Cisco 3845 - Security Bundle Router

11-14
Cisco ME 3800X and 3600X Switch Software Configuration Guide
OL-23400-01
Chapter 11 Configuring Ethernet Virtual Connections (EVCs)
Configuring EFPs
Switch (config-if)# switchport mode allowed vlan none
Switch (config-if)# service instance 1 ethernet
Switch (config-if-srv)# encapsulation dot1q 10 cos 3
Switch (config-if-srv)# bridge-domain 10
Switch (config-if-srv)# exit
Switch (config-if)# service instance 2 ethernet
Switch (config-if-srv)# encapsulation dot1q 10 etype ipv4
Switch (config-if-srv)# bridge-domain 10
Global Rewrite Operation Limitation on a Switch
The switch does not support egress rewrite operations beyond the second VLAN that a packet carries
into a switch. Because of the egress rewrite limitation, if an EFP has a pop 2 rewrite operation at ingress,
no other EFP in the same bridge domain can have a rewrite operation.
In these examples, service instance 1 and the switchport characteristics are configured prior to service
instance 2. In the examples, dot1q 30 identifies a third VLAN to be parsed.
Example 1
Service instance 1 pops two tags at ingress, and service instance 2 does not have rewrite (push) operation
at egress. The configuration for service instance 2 is rejected because it is configuring a match on the
third VLAN of the packet bridged from service instance 1 to dot1q VLAN encapsulation of service
instance 2.
Switch (config-if)# service instance 1 Ethernet
Switch (config-if-srv)# encapsulation dot1q 10 second-dot1q 20
Switch (config-if-srv)# rewrite ingress pop 2 symmetric
Switch (config-if-srv)# bridge-domain 2
Switch (config-if-srv)# exit
Switch (config-if)# service instance 2 Ethernet
Switch (config-if-srv)# encapsulation dot1q 30
Switch (config-if-srv)# bridge-domain 2
Example 2
Service instance 1 pops two tags at ingress, and service instance 2 pushes only the outermost VLAN.
The service instance 2 configuration is rejected since it configures a match on the third VLAN of the
packet bridged from service instance 1 to the second-dot1q 30 encapsulation of service instance 2.
Switch (config-if)# service instance 1 Ethernet
Switch (config-if-srv)# encapsulation dot1q 10 second-dot1q 20
Switch (config-if-srv)# rewrite ingress pop 2 symmetric
Switch (config-if-srv)# bridge-domain 2
Switch (config-if-srv)# exit
Switch (config-if)# service instance 2 Ethernet
Switch (config-if-srv)# encapsulation dot1q 15 second-dot1q 30
Switch (config-if-srv)# rewrite ingress pop 1 symmetric
Switch (config-if-srv)# bridge-domain 2
Example 3
Service instance 1 pops only one tag, and service instance 2 needs to parse the second and third VLANs.
Service instance 2 configuration is rejected since it needs to match on the third VLAN of the packet
bridged from service instance 1 to second-dot1q 30 encapsulation of service instance 2.
Switch (config-if)# service instance 1 Ethernet
Switch (config-if-srv)# encapsulation dot1q 10 second-dot1q 20
Switch (config-if-srv)# rewrite ingress pop 1 symmetric
Switch (config-if-srv)# bridge-domain 2