Table Of Contents
Prerequisites for PPPoE—QinQ Support
Restrictions for PPPoE—QinQ Support
Information About PPPoE—QinQ Support
PPPoE—QinQ Support on Subinterfaces
Cisco 10000 Series Router Application
Security ACL Application on the Cisco 10000 Series Router
Unambiguous and Ambiguous Subinterfaces
How to Configure PPPoE—QinQ Support
Configuring the Interfaces for PPPoE—QinQ Support
Verifying the PPPoE—QinQ Support
Configuration Examples for PPPoE—QinQ Support
Configuring the any Keyword on Subinterfaces for PPPoE—QinQ Support: Example
Feature Information for PPPoE—QinQ Support
PPPoE—QinQ Support
First Published: January 16, 2004Last Updated: November 27, 2009Encapsulating IEEE 802.1Q VLAN tags within 802.1Q enables service providers to use a single VLAN to support customers who have multiple VLANs. The PPPoE—QinQ Support feature on the subinterface level preserves VLAN IDs and keeps traffic in different customer VLANs segregated.
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for PPPoE—QinQ Support" section.
Use Cisco Feature Navigator to find information about platform support and Cisco IOS and Catalyst OS software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Contents
•Prerequisites for PPPoE—QinQ Support
•Restrictions for PPPoE—QinQ Support
•Information About PPPoE—QinQ Support
•How to Configure PPPoE—QinQ Support
•Configuration Examples for PPPoE—QinQ Support
•Feature Information for PPPoE—QinQ Support
•Feature Information for PPPoE—QinQ Support
Prerequisites for PPPoE—QinQ Support
•You have checked Feature Navigator to verify that your Cisco device and software image support this feature.
•You must be connected to an Ethernet device that supports double VLAN tag imposition/disposition or switching.
Restrictions for PPPoE—QinQ Support
Cisco 10000 Series Router Restrictions
•Supported on Ethernet, Fast Ethernet, or Gigabit Ethernet interfaces.
•Supports only PPP over Ethernet (PPPoE) and IP packets that are double-tagged for IEEE 802.1Q in 802.1Q (QinQ) VLAN tag termination. Specifically, PPPoEoQinQ and IPoQinQ are supported.
•PPPoE over QinQ (PPPoEoQinQ) supports a maximum of 32,000 PPPoE sessions per interface for a maximum of 32,000 PPPoE sessions for the router. Note that the number of supported PPPoE sessions per interface can be limited by the cap of 32,000 sessions of any type that can run on the router.
•PPPoEoQinQ supports 4094 outer VLAN IDs and 4094 inner VLAN IDs if only PPPoE is enabled and IP is not enabled on the subinterface.
•IP over QinQ (IPoQinQ) supports a maximum of 16,000 IPoQinQ subinterfaces per interface.
•IPoQinQ supports a maximum of 448 outer VLAN IDs and 4094 inner VLAN IDs.
•Multiprotocol Label Switching (MPLS) is not supported on PPPoEoQinQ and IPoQinQ subinterfaces.
•Layer 2 Ethernet over MPLS (EoMPLS) tunneling using the xconnect command on PPPoEoQinQ and IPoQinQ subinterfaces is not supported.
•Modular quality of service command line interface (MQC) can be applied to unambiguous subinterfaces only.
•Limited ACL support for PPPoEoQinQ subinterfaces.
Information About PPPoE—QinQ Support
To configure the PPPoE—QinQ Support Feature, you should understand the following concepts:
•PPPoE—QinQ Support on Subinterfaces
•Cisco 10000 Series Router Application
•Unambiguous and Ambiguous Subinterfaces
PPPoE—QinQ Support on Subinterfaces
The PPPoE—QinQ Support feature adds another layer of IEEE 802.1Q tag (called "metro tag" or "PE-VLAN") to the 802.1Q tagged packets that enter the network. The purpose is to expand the VLAN space by tagging the tagged packets, thus producing a "double-tagged" frame. The expanded VLAN space allows the service provider to provide certain services, such as Internet access on specific VLANs for specific customers, and yet still allows the service provider to provide other types of services for their other customers on other VLANs.
Generally the service provider's customers require a range of VLANs to handle multiple applications. Service providers can allow their customers to use this feature to safely assign their own VLAN IDs on sub interfaces because these subintervals VLAN IDs are encapsulated within a service provider-designated VLAN ID for that customer. Therefore there is no overlap of VLAN IDs among customers, nor does traffic from different customers become mixed. The double-tagged frame is "terminated" or assigned on a subintervals with an expanded encapsulation dot1q command that specifies the two VLAN ID tags (outer VLAN ID and inner VLAN ID) terminated on the subintervals. See Figure 1.
The PPPoE—QinQ Support feature is generally supported on whichever Cisco IOS features or protocols are supported on the subinterface. For example, if you can run PPPoE on the subinterface, you can configure a double-tagged frame for PPPoE. IPoQinQ supports IP packets that are double-tagged for QinQ VLAN tag termination by forwarding IP traffic with the double-tagged (also known as stacked) 802.1Q headers.
A primary consideration is whether you assign ambiguous or unambiguous subintervals for the inner VLAN ID. See the "Unambiguous and Ambiguous Subinterfaces" section.
For information on supported PPPoE sessions, number of supported inner and outer VLAN IDs, and general restrictions on the Cisco 10000 series routers, see the "Restrictions for PPPoE—QinQ Support" section.
Note The Cisco 10000 series router supports PPPoEoQinQ in Cisco IOS Release 12.3(7)XI1 and later releases, and IPoQinQ in Cisco IOS Release 12.3(7)XI7 and later releases.
The primary benefit for the service provider is a reduced number of VLANs supported for the same number of customers. Other benefits of this feature are as follows:
•PPPoE scalability. Expanding the available VLAN space from 4096 to about 16.8 million (4096 times 4096) allows the number of PPPoE sessions that can be terminated on a given interface to be multiplied.
Note The Cisco 10000 series router supports up to 32,000 PPPoE sessions per interface for a maximum of 61,500 PPPoE sessions for the router. These sessions may be over PPPoEoQinQ ambiguous or unambiguous subinterfaces.
•When deploying Gigabyte Ethernet DSL Access Multiplexer (DSLAM) in a wholesale model, you can assign the inner VLAN ID to represent the end-customer virtual circuit (VC) and assign the outer VLAN ID to represent the service provider ID.
The QinQ VLAN tag termination feature is simpler than the IEEE 802.1Q tunneling feature deployed for the Catalyst 6500 series switches or the Catalyst 3550 and Catalyst 3750 switches. Whereas switches require IEEE 802.1Q tunnels on interfaces to carry double-tagged traffic, routers need only encapsulate QinQ VLAN tags within another level of 802.1Q tags in order for the packets to arrive at the correct destination.
Figure 1 Untagged, 802.1Q-Tagged, and Double-Tagged Ethernet Frames
Cisco 10000 Series Router Application
For the emerging broadband Ethernet-based DSLAM market, the Cisco 10000 series router supports QinQ encapsulation. With the Ethernet-based DSLAM model shown in Figure 2, customers typically get their own VLAN; all these VLANs are aggregated on a DSLAM.
Figure 2
Broadband Ethernet-based DSLAM Model of QinQ VLANs
VLAN aggregation on a DSLAM will result in many aggregate VLANs that at some point need to be terminated on the broadband remote access servers (BRAS). Although the model could connect the DSLAMs directly to the BRAS, a more common model uses the existing Ethernet-switched network where each DSLAM VLAN ID is tagged with a second tag (QinQ) as it connects into the Ethernet-switched network.
The Cisco 10000 series router supports PPPoEoQinQ in Cisco IOS Release 12.3(7)XI1 and later, and IP over QinQ (IPoQinQ) in Cisco IOS Release 12.3(7)XI7 and later releases. Both PPPoE sessions and IP can be enabled on a sub interface. For information on supported PPPoE sessions, number of supported inner and outer VLAN IDs, and general restrictions on the Cisco 10000 series router, see the "Restrictions for PPPoE—QinQ Support" section.
The PPPoEoQinQ model is a PPP-terminated session.
PPPoEQinQ and IPoQinQ encapsulation processing is an extension to 802.1Q encapsulation processing. A QinQ frame looks like a VLAN 802.1Q frame; the only difference is that it has two 802.1Q tags instead of one. See Figure 1.
QinQ encapsulation supports a configurable outer tag Ethertype. The configurable Ethertype field values are 0x8100 (default), 0x9100, and 0x9200. See Figure 3.
Figure 3
Supported Configurable Ethertype Field Values
Security ACL Application on the Cisco 10000 Series Router
The PPPoE—QinQ Support feature provides limited security ACL support for PPPoEoQinQ subinterfaces for the Cisco 10000 series router. There are no ACL restrictions on subinterfaces configured with IPoQinQ.
If you apply an ACL to PPPoE traffic on a QinQ subinterface in a VLAN, apply the ACL directly on the PPPoE session, using virtual access interfaces (VAIs) or RADIUS attribute 11 or 242.
You can apply ACLs to VAIs by configuring them under virtual template interfaces. You can also configure ACLs by using RADIUS attribute 11 or 242. When you use attribute 242, a maximum of 30,000 sessions can have ACLs.
ACLs that are applied to the VLAN QinQ subinterface have no effect and are silently ignored. In the following example, ACL 1 that is applied to the VLAN QinQ subinterface level will be ignored:
Router(config)# interface FastEthernet3/0/0.100Router(config-subif)# encapsulation dot1q 100 second-dot1q 200Router(config-subif)# ip access-group 1Unambiguous and Ambiguous Subinterfaces
Note Only PPPoE is supported on ambiguous subinterfaces. Standard IP routing is not supported on ambiguous subinterfaces.
The encapsulation dot1q command is used to configure QinQ termination on a subinterface. The command accepts an outer VLAN ID and one or more inner VLAN IDs. The outer VLAN ID always has a specific value, and the inner VLAN ID can either be a specific value or a range of values.
A subinterface that is configured with a single inner VLAN ID is called an unambiguous QinQ subinterface. In the following example, QinQ traffic with an outer VLAN ID of 101 and an inner VLAN ID of 1001 is mapped to the Gigabit Ethernet 1/0.100 subinterface:
Router(config)# interface gigabitEthernet1/0.100Router(config-subif)# encapsulation dot1q 101 second-dot1q 1001A subinterface that is configured with multiple inner VLAN IDs is called an ambiguous QinQ subinterface. By allowing multiple inner VLAN IDs to be grouped, ambiguous QinQ subinterfaces allow for a smaller configuration, improved memory usage, and better scalability.
In the following example, QinQ traffic with an outer VLAN ID of 101 and inner VLAN IDs anywhere in the 2001-2100 and 3001-3100 range is mapped to the Gigabit Ethernet 1/0.101 subinterface:
Router(config)# interface fastethernet1/0.101Router(config-subif)# encapsulation dot1q 101 second-dot1q 2001-2100,3001-3100Ambiguous subinterfaces can also use the any keyword to specify the inner VLAN ID.
See the "Configuration Examples for PPPoE—QinQ Support" section for an example of how VLAN IDs are assigned to sub interfaces, and for a detailed example of how the any keyword is used on ambiguous sub interfaces.
Note The any keyword in the second-dot1q keyword is not supported on a subinterface configured for IPoQinQ because IP routing is not supported on ambiguous subinterfaces. Therefore, multiple values and ranges for the inner VLAN ID are not supported on IPoQinQ.
Note On the Cisco 10000 series router, MQC is supported only on unambiguous subinterfaces.
How to Configure PPPoE—QinQ Support
This section contains the following tasks:
•Configuring the Interfaces for PPPoE—QinQ Support (required)
•Verifying the PPPoE—QinQ Support (optional)
Configuring the Interfaces for PPPoE—QinQ Support
Perform this task to configure the main interface used for the QinQ double tagging and to configure the subinterfaces. An optional step in this task shows you how to configure the Ethertype field to be 0x9100 for the outer VLAN tag, if that is required. After the subinterface is defined, the 802.1Q encapsulation is configured to use the double tagging.
Prerequisites
Cisco 10000 Series Router Prerequisites:
•PPPoE or IP is already configured.
•A virtual private dialup network (VPDN) is enabled.
SUMMARY STEPS
1. enable
2. configure terminal
3. interface type number
4. dot1q tunneling ethertype ethertype
5. interface type number.subinterface-number
6. encapsulation dot1q vlan-id second-dot1q {any | vlan-id | vlan-id-vlan-id[,vlan-id-vlan-id]}
7. pppoe enabled [group group-name]
8. ip address ip-address mask [secondary]
9. Repeat Step 5 to configure another subinterface.
10. Repeat Step 6, Step 7, and Step 8, as required, to specify the VLAN tags to be terminated on the subinterface, to enable PPPoE sessions or IP on the subinterface.
11. end
DETAILED STEPS
Verifying the PPPoE—QinQ Support
Perform this optional task to verify the configuration of the PPPoE—QinQ Support feature.
SUMMARY STEPS
1. enable
2. show running-config
3. show vlans dot1q [internal | interface-type interface-number.subinterface-number [detail] | outer-id [interface-type interface-number | second-dot1q [inner-id | any]] [detail]]
DETAILED STEPS
Step 1 enable
Enables privileged EXEC mode. Enter your password if prompted.
Router> enableStep 2 show running-config
Use this command to show the currently running configuration on the device. You can use delimiting characters to display only the relevant parts of the configuration.
The following output shows the currently running PPPoEoQinQ and IPoQinQ configurations on a Cisco 10000 series router:
Router# show running-config...interface FastEthernet0/0.201encapsulation dot1Q 201ip address 10.7.7.5 255.255.255.252!interface FastEthernet0/0.401encapsulation dot1Q 401ip address 10.7.7.13 255.255.255.252!interface FastEthernet0/0.201999encapsulation dot1Q 201 second-dot1q anypppoe enable!interface FastEthernet0/0.2012001encapsulation dot1Q 201 second-dot1q 2001ip address 10.8.8.9 255.255.255.252!interface FastEthernet0/0.2012002encapsulation dot1Q 201 second-dot1q 2002ip address 10.8.8.13 255.255.255.252pppoe enable!interface FastEthernet0/0.4019999encapsulation dot1Q 401 second-dot1q 100-900,1001-2000pppoe enable!interface FastEthernet5/0.101encapsulation dot1Q 101ip address 10.7.7.1 255.255.255.252!interface FastEthernet5/0.301encapsulation dot1Q 301ip address 10.7.7.9 255.255.255.252!interface FastEthernet5/0.301999encapsulation dot1Q 301 second-dot1q anypppoe enable!interface FastEthernet5/0.1011001encapsulation dot1Q 101 second-dot1q 1001ip address 10.8.8.1 255.255.255.252!interface FastEthernet5/0.1011002encapsulation dot1Q 101 second-dot1q 1002ip address 10.8.8.5 255.255.255.252!interface FastEthernet5/0.1019999encapsulation dot1Q 101 second-dot1q 1-1000,1003-2000pppoe enable...Step 3 show vlans dot1q [internal | interface-type interface-number.subinterface-number [detail] | outer-id [interface-type interface-number | second-dot1q [inner-id | any]] [detail]]
Use this command to show the statistics for all the 802.1Q VLAN IDs. In this example, only the outer VLAN ID is displayed.
Note The any keyword is not supported on a subinterface configured for IPoQinQ because IP routing is not supported on ambiguous subinterfaces.
Router# show vlans dot1qTotal statistics for 802.1Q VLAN 1:441 packets, 85825 bytes input1028 packets, 69082 bytes outputTotal statistics for 802.1Q VLAN 101:5173 packets, 510384 bytes input3042 packets, 369567 bytes outputTotal statistics for 802.1Q VLAN 201:1012 packets, 119254 bytes input1018 packets, 120393 bytes outputTotal statistics for 802.1Q VLAN 301:3163 packets, 265272 bytes input1011 packets, 120750 bytes outputTotal statistics for 802.1Q VLAN 401:1012 packets, 119254 bytes input1010 packets, 119108 bytes output
Configuration Examples for PPPoE—QinQ Support
This section provides the following example:
•Configuring the any Keyword on Subinterfaces for PPPoE—QinQ Support: Example
Configuring the any Keyword on Subinterfaces for PPPoE—QinQ Support: Example
Some ambiguous subinterfaces can use the any keyword for the inner VLAN ID specification. The any keyword represents any inner VLAN ID that is not explicitly configured on any other interface. In the following example, seven subinterfaces are configured with various outer and inner VLAN IDs.
Note The any keyword can be configured on only one subinterface of a specified physical interface and outer VLAN ID.
Note The any keyword in the second-dot1q keyword is not supported on a subinterface configured for IPoQinQ because IP routing is not supported on ambiguous subinterfaces. Therefore, multiple values and ranges for the inner VLAN ID are not supported on IPoQinQ.
interface GigabitEthernet1/0/0.1encapsulation dot1q 100 second-dot1q 100interface GigabitEthernet1/0/0.2encapsulation dot1q 100 second-dot1q 200interface GigabitEthernet1/0/0.3encapsulation dot1q 100 second-dot1q 300-400,500-600interface GigabitEthernet1/0/0.4encapsulation dot1q 100 second-dot1q anyinterface GigabitEthernet1/0/0.5encapsulation dot1q 200 second-dot1q 50interface GigabitEthernet1/0/0.6encapsulation dot1q 200 second-dot1q 1000-2000,3000-4000interface GigabitEthernet1/0/0.7encapsulation dot1q 200 second-dot1q anyTable 1 shows which sub interfaces are mapped to different values of the outer and inner VLAN IDs on QinQ frames that come in on Gigabit Ethernet (GE) interface 1/0/0.
A new subinterface is now configured:
interface GigabitEthernet 1/0/0.8encapsulation dot1q 200 second-dot1q 200-600,900-999Table 2 shows the changes made to the table for the outer VLAN ID of 200. Notice that sub interface 1/0/0.7 configured with the any keyword now has new inner VLAN ID mappings.
Additional References
The following sections provide references related to the PPPoE—QinQ Support feature.
Related Documents
Related Topic Document TitleInterface commands: complete command syntax, command mode, defaults, usage guidelines, and examples
Cisco IOS Interface and Hardware Component Command Reference
Interface configuration examples
Cisco IOS Interface and Hardware Component Configuration Guide
Standards
MIBs
RFCs
RFCs TitleNo new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.
—
Technical Assistance
Feature Information for PPPoE—QinQ Support
Table 3 lists the features in this module and provides links to specific configuration information.
Not all commands may be available in your Cisco IOS software release. For release information about a specific command, see the command reference documentation.
Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which Cisco IOS and Catalyst OS software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Note Table 3 lists only the Cisco IOS software release that introduced support for a given feature in a given Cisco IOS software release train. Unless noted otherwise, subsequent releases of that Cisco IOS software release train also support that feature.
CCDE, CCENT, CCSI, Cisco Eos, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Nurse Connect, Cisco Pulse, Cisco SensorBase, Cisco StackPower, Cisco StadiumVision, Cisco TelePresence, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip Mino, Flipshare (Design), Flip Ultra, Flip Video, Flip Video (Design), Instant Broadband, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Capital, Cisco Capital (Design), Cisco:Financed (Stylized), Cisco Store, Flip Gift Card, and One Million Acts of Green are service marks; and Access Registrar, Aironet, AllTouch, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Lumin, Cisco Nexus, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, Continuum, EtherFast, EtherSwitch, Event Center, Explorer, Follow Me Browsing, GainMaker, iLYNX, IOS, iPhone, IronPort, the IronPort logo, Laser Link, LightStream, Linksys, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, PCNow, PIX, PowerKEY, PowerPanels, PowerTV, PowerTV (Design), PowerVu, Prisma, ProConnect, ROSA, SenderBase, SMARTnet, Spectrum Expert, StackWise, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0910R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
©2004-2009 Cisco Systems, Inc. All rights reserved.