This article explains the QinQ encapsulation limitation on the EX4400 platform when attempting to add an additional VLAN tag to traffic that is already double-tagged.

In the reported scenario, customer traffic arriving on the UNI  (User-to-Network Interface) interface is tagged with VLANs A-B. The requirement is to add S-VLAN C  (Service Vlan) and transport the traffic over VLAN D towards the NNI (Network-to-Network Interface), resulting in the following encapsulation: D / C / A-B

This requires the frame to carry three VLAN tags.

The following behavior may be observed when attempting to implement the above design on an EX4400:

• DHCP Discover packets are received on the UNI interface.
• Customer traffic is not forwarded towards the NNI interface.
• Customer MAC addresses are not learned in the expected bridge domain or service.
• Attempting to configure an additional VLAN push operation results in the following commit error:

A two tagged logical interface can not support push on input-vlan-map.

Although the ingress traffic reaches the switch, the requested encapsulation cannot be applied because it exceeds the platform's supported VLAN tagging capabilities.

The EX4400 supports IEEE 802.1ad Q-in-Q tunneling, which allows a maximum of two VLAN tags (one Service VLAN and one Customer VLAN).

The requested encapsulation: D / C / A-B requires three VLAN tags, which is not supported on the EX4400 platform.

This behaviour is expected and is consistent with the documented Junos constraints for Q-in-Q tunneling and VLAN translation.

For additional information, refer to the Constraints for Q-in-Q Tunneling and VLAN Translation section in the Juniper documentation:

https://www.juniper.net/documentation/us/en/software/junos/multicast-l2/topics/topic-map/q-in-q.html#id-configuring-q-in-q-tunneling-on-ex-series-switches-with-els-support