Customer may need to user Q-in-Q in MAC VRF on a single node in some special use cases. In other words, they may want to put Q-inQ ingress and egress port in one MAC VRF on a same switch.
They are trying to get "Traffic Pattern 2" (Mapping a Range of C-VLANs to an S-VLAN, and Pushing an S-VLAN Tag) work as per the official configuration example listed on the link below.
https://www.juniper.net/documentation/us/en/software/junos/evpn-vxlan/topics/topic-map/evpn-vxlan-flexible-vlan-tag.html#id-configuring-traffic-pattern-2-mapping-a-range-of-cvlans-to-an-svlan
Customer noticed that normal Q-in-Q (without MAC VRF) works but it stopped working when MAC VRF is introduced.
Ingress traffic looks good in this use case but there is only one VLAN tag on egress traffic, which makes communication between CE-1 and CE-2 failed because CE-2 is supposed to receive dual-tagged traffic.
Configuration is the same as described in the document being ingress port with "vlan-id-list" and egress port with "input-vlan-map pop" and "output-vlan-map push".
Q-in-Q on the same switch in MAC VRF in this use case is not honored by VxLAN encapsulation but local flooding within the same VLAN so action of input/output (pop/push) VLAN will not be taken.
If we separate ingress and egress ports to two PE nodes it's working as expected.
Thus, Q-in-Q on the same switch in the same MAC VRF will not work as expected.>>> Working use case verified in JTAC lab:
IXIA_port-1 (10.1.1.1/24 with CVLAN 1000) --- (xe-0/0/33.3500) QFX5120-32C-DUT --- (ae0, EZ-LAG) --- QFX5120-48YM (xe-0/0/5.3500) --- (10.1.1.2/24 with SVLAN 3500 and CVLAN 1000) IXIA_port-2
This is the suggested topology as per the document explain traffic pattern 2.
Egress traffic captured on IXIA port 2 now retains double VLAN tags, inner 1000 and outer 3500. Ping between two IXIA ports started working as well. MAC table on two QFX nodes looks good with one MAC locally learned and the other via VTEP interface.
Here are part of the configuration from 2x QFX nodes.
{master:0}
root@QFX5120-32C-r036> show configuration interfaces xe-0/0/33 | display set
Aug 05 18:34:04
set interfaces xe-0/0/33 flexible-vlan-tagging
set interfaces xe-0/0/33 encapsulation extended-vlan-bridge
set interfaces xe-0/0/33 unit 3500 vlan-id-list 1000-2000
root@QFX5120-32C-r036> show configuration routing-instances Q-in-Q_One-Node_test | display set
Aug 05 18:34:17
set routing-instances Q-in-Q_One-Node_test instance-type mac-vrf
set routing-instances Q-in-Q_One-Node_test protocols evpn encapsulation vxlan
set routing-instances Q-in-Q_One-Node_test protocols evpn default-gateway no-gateway-community
set routing-instances Q-in-Q_One-Node_test vtep-source-interface lo0.0
set routing-instances Q-in-Q_One-Node_test service-type vlan-bundle
set routing-instances Q-in-Q_One-Node_test interface xe-0/0/33.3500
set routing-instances Q-in-Q_One-Node_test route-distinguisher 10.250.248.1:3500
set routing-instances Q-in-Q_One-Node_test vrf-target target:1:3500
set routing-instances Q-in-Q_One-Node_test vlans v3500 interface xe-0/0/33.3500
set routing-instances Q-in-Q_One-Node_test vlans v3500 vxlan vni 103500
set routing-instances Q-in-Q_One-Node_test vlans v3500 vxlan encapsulate-inner-vlan
root@QFX5120-48YM-8C-r011> show configuration interfaces xe-0/0/5 | display set
set interfaces xe-0/0/5 flexible-vlan-tagging
set interfaces xe-0/0/5 encapsulation extended-vlan-bridge
set interfaces xe-0/0/5 unit 3500 vlan-id 3500
set interfaces xe-0/0/5 unit 3500 input-vlan-map pop
set interfaces xe-0/0/5 unit 3500 output-vlan-map push
root@QFX5120-48YM-8C-r011> show configuration routing-instances Q-in-Q_One-Node_test | display set
set routing-instances Q-in-Q_One-Node_test interface xe-0/0/5.3500
set routing-instances Q-in-Q_One-Node_test vlans v3500 interface xe-0/0/5.3500