L2VPN Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

L2VPN Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

VLANs in Layer 2 VPNs

Updated: September 11, 2026

Want to summarize with AI?

Log in

Introduces VLAN services in Layer 2 VPNs, highlights the benefits of VLANs, explains attachment circuit types, describes Dot1Q Q-in-Q tunneling, and provides procedures for encapsulation, tag rewrite, and double-tagged 802.1ad options.

A VLAN in Layer 2 VPNs is a network segmentation method that

  • uses VLAN-tagged Ethernet subinterfaces as attachment circuits to connect geographically separated customer sites

  • inserts VLAN membership information into Ethernet frames according to IEEE 802.1Q, and

  • improves segmentation, bandwidth use, and security between internal network segments.

A VLAN is a logical group of devices that communicate as if they are on the same LAN even when they are distributed across multiple LAN segments.

To create a Layer 2 VLAN attachment circuit, create a VLAN subinterface and include the l2transport keyword so the subinterface operates as a Layer 2 interface.

Table 1. Feature History Table

Feature Name

Release Information

Feature Description

Dot1Q Q-in-Q (0x8100/0x8100) Tunneling for VLAN Subinterface Encapsulation

Release 24.4.1

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100]); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

The support for Dot1Q Q-in-Q (0x8100/0x8100) Tunneling for VLAN Subinterface Encapsulation is now extended to all systems in the Cisco 8000 Series Routers.

Dot1Q Q-in-Q (0x8100/0x8100) Tunneling for VLAN Subinterface Encapsulation

Release 24.1.1

We have optimized VLAN implementation by enabling service providers to:

  • expand VLAN space to segregate their networks for customers with multiple VLANs and overlapping VLAN IDs.

  • enhance service mapping for efficiently differentiating data packets and applying QoS policies based on users and services.

Such optimization is possible because this release supports Dot1Q Q-in-Q (0x8100/0x8100) encapsulation for VLAN subinterfaces. This involves configuring these subinterfaces to add an outer 802.1Q tag to packets that are already carrying an 802.1Q VLAN tag.

The feature introduces these changes:

CLI:

New L2VPN commands

YANG Data Model:

This feature is supported on Cisco 8000 series routers that are based on the Q200 silicon chip application-specific integrated circuit (ASIC).

VLAN services in Layer 2 VPNs

Service-provider context and VLAN behavior

The L2VPN feature enables service providers (SPs) to provide Layer 2 services to geographically disparate customer sites.

A virtual local area network (VLAN) is a group of devices on one or more LANs that are configured so that they can communicate as if they were attached to the same wire, even when they are located on different LAN segments.

Cisco IOS XR software supports VLAN subinterface configuration on:

  • 400 Gigabit Ethernet interfaces

  • 100 Gigabit Ethernet interfaces

VLAN attachment circuits (ACs) use a configuration model similar to basic VLAN configuration. To set up a VLAN AC:

  • create a VLAN subinterface

  • enter subinterface configuration mode

  • configure the VLAN on the subinterface

To create an attachment circuit, the configuration includes the l2transport keyword in the interface command string to identify the interface as a Layer 2 interface.

Benefits of VLANs in Layer 2 networks

VLANs provide several key benefits in Layer 2 networks:

  • Simplify user and host management

  • Support bandwidth allocation

  • Optimize network resources

  • Reduce unnecessary broadcast and multicast traffic by dividing large networks into smaller parts

  • Increase security between internal network segments

Attachment circuit models in Layer 2 VPNs

These attachment circuit models are used for VLAN services in Layer 2 VPNs:

  • Basic Dot1Q attachment circuit: matches traffic with a specific single VLAN tag.

  • Q-in-Q attachment circuit: matches traffic with a specific outer VLAN tag and a specific inner VLAN tag.

Dot1Q Q-in-Q tunneling (0x8100/0x8100) requirements for VLAN subinterface encapsulation

Key facts about Dot1Q Q-in-Q tunneling

Dot1Q Q-in-Q tunneling (also called stacked VLAN tagging or double VLAN) enables a scalable VLAN implementation by adding an extra 802.1Q tag to packets already tagged. This technique allows multiple VLAN domains within a larger network, helping service providers support multitenancy with overlapping VLAN IDs.

  • Purpose: Expands VLAN capacity and facilitates service mapping with two levels of VLAN tags.

  • Outer VLAN tag: Represents the service provider VLAN, added by the provider as frames enter the network. Can use EtherType 0x8100, 0x9100, or 0x88A8, depending on platform or configuration.

  • Inner VLAN tag: Represents the customer VLAN, added by the customer network. Must use EtherType 0x8100.

  • VLAN identifier assignment: All Ethernet subinterfaces default to 802.1Q VLAN encapsulation and must have a specific VLAN identifier explicitly defined before they can pass traffic.

  • Multitenancy: Outer and inner VLAN tags enable the router to distinguish packets based on users and services, allowing multiple customers with overlapping VLAN IDs to share the same carrier network.

  • Each subinterface must have a valid tagging protocol encapsulation and be assigned a VLAN identifier for traffic to pass.

  • Double tagging allows for service mapping and distinction between provider and customer VLAN domains.

Q-in-Q tunneling creates a scalable, flexible VLAN environment supporting multiple customers over a single carrier network while maintaining clear distinction between provider and customer VLANs.

Before a subinterface is allowed to pass traffic, it must have a valid tagging protocol encapsulation and VLAN identifier assigned. All Ethernet subinterfaces default to 802.1Q VLAN encapsulation, but the VLAN identifier must be explicitly defined.

Configure Dot1Q Q-in-Q (0x8100/0x8100) tunneling for VLAN subinterface encapsulation

Enable Q-in-Q encapsulation, allowing a VLAN subinterface to carry double VLAN tags (0x8100/0x8100) for service provider tunneling.

Q-in-Q tunneling allows a Layer 2 VLAN subinterface to encapsulate customer VLAN traffic with an additional provider VLAN tag. This configuration is required before a subinterface can pass traffic, with explicit VLAN identifiers provided.

Before you begin

Decide the outer and inner VLAN IDs for the service and identify the target subinterface.

Procedure

  1. Enter interface configuration mode for the Layer 2 subinterface.

    Example:

    Router# configure
Router(config)# interface TenGigE 0/0/0/1.102 l2transport

  2. Configure the Q-in-Q encapsulation.

    Example:

    Router(config-subif)# encapsulation dot1q 200 second-dot1q 201

  3. Commit the configuration.

    Example:

    Router(config-subif)# commit
Router(config-subif)# exit
Router(config)# exit

  4. Use the show interfaces TenGigE 0/0/0/1.102 command to verify that the subinterface is operating in Q-in-Q mode.

    Example:

    Router# show interfaces TenGigE 0/0/0/1.102

    Successful verification shows the subinterface up and the line Encapsulation 802.1Q-802.1Q Virtual LAN.

    HundredGigE0/0/0/1.102 is up, line protocol is up
Hardware is VLAN sub-interface(s)
Encapsulation 802.1Q-802.1Q Virtual LAN

Configure Dot1Q Q-in-Q (0x8100/0x8100) tag rewrite on a VLAN subinterface

This is an optional procedure. Use these example configurations to add or modify double Dot1Q Q-in-Q VLAN tags (with an outer tag of 0x8100) on Layer 2 Ethernet frames.

Enable the addition or modification of double Dot1Q (Q-in-Q) tags for ingress Layer 2 Ethernet frames, supporting flexible VLAN handling for provider and customer edge separation.

This procedure is common in service provider environments that use Q-in-Q tunneling, where double-tagged (VLAN stacked) frames need custom rewrite operations. Typical actions include removing, adding, or translating VLAN tags on incoming frames.

Before you begin

Make sure the Q-in-Q encapsulation is configured on the subinterface before you configure rewrite actions.

Procedure

  1. Enter Layer 2 subinterface configuration mode.

    Example:

    Router# configure
Router(config)# interface TenGigE 0/0/0/1.102 l2transport

  2. Configure the double-tag encapsulation.

    Example:

    Router(config-subif)# encapsulation dot1q 200 second-dot1q 201

  3. Apply the required rewrite action.

    Example:

    Router(config-subif)# rewrite ingress tag pop 2 symmetric

    This example demonstrates push and translate operations for Q-in-Q services.

    /* Configure Dot1Q Q-in-Q Tag Rewrite: Pop 2 */
interface HundredGigE0/0/0/0.1 l2transport
 encapsulation dot1q 200 dot1q 201
  rewrite ingress tag pop 2 symmetric
 !
!

/* Configure Dot1Q Q-in-Q Tag Rewrite: Push */
interface HundredGigE0/0/0/0.1 l2transport
 encapsulation dot1q 200 dot1q 201
  rewrite ingress tag push dot1q 200 second-dot1q 201 symmetric
 !
!

  4. Commit the configuration.

    Example:

    Router(config-subif)# commit
Router(config-subif)# exit
Router(config)# exit

Double-tagged 802.1ad encapsulation options for Layer 2 and Layer 3 physical and bundle subinterfaces

Key facts

Subinterfaces are logical interfaces created on a hardware interface. These software-defined interfaces allow segregation of traffic into separate logical channels and help optimize physical-interface bandwidth.

The encapsulation options and requirements for double-tagged 802.1ad services are as follows:

  • All Ethernet subinterfaces use 802.1Q VLAN encapsulation by default.

  • A VLAN identifier must be explicitly assigned to each subinterface to allow traffic forwarding.

  • Double-tagged 802.1ad services require a valid tagging protocol encapsulation (802.1ad or 802.1Q) configured on the physical, bundle, or subinterface.

  • Double-tagged services are often used to provide service segregation for different customers or applications.

  • Incorrect VLAN or encapsulation configurations may prevent traffic from passing through the subinterface.