Firewall Configuration – Difference Between Set Firewall Filter and Set Firewall Family

GRNET (the Greek Research and Education network) have developed a web application for customers to do this with Flowspec. The web portal has a BGP Flowspec backend which injects flowspec into your network. Highly configurable and in use on the 500-1,000 Gbps pan-European GEANT backbone: https://www.noc.grnet.gr/en/fod

What is the functional difference between these two TPID values?

0x8100

This TPID is used in 802.1Q - its your average, everyday VLAN tagging. A common use for VLANs is for enterprises to organize their network into functional groups (like research, finance, or management).

0x88a8

This TPID is used in 802.1ad - its used for provider bridging (also known as QinQ, stacked VLANs, or double tagging). QinQ allows multiple VLAN tags in an Ethernet frame.

QinQ is used when a customer has to transport VLAN tagged traffic across a service provider network. The service provider will have its own set of VLAN tags, perhaps a tag per customer. So we have customer VLAN tags, and service provider VLAN tags, appropriately called C-TAGs and S-TAGs.

S-TAGs are correlated with the 0x88a8 TPID to signify the existence of the inner C-TAG which uses TPID 0x8100 (S-TAGs are inserted before C-TAGs).

Why would Juniper use a different default TPID than the IEEE reserved TPID for the S-TAG?

They're not, here is a list of the common IEEE TPIDs.

To be more specific, the default is 0x8100 because 802.1Q is used WAY more commonly than 802.1ad/Provider Bridging.

To be even more specific to what I assume is a quote from the JNCIS documentation, is just really poor wording. I believe it's saying that the default TPID is 0x8100 (to imply that 802.1q is default).