQ function enabled, packets received are processed according to the settings of selective QinQ first. Those that do not match selective QinQ settings are tagged with outer VLAN tags according to the basic QinQ settings. Modification of TPID Value of QinQ Frames A VLAN tag uses the tag protocol identifier (TPID) field to identify the protocol type of the tag. The value of this field, as defined in IEEE 802.1Q, is 0x8100. Figure 1-2 shows the 802.1Q-defined tag structure of an Ethernet frame. Figure 1-2 VLAN Tag structure of an Ethernet frame On devices of different vendors, the TPID field of the outer VLAN tag of QinQ frames may have different default values. You can set and/or modify this TPID value. Normally, a frame with the TPID field being 0x8100 is regarded carrying a VLAN tag with it and is processed in the preset way when it reaches a switch. Those with their TPID not being 0x8100 are regarded carrying no VLAN tag. After you configure the TPID value to be adjustable, the switch replaces the TPID value in the outer VLAN tag of a received frame with the customer-defined value before forwarding the frame, so that the frame, when arriving at the public network, is of specific protocol type. This enables a switch to communicate with devices of other vendors. The TPID in an Ethernet frame has the same position with the protocol type field in a frame without a VLAN tag. To avoid problems in packet forwarding and handling in the network, you cannot set the TPID value to any of the values in the table below. Table 1-1 Reserved protocol type values Protocol type Value ARP PUP RARP IP IPv6 PPPoE 0x0806 0x0200 0x8035 0x0800 0x86DD 0x8863/0x

5 Protocol type Value MPLS IPX/SPX IS-IS LACP 0x8847/0x8848 0x8137 0x8000 0x x 0x888E Cluster Reserved 0x88A7 0xFFFD/0xFFFE/0xFFFF Configuring Basic QinQ Follow these steps to configure basic QinQ: To do... Use the command... Remarks Enter system view system-view Enter Ethernet port view or port group view Enter Ethernet port view Enter port group view interface interface-type interface-number port-group { manual port-group-name aggregation agg-id } Use either command. Configurations made in Ethernet port view will take effect on the current port only; configuration made in port group view will take effect on all ports in the port group. Enable QinQ on the port(s) qinq enable Disabled by default. Configuring Selective QinQ The outer VLAN tag added to a frame by the basic QinQ feature is the VLAN tag corresponding to the port s default VLAN ID, while the selective QinQ feature allows adding different outer VLAN tags based on different inner VLAN tags. With selective QinQ configured on a port, the device attaches different outer VLAN tags based on the inner VLAN tags; frames with a VLAN ID out of the range specified in the raw-vlan-id inbound command are attached the port s default VLAN tag as the outer tag. Follow these steps to configure selective QinQ: 1-4

6 To do... Use the command... Remarks Enter system view system-view Enter Ethernet port view or port group view Enter Ethernet port view Enter port group view interface interface-type interface-number port-group { manual port-group-name aggregation agg-id } Use either command. Configurations made in Ethernet port view will take effect on the current port only; configurations made in port group view will take effect on all ports in the port group. Enter QinQ view and configure the outer VLAN tag for the port to add Configure inner VLAN tags corresponding to the outer VLAN tags qinq vid vlan-id raw-vlan-id inbound { all vlan-id-list } An inner VLAN tag corresponds to only one outer VLAN tag. If you want to change an outer VLAN tag, you must delete the old outer VLAN tag configuration and configure a new outer VLAN tag. You can configure selective QinQ and basic QinQ on the same port. The switch uses the basic QinQ function to attach the port s default VLAN tag as the outer tag to frames that do not match the selective QinQ mapping rule. Configuring the TPID Value to Be Carried in VLAN Tags You can configure the TPID value to be carried in a VLAN tag TPID globally (configuration will take effect on all ports of the device). To do... Use the command... Remarks Enter system view system-view Configure the TPID value to be carried in VLAN tags qinq ethernet-type { customer-tag service-tag } hex-value Optional Both 0x8100 by default QinQ Configuration Example Network requirements Provider A and Provider B are service provider network access devices. Customer A, Customer B and Customer C are customer network access devices. Provider A and Provider B are interconnected through a configured trunk port. Provider A belongs to VLAN 1000 of the service provider network, and Provider B belongs to VLAN 2000 of the service provider network. Third-party devices are deployed between Provider A and Provider B, with a TPID value of 0x8200. After configuration, the network should satisfy the following requirement: 1-5

7 Frames of VLAN 10 of Customer A and frames of VLAN 10 of Customer B can be forwarded to each other through VLAN 1000 of the provider network; Frames of VLAN 20 of Customer A and frames of VLAN 20 of Customer C can be forwarded to each other through VLAN 2000 of the provider network. Network diagram Figure 1-3 Network diagram for QinQ configuration Customer A VLAN 10,VLAN 20 Provider A GE0/0/1 Hybrid GE0/0/2 Access GE0/0/3 Trunk Public network VLAN 1000, VLAN 2000 TPID=0x8200 Provider B GE0/0/1 Trunk GE0/0/2 Access VLAN 10 VLAN 20 Customer B Customer C Configuration procedure With this configuration, the user can allow the QinQ packets to pass between the devices of the service providers. 1) Configuration on Provider A # Enter system view. <ProviderA> system-view Configuration on GigabitEthernet 0/0/1 # Configure GigabitEthernet 0/0/1 as a Hybrid port that permits frames of VLAN 1000 and VLAN 2000 to pass, and configure the port to remove the outer tag of the fames when sending them out. [ProviderA] interface GigabitEthernet 0/0/1 [ProviderA-GigabitEthernet0/0/1] port link-type hybrid [ProviderA-GigabitEthernet0/0/1] port hybrid vlan untagged # Configure the port to tag frames from VLAN 10 with an outer tag with the VLAN ID of

8 [ProviderA-GigabitEthernet0/0/1] qinq vid 1000 [ProviderA-GigabitEthernet0/0/1-vid-1000] raw-vlan-id inbound 10 [ProviderA-GigabitEthernet0/0/1-vid-1000] quit # Configure the port to tag frames from VLAN 20 with an outer tag with the VLAN ID of [ProviderA-GigabitEthernet0/0/1] qinq vid 2000 [ProviderA-GigabitEthernet0/0/1-vid-2000] raw-vlan-id inbound 20 [ProviderA-GigabitEthernet0/0/1-vid-2000] quit [ProviderA-GigabitEthernet0/0/1] quit Configuration on GigabitEthernet 0/0/2 # Configure VLAN 1000 as the default VLAN of the port. [ProviderA] interface GigabitEthernet 0/0/2 [ProviderA-GigabitEthernet0/0/2] port access vlan 1000 # Enable basic QinQ so that the port tags frames from VLAN 10 with an outer tag with the VLAN ID of [ProviderA-GigabitEthernet0/0/2] qinq enable [ProviderA-GigabitEthernet0/0/2] quit Configuration on GigabitEthernet 0/0/3. # Configure GigabitEthernet 0/0/3 as a trunk port, and permit frames of VLAN 1000 and VLAN 2000 to pass. [ProviderA] interface GigabitEthernet 0/0/3 [ProviderA-GigabitEthernet0/0/3] port link-type trunk [ProviderA-GigabitEthernet0/0/3] port trunk permit vlan # To enable interoperability with the third-party devices in the public network, set the TPID value to be carried in VLAN Tags to 0x8200. [ProviderA-GigabitEthernet0/0/3] quit [ProviderA] qinq ethernet-type customer-tag ) Configuration on Provider B Configuration on GigabitEthernet 0/0/1 # Configure GigabitEthernet 0/0/1 as a trunk port, and permit frames of VLAN 1000 and VLAN <ProviderB> system-view [ProviderB] interface GigabitEthernet 0/0/1 [ProviderB-GigabitEthernet0/0/1] port link-type trunk [ProviderB-GigabitEthernet0/0/1] port trunk permit vlan # To enable interoperability with the third-party devices in the public network, set the TPID value to be carried in VLAN Tags to 0x8200. [ProviderB-GigabitEthernet0/0/1] quit [ProviderB] qinq ethernet-type customer-tag 8200 Configuration on GigabitEthernet 0/0/2 # Configure VLAN 2000 as the default VLAN of the port. [ProviderB] interface GigabitEthernet 0/0/2 [ProviderB-GigabitEthernet0/0/2] port access vlan 2000 # Enable basic QinQ so as to tag frames from VLAN 20 with an outer tag with the VLAN ID of [ProviderB-GigabitEthernet0/0/2] qinq enable 3) Configuration on devices on the public network As third-party devices are deployed between Provider A and Provider B, what we discuss here is only the basic configuration that should be made on the devices. Configure that device connecting with 1-7

9 GigabitEthernet 0/0/3 of Provider A and the device connecting with GigabitEthernet 0/0/1 of Provider B so that their corresponding ports send tagged frames of VLAN 1000 and VLAN The configuration steps are omitted here. 1-8

10 2 BPDU Tunneling Configuration When configuring BPDU tunneling, go to these sections for information you are interested in: Introduction to BPDU Tunneling Configuring BPDU Isolation Configuring BPDU Transparent Transmission Configuring Destination Multicast MAC Address for BPDU Tunnel Frames BPDU Tunneling Configuration Example Introduction to BPDU Tunneling Why BPDU Tunneling To avoid loops in your network, you can enable the spanning tree protocol (STP) on your device. However, STP gets aware of the topological structure of a network by means of bridge protocol data units (BPDUs) exchanged between different devices and the BPDUs are Layer 2 multicast packets, which can be received and processed by all STP-enabled devices on the network. This prevents each network from correctly calculating its spanning tree. As a result, when redundant links exist in a network, data loops will unavoidably occur. By allowing each network to have its own spanning tree while running STP, BPDU tunneling can resolve this problem. BPDU tunneling can isolate BPDUs of different customer networks, so that one network is not affected by others while calculating the topological structure. BPDU tunneling enables BPDUs of the same customer network to be broadcast in a specific VLAN in the provider network, so that the geographically dispersed customer networks of the same customer can implement consistent spanning tree calculation across the provider network. How BPDU Tunneling Works The BPDU tunneling implements the following two functions: BPDU isolation BPDU transparent transmission The work process of IGMP is as follows: BPDU isolation When a port receives BPDUs of other networks, the port will discard the BPDUs, so that they will not take part in spanning tree calculation. Refer to Configuring BPDU Isolation. BPDU transparent transmission As shown in Figure 2-1, the upper part is the service provider network, and the lower part represents the customer networks. The customer networks include network A and network B. Enabling the BPDU tunneling function on the BPDU input/output devices across the service provider network allows BPDUs of the customer networks to be transparently transmitted in the service provider network, and allows 2-1

11 each customer network to implement independent spanning tree calculation, without affecting each other. Refer to Configuring BPDU Transparent Transmission. Figure 2-1 Network hierarchy of BPDU tunneling BPDU input/output device Service provider network Network BPDU input/output device Network A Customer networks Network B At the BPDU input side, the device changes the destination MAC address of a BPDU from a customer network from 0x0180-C to a special multicast MAC address, 0x010F-E by default. In the service provider s network, the modified BPDUs are forwarded as data packets in the user VLAN. At the packet output side, the device recognizes the BPDU with the destination MAC address of 0x010F-E and restores its original destination MAC address 0x0180-C Then, the device removes the outer tag, and sends the BPDU to the destination customer network. Make sure, through configuration, that the VLAN tag of the BPDU is neither changed nor removed during its transparent transmission in the service provider network; otherwise, the system will fail to transparently transmit the customer network BPDU correctly. Configuring BPDU Isolation Perform the following tasks to configure BPDU isolation: To do... Use the command... Remarks Enter system view system-view Enable BPDU tunneling globally bpdu-tunnel dot1q enable Optional Enabled by default 2-2

12 To do... Use the command... Remarks Enter Ethernet port view or port group view Enter Ethernet port view Enter port group view interface interface-type interface-number port-group { manual port-group-name aggregation agg-id } Use either command. Configurations made in Ethernet port view will take effect on the current port only; configurations made in port group view will take effect on all ports in the port group. Enable BPDU tunneling for the port(s) bpdu-tunnel dot1q enable Disabled by default BPDU tunneling must be enabled globally before the BPDU tunnel configuration for a port can take effect. The BPDU tunneling feature is incompatible with the GVRP feature, so these two features cannot be enabled at the same time. For introduction to GVRP, refer to VLAN in H3C WX6103 Access Controller Switch Interface Board Configuration Guide. The BPDU tunneling feature is incompatible with the NTDP feature, so these two features cannot be enabled at the same time. If you want to enable BPDU tunneling on a port, use the undo ntdp enable command to disable NTDP first. For introduction to NTDP, refer to Cluster Management in H3C WX6103 Access Controller Switch Interface Board Configuration Guide. Configuring BPDU Transparent Transmission Perform the following tasks to configure BPDU transparent transmission: To do... Use the command... Remarks Enter system view system-view Enable BPDU tunneling globally bpdu-tunnel dot1q enable Optional Enabled by default Enter Ethernet port view or port group view Enter Ethernet port view Enter port group view interface interface-type interface-number port-group { manual port-group-name aggregation agg-id } Use either command. Configurations made in Ethernet port view will take effect on the current port only; configurations made in port group view will take effect on all ports in the port group. Enable BPDU tunneling on the port(s) Disable STP on the port(s) Enable BPDU tunneling for STP on the port(s) bpdu-tunnel dot1q enable stp disable bpdu-tunnel dot1q stp Disabled by default Enabled by default Disabled by default 2-3

13 BPDU tunneling must be enabled globally before the BPDU tunnel configuration for a port can take effect. The BPDU tunneling feature is incompatible with the GVRP feature, so these two features cannot be enabled at the same time. For introduction to GVRP, refer to VLAN in H3C WX6103 Access Controller Switch Interface Board Configuration Guide. The BPDU tunneling feature is incompatible with the NTDP feature, so these two features cannot be enabled at the same time. If you want to enable BPDU tunneling on a port, use the undo ntdp enable command to disable NTDP first. For introduction to NTDP, refer to Cluster Management in H3C WX6103 Access Controller Switch Interface Board Configuration Guide. Configuring Destination Multicast MAC Address for BPDU Tunnel Frames By default, the destination multicast MAC address for BPDU Tunnel frames is 0x010F-E You can modify it to 0x0100-0CCD-CDD0, 0x0100-0CCD-CDD1 or 0x0100-0CCD-CDD2 through the following configuration. Follow these steps to configure destination multicast MAC address for BPDU tunnel frames: To do Use the command Remarks Enter system view system-view Configure the destination multicast MAC address for BPDU Tunnel frames bpdu-tunnel tunnel-dmac mac-address Optional 0x010F-E by default. BPDU Tunneling Configuration Example Network requirements Customer A, Customer B, Customer C, and Customer D are customer network access devices. Provider A, Provider B, and Provider C are service provider network access devices, which are interconnected through configured trunk ports. The configuration is required to satisfy the following requirements: Geographically dispersed customer network devices Customer A, Customer C and Customer D can implement consistent spanning tree calculation across the service provider network. BPDU packets from Customer B are isolated so it does not take part in the spanning tree calculation. 2-4

14 Network diagram Figure 2-2 Network diagram for BPDU tunneling configuration Customer A Customer B VLAN 2 GE0/0/1 VLAN 4 Trunk Provider A GE0/0/2 Provider B Trunk Trunk VLAN 2 GE0/0/4 Provider C VLAN 2 GE0/0/3 Customer D Customer C Configuration procedure 1) Configuration on Provider A # Configure BPDU transparent transmission on GigabitEthernet 0/0/1. <ProviderA> system-view [ProviderA] interface GigabitEthernet 0/0/1 [ProviderA-GigabitEthernet0/0/1] port access vlan 2 [ProviderA-GigabitEthernet0/0/1] stp disable [ProviderA-GigabitEthernet0/0/1] undo ntdp enable [ProviderA-GigabitEthernet0/0/1] bpdu-tunnel dot1q enable [ProviderA-GigabitEthernet0/0/1] bpdu-tunnel dot1q stp 2) Configuration on Provider B # Configure BPDU isolation on GigabitEthernet 0/0/2. <ProviderB> system-view [ProviderB] interface GigabitEthernet 0/0/2 [ProviderB-GigabitEthernet0/0/2] port access vlan 4 [ProviderB-GigabitEthernet0/0/2] undo ntdp enable [ProviderB-GigabitEthernet0/0/2] bpdu-tunnel dot1q enable 3) Configuration on Provider C # Configure BPDU transparent transmission on GigabitEthernet 0/0/3. <ProviderC> system-view [ProviderC] interface GigabitEthernet 0/0/3 [ProviderC-GigabitEthernet0/0/3] port access vlan 2 [ProviderC-GigabitEthernet0/0/3] stp disable [ProviderC-GigabitEthernet0/0/3] undo ntdp enable [ProviderC-GigabitEthernet0/0/3] bpdu-tunnel dot1q enable [ProviderC-GigabitEthernet0/0/3] bpdu-tunnel dot1q stp # Configure BPDU transparent transmission on GigabitEthernet 0/0/4. [ProviderC-GigabitEthernet0/0/3] quit 2-5

15 [ProviderC] interface GigabitEthernet 0/0/4 [ProviderC-GigabitEthernet0/0/4] port access vlan 2 [ProviderC-GigabitEthernet0/0/4] stp disable [ProviderC-GigabitEthernet0/0/4] undo ntdp enable [ProviderC-GigabitEthernet0/0/4] bpdu-tunnel dot1q enable [ProviderC-GigabitEthernet0/0/4] bpdu-tunnel dot1q stp When STP works stably on the customer network, if Customer A acts as the root bridge, the ports of Customer C and Customer D connected with Provider C can receive BPDUs from Customer A. Since BPDU isolation is enabled on Customer B, the port that connects Customer B to Provider B cannot receive BPDUs from Customer A. 2-6