IEEE 802.1Q Tunneling (QinQ) and L2PT on L2 Ports

Transcription

1 IEEE 802.1Q Tunneling (QinQ) and L2PT on L2 Ports Revised: July 27, 2012 OL First Published: November 11, 2011 Last Updated: July 27, 2012 This feature provides Layer 2 Tunneling support for QinQ and Layer 2 Protocol Tunneling (L2PT) on Integrated Services Router Generation 2 (ISR G2). User interface will be aligned with the service provider module or switch to support QinQ and L2PT on ISR G2 Layer 2 Port. This enables service providers to run Layer 2 Ethernet services and provide transparent LAN services over a metropolitan Ethernet infrastructure to customers. Finding Feature Information Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the Feature Information for QinQ and L2PT section on page 34. Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to An account on Cisco.com is not required. Contents Prerequisites for QinQ and L2PT on L2 Ports, page 2 Restrictions for QinQ and L2PT on L2 Ports, page 2 Information About QinQ and L2PT on L2 Ports, page 3 How to Implement QinQ and L2PT on L2 Ports, page 5 Configuration Examples for QinQ and L2PT on L2 Ports, page 9 Command Reference, page 21 Americas Headquarters: Cisco Systems, Inc., 170 West Tasman Drive, San Jose, CA USA

2 Prerequisites for QinQ and L2PT on L2 Ports Feature Information for QinQ and L2PT, page 34 Glossary, page 35 Prerequisites for QinQ and L2PT on L2 Ports Ensure that you have the appropriate Cisco routers and switches. This feature supports the following Integrated Series Router Generation 2 (ISR G2) platforms: Cisco 89x and 888EA ISR G2 Cisco 19xx ISR G2 Cisco 29xx ISR G2 Cisco 39xx ISR G2 Ensure that you have the appropriate ether-switch modules installed in ISR G2: HWIC-4ESW, HWIC-4ESW-PO HWIC-D-9ESW, HWIC-D-9ESW-POE EHWIC-4ESG, EHWIC-4ESG-P EHWIC-D-8ESG, EHWIC-D-8ESG-P Note You cannot use the EHWIC switch in conjunction with the HWICs. Note This feature supports Release 15.2(2)T and later releases. Restrictions for QinQ and L2PT on L2 Ports Configuration through SNMP/MIB is not supported. The following dual-attached topology will not be supported where two links from the switch are connected to the same PE: Switch 1 PE1 IPCore PE2 Switch Although 802.1Q tunneling works well for Layer 2 packet switching, incompatibilities exist between some Layer 2 features and Layer 3 switching: A tunnel port cannot be a routed port. IP routing is not supported on a VLAN that includes 802.1Q ports. Packets received from a tunnel port are forwarded based only on Layer 2 information. If routing is enabled on a switch virtual interface (SVI) that includes tunnel ports, untagged IP packets received from the tunnel port are recognized and routed by the switch. Customers can access the Internet through the native VLAN. If this access is not needed, you should not configure SVIs on VLANs that include tunnel ports. 2 Prerequisites for QinQ and L2PT on L2 Ports

3 Information About QinQ and L2PT on L2 Ports Tunnel ports do not support IP access control lists (ACLs). Layer 3 quality of service (QoS) ACLs and other QoS features related to Layer 3 information are not supported on tunnel ports. MAC-based QoS is supported on tunnel ports. Information About QinQ and L2PT on L2 Ports Customers are connected across a service-provider network that are connected to various Layer 2 customer premises equipments (CPEs). Cisco devices will be configured to work with third-party CPEs. All configurations will be done at the Provider Edge (PE). Service providers can take advantage of ISR G2 support for xconnect over Multiprotocol Label Switching (SVIEoMPLS) over generic routing encapsulation (GRE) with Static Pseudowire Provisioning and L2PT on Layer 2 ports, dot1q tunnel mode support on Layer 2 ports, customizable L2PT tunneling MAC address, and other Layer 2 Ethernet services. Benefits of QinQ and L2PT on L2 Ports Simpler Architecture and Lower Operational Cost Layer 2 Ethernet services are offered as a specific service based on pure Ethernet access. End-to-end Ethernet services have simpler architecture with lower operational cost. Scalability The objectives of these enhancements are to enable service providers to extend Layer 2 Ethernet services over any access technology and provide transparent LAN services over a metropolitan Ethernet infrastructure to customers. Because QinQ uses a double-tagged frame technique, it doubles the theoretical frame size limit of the IEEE 802.1Q, which is sufficient to accommodate network growth for several years. Efficiency These enhancements will also enable service providers to run both IP and non-ip traffic under the same CPE. Features The following concepts will help you understand how to implement QinQ and L2PT, which are the focus of this documentation: Port-based EoMPLS over GRE with Static Pseudowire Provisioning Virtual Private Network Layer 2 Protocol Tunneling QinQ Support on Layer 2 Ports Customizable Tunneling MAC Address 3

4 Information About QinQ and L2PT on L2 Ports Port-based EoMPLS over GRE with Static Pseudowire Provisioning Ethernet over multiprotocol label switching (EoMPLS) is a tunneling mechanism that allows you to tunnel Layer 2 traffic through a Layer 3 MPLS network. EoMPLS is also known as Layer 2 tunneling. EoMPLS effectively facilitates the Layer 2 extension over long distances. EoMPLS over GRE helps create the GRE tunnel as a hardware-based switch and encapsulates EoMPLS frames within the GRE tunnel with high performance. The GRE connection is established between the two core routers and then the MPLS label switch path (LSP) is tunneled over. The following are the required features: EoMPLS pseudowire over GRE with static label EoMPLS xconnect on SVI Allow set dscp/prec tunnel for policy-maps output on tunnel interfaces Port-based pseudowire on Layer 3 ports Note Port-based pseudowire on Layer 3 ports and allow set dscp/prev tunnel for policy-maps output on tunnel interfaces are supported on IOS Release 15.2(4)M and later releases. For more information about EoMPLS over GRE, see Virtual Private Network Layer 2 Protocol Tunneling Virtual private networks (VPNs) provide enterprise-scale connectivity on a shared infrastructure, often Ethernet-based, with the same security, prioritization, reliability, and manageability requirements of private networks. VPNs provide security through encryption tunneling, and the Cisco routers support hardware-based Triple Data Encryption Standard (3DES) IP Security (IPsec), Advanced Encryption Standard (AES), and Secure Sockets Layer VPN (SSL VPN). Encryption features can be enabled on the routers with the Advanced Security or any later feature set of the Cisco IOS Software. Layer 2 Protocol Tunneling allows Layer 2 protocol data units (PDUs) (CDP, STP, LACP, PAgP, UDLD, and VTP) to be tunneled through a network. For more information about L2PT, see 2pt.html. The following are the required features: Customizable Tunneling MAC Address Port-based PW on Layer 2 ports L2PT on Layer 2 ports L2PT on Layer 3 ports Note L2PT on Layer 3 Ports is supported in 15.2 (4)M. 4 Information About QinQ and L2PT on L2 Ports

5 How to Implement QinQ and L2PT on L2 Ports QinQ Support on Layer 2 Ports QinQ or QnQ is short for 802.1Q-in-802.1Q. The original 802.1Q specification allows a single VLAN header to be inserted into an Ethernet frame. QinQ enables service providers to use a single VLAN to support customers who have multiple VLANs, while preserving customer VLAN IDs and keeping traffic in different customer VLANs segregated. For more information about QinQ, see ot1qtnl.html. The following is the required feature: Switchport mode dot1q-tunnel QinQ on Layer 2 Ethernet port Customizable Tunneling MAC Address Because customers are connected across a service-provider network that are connected to various Layer 2 third-party CPEs, they do not use the same MAC address, which can cause conflicts to Cisco devices. To resolve this, Cisco L2PT destination MAC address will be configurable and will be set as the default MAC address. Customizable Tunneling MAC Address is a sub-feature of L2PT. How to Implement QinQ and L2PT on L2 Ports Configuring QinQ and L2PT on L2 Ports, page 5 Configuring xconnect on SVI, page 7 Configuring QinQ and L2PT on L2 Ports SUMMARY STEPS 1. enable 2. configure terminal 3. interface interface-id 4. switchport mode access or switchport mode dot1q-tunnel 5. l2protocol-tunnel [cdp stp vtp lacp pagp udld] 6. end 7. show l2protocol 8. copy running-config startup-config (Optional) 5

6 How to Implement QinQ and L2PT on L2 Ports DETAILED STEPS Step 1 Step 2 Command or Action enable Example: Router> enable configure terminal Purpose Enables privileged EXEC mode. Enter your password if prompted. Enters global configuration mode. Step 3 Step 4 Example: Router# configure terminal interface interface-id Example: Router(config)# interface FastEthernet3 switchport mode access or switchport mode dot1q-tunnel Enters interface configuration mode and the interface to be configured as a tunnel port. This should be the edge port in the service provider network that connects to the customer switch. Valid interfaces can be physical interfaces and port-channel logical interfaces (port channels 1 to 64). Configures the interface as an access port or as an IEEE 802.1Q tunnel port. Example: Router(config-if)# switchport mode access Step 5 l2protocol-tunnel [cdp stp vtp lacp pagp udld] Step 6 Example: Router(config-if)# l2protocol-tunnel cdp end Enables protocol tunneling for the desired protocol. If no keyword is entered, tunneling is enabled for all three Layer 2 protocols. Returns to privileged EXEC mode. Step 7 Step 8 Example: Router(config-if)# end show l2protocol Example: Router# show l2protocol copy running-config startup-config Displays the Layer 2 tunnel ports on the switch, including the protocols configured in the thresholds and in the counters. (Optional) Saves your entries in the configuration file. Example: Router# copy running-config startup-config Example The following is a sample output from the show l2protoclol-tunnel command on PE1: Router# show l2protocol-tunnel COS for Encapsulated Packets: 5 l2protocol-tunnel mac-address: ccd.cdd0 Drop Threshold for Encapsulated Packets: 0 6 How to Implement QinQ and L2PT on L2 Ports

7 How to Implement QinQ and L2PT on L2 Ports Port Protocol Shutdown Drop Encaps Decaps Drop Threshold Threshold Counter Counter Counter Fa0 cdp stp vtp pagp lacp Troubleshooting Tips Use the following verification commands on CE: show cdp neighbor show spanning tree vlan vlan-id show vtp status show udld neighbor show etherchannel channel-group-number summary Configuring xconnect on SVI SUMMARY STEPS 1. enable 2. configure terminal 3. interface interface-id xconnect peer-ip-address vcid pseudowire-parameters 6. mpls local-pseudowire-label remote-pseudowire-label DETAILED STEPS Step 1 Step 2 Command or Action enable Example: Router> enable configure terminal Purpose Enables privileged EXEC mode. Enter your password if prompted. Enters global configuration mode. Example: Router# configure terminal 7

8 How to Implement QinQ and L2PT on L2 Ports Step 3 Step 4 Command or Action interface interface-id Example: Router(config)# interface FastEthernet3 Purpose Enters interface configuration mode and the interface to be configured as a tunnel port. This should be the edge port in the service provider network that connects to the customer switch. Valid interfaces can be physical interfaces and port-channel logical interfaces (port channels 1 to 64). Removes the IP address. Step 5 Step 6 Example: Router(config)# xconnect peer-ip-address vcid pseudowire-parameters Example: Router(config)# xconnect encapsulation mpls manual pw-class test mpls label local-pseudowire-label remote-pseudowire-label Example: Router# mpls label Specifies the IP address of the peer PE router. The peer-ip-address and vcid arguments must be a unique combination on the router. At least one of the following pseudowire class parameters must be configured for the pseudowire-parameters argument: encapsulation mpls [manual] Specifies the tunneling method used to encapsulate data in the pseudowire: manual (Optional) This command places the router in xconnect configuration mode for manual configuration. mpls This is the tunneling method to be used. pw-class {pw-class-name} The pseudowire class configuration from which the data encapsulation type will be taken. Checks the validity of the local pseudowire label and generates an error message if the label is invalid. local-pseudowire-label Unused static label that is within the range defined by the mpls label range command. remote-pseudowire-label Value of the local pseudowire label of the peer provider edge router. Example The following is a sample output fromt the show xconnect all command on PE: Router# show xconnect all Legend: XC ST=Xconnect State S1=Segment1 State S2=Segment2 State UP=Up DN=Down AD=Admin Down IA=Inactive SB=Standby RV=Recovering NH=No Hardware XC ST Segment 1 S1 Segment 2 S UP ac Vl10:10(Eth VLAN) UP mpls :10 UP DN ac Vl20:20(Eth VLAN) DN mpls :20 DN 8 How to Implement QinQ and L2PT on L2 Ports

9 Configuration Examples for QinQ and L2PT on L2 Ports The following is a sample output from the show l2protocol-tunnel command on PE: Router# show l2protocol-tunnel COS for Encapsulated Packets: 5 l2protocol-tunnel mac-address: ccd.cdd0 Drop Threshold for Encapsulated Packets: 0 Port Protocol Shutdown Drop Encaps Decaps Drop Threshold Threshold Counter Counter Counter Fa0 cdp lldp stp vtp lacp Troubleshooting Tips Use the following verification commands on PE: show mpls l2transport vc show xconnect all show l2protocol-tunnel Configuration Examples for QinQ and L2PT on L2 Ports Example: EoMPLS Pseudowire over GRE with Static Label, page 9 Example: EoMPLS xconnect on SVI, page 11 Example: QinQ and L2PT on L2 ports with Dual-Homed Topology, page 12 Example: EoMPLS Pseudowire over GRE with Static Label The following example shows how to configure L2PT over GRE: Sample Topology CE1 PE1 IPCore PE2 CE2 G0/1 FE3 GE0 GE0/1 GE0/1 GE0 GE0/1/3 G0/ CE1 Configuration interface GigabitEthernet0/1 ip address PE1 Configuration mpls label range static mpls label protocol ldp pseudowire-class test encapsulation mpls 9

10 Configuration Examples for QinQ and L2PT on L2 Ports protocol none interface Loopback1 description *** Loopback Interface *** ip address interface Tunnel1 description *** Tunnel Interface to PE2 *** ip unnumbered Loopback1 interface FastEthernet3 description * PW Attachment Circuit, connected to CE1 * switchport access vlan 100 switchport mode dot1q-tunnel load-interval 30 l2protocol-tunnel cdp l2protocol-tunnel lldp l2protocol-tunnel stp l2protocol-tunnel vtp l2protocol-tunnel point-to-point udld l2protocol-tunnel point-to-point lacp l2protocol-tunnel point-to-point pagp no cdp enable interface GigabitEthernet0 ip address duplex auto speed auto interface Vlan100 description **L2VPN Customer** xconnect encapsulation mpls manual pw-class test mpls label router ospf 1 network area 0 network area 0 ip route Tunnel1 mpls ldp router-id Loopback1 IP Core Configuration interface GigabitEthernet0/0 ip address interface GigabitEthernet0/1 ip address router ospf 1 network area 0 network area 0 PE2 Configuration mpls label range static mpls label protocol ldp pseudowire-class test encapsulation mpls protocol none interface Loopback1 10 Configuration Examples for QinQ and L2PT on L2 Ports

11 Configuration Examples for QinQ and L2PT on L2 Ports description ***loopback interface*** ip address interface Tunnel1 description ***Tunnel Int to PE1*** bandwidth 10 ip unnumbered Loopback1 load-interval 30 mpls ip tunnel source GigabitEthernet0/0 tunnel destination interface GigabitEthernet0/0 description *** BB interface *** ip address load-interval 30 duplex auto speed auto interface GigabitEthernet0/1/3 description * PW Attachment Circuit, connected to CE1 switchport access vlan 100 l2protocol-tunnel cdp l2protocol-tunnel lldp l2protocol-tunnel stp l2protocol-tunnel vtp l2protocol-tunnel point-to-point udld l2protocol-tunnel point-to-point lacp l2protocol-tunnel point-to-point pagp no cdp enable interface Vlan100 description **L2VPN Customer** load-interval 30 mpls label protocol ldp xconnect encapsulation mpls manual pw-class test mpls label router ospf 1 network area 0 network area 0 ip forward-protocol nd ip route Tunnel1 mpls ldp router-id Loopback1 CE2 Configuration interface GigabitEthernet0/1 ip address Example: EoMPLS xconnect on SVI The following example shows the relevant configuration for EoMPLS under SVI for a single PE: mpls label range static mpls label protocol ldp 11

12 Configuration Examples for QinQ and L2PT on L2 Ports pseudowire-class test encapsulation mpls protocol none interface Loopback1 description *** Loopback Interface *** ip address interface FastEthernet3 description * PW Attachment Circuit * switchport access vlan 100 switchport mode dot1q-tunnel interface Vlan100 description **L2VPN Customer** xconnect encapsulation mpls manual pw-class test mpls label mpls ldp router-id Loopback1 end Example: QinQ and L2PT on L2 ports with Dual-Homed Topology The following example shows how to configure QinQ and L2PT on Layer 2 ports using a Dual-Homed Topology: Physical Topology PE1 Pseudowire2 PE2 G0/0/0 G0/0 G0/0 G0/0/0 F0/24 G0/1 IPCore F0/2/0 F0/14 Switch 1 F0/22 F0/0/0 G0/2 F0/3 Switch 2 F0 PE3 G0/0 G0/0 PE4 F0 Pseudowire Configuration Examples for QinQ and L2PT on L2 Ports

13 Configuration Examples for QinQ and L2PT on L2 Ports Logical Topology Switch 1 Switch Switch-1 Configuration interface FastEthernet0/22 switchport access vlan 20 switchport mode access channel-group 48 mode active end interface FastEthernet0/24 switchport access vlan 20 switchport mode access channel-group 48 mode active end interface Port-channel48 switchport access vlan 20 switchport mode access end interface Vlan20 ip address end SWITCH-1# ping Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to , timeout is 2 seconds: Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms SWITCH-1#show spanning-tree vlan 20 VLAN0020 Spanning tree enabled protocol ieee Root ID Priority 20 Address 000d.28fd.e100 This bridge is the root Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 20 (priority 0 sys-id-ext 20) Address 000d.28fd.e100 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 Interface Role Sts Cost Prio.Nbr Type Po48 Desg FWD P2p SWITCH-1# show cdp neighbors Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone Device ID Local Intrfce Holdtme Capability Platform Port ID SWITCH-2 Fas 0/ R S I SM-ES3-24-Fas 0/14 SWITCH-2 Fas 0/ R S I SM-ES3-24-Fas 0/13 SWITCH-1#show etherchannel 48 summary 13

14 Configuration Examples for QinQ and L2PT on L2 Ports Flags: D - down P - in port-channel I - stand-alone s - suspended H - Hot-standby (LACP only) R - Layer3 S - Layer2 u - unsuitable for bundling U - in use f - failed to allocate aggregator d - default port Number of channel-groups in use: 3 Number of aggregators: 3 Group Port-channel Protocol Ports Po48(SU) LACP Fa0/22(P) Fa0/24(P) PE1 Configuration interface GigabitEthernet0/0/0 switchport access vlan 10 l2protocol-tunnel cdp l2protocol-tunnel stp l2protocol-tunnel vtp l2protocol-tunnel point-to-point pagp l2protocol-tunnel point-to-point lacp no cdp enable end interface Vlan10 xconnect encapsulation mpls end interface Loopback0 ip address interface GigabitEthernet0/1 ip address duplex auto speed auto interface GigabitEthernet0/0/0 switchport access vlan 10 l2protocol-tunnel cdp l2protocol-tunnel stp l2protocol-tunnel vtp l2protocol-tunnel point-to-point pagp l2protocol-tunnel point-to-point lacp l2protocol-tunnel point-to-point udld no cdp enable interface Vlan10 xconnect encapsulation mpls router ospf 100 mpls ldp autoconfig area 0 network area 0 network area 0 PE 1# show l2protocol-tunnel COS for Encapsulated Packets: 5 14 Configuration Examples for QinQ and L2PT on L2 Ports

15 Configuration Examples for QinQ and L2PT on L2 Ports l2protocol-tunnel mac-address: ccd.cdd0 Drop Threshold for Encapsulated Packets: 0 Port Protocol Shutdown Drop Encaps Decaps Drop Threshold Threshold Counter Counter Counter Gi0/0/0 cdp stp vtp pagp lacp PE-3 Configuration PE 3# show running-config interface Loopback0 ip address interface FastEthernet0 switchport access vlan 10 switchport mode dot1q-tunnel l2protocol-tunnel cdp l2protocol-tunnel lldp l2protocol-tunnel stp l2protocol-tunnel vtp l2protocol-tunnel point-to-point lacp l2protocol-tunnel point-to-point pagp l2protocol-tunnel point-to-point udld no cdp enable interface FastEthernet1 shutdown interface FastEthernet2 switchport access vlan 10 shutdown l2protocol-tunnel cdp l2protocol-tunnel stp l2protocol-tunnel point-to-point pagp l2protocol-tunnel point-to-point lacp l2protocol-tunnel point-to-point udld no cdp enable interface GigabitEthernet0 ip address duplex auto speed auto interface Vlan10 xconnect encapsulation mpls router ospf 100 mpls ldp autoconfig area 0 network area 0 network area 0 PE 3# show xconnect all 15

16 Configuration Examples for QinQ and L2PT on L2 Ports Legend: XC ST=Xconnect State S1=Segment1 State S2=Segment2 State UP=Up DN=Down AD=Admin Down IA=Inactive SB=Standby RV=Recovering NH=No Hardware XC ST Segment 1 S1 Segment 2 S UP ac Vl10:10(Eth VLAN) UP mpls :10 UP DN ac Vl20:20(Eth VLAN) DN mpls :20 DN PE 3# show l2protocol-tunnel COS for Encapsulated Packets: 5 l2protocol-tunnel mac-address: ccd.cdd0 Drop Threshold for Encapsulated Packets: 0 Port Protocol Shutdown Drop Encaps Decaps Drop Threshold Threshold Counter Counter Counter Fa0 cdp lldp stp vtp lacp IP-CORE Configuration interface Loopback0 ip address interface Loopback1 shutdown interface GigabitEthernet0/1 ip address duplex auto speed auto no keepalive interface GigabitEthernet0/2 ip address duplex auto speed auto no keepalive interface FastEthernet0/0/0 ip address duplex auto speed auto interface FastEthernet0/2/0 ip address duplex auto speed auto router ospf 100 mpls ldp autoconfig area 0 network area 0 network area 0 network area 0 network area 0 network area 0 16 Configuration Examples for QinQ and L2PT on L2 Ports

17 Configuration Examples for QinQ and L2PT on L2 Ports default-information originate PE-2 Configuration interface Loopback0 ip address interface GigabitEthernet0/0 ip address duplex auto speed auto interface GigabitEthernet0/1 ip address duplex auto speed auto interface GigabitEthernet0/2 duplex auto speed auto interface GigabitEthernet0/0/0 switchport access vlan 10 switchport mode dot1q-tunnel l2protocol-tunnel cdp l2protocol-tunnel stp l2protocol-tunnel vtp l2protocol-tunnel point-to-point pagp l2protocol-tunnel point-to-point lacp l2protocol-tunnel point-to-point udld no cdp enable interface Vlan10 xconnect encapsulation mpls router ospf 100 mpls ldp autoconfig area 0 network area 0 network area 0 PE 2# show xconnect all Legend: XC ST=Xconnect State S1=Segment1 State S2=Segment2 State UP=Up DN=Down AD=Admin Down IA=Inactive SB=Standby RV=Recovering NH=No Hardware XC ST Segment 1 S1 Segment 2 S UP ac Vl10:10(Eth VLAN) UP mpls :10 UP PE 2# show l2protocol-tunnel COS for Encapsulated Packets: 5 l2protocol-tunnel mac-address: ccd.cdd0 Drop Threshold for Encapsulated Packets: 0 Port Protocol Shutdown Drop Encaps Decaps Drop Threshold Threshold Counter Counter Counter

18 Configuration Examples for QinQ and L2PT on L2 Ports Gi0/0/0 cdp stp vtp pagp lacp =========================================================================== PE 4:- ====== interface Loopback0 ip address interface FastEthernet0 switchport access vlan 10 switchport mode dot1q-tunnel l2protocol-tunnel cdp l2protocol-tunnel stp l2protocol-tunnel vtp l2protocol-tunnel point-to-point lacp l2protocol-tunnel point-to-point udld l2protocol-tunnel point-to-point pagp no cdp enable interface GigabitEthernet0 ip address duplex auto speed auto interface Vlan10 xconnect encapsulation mpls router ospf 100 mpls ldp autoconfig area 0 network area 0 network area 0 router ospf 500 PE 4# show xconnect all Legend: XC ST=Xconnect State S1=Segment1 State S2=Segment2 State UP=Up DN=Down AD=Admin Down IA=Inactive SB=Standby RV=Recovering NH=No Hardware XC ST Segment 1 S1 Segment 2 S UP ac Vl10:10(Eth VLAN) UP mpls :10 UP DN ac Vl20:20(Eth VLAN) DN mpls :20 DN PE 4# show l2protocol-tunnel COS for Encapsulated Packets: 5 l2protocol-tunnel mac-address: ccd.cdd0 Drop Threshold for Encapsulated Packets: 0 Port Protocol Shutdown Drop Encaps Decaps Drop Threshold Threshold Counter Counter Counter Fa0 cdp Configuration Examples for QinQ and L2PT on L2 Ports

19 Configuration Examples for QinQ and L2PT on L2 Ports SWITCH-2 Configuration interface FastEthernet0/13 switchport access vlan 20 switchport mode access channel-group 48 mode active end interface FastEthernet0/14 switchport access vlan 20 switchport mode access channel-group 48 mode active end interface Port-channel48 switchport access vlan 20 switchport mode access end interface Vlan20 ip address end SWITCH-2# ping stp vtp lacp Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to , timeout is 2 seconds: Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/8 ms SWITCH-2# show spanning-tree vlan 20 VLAN0020 Spanning tree enabled protocol ieee Root ID Priority 20 Address 000d.28fd.e100 Cost 12 Port 432 (Port-channel48) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority (priority sys-id-ext 20) Address 5475.d016.1e80 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec Interface Role Sts Cost Prio.Nbr Type Po48 Root FWD P2p 19

20 Configuration Examples for QinQ and L2PT on L2 Ports SWITCH-2# show cdp neighbors Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone, D - Remote, C - CVTA, M - Two-port Mac Relay Device ID Local Intrfce Holdtme Capability Platform Port ID SWITCH-1 Fas 0/ R S I WS-C3550- Fas 0/24 SWITCH-1 Fas 0/ R S I WS-C3550- Fas 0/22 20 Configuration Examples for QinQ and L2PT on L2 Ports

21 Command Reference Command Reference This section documents the new and existing commands that you can use in this release. debug l2protocol-tunnel (new) l2protocol-tunnel l2protocol-tunnel point-to-point (new) show l2protocol-tunnel switchport mode 21

22 debug l2protocol-tunnel debug l2protocol-tunnel To configure the debugging option of Layer 2 Protocol Tunneling (L2PT), use the debug l2protocol-tunnel command in EXEC mode. debug l2protocol-tunnel [error event misc packet] Syntax Description error event misc packet (Optional) Displays L2PT errors. (Optional) Displays L2PT events. (Optional) Displays L2PT miscellaneous. (Optional) Displays L2PT activities. Command Default If you do not specify a debugging option, all options are enabled. Command Modes User EXEC (>) Command History Release 15.2(2)T Modification This command was introduced. Examples The following example shows how to debug the l2protocol-tunnel command: Router# debug l2protocol-tunnel error Related Commands Command l2protoco-tunnel show l2protocol-tunnel Description Enables Layer 2 protocol tunneling for CDP, STP, or VTP packets on an interface. Displays information about L2PT ports. 22 debug l2protocol-tunnel

23 l2protocol-tunnel l2protocol-tunnel To enable the protocol tunneling on an interface and specify the type of protocol to be tunneled, use the l2protocol-tunnel command in global or interface configuration mode. To disable protocol tunneling, use the no form of this command. Global Configuration l2protocol-tunnel [cos cos-value global mac-address] no l2protocol-tunnel Interface Configuration l2protocol-tunnel [cdp lldp stp vtp] no l2protocol-tunnel Syntax Description cos cos-value (Optional) Specifies a class of service (CoS) value globally on all ingress Layer 2 protocol tunneling ports. global (Optional) Displays global settings. mac-address (Optional) Displays L2PT MAC address. cdp (Optional) Enables Cisco Discovery Protocol (CDP) tunneling. lldp (Optional) Enables Link Layer Discovery Protocol (LLDP) tunneling. stp (Optional) Enables Spanning Tree Protocol (STP) tunneling. vtp (Optional) Enables VLAN Trunking Protocol (VTP) tunneling. Defaults This command is disabled by default. Command Modes Global configuration (config) Interface configuration (config-if) Command History Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine (17d)SXB Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 15.2(2)T This command was modified. The lldp, cos, global, and mac-address keywords were added. 23

24 l2protocol-tunnel Usage Guidelines On all the service provider edge switches, you must enable PortFast BPDU filtering on the 802.1Q tunnel ports by entering these commands: Router(config-if)# spanning-tree bpdufilter enable Router(config-if)# spanning-tree portfast Note PortFast BPDU filtering is enabled automatically on tunnel ports. If you do not specify a protocol, all protocols are tunneled. You can configure protocol tunneling on VLAN and trunk interfaces. You must enter the switchport command once without any keywords to configure the LAN port as a Layer 2 interface before you can enter additional switchport commands with keywords. This action is required only if you have not entered the switchport command for the interface. Examples This example shows how to enable a tunneling protocol on an interface: Router> enable Router# configure terminal Router(config)# interface FastEthernet 0/0 Router(config-if)# l2protocol-tunnel cdp This example shows how to disable a tunneling protocol on an interface: Router> enable Router# configure terminal Router(config)# interface FastEthernet 4/1 Router(config-if)# no l2protocol-tunnel Protocol tunneling disabled on interface fastethernet 4/1 Related Commands Command Description show Displays the protocols that are tunneled on an interface or on all interfaces. l2protocol-tunnel switchport Modifies the switching characteristics of the Layer 2-switched interface. 24 l2protocol-tunnel

25 l2protocol-tunnel point-to-point l2protocol-tunnel point-to-point To enable point-to-point protocol tunneling, use the l2protocol-tunnel point-to-point command in interface configuration mode. To disable, use the no form of this command. l2protocol-tunnel point-to-point [pagp lacp udld] no l2protocol-tunnel point-to-point [pagp lacp udld] Syntax Description pagp lacp udld (Optional) Enables port aggregation on a point-to-point protocol tunneling. (Optional) Enables link aggregation on a point-to-point protocol tunneling. (Optional) Enables a unidirectional link detection on a point-to-point protocol tunneling. Command Default If no keyword is selected, tunneling is enabled for all three protocols. Command Modes Interface configuration (config-if) Command History Release 15.2(2)T Modification This command was introduced. Usage Guidelines To avoid a network failure, make sure that the network is a point-to-point topology before you enable tunneling for PAgP, LACP, or UDLD packets. Examples The following example shows how to enable link aggregation on a point-to-point protocol tunneling: Router(config-if)# l2protocol-tunnel point-to-point lacp Related Commands Command show l2protocol-tunnel Description Displays the enabled protocols and their values. 25

26 show l2protocol-tunnel show l2protocol-tunnel To display the protocols that are tunneled on an interface or on all interfaces, use the show l2protocol-tunnel command in the user EXEC or priveleged EXEC mode. show l2protocol-tunnel [{interface interface-id mod/port} summary vlan vlan] Syntax Description interface interface-id mod/port summary vlan vlan (Optional) Specifies the interface type; possible valid values are ethernet, fastethernet, gigabitethernet, tengigabitethernet, pos, atm, and ge-wan. Module and port number. (Optional) Displays a summary of a tunneled port. (Optional) Limits the display to interfaces on the specified VLAN; valid values are from 1 to Command Default This command has no default settings. Command Modes User EXEC (>) Privileged EXEC (#) Command History Release Modification 12.2(14)SX Support for this command was introduced on the Supervisor Engine (17a)SX The show l2protocol-tunnel summary command output was changed to display the following information: 12.2(17d)SXB 12.2(33)SRA 12.2(33)SXI 15.2(2)T Global drop-threshold setting Up status of a Layer 2-protocol interface tunnel Support for this command on the Supervisor Engine 2 was extended to the 12.2 SX release. This command was integrated into Cisco IOS Release 12.2(33)SRA. This command was changed to add the optional vlan vlan keyword and argument. This command was integrated into Cisco IOS Release 15.2(2)T. Usage Guidelines After enabling Layer 2 protocol tunneling on an access or IEEE 802.1Q tunnel port by using the l2protocol-tunnel interface configuration command, you can configure some or all of these parameters: Protocol type to be tunneled Shutdown threshold Drop threshold The show l2protocol-tunnel command displays only the ports that have protocol tunneling enabled. 26 show l2protocol-tunnel

27 show l2protocol-tunnel The show l2protocol-tunnel summary command displays the ports that have protocol tunneling enabled, regardless of whether the port is down or currently configured as a trunk. The show l2protocol-tunnel [interface interface-id] command shows only the information about the active ports in which all the parameters are configured. Examples The following example is an output from the show l2protocol-tunnel command: Router# show l2protocol-tunnel COS for Encapsulated Packets: 5 Drop Threshold for Encapsulated Packets: 0 Port Protocol Shutdown Drop Encapsulation Decapsulation Drop Threshold Threshold Counter Counter Counter Fa0/3 pagp lacp udld Fa0/4 pagp lacp udld Gi0/3 cdp pagp lacp udld Gi0/3 cdp pagp lacp udld This example shows how to display a summary of Layer 2-protocol tunnel ports: Router# show l2protocol-tunnel summary COS for Encapsulated Packets:5 Drop Threshold for Encapsulated Packets:0 Port Protocol Shutdown Drop Status Threshold Threshold (cdp/stp/vtp) (cdp/stp/vtp) Fa9/1 --- stp /----/ /----/---- down Fa9/9 cdp stp vtp ----/----/ /----/---- up Fa9/ /----/ /1500/1500 down(trunk) Fa9/48 cdp stp vtp ----/----/ /----/---- down(trunk) This example shows how to display Layer 2-protocol tunnel information on interfaces for a specific VLAN: Router# show l2protocol-tunnel vlan 1 COS for Encapsulated Packets: 5 Drop Threshold for Encapsulated Packets: 0 27

28 show l2protocol-tunnel Protocol Drop Counter cdp 0 lldp 0 stp 0 vtp 0 Port Protocol Thresholds Counters Shutdown Drop Encap Decap Drop Related Commands Command Description debug Displats the debugging options for L2PT. l2protocol-tunnel l2protocol-tunnel Enables the protocol tunneling on an interface and specifies the type of protocol to be tunneled. l2protocol-tunnel drop-threshold l2protocol-tunnel global drop-threshold l2protocol-tunnel shutdown-threshold Specifies the maximum number of packets that can be processed for the specified protocol on that interface before being dropped. Enables rate limiting at the software level. Specifies the maximum number of packets that can be processed for the specified protocol on that interface in one second. 28 show l2protocol-tunnel

29 switchport mode switchport mode To set the interface type, use the switchport mode command in interface configuration mode. Use the appropriate no form of this command to reset the mode to the appropriate default mode for the device. Cisco 2600 Series, Cisco 3600 Series, and Cisco 3700 Series Routers switchport mode {access trunk} no switchport mode Cisco Catalyst 6500/6000 Series Switches switchport mode {access dot1q-tunnel dynamic {auto desirable} trunk} no switchport mode Cisco 7600 Series Routers switchport mode {access dot1q-tunnel dynamic {auto desirable} private-vlan trunk} no switchport mode switchport mode private-vlan {host promiscuous} no switchport mode private-vlan Syntax Description access trunk dot1q-tunnel dynamic auto dynamic desirable private-vlan host private-vlan promiscuous Sets a nontrunking, nontagged single VLAN Layer 2 interface. Specifies a trunking VLAN Layer 2 interface. Sets the trunking mode to TUNNEL unconditionally. Sets the interface to convert the link to a trunk link. Sets the interface to actively attempt to convert the link to a trunk link. Specifies that the ports with a valid private VLAN (PVLAN) association become active host private VLAN ports. Specifies that the ports with a valid PVLAN mapping become active promiscuous ports. Defaults Cisco 2600 Series, Cisco 3600 Series, and Cisco 3700 Series Routers The default is access mode. Cisco Catalyst 6500/6000 Switches The default mode is dependent on the platform; it should be either dynamic auto for platforms that are intended as wiring closets or dynamic desirable for platforms that are intended as backbone switches. The default for PVLAN ports is that no mode is set. 29

30 switchport mode Cisco 7600 Series Routers The defaults are as follows: The mode is dependent on the platform; it should either be dynamic auto for platforms that are intended for wiring closets or dynamic desirable for platforms that are intended as backbone switches. No mode is set for PVLAN ports. Command Modes Interface configuration (config-if) Command History Release Modification 12.0(7)XE This command was introduced on the Cisco Catalyst 6000 family switches. 12.1(1)E This command was integrated on the Cisco Catalyst 6000 family switches. 12.1(8a)EX The switchport mode private-vlan {host promiscuous} syntax was added. 12.2(2)XT Creation of switchports became available on Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers. 12.2(8)T This command was integrated into Cisco IOS Release 12.2(8)T for the creation of switchports on Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers. 12.2(14)SX Support for this command was introduced on the Supervisor Engine (17d)SXB Support for this command on the Supervisor Engine 2 was extended to Cisco IOS Release 12.2(17d)SXB. 15.2(2)T This command was integrated into Cisco IOS Release 15.2(2)T. Usage Guidelines Cisco 2600 Series, Cisco 3600 Series, and Cisco 3700 Series Routers If you enter a forced mode, the interface does not negotiate the link to the neighboring interface. Ensure that the interface ends match. The no form of the command is not supported on the Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers. Cisco Catalyst 6500/6000 Switches and Cisco 7600 Series Routers If you enter access mode, the interface goes into permanent nontrunking mode and negotiates to convert the link into a nontrunk link even if the neighboring interface does not agree to the change. If you enter trunk mode, the interface goes into permanent trunking mode and negotiates to convert the link into a trunk link even if the neighboring interface does not agree to the change. If you enter dynamic auto mode, the interface converts the link to a trunk link if the neighboring interface is set to trunk or desirable mode. If you enter dynamic desirable mode, the interface becomes a trunk interface if the neighboring interface is set to trunk, desirable, or auto mode. If you configure a port as a promiscuous or host-pvlan port and one of the following applies, the port becomes inactive: The port does not have a valid PVLAN association or mapping configured. The port is a SPAN destination. 30 switchport mode

31 switchport mode If you delete a private-port PVLAN association or mapping, or if you configure a private port as a SPAN destination, the deleted private-port PVLAN association or mapping or the private port that is configured as a SPAN destination becomes inactive. If you enter dot1q-tunnel mode, PortFast Bridge Protocol Data Unit (BPDU) filtering is enabled and Cisco Discovery Protocol (CDP) is disabled on protocol-tunneled interfaces. Examples Cisco 2600 Series, Cisco 3600 Series, and Cisco 3700 Series Routers The following example shows how to set the interface to access desirable mode: Router(config-if)# switchport mode access The following example shows how to set the interface to trunk mode: Router(config-if)# switchport mode trunk Cisco Catalyst 6500/6000 Switches and Cisco 7600 Series Routers The following example shows how to set the interface to dynamic desirable mode: Router(config-if)# switchport mode dynamic desirable The following example shows how to set a port to PVLAN-host mode: Router(config-if)# switchport mode private-vlan host The following example shows how to set a port to PVLAN-promiscuous mode: Router(config-if)# switchport mode private-vlan promiscuous Integrated Series Routers Generation 2 (ISR G2) Platforms The following example shows how to configure tunneling on port 4/1 and verify the configuration: Router# configure terminal Router (config)# interface fastethernet 4/1 Router (config-if)# switchport mode dot1q-tunnel Router (config-if)# end Related Commands Command Description show dot1q-tunnel Displays a list of 802.1Q tunnel-enabled ports. show interfaces switchport Displays administrative and operational status of a switching (nonrouting) port. show interfaces trunk Displays trunk information. switchport Modifies the switching characteristics of the Layer 2-switched interface. switchport private-vlan Defines a PVLAN association for an isolated or community port. host-association switchport private-vlan Defines the PVLAN mapping for a promiscuous port. mapping switchport trunk Sets trunk characteristics when the interface is in trunking mode. 31

32 Additional References Additional References Related Documents Related Topic Document Title Cisco IOS commands Cisco IOS Master Commands List, All Releases Cisco IOS MPLS commands Cisco IOS Multiprotocol Label Switching Command Reference Cisco HWIC-4ESW and HIWIC-D-9ESW EthernetSwitch Interface Cards Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards Cisco Integrated Services Routers Generation 2 Cisco Integrated Services Routers Generation 2 Standards Standard Title No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature. MIBs MIB MIBs Link No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature. To locate and download MIBs for selected platforms, Cisco software releases, and feature sets, use Cisco MIB Locator found at the following URL: RFCs RFC Title No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature. 32 Additional References

33 Additional References Technical Assistance Description The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password. Link 33

34 Feature Information for QinQ and L2PT Feature Information for QinQ and L2PT Table 1 lists the release history for this feature. Note Table 1 lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature. Table 1 Feature Information for QinQ and L2PT Feature Name Releases Feature Information IEEE 802.1Q (QinQ) and L2PT on Layer 2 Ports 15.2(2)T This feature enables service providers to run Layer 2 Ethernet services and provide transparent LAN services over a metropolitan Ethernet infrastructure to customers. 34 Feature Information for QinQ and L2PT

35 Glossary Glossary ACL access control list CDP Cisco Discovery Protocol DTP Dynamic Trunking Protocol L2PT Layer 2 Protocol Tunneling PAgP Port Aggregation Protocol VTP VLAN Trunking Protocol Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R) Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental Cisco Systems, Inc. All rights reserved. 35

36 Glossary 36 Glossary