Effects Of Qinq On Other Switch Features - HP 3500 Series Advanced Traffic Management Manual

QinQ (Provider Bridging)

Effects of QinQ on Other Switch Features

N o t e
7-26
Effects of QinQ on Other Switch
Features
Per the IEEE standards, protocols such as STP and GVRP are assigned
separate addresses for customer networks and provider networks, ensuring
that QinQ has no impact on their operations. Bridge Protocol Data Units
(BPDUs) that need to be tunneled through the provider network are treated
as normal multicast frames at the provider bridge and forwarded out.
However, other protocols use common addresses for both customer and
provider networks, and so are not supported when QinQ is enabled on the
switch. Similarly, proprietary features such as meshing, discovery, UDLD, and
loop-protect do not provide 'tunneling' support. In such cases, where provider
networks could run an instance of the same protocol as a customer could run
local to their site, these frames are dropped at the customer-network ports of
the provider bridge.
The IEEE standards group are devising new addressing schemes that may
support additional QinQ tunneling operations. Check the latest product
release notes for implementation updates as they apply to HP switches.
When QinQ is not enabled (the default setting), there are no impacts to the
switch's normal operations. Table 7-2 shows the impacts of QinQ on the
operation of switch protocols and features based on the QinQ mode that is
configured: QinQ mixed vlan mode (C-VLANs and S-VLANs are allowed) or
QinQ svlan mode (S-VLANs only).
Table 7-2. Impacts of QinQ Configurations on Other Switch Features
Switch Feature Impacts of QinQ Configurations and Allowed Operations
ACLs In QinQ mixed vlan or svlan modes:
• On double-tagged frames , the VID applicable when applying ACLs will
be the S-VLAN tag and not the C-VLAN tag.
aaa In QinQ mixed vlan mode:
• auth-vid/unauth-vid configuration is not supported on svlan ports; the
auth-vid/unauth-vid cannot be an S-VLAN id.
• If a port that is a member of C-VLANs is configured with auth-vid or
unauth-vid and it needs to be added to the S-VLAN domain, the auth/
unauth configuration must first be undone.
arp-protect In QinQ mixed vlan mode:
• arp-protect is NOT supported on SVLANs, nor on S-VLAN ports.