newbie here with a very similar question to one that was posted a couple of years back … only slightly different (so, as the original question was asked so perfectly, I've copied it nearly verbatim and just edited it slightly … terribly lazy I know!)
How do I tell Juniper EX4200 to push specific S-VLAN based on C-VLAN on q-in-q (dot1q-tunneling) port?
For instance I want to instruct EX4200 to perform Q-in-Q using these rules:
1) If a single-tag frame is received on ge-0/0/0 with C-VLAN=41, DO NOT PUSH S-VLAN*
2) If a single-tag frame is received on ge-0/0/0 with C-VLAN=42, push S-VLAN=5.
3) If a single-tag frame is received on ge-0/0/0 with C-VLAN=51, push S-VLAN=5.
4) If a single-tag frame is received on ge-0/0/0 with C-VLAN=52, push S-VLAN=5.
Conversely, whenever a double-tag frame is to be sent out on ge-0/0/0, the outer S-VLAN ought to be removed (popped).
"DO NOT PUSH S-VLAN" means "leave as a single tagged frame with vlan-id 41 as the only tag"
Can this be done on a Juniper EX4200? If so, please point out the specific configuration commands.
Best Answer
Q-in-Q on the 4200 is super non-intuitive, but here is the configuration that will work for you:
If you're mixing Q-in-Q and dot1q, you need to set the dot1q tunnelling ethertype to be
0x8100
Now, configure the interface you'll be receiving the C-TAGs on - note that you will only configure it as an untagged interface (very non-intuitive):
Now create your S-VLAN 5 and "C-VLAN" 41 and apply them to interface
ge-0/0/7.0
- note that because the interface is not tagged in the previous step, you have to apply the interface within the VLAN configuration as per below (other interfaces in VLAN 41 can be applied in the normal way):The last piece is how to deal with the dot1q tag being received; if you leave things as they are, the dot1q traffic for VLAN 41 will be dropped on ingress to port
ge-0/0/7.0
, so you need to create a VLAN swap action which essentially swaps 41 with 41 (like I said, it's super non-intuitive):Now you should be able to handle both dot1q and q-in-q frames on the same interface.
One caveat to be aware of is that you can't have an S-VLAN ID the same as any of your C-VLAN IDs, since you need to create the VLAN on the switch to tunnel.