Bridging Support Over Layer2 Sub-interface
Overview
Bridge-domain bridging allows Layer 2 switching across multiple sub-interfaces. Each sub-interface, configured with encapsulation dot1q, becomes part of a common bridge-domain. This setup enables an Ethernet LAN (ELAN)-like service across sub-interfaces.
Feature Characteristics
• Supports Layer 2 switching between sub-interfaces on the same or different physical interfaces.
• Uses 802.1Q VLAN tagging for traffic separation and identification.
• Provides BUM traffic flooding within the bridge-domain.
• Dynamically learns MAC addresses for known unicast forwarding.
• Static MAC address support for deterministic forwarding.
Benefits
• Simplifies service delivery for ELAN or pseudo-wire services.
• Reduces flooding through MAC learning and static mapping.
• Enhance traffic control with static MAC configurations.
• Allows flexible service mapping using sub-interfaces instead of full physical ports.
Prerequisites
• Interfaces must support Layer 2 mode and be capable of sub-interface configuration.
• VLANs must be correctly assigned and unique across sub-interfaces.
• Bridge-domain must be defined and interfaces added to it.
Configuration
The following steps outline how to configure Layer 2 sub-interfaces, encapsulation types, rewrite operations, and bridge domains on OcNOS for various L2 service scenarios.
Topology
Bridging support over L2 sub-interface
Configuring Layer 2 Sub-interfaces and Bridge Domain
1. Configure Physical Interface for Dot1ad
Set the TPID value to 0x88a8, enabling support for 802.1ad (Q-in-Q) encapsulation on the physical interface.
#configure terminal
(config)#interface xe1
(config-if)#dot1ad ethertype 0x88a8
(config-if)#exit
(config)#interface xe2
(config-if)#dot1ad ethertype 0x88a8
(config-if)#exit
2. Create Sub-Interfaces and Apply Encapsulation
Create a Layer 2 sub-interfaces (xe1.1 and xe2.1) and configure it to match traffic tagged with VLAN ID 10 using 802.1Q encapsulation.
(config)#interface xe1.1 switchport
(config-if)#encapsulation dot1q 10
(config-if)#exit
(config)#interface xe2.1 switchport
(config-if)#encapsulation dot1q 10
(config-if)#exit
3. Create Bridge Domain and Attach Interfaces
Create Bridge Domain 1 and attach sub-interfaces xe1.1 and xe2.1 to it, enabling Layer 2 bridging between them.
(config)#bridge-domain 1
(config-bridge-domain)#interface xe1.1
(config-bridge-domain)#interface xe2.1
(config-bridge-domain)#exit
(config)#commit
Configuring L2 Sub-interface with Double-Push and Bridge Domain
1. Create and Configure Double-Push Rewrite
• Create the sub-interface xe1.1 and configure it to accept untagged frames from the customer-facing side (typically access-facing). This sets up the interface to apply tagging before forwarding.
• Configure the interface to push two VLAN tags, both outer and inner set to VLAN 200 with TPID 0x8100. This is commonly used for Q-in-Q tunneling where the provider edge applies double tagging to customer traffic.
#configure terminal
(config)#interface xe1.1 switchport
(config-if)#encapsulation untagged
(config-if)#rewrite push 0x8100 200 inner-dot1q 200
(config-if)#exit
• Configure the sub-interface xe2.1 to match traffic with two VLAN tags (outer 802.1ad VLAN 200 and inner VLAN 200).
(config)#interface xe2.1 switchport
(config-if)#encapsulation dot1ad 200 inner-dot1q 200
(config-if)#exit
2. Add Interfaces to Bridge Domain
Create Bridge Domain 1 and attach sub-interfaces xe1.1 and xe2.1 to it, enabling Layer 2 bridging between them.
(config)#bridge-domain 1
(config-bridge-domain)#interface xe1.1
(config-bridge-domain)#interface xe2.1
(config-bridge-domain)#exit
(config)#commit
Configuring L2 Sub-interface with Double-Pop and Bridge Domain
1. Create Sub-Interfaces and Rewrite with Pop
• Set xe1.1 to receive untagged traffic. This usually represents the access or customer side that does not use VLAN tagging.
#configure terminal
(config)#interface xe1.1 switchport
(config-if)#encapsulation untagged
(config-if)#exit
• Configure xe2.1 to match traffic with two VLAN tags (outer 802.1ad VLAN 200 and inner VLAN 200) and pop both tags before forwarding.
(config)#interface xe2.1 switchport
(config-if)#encapsulation dot1ad 200 inner-dot1q 200
(config-if)#rewrite pop-2tag
(config-if)#exit
2. Add Interfaces to Bridge Domain
Create Bridge Domain 1 and attach sub-interfaces xe1.1 and xe2.1 to it, enabling Layer 2 bridging between them.
(config)#bridge-domain 1
(config-bridge-domain)#interface xe1.1
(config-bridge-domain)#interface xe2.1
(config-bridge-domain)#exit
(config)#commit
Creating a Sub-interface with Encapsulation
Configure Single Encapsulation with VLAN Range (dot1q)
Create sub-interface xe1.100 and define a VLAN range (100 to 200) using 802.1Q encapsulation. This enables the interface to handle multiple VLAN-tagged traffic.
#configure terminal
(config)#interface xe1.100 switchport
(config-if)#encapsulation dot1q 100-200
(config-if)#exit
Configure Single Encapsulation with VLAN Range (dot1ad)
Apply 802.1ad (Q-in-Q) encapsulation to the sub-interface for VLANs 100 to 200, allowing service provider-style tunneling with S-tags.
#configure terminal
(config)#interface xe1.100 switchport
(config-if)#encapsulation dot1ad 100-200
(config-if)#exit
Configure Double Encapsulation (dot1q)
Set up double VLAN tagging (both outer and inner VLAN 10) on xe1.100 using dot1q encapsulation. This prepares the interface to handle nested VLAN tags.
#configure terminal
(config)#interface xe1.100 switchport
(config-if)#encapsulation dot1q 10 inner-dot1q 10
(config-if)#exit
Configure Double Encapsulation (dot1ad)
Configure sub-interface xe1.200 with outer tag 20 (dot1ad) and inner tag 20 (dot1q), enabling Q-in-Q double tagging.
#configure terminal
(config)#interface xe1.200 switchport
(config-if)#encapsulation dot1ad 20 inner-dot1q 20
(config-if)#exit
Set Default Encapsulation
Assign the default encapsulation type to the interface, which allows any traffic not matched by specific sub-interfaces.
#configure terminal
(config)#interface xe1.101 switchport
(config-if)#encapsulation default
(config-if)#exit
Set Untagged Encapsulation
Configure the interface to accept untagged traffic. This is typical for access ports connected to hosts or customers.
#configure terminal
(config)#interface xe1.102 switchport
(config-if)#encapsulation untagged
(config-if)#exit
Rewrite Operations
Apply VLAN Push Rewrite
Configure xe1.1 to add VLAN 100 (with TPID 0x8100) to incoming traffic that matches VLAN 10. On xe2.2, configure double-tagged encapsulation to match the pushed frame.
#configure terminal
(config)#interface xe1.1 switchport
(config-if)#encapsulation dot1q 10
(config-if)#rewrite push 0x8100 100
(config-if)#exit
(config)#interface xe2.2 switchport
(config-if)#encapsulation dot1q 100 inner-dot1q 10
(config-if)#exit
(config)#bridge-domain 1
(config-bridge-domain)#interface xe1.1
(cconfig-bridge-domain)#interface xe2.1
(config-bridge-domain)#exit
Note: At interface xe1.1, for incoming traffic, "rewrite push" will add VLAN 100 with TPID values of 8100. At interface xe1.1, for outgoing traffic, "rewrite push" will pop the VLAN.
Apply VLAN Translate Rewrite
Set xe1.1 to translate VLAN 200 to 100 using TPID 0x9100. This is useful for interoperability between customer and provider VLAN schemes.
#configure terminal
(config)#interface xe1
(config-if)#dot1ad ethertype 0x9100
(config-if)#interface xe1.1 switchport
(config-if)#encapsulation dot1ad 200
(config-if)#rewrite translate 1-to-1 0x9100 100
(config-if)#interface xe2
(config-if)#dot1ad ethertype 0x9100
(config-if)#interface xe2.2 switchport
(config-if)#encapsulation dot1ad 100
(config-if)#exit
(config)#bridge-domain 1
(config-bridge-domain)#interface xe1.1
(config-bridge-domain)#interface xe2.1
Note: At interface xe1.1, for incoming traffic, "rewrite translate" will update the VLAN to 100 with TPID values 9100. At interface xe1.1, for outgoing traffic, "rewrite translate" will update the VLAN to 200 with TPID values 9100.
Apply VLAN Pop Rewrite
Configure xe1.1 to remove the VLAN tag from incoming frames. On xe2.2, accept the resulting untagged traffic.
#configure terminal
(config)#interface xe1.1 switchport
(config-if)#encapsulation dot1q 100
(config-if)#rewrite pop
(config-if)#interface xe2.2 switchport
(config-if)#encapsulation untagged
(config-if)#exit
(config)#bridge-domain 1
(config-xc)#interface xe1.1
(config-xc)#interface xe2.1
Note: At interface xe1.1, for incoming traffic, "rewrite pop" will pop the VLAN. At interface xe1.1, for outgoing traffic, "rewrite pop" will add VLAN 100 with TPID values 8100. Push, pop, and translate rewrite operations are supported with TPID values 8100/88a8/9100/9200 as symmetric operations.
Remove All Sub-interfaces
Remove all sub-interfaces configured under xe1.
#configure terminal
(config)#interface xe1
(config-if)#no subinterfaces
Note: The command "no subinterfaces" will remove all the sub-interfaces within a particular interface. OcNOS allows the same physical interface to support both L2 and L3 sub-interfaces.
Validation
#show bridge-domain
Bridge Id interfaces Status
--------------+----------------+----------------+-------
1 xe1.1 UP
xe2.1 UP
1. Command to display the learned MAC entries of bridge domain
#show mac address-table dynamic bridge-domain id 1
Bridge MAC Address Type Ports
------+---------------+---------+---------+
1 0022.3344.5566 dynamic xe1.1
#show mac address-table dynamic bridge-domain all
Bridge MAC Address Type Ports
------+---------------+---------+---------+
1 0022.3344.5566 dynamic xe1.1
#show mac address-table dynamic bridge-domain interface xe1.1
Bridge MAC Address Type Ports
------+---------------+---------+---------+
1 0022.3344.5566 dynamic xe1.1
#show mac address-table dynamic bridge-domain address 0022.3344.5566
Bridge MAC Address Type Ports
------+---------------+---------+---------+
1 0022.3344.5566 dynamic xe1.1
2. Command to clear the learned MAC entries
#clear mac address-table dynamic bridge-domain id 1
#clear mac address-table dynamic bridge-domain id 1 interface xe1.1
#clear mac address-table dynamic bridge-domain id 1 address 0022.3344.5566
#clear mac address-table dynamic bridge-domain all
#show mac address-table dynamic bridge-domain id 1
Bridge MAC Address Type Ports
------+---------------+---------+---------+
Configuring Static MAC Address on L2 Sub-interface
In a bridge-domain, static MAC addresses can be configured on specific sub-interfaces to control traffic flow precisely. This setup supports Layer 2 switching between sub-interfaces, whether they reside on the same or different physical ports.
The bridge-domain uses 802.1Q VLAN tagging to identify and separate traffic. Broadcast, unknown Unicast, and Multicast (BUM) traffic is flooded within the bridge-domain, ensuring delivery even in the absence of MAC learning. For known unicast traffic, forwarding decisions are based on the Layer 2 forwarding database (FDB).
When a destination MAC address is statically configured on a sub-interface, all matching traffic will egress only via that sub-interface, eliminating unnecessary flooding. This deterministic forwarding improves efficiency and enhances control over traffic paths.
1. Configure Physical Interfaces in Switchport Mode: Enable Layer 2 mode on interfaces xe1, xe2, and xe3 for sub-interface creation.
(config)#interface xe1
(config-if)#switchport
(config-if)#exit
(config)#interface xe2
(config-if)#switchport
(config-if)#exit
(config)#interface xe3
(config-if)#switchport
(config-if)#exit
2. Create Sub-interfaces and Set VLAN Encapsulation: Configure sub-interfaces xe1.1, xe2.1, and xe3.1 to match VLAN 100 tagged traffic using 802.1Q encapsulation.
(config)#interface xe1.1 switchport
(config-if)#encapsulation dot1q 100
(config-if)#exit
(config)#interface xe2.1 switchport
(config-if)#encapsulation dot1q 100
(config-if)#exit
(config)#interface xe3.1 switchport
(config-if)#encapsulation dot1q 100
(config-if)#exit
3. Create Bridge-Domain and Attach Sub-interfaces: Create bridge-domain 1 and associate all three sub-interfaces, enabling Layer 2 switching between them.
(config)#bridge-domain 1
(config-bridge-domain)#interface xe1.1
(config-bridge-domain)#interface xe2.1
(config-bridge-domain)#interface xe3.1
4. Configure Static MAC Entries: Map MAC 0000.0100.0001 to sub-interface xe1.1 and MAC 0010.9400.0002 to xe2.1. This forces unicast traffic to these MACs to egress only from the specified ports, avoiding flooding.
(config-bridge-domain)#mac 0000.0100.0001 forward xe1.1
(config-bridge-domain)#mac 0010.9400.0002 forward xe2.1
(config-bridge-domain)#exit
(config)#commit
end
Validation
Confirm that static MAC entries and sub-interfaces are correctly attached to bridge-domain 1.
Verify Running Configuration
!
interface xe1
switchport
!
interface xe1.1 switchport
encapsulation dot1q 100
!
interface xe2
switchport
!
interface xe2.1 switchport
encapsulation dot1q 100
!
interface xe3
switchport
!
interface xe3.1 switchport
encapsulation dot1q 100
!
exit
!
bridge-domain 1
interface xe1.1
interface xe2.1
interface xe3.1
mac 0000.0100.0001 forward xe1.1
mac 0010.9400.0002 forward xe2.1
!
!
#show running-config bridge-domain
!
bridge-domain 1
interface xe1.1
interface xe2.1
interface xe3.1
mac 0000.0100.0001 forward xe1.1
mac 0010.9400.0002 forward xe2.1
!
!
Monitor Interface Traffic
Observe traffic flow patterns on each sub-interface to validate unicast forwarding based on the static MACs.
#show interface counters rate mbps
+-------------------+--------------+-------------+--------------+-------------+
| Interface | Rx mbps | Rx pps | Tx mbps | Tx pps |
+-------------------+--------------+-------------+--------------+-------------+
xe1 0.00 0 242.13 236450
xe1.1 0.00 0 241.82 236149
xe2 0.00 0 181.24 176993
xe2.1 0.00 0 181.10 176852
xe3 399.78 390406 0.00 0
xe3.1 397.50 388183 0.00 0
Verify Static MAC Address Table
Verify that the static MAC entries are configured correctly and are active in the bridge-domain.
#show mac address-table static bridge-domain all
Bridge MAC Address Type Ports
------+---------------+---------+---------+
1 0000.0100.0001 static xe1.1
1 0010.9400.0002 static xe2.1
Static MAC Commands
The following new commands are introduced as part of the static MAC support enhancement; for more details, refer to the Layer 2 Sub-interface Commands section.
Troubleshooting
MAC not learning: Ensure correct VLAN tags and that sub-interfaces are operational.
Flooding despite known MAC: Check for missing static entries or bridge-domain misconfiguration.
No traffic flow: Use the show interface counters rate command to verify Transmit (TX) and Receive (RX) interface activity.
Glossary
The following provides definitions for key terms or abbreviations and their meanings used throughout this document:
Key Terms/Acronym | Description |
Bridge-Domain | Logical L2 switch fabric grouping multiple sub-interfaces. |
BUM | Broadcast, Unknown Unicast, Multicast traffic. |
FDB | Forwarding Database containing learned or static MAC addresses. |
Sub-interface | Virtual interface configured with VLAN encapsulation. |