tried the same setup with Catalyst 9300 subinterface for termination and it works.
guess it's down to individual module's limitation.
as for using one PE for both double tagging and L2VPN encapsulation, it is still not feasible in IOS XE devices as tested.
seems like the limitation centres on the inability for one device to do these two actions at the same time.
Original Message:
Sent: 07-06-2026 08:40
From: Olivier Benghozi
Subject: NNI/VLAN Tag Agreement Problem
Not really sure that a dual tagged interface can be terminated on an EX, actually...
------------------------------
Olivier Benghozi
------------------------------
Original Message:
Sent: 07-05-2026 23:44
From: DANIEL NG
Subject: NNI/VLAN Tag Agreement Problem
this is the config i use in my EX4000 for termination. not sure why the IP address is not reachable from the CE.
unit 5003 { description "Dual tagged IP whatever"; vlan-tags outer 3003 inner 1; family inet { mtu 1500; address a.b.c.d/30; } }
i haven't used 'encapsulation flexible-ethernet-services' though since i only have one unit on the interface. but i think that is not needed for termination to work.
for using only one device as PE for both double tagging and termination, i think that is not really supported since in the double tagging config, the only place to set the S-VLAN is on the NNI, which must be a bridge interface in the same bridge domain with the UNI and thus cannot run IGP and BGP in the MPLS core.
has anyone ever tried to use a single PE for both double tagging and termination?
------------------------------
DANIEL NG
------------------------------
Original Message:
Sent: 07-05-2026 22:05
From: Olivier Benghozi
Subject: NNI/VLAN Tag Agreement Problem
In our deployments we have an MX as PE with a QFX as QinQ multi-socket for smaller speeds. Some trunks plugged on the QFX have hundreds of vlans, so QinQ allows to keep this completely transparent from the QFX PoV. Some other vlans are single tag. An example of a LAG interface at the MX/PE side, with a single-tag IP interface, a dualtag IP interface, and a Pseudowire/L2Circuit matching an outer tag:
ae2 { flexible-vlan-tagging; mtu 9192; encapsulation flexible-ethernet-services; aggregated-ether-options { link-speed 40g; lacp { active; periodic slow; } } unit 1050 { description "Simple tagged blah"; vlan-id 1050; family inet { mtu 1500; address aa.bb.cc.dd/29; } } unit 3104 { description "Cust blah (PW Site1 to Site2)"; encapsulation vlan-ccc; vlan-id 3104; family ccc { mtu 2022; } } unit 5003 { description "Dual tagged IP whatever"; vlan-tags outer 3003 inner 1; family inet { mtu 1500; address a.b.c.d/30; } }}
------------------------------
Olivier Benghozi
------------------------------
Original Message:
Sent: 07-05-2026 21:46
From: DANIEL NG
Subject: NNI/VLAN Tag Agreement Problem
that's right.
strangely when i use an EX switch's subinterface for NPE, the CE cannot reach it through the UPE. not sure if that's the product limitation of EX series.
i also see routers like MX can also configure the exact commands as EX for double tagging. does that mean they are capable of double tagging as well?
if it routers are indeed capable, can they do both double tagging and termination as one PE?
------------------------------
DANIEL NG
------------------------------
Original Message:
Sent: 07-05-2026 20:42
From: Olivier Benghozi
Subject: NNI/VLAN Tag Agreement Problem
About subinterface to configure Q-in-Q matching, you mean terminating a double tagged vlan (or switching it to some EoM tunnel)? On PTX and MX, yes.
------------------------------
Olivier Benghozi
------------------------------
Original Message:
Sent: 07-04-2026 06:33
From: DANIEL NG
Subject: NNI/VLAN Tag Agreement Problem
after some more testing, i've found that the NPE behind the UPE (switches) do not seem to match the tags properly.
when i configure the NPE to match the S- and C-VID as below, even if they don't match, traffic can still go through.
root# show interfaces ge-0/0/5
flexible-vlan-tagging;
encapsulation extended-vlan-bridge;
unit 10 {
vlan-tags outer 10 inner 100;
}
not sure if there is some extra config needed but that's what i found so far.
also, in other OSes like IOS XE, you can use subinterface to configure Q-in-Q matching in a NPE. is it also possible in Junos? i've only seen examples with bridge interface.
------------------------------
DANIEL NG
------------------------------
Original Message:
Sent: 06-30-2026 04:19
From: DANIEL NG
Subject: NNI/VLAN Tag Agreement Problem
i think i found the cause or part of it.
if i configure it from scratch without native vlan, it works fine.
but if i add native vlan then remove it. the switch seems to bug out.
i have to remove the whole Q-in-Q config then reboot then reconfigure to reinstate the function.
this action also somehow removes the S-VLAN from the config.
this is somewhat similar to the interface protocol not effective bug where you have to delete the routing instance where the interface is in, then add it back to make the protocol effective.
------------------------------
DANIEL NG
------------------------------
Original Message:
Sent: 06-29-2026 10:17
From: Olivier Benghozi
Subject: NNI/VLAN Tag Agreement Problem
We're successfully using QinQ on EX4600, EX4650, QFX5120 (QinQ vlans usually terminated as double-tagged layer3 interfaces on some MX, but sometimes on a Linux). Using only 802.1q ethertype of course.
But these are actually QFX or «QFX sold as EX», so different beasts than EX4000...
Sample configs (we use encap flexible-ether-srv on NNI below. As we have both Enterprise and SP style config, because we have some classic vlans and QinQ vlans at the same time there) ; but if you only use SP Style, you don't need that (and you can use encap ext-vlan-br, and no encap vlan-br in the units):
interfaces { xe-0/0/10 { description "UNI"; flexible-vlan-tagging; mtu 9216; encapsulation extended-vlan-bridge; unit 3000 { description "QinQ Vlan UNI 3000"; vlan-id-list 2-4094; input-vlan-map push; output-vlan-map pop; } } ae0 { description "NNI to MX"; flexible-vlan-tagging; mtu 9216; encapsulation flexible-ethernet-services; aggregated-ether-options { link-speed 100g; lacp { active; periodic slow; } } unit 0 { description "Not QinQ VLANs"; family ethernet-switching { interface-mode trunk; vlan { members vlan.not-qinq; } } } unit 3000 { description "Q-in-Q vlan 3000"; encapsulation vlan-bridge; vlan-id 3000; }}vlans { qinq-3000 { description "Q-in-Q vlan 3000"; interface ae0.3000; interface xe-0/0/10.3000; switch-options { no-mac-learning; } } vlan.not-qinq { description "My not QinQ vlan for various stuff"; vlan-id 1050; l3-interface irb.1050; }}
We have some UNI interfaces with untagged stuff, too:
xe-0/0/3 { description "UNI Whatever including untagged stuff"; flexible-vlan-tagging; native-vlan-id 1; mtu 9216; encapsulation extended-vlan-bridge; unit 3003 { description "UNI cust including untagged (and in this case, only untagged)"; vlan-id-list 1; input-vlan-map push; output-vlan-map pop; }}
In this case on the NNI side the traffic is still double tagged: SVLAN 3003, CVLAN 1.
------------------------------
Olivier Benghozi
------------------------------
Original Message:
Sent: 06-29-2026 09:53
From: DANIEL NG
Subject: NNI/VLAN Tag Agreement Problem
has anyone actually successfully made it work on ELS Junos for endpoint double tagging?
------------------------------
DANIEL NG
------------------------------
Original Message:
Sent: 06-26-2026 06:23
From: DANIEL NG
Subject: NNI/VLAN Tag Agreement Problem
the second switch is also EX4000 and same Junos version.
the config is exactly vice versa.
i find no difference with matching unit number.
------------------------------
DANIEL NG
------------------------------
Original Message:
Sent: 06-25-2026 08:56
From: Olivier Benghozi
Subject: NNI/VLAN Tag Agreement Problem
Got it, but what's the conf of the second QinQ one, and is it the same EX/version?
As Juniper made some changes about the native vlan tag present or not in QinQ (in all newer switches and JunOS, NNI presents double-tagged frames, whereas in previous stuff – and by default in EX4300 – not always).
And from what I read (but I can be wrong), the unit number was relevant and needed to match the SVLAN.
------------------------------
Olivier Benghozi
------------------------------
Original Message:
Sent: 06-25-2026 01:11
From: DANIEL NG
Subject: NNI/VLAN Tag Agreement Problem
there were multiple switches between the two Q-in-Q switches. but now i connect those two back to back. no difference it seems.
i remember it used to work with 'dot1q-tunneling' command in non-ELS Junos which is not available anymore in ELS Junos.
the new commands seem to be more like for subinterface, which is why i doubt ELS Junos could not support Q-in-Q for endpoint double tagging.
------------------------------
DANIEL NG
------------------------------
Original Message:
Sent: 06-24-2026 13:25
From: Olivier Benghozi
Subject: NNI/VLAN Tag Agreement Problem
What is there behind the NNI, and what's its port config (my idea here is, maybe it doesn't match the way the EX4300 tags the stuff) ?
------------------------------
Olivier Benghozi
------------------------------
Original Message:
Sent: 06-24-2026 09:36
From: DANIEL NG
Subject: NNI/VLAN Tag Agreement Problem
tried with and without native vlan. same result.
------------------------------
DANIEL NG
------------------------------
Original Message:
Sent: 06-24-2026 09:14
From: Olivier Benghozi
Subject: NNI/VLAN Tag Agreement Problem
I think that «native-vlan-id 111» must be removed.
And I suppose that setting the unit number to be equal to the S-vlan-id (111) would be better.
------------------------------
Olivier Benghozi
------------------------------
Original Message:
Sent: 06-23-2026 01:13
From: DANIEL NG
Subject: NNI/VLAN Tag Agreement Problem
interfaces {
ge-0/0/1 { (NNI)
flexible-vlan-tagging;
native-vlan-id 111;
encapsulation extended-vlan-bridge;
unit 1 {
vlan-id 111;
}
}
ge-0/0/2 { (UNI)
flexible-vlan-tagging;
encapsulation extended-vlan-bridge;
unit 1 {
vlan-id-list [ 1 2 3-5 ];
input-vlan-map push;
output-vlan-map pop;
}
}
}
vlans {
v111 {
interface ge-0/0/1.1;
interface ge-0/0/2.1;
}
}
i have also tried to use trunk port on the NNI but still same.
i am beginning to feel this is actually the subinterface config for Q-in-Q rather than switch interface config.
------------------------------
DANIEL NG
------------------------------
Original Message:
Sent: 06-22-2026 09:06
From: Olivier Benghozi
Subject: NNI/VLAN Tag Agreement Problem
Maybe post the content of both ports and the vlan definition ?
------------------------------
Olivier Benghozi
------------------------------
Original Message:
Sent: 06-22-2026 06:13
From: DANIEL NG
Subject: NNI/VLAN Tag Agreement Problem
followed the procedure in the url exactly and can commit now when i removed 'vlan-id' under vlan.
but traffic still does not go through. i am almost certain the official documentation is missing a significant part of config.
------------------------------
DANIEL NG
------------------------------
Original Message:
Sent: 06-22-2026 02:41
From: PER GRANATH
Subject: NNI/VLAN Tag Agreement Problem
QinQ works fine on EX with ELS.
You must be aware of that there is "Enterprise Style" and "SP Style" of configuring this, and you must use the same style on both client port and uplink/trunk port.
SP Style is possibly more reliable...
https://community.juniper.net/discussion/help-with-q-in-q-on-ex4600-and-ex3400
------------------------------
PER GRANATH
------------------------------
Original Message:
Sent: 06-21-2026 13:05
From: DANIEL NG
Subject: NNI/VLAN Tag Agreement Problem
i was also trying to do Q-inQ with my EX4000 switches which is also ELS Junos.
tried following below document but it couldn't even commit.
https://www.juniper.net/documentation/us/en/software/junos/multicast-l2/topics/topic-map/q-in-q.html#id-configuring-q-in-q-tunneling-on-ex-series-switches-with-els-support
so that means the current ELS Junos does not support Q-in-Q anymore?
------------------------------
DANIEL NG
------------------------------
Original Message:
Sent: 04-30-2026 11:20
From: HUNTER JOHNSON
Subject: NNI/VLAN Tag Agreement Problem
I appreciate the help yall. Unfortunately, the s vlan configuration is for older EX devices that we don't use or aren't supported. I ran this past our Juniper TAM and he confirmed that it wouldn't work.
Juniper switching platform is not a viable solution for what we need. We need a switch that can do 1 tag to 2 tag operations while using the same tag for MGMT on every subunit which Juniper does not support.
Hunter Johnson, Network Engineer
Direct: 541.414.1422
Support: 541.200.2202
Original Message:
Sent: 4/30/2026 11:02:00 AM
From: Olivier Benghozi
Subject: RE: NNI/VLAN Tag Agreement Problem
EX2300/EX4300 being ELS JunOS config style, I guess QinQ is not configured with «dot1q-tunneling» that was for older switches...
This was answered a long time and may work: Community Juniper / RE: Q-in-Q configuration on EX2300
------------------------------
Olivier Benghozi
------------------------------