L2VPN Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

L2VPN Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

L2 VLAN subinterface encapsulation and rewrite

Updated: September 11, 2026

Want to summarize with AI?

Details encapsulation and rewrite options for L2 VLAN subinterfaces, including configuring exact matching for single-tagged and legacy QinQ encapsulation, handling priority-tagged traffic, and reviewing supported encapsulation types.

L2 VLAN subinterface encapsulation and rewrite is a Layer 2 VLAN capability that

matches single-tagged Ethernet frames with exact VLAN criteria
supports legacy QinQ encapsulation with 0x9100 and 0x8100 ethertypes as well as priority-tagged traffic, and
expands subinterface encapsulation and tag-rewrite behavior for more flexible VLAN handling.

Table 1. Feature History Table
Feature Name	Release Information	Feature Description
L2 VLAN Subinterface Encapsulation and Rewrite	Release 26.3.1	Introduced in this release on: Modular Systems (8800 [LC ASIC: K100])(select variants only) This feature is supported on Cisco 88-LC1-48Y8H-EM line cards.
L2 VLAN Subinterface Encapsulation and Rewrite	Release 26.1.1	Introduced in this release on: Centralized Systems (8400 [ASIC: K100]) (select variants only) This feature is supported on Cisco 8404-SYS-D router.
L2 VLAN Subinterface Encapsulation and Rewrite	Release 25.4.1	Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only) This feature is supported on: 8011-12G12X4Y-A 8011-12G12X4Y-D
L2 VLAN Subinterface Encapsulation and Rewrite	Release 25.1.1	Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100]) This feature is now supported on: 8712-MOD-M 8011-4G24Y4H-I
L2 VLAN Subinterface Encapsulation and Rewrite	Release 24.4.1	Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100]); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100]) You can now use the VLAN Subinterface Encapsulation and Rewrite operations to: Configure exact matching for all single-tagged encapsulations. Support legacy Q-in-Q encapsulation 0x9100/0x8100. Enable priority tagged traffic to map to the specified interface. The feature introduces these changes: CLI: dot1q tunneling ethertype 0x9100 hw-module profile encap-exact encapsulation dot1ad priority-tagged encapsulation dot1q priority-tagged rewrite ingress tag YANG Data Model: `Cisco-IOS-XR-um-8000-hw-module-profile-cfg` (see GitHub, YANG Data Models Navigator)

Configure exact matching for single-tagged encapsulations

Set up exact matching for all single-tagged encapsulations on the specified interface, interface type, or location to prevent double-tagged traffic from incorrectly matching single-tagged subinterfaces.

The hw-module profile encap-exact command applies only to single-tagged encapsulations and prevents double-tagged traffic from matching single-tagged subinterfaces. This configuration ensures that double-tagged traffic will not match single-tagged subinterfaces on Layer 2 interfaces. To activate this profile, you must reload the affected line card or router.

Before you begin

Decide whether to apply the profile to all interfaces, a device or line card, all bundle interfaces, or a specific interface.

Procedure

Enter configuration mode and apply the exact-matching profile.

Example:

Router# configure
Router(config)# hw-module profile encap-exact location all

Router# configure
Router(config)# hw-module profile encap-exact location <node-id>

Router# configure
Router(config)# hw-module profile encap-exact location all-virtual

Router# configure
Router(config)# hw-module profile encap-exact interface <intf>

Reload the affected chassis or line cards so the profile takes effect.

Running configuration:

configure
hw-module profile encap-exact location all
Wed Nov 20 16:30:52.007 EST
In order to activate/deactivate this profile, you must manually reload the chassis/all line cards

Use the show hw-module profile encap-exact command to verify the profile state before and after reload.

Example:

/* Before Reload */
Router# show hw-module profile encap-exact
Encap Exact                   Configured      No        Reload

/* After Reload */
Router# show hw-module profile encap-exact
Encap Exact                   Configured      Yes       None

Configure legacy QinQ encapsulation 0x9100/0x8100

Set up legacy QinQ encapsulation with outer EtherType 0x9100 for Dot1Q tunneling, enabling compatibility with older systems and specific service requirements.

This task configures legacy QinQ encapsulation on Cisco IOS XR interfaces. The dot1q tunneling ethertype 0x9100 command ensures that Dot1Q second-dot1q services use 0x9100 as the outer EtherType instead of the default 0x8100.

Before you begin

Identify the main interface and the outer and inner VLAN IDs for the service.

Procedure

Configure legacy QinQ encapsulation on the interface and subinterface.

Example:

Router# configure
Router(config)# interface FH0/0/0/3
Router(config-subif)# dot1q tunneling ethertype 0x9100
Router(config-subif)# interface FH0/0/0/3.1 l2transport
Router(config-subif)# encapsulation dot1q 500 second-dot1q 600
Router(config-subif)# commit
Router(config-subif)# exit
Router(config)# exit

Running configuration:

configure
interface FH0/0/0/3
    dot1q tunneling ethertype 0x9100
interface FH0/0/0/3.1 l2transport
    encapsulation dot1q 500 second-dot1q 600

Verify the running configuration and active encapsulation.

Example:

Router# show run int FH0/0/0/3.1
interface FourHundredGigE0/0/0/3.1 l2transport
encapsulation dot1q 500 second-dot1q 600

Router# show run int FH0/0/0/3
interface FourHundredGigE0/0/0/3
dot1q tunneling ethertype 0x9100

Router# show int FH0/0/0/3.1
FourHundredGigE0/0/0/3.1 is up, line protocol is up
  Interface state transitions: 1
  Hardware is VLAN sub-interface(s), address is 0075.f409.6818
  Layer 2 Transport Mode
  MTU 1522 bytes, BW 400000000 Kbit (Max: 400000000 Kbit)
     reliability Unknown, txload Unknown, rxload Unknown
  Encapsulation 802.1Q Virtual LAN,
    Outer Match: Dot1Q VLAN 500
    Inner Match: Dot1Q VLAN 600
    Ethertype Any, MAC Match src any, dest any
  loopback not set,
  Last link flapped 00:00:34
  Last input never, output never
  Last clearing of "show interface" counters never
     0 packets input, 0 bytes
     0 input drops, 0 queue drops, 0 input errors
     0 packets output, 0 bytes
     0 output drops, 0 queue drops, 0 output errors

Router# show int FH0/0/0/3
FourHundredGigE0/0/0/3 is up, line protocol is up
  Interface state transitions: 1
  Hardware is FourHundredGigE, address is 0075.f409.6818 (bia 0075.f409.6818)
  Internet address is Unknown
  MTU 1514 bytes, BW 400000000 Kbit (Max: 400000000 Kbit)
     reliability 255/255, txload 0/255, rxload 0/255
  Encapsulation ARPA,
  Full-duplex, 400000Mb/s, link type is force-up
  output flow control is off, input flow control is off
  Carrier delay (up) is 200 msec
  loopback not set,
  Last link flapped 00:00:53
  Last input never, output never
  Last clearing of "show interface" counters never
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes, 0 total input drops
     0 drops for unrecognized upper-level protocol
     Received 0 broadcast packets, 0 multicast packets
              0 runts, 0 giants, 0 throttles, 0 parity
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     0 packets output, 0 bytes, 0 total output drops
     Output 0 broadcast packets, 0 multicast packets
     0 output errors, 0 underruns, 0 applique, 0 resets
     0 output buffer failures, 0 output buffers swapped out

Configure priority-tagged traffic on a VLAN subinterface

Map priority-tagged traffic to a Layer 2 VLAN subinterface to enable proper handling of packets with VLAN ID 0.

Priority-tagged traffic uses VLAN ID 0. This configuration ensures that such traffic is correctly mapped to the intended Layer 2 interface for handling and transport.

Procedure

Configure priority-tagged encapsulation on the Layer 2 subinterface.

Example:

Router# configure
Router(config)# interface TenGigE0/0/0/0.1 l2transport
Router(config-subif)# encapsulation dot1q priority-tagged
Router(config-subif)# commit
Router(config-subif)# exit
Router(config)# exit

Use the show int TenGigE0/0/0/0.1 command to verify that the priority-tagged encapsulation is active.

Example:

Router# show int TenGigE0/0/0/0.1
TenGigE0/0/0/0.1 is up, line protocol is up
Layer 2 Transport Mode
Encapsulation 802.1Q priority tagged,
  Outer Match: Dot1Q VLAN Priority-tagged

Supported encapsulation modes for Layer 2 interfaces

Table 2. 802.1ad encapsulation support for Layer 2 interfaces and subinterfaces
Interface type	Encapsulation class	Encapsulation	Support status
Layer 2 interface, Layer 2 subinterface, and Layer 2 bundle subinterface	Single-tag encapsulation	`dot1ad`	Supported from Cisco IOS XR Release 24.4.1 onward.
Layer 2 interface, Layer 2 subinterface, and Layer 2 bundle subinterface	Single-tag encapsulation	`dot1q`	Supported.
Layer 2 interface, Layer 2 subinterface, and Layer 2 bundle subinterface	Single-tag encapsulation	`default`	Supported.
Layer 2 interface, Layer 2 subinterface, and Layer 2 bundle subinterface	Single-tag encapsulation	`untagged`	Supported.
Layer 2 interface, Layer 2 subinterface, and Layer 2 bundle subinterface	Single-tag encapsulation	`dot1q priority-tagged`	Supported from Cisco IOS XR Release 24.4.1 onward.
Layer 2 interface, Layer 2 subinterface, and Layer 2 bundle subinterface	Single-tag encapsulation	`dot1ad priority-tagged`	Supported from Cisco IOS XR Release 24.4.1 onward.
Layer 2 interface, Layer 2 subinterface, and Layer 2 bundle subinterface	Double-tag encapsulation	`dot1ad <> dot1q <>`	Supported.
Layer 2 interface, Layer 2 subinterface, and Layer 2 bundle subinterface	Double-tag encapsulation	`dot1q <> dot1q <>`	Supported on Q200-based line cards from Cisco IOS XR Release 24.1.1 onward and supported for all Cisco 8000 Series Routers from Cisco IOS XR Release 24.4.1 onward.

Encapsulation default catch-all mode

Encapsulation default catch-all mode is a Layer 2 (L2) attachment circuit (AC) traffic-matching mode that maps unmatched VLAN-tagged traffic and untagged traffic to an encapsulation default subinterface.

Without the catch-all hardware profile enabled, an encapsulation default L2 AC matches only VLAN-tagged traffic that does not match another subinterface encapsulation. With the catch-all hardware profile enabled, the L2 AC also matches untagged traffic.

Table 3. Feature History Table
Feature name	Release information	Feature description
Encapsulation default catch-all mode	Release 26.3.1	Introduced in this release on: Fixed Systems (8700 [ASIC: K100, P100], 8210 [ASIC: P100]); Centralized Systems (8400); Modular Systems (8800 [LC ASIC: K100, P100]) This feature enables an encapsulation default Layer 2 subinterface to match untagged traffic in addition to unmatched VLAN-tagged traffic. This catch-all capability allows the matched traffic to be carried over VPWS or VPLS services through a single subinterface.

Operational capabilities and limitations of encapsulation default catch-all mode

Use this information to determine whether catch-all mode supports the required Layer 2 service behavior.

The hardware profile state determines which traffic types map to the encapsulation default subinterface.

Table 4. Traffic mapping by hardware profile state
Traffic type	Catch-all profile enabled	Catch-all profile disabled
VLAN-tagged traffic that does not match another subinterface	Mapped	Mapped
Untagged traffic	Mapped	Not mapped

Catch-all L2 ACs support only these symmetric ingress rewrite operations:

rewrite ingress tag push dot1q vlan-id symmetric
rewrite ingress tag push dot1q outer-vlan-id second-dot1q inner-vlan-id symmetric
rewrite ingress tag push dot1ad vlan-id symmetric
rewrite ingress tag push dot1ad outer-vlan-id dot1q inner-vlan-id symmetric

Related feature and protocol support

Encapsulation default catch-all L2 attachment circuits support:

Connectivity fault management (CFM) on main interfaces and subinterfaces
Slow-path handling of untagged Link Aggregation Control Protocol (LACP), Link Layer Discovery Protocol (LLDP), and Cisco Discovery Protocol (CDP) packets
QoS functions, including classification, remarking, policing, and queueing

Restrictions of catch-all mode

Catch-all mode is supported only on L2 ACs. It is not supported on Layer 3 ACs.
Priority code point and drop eligible indicator remarking does not change tagged traffic unless a VLAN push operation adds a tag.

Configure encapsulation default catch-all mode

Enable the hardware profile that supports catch-all traffic matching on encapsulation default interfaces.

Use catch-all mode when one L2 attachment circuit must accept untagged traffic and VLAN-tagged traffic that does not match another subinterface.

Before you begin

Configure a physical or bundle main interface that supports an L2 subinterface.

Procedure

Enter global configuration mode and enable the encapsulation default catch-all hardware profile.

Example:

Router# configure
Router(config)# hw-module profile interface encap-default catch-all
Router(config)# commit

The router displays a message indicating that you must reload the chassis to apply the updated profile:

Hw-module profile config changed for "interface encap-default catch-all", do chassis reload to get the most recent config updated

Reload the affected chassis for the profile to take effect.

Verify that the encapsulation default catch-all profile is configured and applied.

Example:


Router#show hw-module profile interface 
------------------------------------------------------------------------
Knob                                    Status          Applied   Action         
------------------------------------------------------------------------
Encap-Default Catch-All                 Configured      Yes       None

Confirm that the Encap-Default Catch-All row shows Configured in the Status column and Yes in the Applied column.

The encapsulation default catch-all hardware profile is enabled and active on the affected chassis.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.