IEEE 802.1ad

Not to be confused with IEEE 802.11ad or IEEE 802.11ac.

IEEE 802.1ad^{[note 1]} is an Ethernet networking standard informally known as QinQ and is an amendment to IEEE standard IEEE 802.1Q-1998. The technique is also known as provider bridging, Stacked VLANs, or simply QinQ or Q-in-Q. "Q-in-Q" can for supported devices apply to C-tag stacking on C-tag (Ethernet Type = 0x8100) but this has limited application in the modern methodology of network routing.

The original 802.1Q specification allows a single Virtual Local Area Network (VLAN) header to be inserted into an Ethernet frame. QinQ allows multiple VLAN tags to be inserted into a single frame, an essential capability for implementing Metro Ethernet network topologies. Just as QinQ extends 802.1Q, QinQ itself is extended by other Metro Ethernet protocols.

In a multiple VLAN header context, out of convenience the term "VLAN tag" or just "tag" for short is often used in place of "802.1Q VLAN header". QinQ allows multiple VLAN tags in an Ethernet frame; together these tags constitute a tag stack. When used in the context of an Ethernet frame, a QinQ frame is a frame that has 2 VLAN 802.1Q headers (double-tagged).

Background

802.1ad specifies architecture and bridge protocols to provide separate instances of the MAC services to multiple independent users of a Bridged Local Area Network in a manner that does not require cooperation among the users, and requires a minimum of cooperation between the users and the provider of the MAC service.

The idea is to provide, for example, the possibility for customers to run their own VLANs inside service provider's provided VLAN. This way the service provider can just configure one VLAN for the customer and customer can then treat that VLAN as if it was a trunk.

IEEE 802.1ad was created for the following reasons:

802.1Q has a 12-bit VLAN ID field, which has a theoretical limit of 2¹²=4096 tags. With the growth of networks, this limitation has become more acute. A double-tagged frame has a theoretical limitation of 4096×4096=16777216, sufficient to accommodate network growth for the next several years.
The addition of a second tag allows operations that would not have been available had the VLAN ID field simply been expanded from 12 bits to 24 bits (or any other large value). Having multiple tags—the tag stack—allows switches to more easily modify frames. In a tag stack scheme, switches can add ("push"), remove ("pop") or modify single or multiple tags.
A multi-tagged frame not only has multiple VLAN IDs, but has multiple VLAN header bit fields.
A tag stack creates a mechanism for Internet Service Providers to encapsulate customer single-tagged 802.1Q traffic with a single tag, the final frame being a QinQ frame. The outer tag is used to identify and segregate traffic from different customers; the inner tag is preserved from the original frame.
QinQ frames are convenient means of constructing Layer 2 tunnels, or applying Quality of service (QoS) policies, etc.
802.1ad is upward compatible with 802.1Q. Although 802.1ad is limited to two tags, there is no ceiling on the standard limiting a single frame to more than two tags, allowing for growth in the protocol. In practice Service Provider topologies often anticipate and utilize frames having more than two tags.
It is easier for networking equipment makers to modify their existing equipment by creating multiple 802.1Q headers than to modify their equipment to implement some hypothetical new non-802.1Q extended VLAN ID field header.

Frame format

Insertion of 802.1ad DoubleTag in Ethernet-II frame

These examples are for an Ethernet II framing (length/ethertype field => ethertype) frame. This could also be applied to 802.3 frames (length/ethertype field => length), with or without an LLC (i.e. Logical Link Control), LLC+SNAP header. The top frame is a simple Ethernet II frame. The middle frame has a .1Q (shorthand for 802.1q) tag added to it. The bottom frame has yet another .1Q tag added to it.

A .1Q header, which is 4 bytes long, is added to an untagged Ethernet II frame in the following manner:

The 4-byte tag is inserted between the MAC Source Address (SAMAC) of the untagged frame and its ethertype field.
The newly inserted VLAN header's ethertype is set to 0x8100 to identify the following data as a VLAN tag.
12 bits are used for the VLAN ID, the other bits in the VLAN fields are filled in according to the QoS policy, etc. of the interface at which the tag imposition occurred.

Notice that after the insertion of a .1Q header to an untagged frame, the frame's original ethertype appears to have been changed to 0x8100. The untagged frame's original ethertype in the single-tag frame is now located adjacent to the payload. Its value is unchanged.

A second .1Q header is added to a single-tagged frame in the following manner:

The second tag is inserted in front of the first tag, meaning the second tag is closer to the Ethernet header than the first (original) tag.
The second tag is inserted between the MAC SAMAC and the first (original) tag.
The second tag is assigned an ethertype of 0x88A8 (instead of the .1Q standard 0x8100) by default. (An old non-standard 802.1QinQ protocol used 0x9100.)
12 bits are used for the VLAN ID, the other bits in the VLAN fields are filled in according to the QoS policy, etc. of the interface at which the tag imposition occurred.

Any third or subsequent tag imposition will insert the tag in front of, closest to the Ethernet header, than the preceding tags. The frame's original (from untagged) ethertype is always located above all the tags, next to the payload. In the case of an 802.3 frame, this ethertype would be a length value instead, and would contain the length from there to the end of the frame. In the case of an 802.3 frame with an LLC header, the LLC header stays above the length field, adjacent to the payload.

The conventions for 802.1ad terminology typically are as follows:

The inner tag is the tag which is closest to the payload portion of the frame; it is officially called C-TAG (Customer tag, with ethertype 0x8100).
The outer tag is the one closer/closest to the Ethernet header; its name is S-TAG (Service tag, ethertype 0x88a8).
tag 1 is the outer tag; tag 2, the second tag, is the inner tag. The tag number has nothing to do with the order in which the tags were added, etc. It is simply a convention.
For a single-tagged (802.1q) frame, that tag is designated tag 1 when mixed with 802.1ad tags.
In frames having more than one tag, the tags are numbered 1 to N, and appear sequentially and contiguously in the frame from Ethernet header to payload. In this case the innermost tag is the C-TAG and all other tags are S-TAGs.

In IEEE 802.1ad the CFI is replaced by a Drop Eligibility Indicator (DEI), increasing the functionality of the PCP field.

Tag operations

In a tag stack, push and pop operations are done at the outer tag end of the stack, therefore:

The tag added by a tag push operation becomes a new outer tag. The tag to be removed by a tag pop operation is the current outer tag.

Examples

Virtual networks

Simple QinQ Example

This simple example will illustrate a practical use of 802.1ad. The diagram shows switches as hexagons, and a Service Provider (SP) network encompassing all items within the dotted oval. The items on the periphery of the oval are networks belonging to SP customers. Different physical locations appear in the shaded rectangle, and include both customer and SP network components.

A Service Provider (SP) offers L2 connectivity to customers in the cities of Seattle and Tacoma. Two corporations, "Acme" and "XYZ", have a campus located in both Seattle and Tacoma. All campuses run Ethernet LANs, and the customers intend to connect through the SP's L2 VPN network so that their campuses are in the same LAN (L2 network). It is desirable for Acme and XYZ to have a single LAN in both Seattle and Tacoma, obviating the alternative of having two LANs in which traffic must be routed between the LANs. The SP has two switches, one in Seattle (S-Switch #1), and one in Tacoma (S-Switch #2). The customers interface to the SP network in switches designated "A" and "B". Each customer has its own pair of A and B switches. Acme switch A is connected to S-Switch #1 through link "A1"; the rest of the links are labelled. S-Switch #1 and #2 are connected by link S12.

Acme's LAN uses VLAN IDs 10,11,12 in their network. The connections A1 and A2 are Ethernet trunks that have single-tagged VLAN traffic, the traffic using IDs 10,11,12. Likewise XYZ uses IDs 11,12,13 in their network, so X1 and X2 are also trunks with single tagged traffic of IDs 11,12,13. The SP, having one network and one connection between S-Switch #1 and S-Switch #2, must segregate Acme's and XYZ's traffic. Since both Acme and XYZ share some VLAN IDs, traffic cannot be segregated by customer VLAN ID.

The solution is for the SP to use 802.1ad in their network. They assign a single, unique outer VLAN tag ID of 100 for Acme, and a unique outer VLAN ID of 101 for XYZ. All traffic sent from Acme A to the SP network (sent on A1, destined for Acme B) will have a tag of ID=100 pushed. The inner tag will be either 10,11,12, the original Acme tag. The traffic will be sent through S12 in this format, and just before it exits S-Switch #2 bound for Acme B (link A2), all traffic will undergo a single pop operation, removing the outer VLAN tag with the ID 100. This pop operation is the inverse of the former push operation, with the net result of no change to the traffic. The traffic passes through the SP network as 802.1ad frames, but no 802.1ad frames are sent to or received from the customer.

Problems with previous example

An experienced network engineer will immediately recognize the shortcomings of the above example. This is the reason why 802.1ad is more of a definition for a method of adding multiple tags to a frame than it is an end-to-end self-contained solution. It is used in conjunction with other protocols and standards. The problems with the above example are:

Many switches bridge Ethernet traffic based on MAC addresses—not on VLAN IDs. This is called Shared VLAN Learning and is done per 802.1d MAC learning/MAC aging, etc.
Should Acme and XYZ use the same MAC addresses in their networks, this will cause problems with the MAC learning, as the assumption in MAC learning is that no two hosts use the same MAC address. In other words, a MAC should only be learned from a single switch's port.
The SP network must learn all customer MAC addresses in order to switch them. This does not scale well.
There is no provision in the above example for L2 protocol frames, Spanning Tree being the most important.
Additional QoS capabilities are lacking.
Bridges that use Independent VLAN Learning (IVL), i.e., the first VLAN tag is included as part of the SAMAC address, circumvent the problems mentioned in paragraphs 1 and 2. IVL resolves the problem of MAC addresses possibly being used by more than one customer (device MAC addresses should be globally unique, so this is more of a theoretical problem). However, switches en route still have to learn all inserted VLAN/MAC address combinations (12 + 48 = 60 bits).
Broadcasts from LAN to LAN is always an issue to consider.

Provider Bridges (802.1ad) and Provider Backbone Bridges (the IEEE 802.1ah-2008 standard) address the above problems by a further modified SAMAC learning method.