L2VPN Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

L2VPN Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

L2 VLAN subinterface encapsulation and rewrite

Updated: June 15, 2026

Want to summarize with AI?

Details encapsulation and rewrite options for L2 VLAN subinterfaces, including configuring exact matching for single-tagged and legacy QinQ encapsulation, handling priority-tagged traffic, and reviewing supported encapsulation types.

L2 VLAN subinterface encapsulation and rewrite is a Layer 2 VLAN capability that

matches single-tagged Ethernet frames with exact VLAN criteria
supports legacy QinQ encapsulation with 0x9100 and 0x8100 ethertypes as well as priority-tagged traffic, and
expands subinterface encapsulation and tag-rewrite behavior for more flexible VLAN handling.

Table 1. Feature History Table
Feature Name	Release Information	Feature Description
L2 VLAN Subinterface Encapsulation and Rewrite	Release 26.1.1	Introduced in this release on: Centralized Systems (8400 [ASIC: K100]) (select variants only) This feature is supported on Cisco 8404-SYS-D router.
L2 VLAN Subinterface Encapsulation and Rewrite	Release 25.4.1	Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only) This feature is supported on: 8011-12G12X4Y-A 8011-12G12X4Y-D
L2 VLAN Subinterface Encapsulation and Rewrite	Release 25.1.1	Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100]) This feature is now supported on: 8712-MOD-M 8011-4G24Y4H-I
L2 VLAN Subinterface Encapsulation and Rewrite	Release 24.4.1	Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100]); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100]) You can now use the VLAN Subinterface Encapsulation and Rewrite operations to: Configure exact matching for all single-tagged encapsulations. Support legacy Q-in-Q encapsulation 0x9100/0x8100. Enable priority tagged traffic to map to the specified interface. The feature introduces these changes: CLI: dot1q tunneling ethertype 0x9100 hw-module profile encap-exact encapsulation dot1ad priority-tagged encapsulation dot1q priority-tagged rewrite ingress tag YANG Data Model: `Cisco-IOS-XR-um-8000-hw-module-profile-cfg` (see GitHub, YANG Data Models Navigator)

Configure exact matching for single-tagged encapsulations

Set up exact matching for all single-tagged encapsulations on the specified interface, interface type, or location to prevent double-tagged traffic from incorrectly matching single-tagged subinterfaces.

The hw-module profile encap-exact command applies only to single-tagged encapsulations and prevents double-tagged traffic from matching single-tagged subinterfaces. This configuration ensures that double-tagged traffic will not match single-tagged subinterfaces on Layer 2 interfaces. To activate this profile, you must reload the affected line card or router.

Before you begin

Decide whether to apply the profile to all interfaces, a device or line card, all bundle interfaces, or a specific interface.

Procedure

Enter configuration mode and apply the exact-matching profile.

Example:

Router# configure
Router(config)# hw-module profile encap-exact location all

Router# configure
Router(config)# hw-module profile encap-exact location <node-id>

Router# configure
Router(config)# hw-module profile encap-exact location all-virtual

Router# configure
Router(config)# hw-module profile encap-exact interface <intf>

Reload the affected chassis or line cards so the profile takes effect.

Running configuration:

configure
hw-module profile encap-exact location all
Wed Nov 20 16:30:52.007 EST
In order to activate/deactivate this profile, you must manually reload the chassis/all line cards

Use the show hw-module profile encap-exact command to verify the profile state before and after reload.

Example:

/* Before Reload */
Router# show hw-module profile encap-exact
Encap Exact                   Configured      No        Reload

/* After Reload */
Router# show hw-module profile encap-exact
Encap Exact                   Configured      Yes       None

Configure legacy QinQ encapsulation 0x9100/0x8100

Set up legacy QinQ encapsulation with outer EtherType 0x9100 for Dot1Q tunneling, enabling compatibility with older systems and specific service requirements.

This task configures legacy QinQ encapsulation on Cisco IOS XR interfaces. The dot1q tunneling ethertype 0x9100 command ensures that Dot1Q second-dot1q services use 0x9100 as the outer EtherType instead of the default 0x8100.

Before you begin

Identify the main interface and the outer and inner VLAN IDs for the service.

Procedure

Configure legacy QinQ encapsulation on the interface and subinterface.

Example:

Router# configure
Router(config)# interface FH0/0/0/3
Router(config-subif)# dot1q tunneling ethertype 0x9100
Router(config-subif)# interface FH0/0/0/3.1 l2transport
Router(config-subif)# encapsulation dot1q 500 second-dot1q 600
Router(config-subif)# commit
Router(config-subif)# exit
Router(config)# exit

Running configuration:

configure
interface FH0/0/0/3
    dot1q tunneling ethertype 0x9100
interface FH0/0/0/3.1 l2transport
    encapsulation dot1q 500 second-dot1q 600

Verify the running configuration and active encapsulation.

Example:

Router# show run int FH0/0/0/3.1
interface FourHundredGigE0/0/0/3.1 l2transport
encapsulation dot1q 500 second-dot1q 600

Router# show run int FH0/0/0/3
interface FourHundredGigE0/0/0/3
dot1q tunneling ethertype 0x9100

Router# show int FH0/0/0/3.1
FourHundredGigE0/0/0/3.1 is up, line protocol is up
  Interface state transitions: 1
  Hardware is VLAN sub-interface(s), address is 0075.f409.6818
  Layer 2 Transport Mode
  MTU 1522 bytes, BW 400000000 Kbit (Max: 400000000 Kbit)
     reliability Unknown, txload Unknown, rxload Unknown
  Encapsulation 802.1Q Virtual LAN,
    Outer Match: Dot1Q VLAN 500
    Inner Match: Dot1Q VLAN 600
    Ethertype Any, MAC Match src any, dest any
  loopback not set,
  Last link flapped 00:00:34
  Last input never, output never
  Last clearing of "show interface" counters never
     0 packets input, 0 bytes
     0 input drops, 0 queue drops, 0 input errors
     0 packets output, 0 bytes
     0 output drops, 0 queue drops, 0 output errors

Router# show int FH0/0/0/3
FourHundredGigE0/0/0/3 is up, line protocol is up
  Interface state transitions: 1
  Hardware is FourHundredGigE, address is 0075.f409.6818 (bia 0075.f409.6818)
  Internet address is Unknown
  MTU 1514 bytes, BW 400000000 Kbit (Max: 400000000 Kbit)
     reliability 255/255, txload 0/255, rxload 0/255
  Encapsulation ARPA,
  Full-duplex, 400000Mb/s, link type is force-up
  output flow control is off, input flow control is off
  Carrier delay (up) is 200 msec
  loopback not set,
  Last link flapped 00:00:53
  Last input never, output never
  Last clearing of "show interface" counters never
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes, 0 total input drops
     0 drops for unrecognized upper-level protocol
     Received 0 broadcast packets, 0 multicast packets
              0 runts, 0 giants, 0 throttles, 0 parity
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     0 packets output, 0 bytes, 0 total output drops
     Output 0 broadcast packets, 0 multicast packets
     0 output errors, 0 underruns, 0 applique, 0 resets
     0 output buffer failures, 0 output buffers swapped out

Configure priority-tagged traffic on a VLAN subinterface

Map priority-tagged traffic to a Layer 2 VLAN subinterface to enable proper handling of packets with VLAN ID 0.

Priority-tagged traffic uses VLAN ID 0. This configuration ensures that such traffic is correctly mapped to the intended Layer 2 interface for handling and transport.

Procedure

Configure priority-tagged encapsulation on the Layer 2 subinterface.

Example:

Router# configure
Router(config)# interface TenGigE0/0/0/0.1 l2transport
Router(config-subif)# encapsulation dot1q priority-tagged
Router(config-subif)# commit
Router(config-subif)# exit
Router(config)# exit

Use the show int TenGigE0/0/0/0.1 command to verify that the priority-tagged encapsulation is active.

Example:

Router# show int TenGigE0/0/0/0.1
TenGigE0/0/0/0.1 is up, line protocol is up
Layer 2 Transport Mode
Encapsulation 802.1Q priority tagged,
  Outer Match: Dot1Q VLAN Priority-tagged

Supported encapsulation modes for Layer 2 interfaces

Table 2. 802.1ad encapsulation support for Layer 2 interfaces and subinterfaces
Interface type	Encapsulation class	Encapsulation	Support status
Layer 2 interface, Layer 2 subinterface, and Layer 2 bundle subinterface	Single-tag encapsulation	`dot1ad`	Supported from Cisco IOS XR Release 24.4.1 onward.
Layer 2 interface, Layer 2 subinterface, and Layer 2 bundle subinterface	Single-tag encapsulation	`dot1q`	Supported.
Layer 2 interface, Layer 2 subinterface, and Layer 2 bundle subinterface	Single-tag encapsulation	`default`	Supported.
Layer 2 interface, Layer 2 subinterface, and Layer 2 bundle subinterface	Single-tag encapsulation	`untagged`	Supported.
Layer 2 interface, Layer 2 subinterface, and Layer 2 bundle subinterface	Single-tag encapsulation	`dot1q priority-tagged`	Supported from Cisco IOS XR Release 24.4.1 onward.
Layer 2 interface, Layer 2 subinterface, and Layer 2 bundle subinterface	Single-tag encapsulation	`dot1ad priority-tagged`	Supported from Cisco IOS XR Release 24.4.1 onward.
Layer 2 interface, Layer 2 subinterface, and Layer 2 bundle subinterface	Double-tag encapsulation	`dot1ad <> dot1q <>`	Supported.
Layer 2 interface, Layer 2 subinterface, and Layer 2 bundle subinterface	Double-tag encapsulation	`dot1q <> dot1q <>`	Supported on Q200-based line cards from Cisco IOS XR Release 24.1.1 onward and supported for all Cisco 8000 Series Routers from Cisco IOS XR Release 24.4.1 onward.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.