Table of Contents- VLAN Aggregation

• Technical Background of VLAN Aggregation
• Concept of VLAN Aggregation
• Working Principle of VLAN Aggregation
• Application Scenarios
• Super-VLAN Configuration
• Communication Within Sub-VLANs
• Inter-Sub-VLAN Communication Example
• Layer 2 Communication with External Devices
• Key Configuration Commands
• Configuration Example
• MUX VLAN
• Technical Background of MUX VLAN
• Core Concepts
• Use Cases
• Configuration Commands
• Configuration Example
• QinQ
• Overview of QinQ
• Frame Structure
• Working Mechanism
• Basic QinQ Implementation
• Flexible QinQ Implementation
• Campus Network Applications
• Configuration Commands
• Configuration Examples

VLAN technology is widely deployed in campus networks to isolate broadcast domains. However, traditional VLAN implementations face challenges like IP address waste when multiple VLANs exist and network complexity when isolating external partners. This article explores advanced VLAN techniques including VLAN Aggregation, MUX VLAN, and QinQ to address these challenges.

VLAN Aggregation

Technical Background of VLAN Aggregation

Traditional Layer 3 switches use a one-to-one mapping between VLANs and VLANIF interfaces, leading to inefficient IP address utilization. Each VLAN's subnet reserves addresses for network identifier, broadcast address, and gateway, resulting in wasted resources when actual device counts are low.

Concept of VLAN Aggregation

VLAN Aggregation (also known as Super-VLAN) combines multiple physical VLANs (Sub-VLANs) into a single logical VLAN. This allows multiple broadcast domains to share a common IP subnet and default gateway, significantly improving IP address efficiency. Sub-VLANs handle Layer 2 isolation while the Super-VLAN manages Layer 3 routing through its VLANIF interface.

Working Principle of VLAN Aggregation

Each Sub-VLAN maintains its own broadcast domain while sharing the Super-VLAN's IP subnet and gateway. This eliminates the need for separate IP subnets per VLAN and reduces routing table entries.

Application Scenarios

Traditional VLAN implementation requires 4 IP subnets and 4 routing entries for 4 VLANs. With VLAN Aggregation, all Sub-VLANs share one IP subnet and gateway while maintaining Layer 2 isolation between them.

Super-VLAN Configuration

Branch networks can aggregate multiple Layer 2 VLANs under a single Super-VLAN, enabling IP address sharing while preserving broadcast domain isolation.

Communication Within Sub-VLANs

Devices within the same Sub-VLAN communicate directly at Layer 2 since they belong to the same broadcast domain.

Inter-Sub-VLAN Communication Example

With ARP proxy enabled on VLANIF100:

1. PC1 sends ARP request for PC2 in same subnet
2. Super-VLAN's VLANIF100 broadcasts ARP request across all Sub-VLANs
3. PC2 responds with its MAC address
4. Gateway returns its own MAC to PC1, enabling routed communication

Layer 2 Communication with External Devices

Sub-VLAN communication with external devices follows standard VLAN behavior. Super-VLAN interfaces cannot process tagged frames directly.

Key Configuration Commands

1. Create Super-VLAN: [Huawei-vlan200] aggregate-vlan
2. Add Sub-VLANs: [Huawei-vlan200] subordinate-vlan { vlan-id1 [to vlan-id2] }
3. Enable ARP proxy: [Huawei-vlanif200] arp-proxy inter-sub-vlan enable

Configuration Example

Scenario: Configure VLAN Aggregation on SwitchA

[SwitchA] vlan batch 15 25
[SwitchA] interface GigabitEthernet0/0/1
[SwitchA-GigabitEthernet0/0/1] port link-type trunk
[SwitchA-GigabitEthernet0/0/1] port trunk allow-pass vlan 15
[SwitchA] interface GigabitEthernet0/0/2
[SwitchA-GigabitEthernet0/0/2] port link-type trunk
[SwitchA-GigabitEthernet0/0/2] port trunk allow-pass vlan 25
[SwitchA] vlan 200
[SwitchA-vlan200] aggregate-vlan
[SwitchA-vlan200] subordinate-vlan 15 25
[SwitchA] interface vlanif 200
[SwitchA-vlanif200] ip address 192.168.100.254 24
[SwitchA-vlanif200] arp-proxy inter-sub-vlan enable

MUX VLAN

Technical Background of MUX VLAN

Traditional VLAN implementations require unique VLAN IDs for each isolated group. MUX VLAN provides a solution for scenarios where multiple groups need access to common resources while maintaining isolation.

Core Concepts

MUX VLAN includes:

• Principal VLAN (main VLAN)
• Subordinate VLANs (Group VLANs for互通 and Separate VLANs for isolation)

Use Cases

Example network design:

• Departments A/B: Group VLANs with internal Layer 2 connectivity
• Visitors: Separate VLAN with isolation
• Servers: Principal VLAN for universal access

Configuration Commands

1. Configure Principal VLAN: [Huawei-vlan300] mux-vlan
2. Add Group VLANs: [Huawei-vlan300] subordinate group { vlan-id1 [to vlan-id2] }
3. Add Separate VLAN: [Huawei-vlan300] subordinate separate vlan-id
4. Enable interface: [Huawei-GigabitEthernet0/0/1] port mux-vlan enable vlan-id

Configuration Example

Scenario: Configure MUX VLAN for departmental isolation

[SwitchB] vlan batch 12 22 32 300
[SwitchB] vlan 300
[SwitchB-vlan300] mux-vlan
[SwitchB-vlan300] subordinate group 12 22
[SwitchB-vlan300] subordinate separate 32
[SwitchB] interface GigabitEthernet0/0/1
[SwitchB-GigabitEthernet0/0/1] port link-type access
[SwitchB-GigabitEthernet0/0/1] port default vlan 12
[SwitchB-GigabitEthernet0/0/1] port mux-vlan enable vlan 300

QinQ

Overview of QinQ

Standard 802.1Q VLAN tags limit networks to 4096 VLANs. QinQ (802.1Q-in-802.1Q) adds an outer tag to extend VLAN capacity, enabling service provider networks to carry multiple customer VLANs.

Frame Structure

QinQ frames contain two VLAN tags:

• Inner tag: Customer VLAN ID
• Outer tag: Service provider VLAN ID

Working Mechanism

Network devices forward based on outer tags while preserving inner tags. This enables multiple customers with overlapping VLAN IDs to coexist in the same service provider network.

Basic QinQ Implementation

1. Edge switch receives frames with VLAN 10/20
2. Adds outer VLAN 100 tag
3. Core network forwards based on outer tag
4. Egress switch removes outer tag

Flexible QinQ Implementation

1. Edge switch classsifies traffic by inner VLAN
2. Applies different outer tags:

• VLAN 10 → outer VLAN 100
• VLAN 20 → outer VLAN 200

3. Core network maintains both tags
4. Egress switch removes appropriate outer tag

Campus Network Applications

Key benefits:

• Per-device traceability
• Isolated broadcast domains per device
• Layer 2 connectivity between edge devices and BRAS

Configuration Commands

1. Configure dot1q-tunnel interface: [Huawei-GigabitEthernet0/0/1] port link-type dot1q-tunnel
2. Enable VLAN translation: [Huawei-GigabitEthernet0/0/1] qinq vlan-translation enable
3. Configure flexible QinQ:

[Huawei-GigabitEthernet0/0/1] port vlan-stacking vlan 100-200 stack-vlan 1000

Configuration Examples

Basic QinQ Example:

[ProviderSwitch] vlan batch 100 200
[ProviderSwitch] interface GigabitEthernet0/0/1
[ProviderSwitch-GigabitEthernet0/0/1] port link-type dot1q-tunnel
[ProviderSwitch-GigabitEthernet0/0/1] port default vlan 100
[ProviderSwitch] interface GigabitEthernet0/0/2
[ProviderSwitch-GigabitEthernet0/0/2] port link-type dot1q-tunnel
[ProviderSwitch-GigabitEthernet0/0/2] port default vlan 200

Flexible QinQ Example:

[EdgeSwitch] vlan batch 2 3 100 300
[EdgeSwitch] interface GigabitEthernet0/0/1
[EdgeSwitch-GigabitEthernet0/0/1] port link-type hybrid
[EdgeSwitch-GigabitEthernet0/0/1] port hybrid untagged vlan 2 3
[EdgeSwitch-GigabitEthernet0/0/1] qinq vlan-translation enable
[EdgeSwitch-GigabitEthernet0/0/1] port vlan-stacking vlan 100 stack-vlan 2
[EdgeSwitch-GigabitEthernet0/0/1] port vlan-stacking vlan 300 stack-vlan 3