Interfaces and Hardware Component Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

Interfaces and Hardware Component Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

Layer 2 interface VLAN encapsulation using VLAN ranges and lists

Updated: July 31, 2026

Want to summarize with AI?

This topic describes Layer 2 interface VLAN encapsulation using VLAN ranges and lists on the Cisco 8000 Series Router, which lets you group multiple VLAN IDs together for encapsulation to simplify configuration and improve scalability.

VLAN encapsulation is a networking technique that:

embeds VLAN tags within Ethernet frames to distinguish and identify network traffic
relies on unique VLAN IDs, organized through ranges and lists, to manage and distinguish different VLANs, and
ensures logical separation of traffic types to enhance network performance, security, and manageability.

Table 1. Feature History Table
Feature Name	Release Information	Feature Description
Layer 2 interface VLAN encapsulation using VLAN ranges and lists	Release 26.1.1	Introduced in this release on: Centralized Systems (8400 [ASIC:K100]) )(select variants only) This feature is now supported on Cisco 8404-SYS-D routers.
Layer 2 interface VLAN encapsulation using VLAN ranges and lists	Release 25.4.1	Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100])(select variants only) This feature is supported on: 8711-48Z-M 8011-32Y8L2H2FH 8011-12G12X4Y-A/D
Layer 2 interface VLAN encapsulation using VLAN ranges and lists	Release 25.1.1	Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only) This feature is supported on Cisco 8011-4G24Y4H-I routers.
Layer 2 interface VLAN encapsulation using VLAN ranges and lists	Release 24.4.1	Introduced in this release on: Fixed Systems (8200, 8700 [ASIC: K100])(select variants only); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q200, P100])(select variants only) You can now leverage the VLAN ranges and lists to effectively separate networks operating over shared links and devices. VLAN encapsulation is typically determined by the access network and customer edge (CE) device, limiting the network provider's control over the VLAN tag or Ethernet type of customer traffic. The VLAN ranges and lists support various customer traffic types, enhancing network flexibility and management. This feature is supported on: 8201-32FH 8201-24H8FH 8202-32FH-M 8212-48FH-M 8608 8711-32FH-M 8712-MOD-M 88-LC0-34H14FH 88-LC0-36FH 88-LC0-36FH-M 88-LC1-36EH 88-LC1-52Y8H-EM 88-LC1-12TH24FH-E This feature modifies these changes: CLI: encapsulation dot1ad* encapsulation dot1ad dot1q encapsulation dot1q encapsulation dot1q second-dot1q

VLAN ranges and lists

VLAN ranges and lists differ in their approach to VLAN encapsulation:

A VLAN range is a sequence of contiguous VLAN IDs used for encapsulation. For instance, VLAN IDs from 200 to 250 can be grouped in a range.
A VLAN list is a specific enumeration of VLAN IDs used for encapsulation. For instance, VLAN IDs 100, 123, and 150 can be grouped in a list.

VLAN list and range can be used together in configuration.

Benefits of Layer 2 interface VLAN encapsulation using VLAN ranges and lists

The VLAN encapsulation using VLAN ranges and lists offers several key benefits and is crucial for efficient network management:

Simplified configuration: Configuring multiple VLANs with a single command, rather than individually, reduces the time and effort required for network setup and modification.
Enhanced manageability: Managing VLANs becomes easier when grouped into lists or ranges. Changes can be applied to multiple VLANs simultaneously, simplifying network management tasks.
Improved scalability: Grouping VLANs supports more efficient scaling in large-scale network environments, enabling the network to handle more VLANs without significantly increasing configuration complexity. A single subinterface can be used instead of multiple subinterfaces.
Reduced configuration errors: Using fewer commands to configure multiple VLANs decreases the likelihood of configuration errors, resulting in a more stable and reliable network setup.

Supported encapsulations

encapsulation dot1q <x> , <y> (For example, encapsulation dot1q 200, 210, 300, 310, 400)
encapsulation dot1q <x> - <y> (For example, encapsulation dot1q 200 – 400, 600-801, 901-1000)
encapsulation dot1q <x> second-dot1q <y>, <z>
encapsulation dot1q <x> second-dot1q <y> - <z>
encapsulation dot1q <x> - <y> second-dot1q <z>
encapsulation dot1ad <x> dot1q <y>, <z>
encapsulation dot1ad <x> dot1q <y> - <z>
encapsulation dot1ad <x> - <y> dot1q <z>
encapsulation dot1ad <x>, <y> dot1q <z>
encapsulation dot1ad <x>, <y>
encapsulation dot1ad <x> - <y>

Restrictions for Layer 2 interface VLAN encapsulation using VLAN ranges and lists

These are the restrictions of Layer 2 interface VLAN encapsulation using VLAN ranges and lists:

Supported only on Q200, P100, and K100 line cards and systems.
Double-tagged encapsulations support the inner or outer tag as a list or range of VLAN IDs, but not both. For example:
- encapsulation dot1ad 100-200 dot1q 300 (supported)
- encapsulation dot1ad 100 dot1q 200,300 (supported)
- encapsulation dot1ad 10-20 dot1q 30-40 (not supported)
Supported only on Layer 2 subinterfaces.
The maximum number of list entries, individual or range per encapsulation, is 64.
Ranges of up to 4094 VLAN IDs are supported.
For lists with more than ten list items, use the encapsulation list-extended command.

For example, encapsulation list-extended dot1q <x1>, … , <x10>

Configure a VLAN range and a VLAN list on Layer 2 subinterfaces

Define the matching criteria to map VLAN-tagged frames to the appropriate service instance.

Procedure

Configure a VLAN range and a VLAN list on Layer 2 subinterfaces using the appropriate encapsulation method based on your requirements.

If you want to configure a service with a list of noncontiguous customer VLAN (C-VLAN) ranges:

Router# configure
Router(config)# interface HundredGigE0/3/0/0.1 l2transport
Router(config-subif)# encapsulation dot1ad 200-400,600-801
Router(config-subif)# commit

If you want to configure a service with a list of C-VLANs:

Router# configure
Router(config)# interface HundredGigE0/2/0/0.1 l2transport
Router(config-subif)# encapsulation dot1q 200,210,300,310,400
Router(config-subif)# commit

If you want to configure a service with a range of service provider VLANs (S-VLANs) and a single inner C-VLAN:

Router# configure
Router(config)# interface HundredGigE0/4/0/0.1 l2transport
Router(config-subif)# encapsulation dot1ad 100-200 dot1q 300
Router(config-subif)# commit

If you want to configure a QinQ service with a single S-VLAN and a list of C-VLANs:

Router# configure
Router(config)# interface HundredGigE0/5/0/0.1 l2transport
Router(config-subif)# encapsulation dot1q 100 second-dot1q 200,300
Router(config-subif)# commit

Run the show interfaces command to verify the VLAN range and VLAN list on the Layer 2 subinterface.

The corresponding value of the outer match appears depending on the VLAN configuration. The Outer Match field corresponds to the Dot1ad VLAN range and list in this example.

Router# show interfaces HundredGigE0/3/0/0.1 
HundredGigE0/3/0/0.1 is UP, line protocol is UP
Interface state transitions: 0
Hardware is VLAN sub-interface(s), address is dc05.39c7.9440
Layer 2 Transport Mode
MTU 1518 bytes, BW 100000000 Kbit (Max: 100000000 Kbit)
reliability Unknown, txload Unknown, rxload Unknown
Encapsulation 802.1ad Virtual LAN,
Outer Match: Dot1ad VLAN 200-400,600-801
Ethertype Any, MAC Match src any, dest any
loopback not set,
Last input never, output never
Last clearing of "show interface" counters never
0 packets input, 0 bytes
0 input drops, 0 queue drops, 0 input errors
0 packets output, 0 bytes
0 output drops, 0 queue drops, 0 output errors

In this example, the Outer Match and Inner Match fields correspond to the Dot1ad VLAN range 100-200 and VLAN list Dot1Q VLAN 300.

Router# show interfaces HundredGigE0/4/0/0.1 

HundredGigE0/4/0/0.1 is UP, line protocol is UP
Interface state transitions: 0
Hardware is VLAN sub-interface(s), address is dc05.39c7.9440
Layer 2 Transport Mode
MTU 1522 bytes, BW 100000000 Kbit (Max: 100000000 Kbit)
reliability Unknown, txload Unknown, rxload Unknown
Encapsulation 802.1ad-802.1Q Virtual LAN,
Outer Match: Dot1ad VLAN 100-200
Inner Match: Dot1Q VLAN 300
Ethertype Any, MAC Match src any, dest any
loopback not set,
Last input never, output never
Last clearing of "show interface" counters never
0 packets input, 0 bytes
0 input drops, 0 queue drops, 0 input errors
0 packets output, 0 bytes
0 output drops, 0 queue drops, 0 output errors

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.