topic Re: vwire & VLAN tagging? in General Topics

vwire & VLAN tagging?

BigIr0n — Fri, 14 Nov 2014 16:10:20 GMT

Hi all,

Is there any issue with configuring a vwire for both tagged and untagged traffic. For example use VLAN tag 0 AND whatever my real tags would be, like 1, 100, 200, etc. I'm assuming it will be fine since there is an option for 0-4094.

Any issues or limitations I should be aware of? Thanks for your support!

Re: vwire & VLAN tagging?

ssharma — Fri, 14 Nov 2014 16:20:25 GMT

Hi BigIr0n ,

Yes that is correct, if you don't specify any vlans that means (0-4094), that everything is that is coming off of 1 vwire interface will exit out other interface. If you want do it based off of specific vlan, you can configure that as well. There are no issues with this configuration. Hope this helps. Thank you.

Re: vwire & VLAN tagging?

Harshit — Fri, 14 Nov 2014 19:07:11 GMT

In my experience,

when i deployed the Vwire with trunks on either side of it, i had to give tags as 0-4094 and only then the tagged traffic would pass through.

leaving it blank was dropping all the "tagged"traffic.

you can try leaving it empty, but in case you run into issues, try that workaround.

Regards,

~Harry

Re: vwire & VLAN tagging?

hshah — Fri, 14 Nov 2014 20:20:30 GMT

Hi Biglr0n,

Please find Configuration Guide Description for "Tag Allowed" field :

Enter the tag number (0 to 4094) or range of tag numbers (tag1-tag2) for the traffic allowed on the virtual wire. A tag value of zero indicates untagged traffic (the default). Multiple tags or ranges must be separated by commas. Traffic that has an excluded tag value is dropped. Note that tag values are not changed on incoming or outgoing packets.When utilizing virtual wire subinterfaces, the Tag Allowed list will cause all traffic with the listed tags to be classified to the parent virtual wire. Virtual wire subinterfaces must utilize tags that do not exist in the parent's Tag Allowed list.

Which means you have to enter value 0-4094 to allow tagged and all tagged frames.

Let me know if this helps.

Regards,

Hardik Shah

Re: vwire & VLAN tagging?

Retired Member — Fri, 14 Nov 2014 21:15:31 GMT

you can also use subinterfaces with tags

https://live.paloaltonetworks.com/docs/DOC-6894

Re: vwire & VLAN tagging?

mr.linus — Wed, 25 Mar 2015 11:06:29 GMT

Hey Panos,

I have a question regarding the config in knowledgebase document you provided (Error When Specifying a Tag for VWire Subinterfaces)

Why do they not specify anything in the "Tags Allowed" field for the vwire1 and vwire2?

Why not set "Tags Allowed" to 1 and 2 respectively?

Is this necessary, or will adding the tag numbers here as well work but just be redundant since you configure it on the interface?

Also, shouldn't 0 be added to the "Tags Allowed" for the default-vwire (so set it to: "0, 3-4094") to allow untagged traffic as well?

Re: vwire & VLAN tagging?

LooperN — Tue, 22 Mar 2016 20:06:06 GMT

There are a few threads where this question comes up, but this seems to be the one with the most & newest comments...

I've noticed the following situation:

- allowing tags (dot1q VLANs) 0-4094 doesn't allow any traffic through, even when trunking is explicitly configured on each device connected via the vwire

- changing the Tag Allowed field from '0-4094' to the specific VLANs you need to transit (such as 0,1,199,900, etc.) allows such traffic to flow

Has anyone else noticed this?

Nick