VLAN Configuration VLAN Configuration I VLAN Configuration Table of Contents Chapter 1 VLAN Configuration............................................................................................................. 1 1.1 VLAN Introduction....................................................................................................................1 1.2 Dot1Q Tunnel Overview..........................................................................................................1 1.2.1 Preface...........................................................................................................................1 1.2.2 Dot1Q Tunnel Realization Mode................................................................................2 1.3 VLANConfiguration Task List..................................................................................................2 1.4 VLAN Configuration Task........................................................................................................2 1.4.1 Adding/Deleting VLAN.................................................................................................2 1.4.2 Configuring the Port of the Switch.............................................................................3 1.4.3 Creating/deleting the VLAN interface........................................................................4 1.4.4 Monitoring the VLAN Configuration and VLAN State.............................................4 1.4.5 Enabling or Disabling Dot1Q Tunnel Globally......................................................... 4 1.5 Configuration Example............................................................................................................4 1.5.1 Dot1Q Tunnel Configuration Examples.................................................................... 4 Appendix A Abbreviations...................................................................................................................7 II VLAN Configuration Chapter 1 VLAN Configuration 1.1 VLAN Introduction The virtual local area network (VLAN) is an exchange network which logically groups the devices in LAN. IEEE issued the IEEE 802.1Q standard in 1999 for realizing the VLAN standard. The VLAN technology can divide a physical LAN logic address into different broadcast domains. Each VLAN has a group of devices which have the same demands but the same attributes with those on the physical LAN. Because it is a logical group, the devices in a same VLAN can be in different physical spaces. The broadcast/unicast flow within a VLAN cannot be forwarded to other VLANs. Such advantages as flow control, low device investment, easy network management and high network security, hence, are obtained.  Support port-based VLAN  Support 802.1Q relay mode  Support the access port The port-based VLAN is to classify the port into a subset of VLAN supported by the switch. If the VLAN subnet includes only one VLAN, the port is the access port; if the VLAN subnet has multiple VLANs, the port is a trunk port; there is a default VLAN among these VLANs, which is the native VLAN of the port and whose ID is PVID.  Support VLAN range control The vlan-allowed parameter is used to control the VLAN range; the vlan-untagged parameter is used to control the transmission of the untagged VLAN packet from the port to the corresponding VLAN. VLAN planning modes are various such as based on MAC, IP subnet, protocol, or port. 1.2 Dot1Q Tunnel Overview 1.2.1 Preface Dot1Q Tunnel is a lively name of the tunnel protocol based on 802.1Q encapsulation, which is defined in IEEE 802.1ad. Its core idea is to encapsulate the VLAN tag of the private network to that of the public network, and the packets with two layers of tags traverse the backbone network of ISP and finally a relatively simple L2 VPN tunnel is provided to users. The Dot1Q Tunnel protocol is a simple and manageable protocol, which is realized through static configuration without signaling support and widely applied to enterprise networks consisting of L3 switches or small-scale MAN. The Dot1Q Tunnel attribute of switches just meets this requirement. As a cheap and compact L2 VPN solution, it is increasingly popular among more and more small-scale users when VPN network is required. At the inside of carrier’s network, P device need not support the Dot1Q Tunnel function. That is, traditional L3 switches can meet the requirements fully and protect the investment of the carrier greatly.  Enables Dot1Q Tunnel globally.  Supports the inter-translation between customer VLAN and SPVLAN on the downlink port, including translation in Flat mode and in QinQ mode.  Supports the configuration of the uplink port. 1 VLAN Configuration 1.2.2 Dot1Q Tunnel Realization Mode There are two modes to realize Dot1Q Tunnel: port-based Dot1Q Tunnel and Dot1Q Tunnel based on inner CVLAN tag classification. 1) Port-based Dot1Q Tunnel: When a port of this device receives packets, no matter whether packets have the VLAN tag, the switch will add the VLAN tag of the default VLAN on this port to these packets. Thus, if a received packet has a VLAN tag, the packet become a packet with double tags; if a received packet is untagged, this packet will be added a default VLAN tag of this port. The packet with a single VLAN tag has the following structure, as shown in table 1: DA SA ETYPE(8100) VLAN TAG ETYPE DATA FCS (6B) (6B) (2B) (2B) (2B) (0~1500B) (4B) Table 1 Packet with a single VLAN tag The packet with double VLAN tags has the following structure, as shown in table 2: SPVLAN ETYPE CVLAN DA SA ETYPE(8100) ETYPE DATA FCS Tag (8100) Tag (6B) (6B) (2B) (2B) (0~1500B) (4B) (2B) (2B) (2B) Table 2 Packet with double VLAN tags 2) Dot1Q Tunnel based on the inner CVLAN Tag: The service is distributed according to the CVLAN ID zone of the inner CVLAN tag of Dot1Q Tunnel. The CVLAN zone can be translated into SPVLAN ID and there are two translation modes: Flat VLAN translation and QinQ VLAN translation. In QinQ VLAN translation mode, when a same user uses different services by using different CVLAN IDs, the services can be distributed according to CVLAN ID. For example, the CVLAN ID of bandwidth service ranges between 101 and 200; the CVLAN ID of VOIP service ranges between 201～300; and the CVLAN ID of IPTV service ranges between 301～ 400. When PE device receives the user data, set SPVLAN Tag with ID as 1000 for the bandwidth service; set SPVLAN Tag with ID as 2000 for the VOIP service; set SPVLAN Tag with ID as 3000 for IPTV. The difference of the Flat VLAN translation mode and the QinQ VLAN translation mode is that in the flat VLAN translation mode the SPVLAN tag is not on the out-layer of the CVLAN tag, but replaces the CVLAN tag directly. 1.3 VLANConfiguration Task List  Adding/Deleting VLAN  Configuring the Port of the Switch  Creating/deleting the VLAN interface  Monitoring the VLAN Configuration and VLAN State  Enabling or Disabling Dot1Q Tunnel Globally 1.4 VLAN Configuration Task 1.4.1 Adding/Deleting VLAN VLAN is grouped according to different functions, project groups or different applications, not based on the physical locations of these users. VLAN has the 2 VLAN Configuration similar attributes as the physical LAN, but can group terminals in different physical LANs into a same VLAN. One VLAN can have multiple ports, while all unicast/broadcast/multicast packets can be forwarded or diffused to the terminals through a same VLAN. Each VLAN is a logical network; to forward one packet to another VLAN, the routes or bridge must be used to forward it. Run the following commands to configure VLAN: Command Purpose vlan vlan-id Enters theVLANconfiguration mode. name str Name in theVLANconfiguration mode Exit Exits theVLANconfiguration mode and creates theVLAN. vlan vlan-range Creates multiple VLANs simultaneously. no vlan vlan-id | vlan-range Deletes one or multiple VLANs. You can use the GVRP protocol to dynamically add or delete the VLAN. 1.4.2 Configuring the Port of the Switch The switch's port supports the following modes: the access mode, the relay mode, the VLAN tunnel mode, the VLAN translating tunnel mode and the VLAN tunnel uplink mode.  The access mode indicates that the port belongs to just one VLAN; only the untagged Ethernet frame can be transmitted and received.  The relay mode indicates that the port connects other switches and the tagged Ethernet frame can be transmitted and received.  The VLAN translating tunnel mode is a sub mode based on the relay mode. The port looks up the VLAN translation table according to the VLAN tag of received packets to obtain corresponding SPVLAN, and then the switching chip replaces the original tag with SPVLAN or adds the SPVLAN tag to the outside layer of the original tag. When the packets is forwarded out of the port, the SPVLAN will be replaced by the original tag or the SPVLAN tag will be removed mandatorily. Hence, the switch omits different VLAN partitions that access the network, and then passes them without change to the other subnet that connects the other port of the same client, realizing transparent transmission.  The VLAN tunnel uplink mode is a sub mode based on the relay mode. The SPVLAN should be set when packets are forwarded out of the port. When the packets are received by the port, their TPIDs will be checked. If difference occurs or they are untagged packets, the SPVLAN tag which contains their own TPID will be added to them as their outer-layer tag.When the packets are received by the port, their TPIDs will be checked. If difference occurs or they are untagged packets, the SPVLAN tag which contains their own TPID will be added to them as their outer-layer tag. Each port has a default VLAN and PVID; all VLAN-untagged data received on the port belongs to the packets of the VLAN. The relay mode can group the port to multiple VLANs; at the same time, you can configure the type of to-be-forwarded packets and the quantity of the corresponding VLANs. Run the following commands to configure the switch’s port: 3 VLAN Configuration Command Purpose switchport pvid vlan-id Configures PVID of the switch’s interface. switchport mode {access | trunk | Configures the interface mode of the dot1q-translating-tunnel | switch. dot1q-tunnel-uplink } switchport trunk vlan-allowed… Configures the VLAN range of the switch’s interface. switchport trunk vlan-untagged… Configures the untagged VLAN ranges of the switch’s port. 1.4.3 Creating/deleting the VLAN interface To realize network management or layer-3 routing, you need create a VLAN interface which can be used for designating the IP address and mask of the interface. Run the following command to configure the VLAN interface. Command Purpose [no] interface vlan vlan-id Creates or deletes a VLAN interface. 1.4.4 Monitoring the VLAN Configuration and VLAN State To monitor the configuration and state of VLAN and Dot1Q tunnel, run the following commands in EXEC mode: Command Purpose show vlan [ id x | interface intf | dot1q-tunnel Displays the configuration and state of [interface intf]|mac-vlan | subnet |protocol-vlan VLAN or Dot1Q tunnel. |dot1q-translating-tunnel|flat-translation-table] show interface vlan x Displays the state of the VLAN interface or that of the supervlan interface. 1.4.5 Enabling or Disabling Dot1Q Tunnel Globally After Qot1Q Tunnel is globally enabled, all ports serve as the downlink ports of Qot1Q Tunnel by default and put the SPVLAN tag on the incoming packets. The command to enable dot1q-tunnel globally: Command Purpose dot1q-tunnel The command is used to configure dot1q-tunnel globally. 1.5 Configuration Example 1.5.1 Dot1Q Tunnel Configuration Examples The following typical solutions show how to apply Dot1Q tunnel. 4 VLAN Configuration 1. Example 1 Figure 3 Typical configuration of Dot1Q tunnel As shown in the figure above, port F0/1 of CE1 connects port F0/1 (or port G0/1) of PE1, PE1 connects S8510 on port F0/2 (or port G0/2), PE2 connects S8510 on port F0/2 (or port G0/2), and port F0/1 (or port G0/1) of PE2 connects port F0/1 of CE1. Port G0/1 of PE is set to be the access port of VLAN 10 and on them Dot1Q Tunnel is enabled. However, the ports of CE still need Trunk VLAN 200-300, enabling the link between CE and PE to be an asymmetrical link. In this case, the public network only needs to distribute users a VLAN ID, 10. No matter how many VLAN IDs of private network are planned in the user’s network, the newly distributed VLAN ID of the public network will be mandatorily inserted into the tagged packets when these packets enter the backbone network of ISP. These packets then pass through the backbone network through the VLAN ID of the public network, reach the other side of the backbone network, that is, the PE devices, get rid of the VLAN tag of the public network, resume the user’s packets and at last are transmitted to the CE devices of the users. Therefore, the packets that are forwarded in the backbone network have two layers of 802.1Q tag headers, one being the tag of the public network and the other being the tag of the private network. The detailed flow of packet forwarding is shown as follows: 1) Because the egress port of CE1 is a Trunk port, all the packets that are transmitted by users to PE1 have carried the VLAN tag of the private network (ranging from 200 to 300). One of these packets is shown in figure 4. DA SA ETYPE(8100) VLAN TAG ETYPE DATA FCS (6B) (6B) (2B) (2B) (2B) (0~1500B) (4B) Figure 4 Structure of a packet from CE1 2) After the packets enter PE1, PE1, for the ingress port is the access port of Dot1Q tunnel, ignores the VLAN tag of the private network but inserts the default VLAN 10’s tag into these packets, as shown in figure 5. 5 VLAN Configuration SPVLAN ETYPE DA SA ETYPE(8100) CVLAN Tag ETYPE DATA FCS Tag (8100) (6B) (6B) (2B) (2B) (2B) (0~1500B) (4B) (2B) (2B) Figure 5 Structure of a packet going into PE1 3) In the backbone network, packets are transmitted along the port of trunk VLAN 10. The tag of the private network is kept in transparent state until these packets reach PE2. 4) PE2 discovers that the port where it connects CE2 is the access port of VLAN 10, removes the tag header of VLAN 10 according to 802.1Q, resumes the initial packets of users, and transmit the initial packets to CE2, as shown in figure 6. DA SA ETYPE(8100) VLAN TAG ETYPE DATA FCS (6B) (6B) (2B) (2B) (2B) (0~1500B) (4B) Figure 6 Structure of a packet from PE2 Seen from the forwarding flow, Dot1Q Tunnel is very concise for the signaling is not required to maintain the establishment of the tunnel, which can be realized through static configuration. As to the typical configuration figure of Dot1Q Tunnel, products of different models are configured as follows when they run as PE (PE1 configuration is same to PE2). 1) Dot1Q Tunnel Configuration of the switch Switch_config#dot1q-tunnel Switch_config_g0/1#switchport pvid 10 Switch_config_g0/2#switchport mode trunk Switch_config_g0/2#switchport trunk vlan-untagged 1-9,11-4094 6 VLAN Configuration Appendix A Abbreviations Abbrev. Full Name Chinese Name VPN Virtual Private Network Virtual Private Network TPID Tag Protocol Identifier Tag Protocol Identifier QoS Quality of Service QoS P provider bridged network core provider bridged network core PE provider bridged network edge provider bridged network edge CE customer network edge customer network edge UNI user-network interface user-network interface NNI network-network interface network-network interface CVLAN Customer VLAN Customer VLAN SPVLAN Service provider VLAN Service provider VLAN 7