Glossary

QinQ

802.1Q-in-802.1Q

What is QinQ

QinQ — short for "802.1Q in 802.1Q" — is a simple Layer 2 VPN technique built on top of the IEEE 802.1Q standard, the specification that defines VLAN tagging on Ethernet networks. A standard IEEE 802.1Q frame carries a single 4-byte VLAN tag inserted between the source MAC address and the ethertype field; QinQ's entire premise is to add a second one of these tags to a frame that already carries one, letting a single packet cross a carrier's network wrapped inside an extra layer of addressing. When that packet reaches the private network on the other side, the carrier's outer tag gets stripped off, and forwarding continues based on the customer's original, inner 802.1Q tag — as if the carrier's network was never involved at all.

QinQ was originally created to solve a much simpler problem: the IEEE 802.1Q standard defines a 12-bit VLAN ID field, which caps a single tagging layer at 4094 usable VLANs — not nearly enough once a carrier needs to keep many customers' VLANs from colliding with each other on a shared network. Stacking a second IEEE 802.1Q tag on top of the first multiplies that ceiling to roughly 4094 × 4094 — effectively removing VLAN-space exhaustion as a constraint. As metropolitan Ethernet and carrier services matured, QinQ's two tags found a second use: the inner tag can identify the customer, while the outer tag identifies the service — giving carriers a clean way to keep customer traffic segmented from their own public-network VLANs while getting real mileage out of a limited pool of provider-side VLAN IDs.

How QinQ Works

QinQ comes in two forms, distinguished by how much control they give over which outer tag gets applied.

Basic QinQ — also called Layer 2 tunneling — is configured per interface. Once enabled, every frame entering that interface gets the same outer VLAN tag: the interface's default VLAN. An untagged frame simply receives that tag; a frame that already carries one gets a second tag stacked on top of it, becoming a double-tagged frame. Every frame on that interface is treated identically, regardless of what inner VLAN it happens to carry.

Flexible QinQ builds on the same underlying mechanism but adds per-VLAN granularity: frames arriving on the same interface can receive different outer tags depending on their inner VLAN ID. An untagged frame still falls back to the interface's default (PVID) tag, but a tagged frame gets matched against configured rules, and — if a match is found — receives the specific outer tag that rule defines. This is what lets a carrier segment many customer VLANs distinctly, rather than lumping every customer on a port into a single outer tag the way Basic QinQ does.

One more detail matters for interoperability: the TPID (Tag Protocol Identifier), the field inside every IEEE 802.1Q frame that identifies what kind of tag follows it. Devices use it to distinguish a service-provider tag from a customer tag, and different carriers sometimes expect different TPID values on their network. QinQ lets that value be modified on a per-interface basis, so outbound frames carry whatever TPID a specific upstream carrier requires — rather than assuming every network in the path agrees on the IEEE 802.1Q standard's default of 0x8100.

Why QinQ is Beneficial

  • Removes VLAN-count as a constraint: Stacking a second tag multiplies the usable VLAN space well beyond the roughly 4,000 IDs a single IEEE 802.1Q tagging layer allows, which matters the moment a network has to serve many customers or departments at once.

  • Keeps customer traffic genuinely separated: Wrapping customer VLANs inside a carrier-assigned outer tag means customer traffic can cross a shared network without ever risking a VLAN ID collision with another customer, or with the carrier's own infrastructure VLANs.

  • Scales carrier services without renumbering customers: A carrier doesn't need every customer to use non-overlapping VLAN ranges — QinQ's outer tag absorbs that complexity, so customers keep using whatever VLAN numbering they already have internally.

  • Flexible QinQ adds real per-customer granularity: Rather than treating every frame on a port identically, Flexible QinQ lets one physical interface serve multiple customers or services, each getting a distinct outer tag based on their inner VLAN.

  • Interoperates across carriers with different conventions: Configurable TPID means a device doesn't need every upstream network to agree on a single tag-identification value to work correctly together.

At Asteraix

What We Can Do at Asteraix

AsterNOS implements both Basic and Flexible QinQ directly through the CLI, matching the two deployment models operators actually need.

  • Simple, per-interface Basic QinQ: qinq enable on an interface is all it takes to have every frame entering that port double-tagged with its default VLAN — the fastest path to expanding usable VLAN space or tunneling customer traffic across a shared network.

  • Rule-based Flexible QinQ: vlan-stack tagged <vlan-id> <stack-id> [remark-tc <value>] lets operators match specific inner VLAN IDs and assign each one a distinct outer stacking VLAN — with the option to remark traffic class in the same command, so priority marking and VLAN stacking can be configured together rather than as separate steps.

  • Configurable TPID for multi-carrier compatibility: qinq protocol <tpid> changes an interface's outer-tag TPID away from the 0x8100 default, letting a device match whatever TPID value a specific upstream carrier expects — exactly the kind of interoperability requirement that comes up connecting to different providers' networks.

  • Verification built into the CLI: show interface qinq protocol [interface_name] and show interface vlan-stack tagged let operators confirm both TPID settings and Flexible QinQ stacking rules directly, without needing to trace packet captures to verify a configuration is correct.

  • Documented, real-world deployment pattern: AsterNOS's QinQ documentation walks through a complete branch-interconnection example — two sites using internal VLANs 100 and 200, tunneled transparently across a carrier network using VLAN 101 and a carrier-specific TPID of 0x8200 — reflecting exactly the kind of metro-Ethernet, multi-site scenario QinQ is built for.