There is no single counter to indicate that non-tagged packets are entering an interface configured for vlan-tagging. This article provides information about the counters that should be examined, when verifying this type of issue.

If non-tagged packets are entering an interface, which is configured with a VLAN, they will be dropped. To verify, examine the output of show interface <interface-name> extensive . All packets will be rejected and reflect in the filter statistics. However, the Input DA rejects and Input SA rejects counters will not increment. The L2 channel errors counter will also not increment. If L2 channel errors are incrementing, it indicates that the packets are tagged with a vlan-id, which is not configured on the interface.


For example:

> show interface ge-4/2/9 extensive
Physical interface: ge-4/2/9, Enabled, Physical link is Up
......
Input errors:
  Errors: 0, Drops: 0, Framing errors: 0, Runts: 0, Policed discards: 0, L3 incompletes: 0,
  L2 channel errors: 0, L2 mismatch timeouts: 0 ,FIFO errors: 0, Resource errors: 0
......
Filter statistics:
  Input packet count 528
  Input packet rejects 528
  Input DA rejects 0
  Input SA rejects 0

To resolve this issue, configure the remote device to send vlan-tagged packets or configure a native-vlan-id on the local interface.  A feature, known-as flexible-vlan-tagging , must be configured for native-vlan-tagging to correctly operate. Refer to Juniper Networks Technical Documentation for additional information on flexible-vlan-tagging.


For example:

interfaces {
    ge-4/2/9 {
        flexible-vlan-tagging; <<<<<
        native-vlan-id 900; <<<<<
        unit 0 {
            encapsulation vlan-bridge;
            vlan-id 900;
        }
    }
}