H3C S5100-SI Operation Manual page 714

PC users and PC servers are in VLAN 100 created in the private network, while terminal users and
terminal servers are in VLAN 200, which is also created in the private network. The VLAN VPN
connection is established in VLAN 1040 of the public network.
Switches of other vendors' are used in the public network. They use the TPID value 0x9200.
Employ VLAN-VPN on Switch A and Switch B to enable the PC users and PC servers to
communicate with each through a VPN, and employ VLAN-VPN on Switch A and Switch B to
enable the Terminal users and Terminal servers to communicate with each other through a VPN.
Network diagram
Figure 1-4 Network diagram for VLAN-VPN configuration
Configuration procedure
Configure Switch A.
# Enable the VLAN-VPN feature on GigabitEthernet 1/0/11 of Switch A and tag the packets received on
this port with the tag of VLAN 1040 as the outer VLAN tag.
<SwitchA> system-view
[SwitchA] vlan 1040
[SwitchA-vlan1040] port GigabitEthernet 1/0/11
[SwitchA-vlan1040] quit
[SwitchA] interface GigabitEthernet 1/0/11
[SwitchA-GigabitEthernet1/0/11] vlan-vpn enable
[SwitchA-GigabitEthernet1/0/11] quit
# Set the global TPID value of Switch A to 0x9200 and configure GigabitEthernet1/0/12 as a VLAN VPN
uplink port, so that Switch A can intercommunicate with devices in the public network.
[SwitchA] vlan-vpn tpid 9200
[SwitchA] interface GigabitEthernet1/0/12
[SwitchA-GigabitEthernet1/0/12] port link-type trunk
[SwitchA-GigabitEthernet1/0/12] port trunk permit vlan 1040
[SwitchA-GigabitEthernet1/0/12] vlan-vpn uplink enable
Configure Switch B.
1-5