Example QinQ Tunneling Configuration – Juniper and Cisco

In this article, we are going to talk about QinQ tunneling configuration between Juniper MX10 and Cisco ASR1001, it’s basically Junos and IOS. Before going to the main part, let start with some introduction so that you understand a little bit about QinQ.

Understanding QinQ Tunneling

QinQ (formally defined as 802.1ad) is developed based around 802.1q (VLAN tagging) to provide an additional layer of flexibility when dealing with Layer 2 networking. It was originally designed to allow service providers to create a Layer 2 Ethernet connection between two customer sites that may wish to re-use the same VLAN.

You can map one C-VLAN (customer VLAN) to one S-VLAN (service provider VLAN) or multiple C-VLANs to one S-VLAN. C-VLAN and S-VLAN tags use separate name spaces, so you can have both a C-VLAN 202 and an S-VLAN 202, for example. Look at below Ethernet frame for quick understanding.

Tag in dark grey = C-VLAN (Inner Tag)
Tag in light grey = S-VLAN (Outer Tag)

In QinQ tunneling, as a packet travels from a customer VLAN (C-VLAN) to a service provider’s or data center VLAN (S-VLAN), another 802.1Q tag for the appropriate S-VLAN is added before the C-VLAN tag. The C-VLAN tag remains and transmits through the network. As the packet leaves the S-VLAN in the downstream direction, the S-VLAN 802.1Q tag is removed. That’s enough!! Let have a look at example configuration below.

Network Connectivity

QinQ Configuration


set interfaces ge-1/0/0 unit 0 family bridge interface-mode access
set interfaces ge-1/0/0 unit 0 family bridge vlan-id 100

set interfaces xe-0/0/0 unit 200 description "QinQ TO iNET9-B"
set interfaces xe-0/0/0 unit 200 vlan-tags outer 200
set interfaces xe-0/0/0 unit 200 vlan-tags inner 100



interface GigabitEthernet0/0/0
 description "QinQ TO iNET9-A"
 encapsulation dot1Q 200 second-dot1q 100

And that’s it for the basic QinQ!! You can assign an IP address to host of both VLAN100 ends, then test connectivity between each other over QinQ network. Also, check for the MAC address if it is learnt properly. Let us know in the comment box below if you have any words.

2 Replies to “Example QinQ Tunneling Configuration – Juniper and Cisco”

    1. Hi Richard,
      Based on configuration in this article, it is the configuration that customer can send and receive untagged packets.

      Assuming Juniper MX10 and Cisco ASR1001 are PE. Customer facing interfaces of both PE can be configured as access port. So, each time PE send packets to customer, there will be no tag.
      Customer can send untagged traffic to PE, then PE routers will tag with a VLAN ID (C-Tag) and map to another VLAN ID (S-Tag) then send to remote end without customer knowledge. In this case, customer will send and receive untagged traffic.


Leave a Reply

Your email address will not be published. Required fields are marked *