In the previous article, we shared you an example of configuring double tag translation. This time, we are going to do single tag translation. Single tag translation is about where you map QinQ packets of a customer to a VNI of VxLAN and preserve the service as an inner VLAN inside a VXLAN packet. The customer-facing interface is a QinQ access port with the outer S-tag. The S-tag is then translated to a VXLAN VNI. Single tag translation leverages VLAN-aware Linux bridge mode with the use of the 802.1ad VLAN protocol (the only supported protocol at the time of writing). Hence, it is more scalable.
Note: you need to have Cumulus Linux 3.3.1 at least and QinQ metapackage installed. The steps of doing this is mentioned in the previous article about doing double tag translation.
As you can see the above network connectivity, VLAN 40, 50 and 60 are C-Tag. We allow them on trunk port on both Juniper EX2200 and Cisco switch. Port swp3 of both iNET9-CL01 and 02 will be in access mode and map to VLAN 200 which is considered as S-Tag. VLAN 200 will then map to VNI 1000.
Configuration1. iNET9-CL01 vi /etc/network/interfaces auto swp2 iface swp2 link-speed 10000 address 22.214.171.124/30 auto swp3 iface swp3 link-speed 1000 bridge-access 200 auto vni-1000 iface vni-1000 vxlan-local-tunnelip 126.96.36.199 vxlan-remoteip 188.8.131.52 bridge-access 200 vxlan-id 1000 auto bridge iface bridge bridge-ports swp3 vni-1000 bridge-vlan-aware yes bridge-vlan-protocol 802.1ad Save the interfaces file then do ifreload -a to get interface configuration to take effect. 2. iNET9-CL02 vi /etc/network/interfaces auto swp2 iface swp2 link-speed 10000 address 184.108.40.206/30 auto swp3 iface swp3 link-speed 1000 bridge-access 200 auto vni-1000 iface vni-1000 vxlan-local-tunnelip 220.127.116.11 vxlan-remoteip 18.104.22.168 bridge-access 200 vxlan-id 1000 auto bridge iface bridge bridge-ports swp3 vni-1000 bridge-vlan-aware yes bridge-vlan-protocol 802.1ad Save the interfaces file then do ifreload -a to get interface configuration to take effect. 3. iNET9-EX2200 set vlans VLAN40 vlan-id 40 set vlans VLAN40 l3-interface vlan.40 set vlans VLAN50 vlan-id 50 set vlans VLAN50 l3-interface vlan.50 set vlans VLAN60 vlan-id 60 set vlans VLAN60 l3-interface vlan.60 set interfaces ge-0/0/1 unit 0 family ethernet-switching port-mode trunk set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members VLAN40 set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members VLAN50 set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members VLAN60 set interfaces vlan unit 40 family inet address 22.214.171.124/24 set interfaces vlan unit 50 family inet address 126.96.36.199/24 set interfaces vlan unit 60 family inet address 188.8.131.52/24 4. iNET9-Cisco Switch vlan 40 name VLAN40 ! vlan 50 name VLAN50 ! vlan 60 name VLAN60 ! interface GigabitEthernet0/2 switchport trunk encapsulation dot1q switchport trunk allowed vlan 40,50,60 switchport mode trunk ! interface Vlan40 ip address 184.108.40.206 255.255.255.0 ! interface Vlan50 ip address 220.127.116.11 255.255.255.0 ! interface Vlan60 ip address 18.104.22.168 255.255.255.0 !
You can use command net show bridge vlan to verify VLAN mapping. Also, to verify that the bridge is configured for QinQ, run ip -d link show bridge and look for vlan_protocol 802.1ad in the output. Last but not least, we can use ping command to verify reachability between Juniper and Cisco switch for each VLAN.
[email protected]> show interfaces terse vlan Interface Admin Link Proto Local Remote vlan.40 up up inet 22.214.171.124/24 vlan.50 up up inet 126.96.36.199/24 vlan.60 up up inet 188.8.131.52/24
[email protected]> ping 184.108.40.206 PING 220.127.116.11 (18.104.22.168): 56 data bytes 64 bytes from 22.214.171.124: icmp_seq=0 ttl=255 time=4.498 ms 64 bytes from 126.96.36.199: icmp_seq=1 ttl=255 time=3.285 ms 64 bytes from 188.8.131.52: icmp_seq=2 ttl=255 time=2.643 ms 64 bytes from 184.108.40.206: icmp_seq=3 ttl=255 time=3.305 ms 64 bytes from 220.127.116.11: icmp_seq=4 ttl=255 time=2.615 ms 64 bytes from 18.104.22.168: icmp_seq=5 ttl=255 time=2.521 ms ^C — 22.214.171.124 ping statistics — 6 packets transmitted, 6 packets received, 0% packet loss round-trip min/avg/max/stddev = 2.521/3.145/4.498/0.683 ms
[email protected]> ping 126.96.36.199 PING 188.8.131.52 (184.108.40.206): 56 data bytes 64 bytes from 220.127.116.11: icmp_seq=0 ttl=255 time=3.861 ms 64 bytes from 18.104.22.168: icmp_seq=1 ttl=255 time=2.786 ms 64 bytes from 22.214.171.124: icmp_seq=2 ttl=255 time=2.742 ms ^C — 126.96.36.199 ping statistics — 3 packets transmitted, 3 packets received, 0% packet loss round-trip min/avg/max/stddev = 2.742/3.130/3.861/0.517 ms
[email protected]> ping 188.8.131.52 PING 184.108.40.206 (220.127.116.11): 56 data bytes 64 bytes from 18.104.22.168: icmp_seq=0 ttl=255 time=3.553 ms 64 bytes from 22.214.171.124: icmp_seq=1 ttl=255 time=2.347 ms 64 bytes from 126.96.36.199: icmp_seq=2 ttl=255 time=3.324 ms 64 bytes from 188.8.131.52: icmp_seq=3 ttl=255 time=2.330 ms ^C — 184.108.40.206 ping statistics — 4 packets transmitted, 4 packets received, 0% packet loss round-trip min/avg/max/stddev = 2.330/2.889/3.553/0.556 ms
[email protected]> show ethernet-switching table Ethernet-switching table: 9 entries, 3 learned, 0 persistent entries VLAN MAC address Type Age Interfaces VLAN40 * Flood – All-members VLAN40 10:8c:cf:48:89:42 Learn 1:11 ge-0/0/1.0 VLAN40 64:64:9b:10:61:c1 Static – Router VLAN50 * Flood – All-members VLAN50 10:8c:cf:48:89:43 Learn 0 ge-0/0/1.0 VLAN50 64:64:9b:10:61:c1 Static – Router VLAN60 * Flood – All-members VLAN60 10:8c:cf:48:89:44 Learn 0 ge-0/0/1.0 VLAN60 64:64:9b:10:61:c1 Static – Router
[email protected]> show arp MAC Address Address Name Interface Flags 10:8c:cf:48:89:42 220.127.116.11 18.104.22.168 vlan.40 none 10:8c:cf:48:89:43 22.214.171.124 126.96.36.199 vlan.50 none 3c:8a:b0:ac:bb:88 188.8.131.52 184.108.40.206 me0.0 none 10:8c:cf:48:89:44 220.127.116.11 18.104.22.168 vlan.60 none Total entries: 4