Layer 2 Vpn Architectures [Electronic resources] نسخه متنی

802.1q Tunneling

One of the enterprise's business requirements can entail sending multiple VLANs across the service provider's Metro Ethernet network. The enterprise can accomplish this via 802.1q tunneling, also known as QinQ. This chapter uses both names interchangeably.

802.1q tunneling is a tunneling mechanism that service providers can use to provide secure Ethernet VPN services to their customers. Ethernet VPNs using QinQ are possible because of the two-level VLAN tag scheme that QinQ uses. The outer VLAN tag is referred to as the service provider VLAN and uniquely identifies a given customer within the network of the service provider. The inner VLAN tag is referred to as the customer VLAN tag because the customer assigns it. QinQ's use of double VLAN tags is similar to the label stack used in MPLS to enable Layer 3 VPNs and Layer 2 VPNs. It is also possible for multiple customer VLANs to be tagged using the same outer or service provider VLAN tag, thereby trunking multiple VLANs among customer sites. Note that by using two VLAN tagsouter and inner VLANyou achieve a demarcation point between the domain of the customer and the domain of the service provider. The service provider can use any VLAN scheme it decides upon to identify a given customer within his provider network. Similarly, the enterprise customer can independently decide on a VLAN scheme for the VLANs that traverse the service provider network without consulting the service provider.

In summary, 802.1q tunneling allows service providers to use a single VLAN to support multiple VLANs of customers, while preserving customer VLAN IDs and keeping traffic in different customer VLANs segregated. At the same time, it significantly reduces the number of VLANs required to support the VPNs. QinQ encapsulates the VLANs of the enterprise customers into a VLAN of the service provider.

QinQ accomplishes the following:

Enterprise customers receive transparent Layer 2 links between sites within a metro area, such as a link from a branch office to a main campus.

Service providers can separate or group traffic on a per-customer basis using outer VLAN tags as it traverses the common infrastructure so that the same infrastructure can provide service to multiple customers.

The VLAN ID of the enterprise and the VLAN ID of the service provider do not have to match.

The customers can treat the switching infrastructure in a remote site as if it were part of the local site. They can use the same VLAN space and run protocols such as STP across the provider infrastructure through 802.1q.

The QinQ model allows the customer edge switch on each side of the tunnel to view the service provider infrastructure as nothing more than a transparent bridge. The following sections talk about the 802.1q tunneling underlying processes.

802.1. q and 802.1p Tagging

802.1q tagging refers to modifications made to the original Ethernet frame described earlier in the chapter. In 802.1q tagging, additional bytes are inserted into the Ethernet frame.

Altogether, the Ethernet frame is inserted with four additional bytes that turn it into the 802.1q frame, and FCS is recalculated. The new fields are illustrated in Figure 4-5.

Following are the new fields inserted by "tagging":

Ethertype 2 bytes that identify an 802.1q frame and equal 0x8100. Ethertype is also called Tag Protocol Identifier (TPID).

TCI 2 bytes of Tag Control Information that in turn contain the following:

Priority 3 bits that define the 802.1p user priority. They are also referred to as the class of service (CoS) bits.

CFI 1-bit Canonical Format Identifier (CFI) for compatibility issues between Ethernet-type networks and Token Ringtype networks.

VLAN ID A 12-bit field that identifies the VLAN.

IEEE 802.1p is a supplement to the IEEE 802.1d specification. It is intended for QoS implementation on LANs, analogous to the three precedence bits in IP. 802.1p describes mechanisms in switches for handling the time-sensitive traffic and reducing the impact of high-bandwidth traffic within a LAN.

The IEEE 802.1p is needed because Ethernet, unlike Token Ring, does not inherently provide support for priority levels in frames. Based on the MAC frame information, 802.1p provides an in-band QoS signaling method for traffic classification. 802.1p also provides an optional mechanism in switches for supporting end-to-end time-critical frame delivery.

Under IEEE 802.1p, eight CoSs are supported. The higher the value is, the higher the priority of the frame. Zero, the lowest, stands for routine service with no priority specified. You can configure switches in a LAN and different ports of a switch for several different priority levels.

Chapters 9, "Advanced AToM Case Studies," and 13, "Advanced L2TPv3 Case Studies." Now it is time to examine the innerworkings of 802.1q tunneling.

Understanding How 802.1q Tunneling Works

A tunnel port is a port that is configured to support 802.1q tunneling. Each customer comes in on a dedicated customer-facing port on the service provider switch where a VLAN that is dedicated to tunneling is assigned. The service provider assigns each customer an outer VLAN tag or a service provider VLAN tag that uniquely identifies him within the network. The service provider VLAN also keeps the customer traffic isolated from other customer traffic that is traversing the same service provider network. That service provider VLAN supports all the VLANs of the customer.

802.1q tunneling refers to multiple tagging of dot1Q frames as they enter a service provider switch from a client switch. QinQ can tag or untag any frames that it receives from the customer tag. 802.1q also has native VLAN frames that are untagged. The service provider switch adds the outer VLAN tag.

Tagged and untagged customer traffic comes from a port on a customer device and enters the service-provider edge switch through a tunnel port. Each customer edge port that is connected to an 802.1q tunnel port is typically configured as a trunk port. The customer trunk port is unaware of the provider 802.1q tunnel and can communicate with all of its other trunk ports that are connected to the metro network of the provider as if they were directly connected. This makes the process transparent to the switching network of the enterprise.

A hub customer edge might have connectivity to two remote spoke sites and have only half of the VLANs from the hub site go to one site and the remaining to the second remote site. This is possible using two service provider VLANs for this enterprise customer when certain sites need to see only some and not all of the VLAN traffic from the hub site.

The link between the 802.1q trunk port on a customer device and the tunnel port is known as an asymmetrical link. One end is designated as an 802.1q trunk port, whereas the other end is configured as a tunnel port. The tunnel port is configured with an access VLAN ID that is unique to a customer, as shown in Figure 4-6.