vwire & VLAN tagging?

Reply
Highlighted
L0 Member

vwire & VLAN tagging?

Hi all,

Is there any issue with configuring a vwire for both tagged and untagged traffic. For example use VLAN tag 0 AND whatever my real tags would be, like 1, 100, 200, etc. I'm assuming it will be fine since there is an option for 0-4094.

Any issues or limitations I should be aware of? Thanks for your support!

Highlighted
L5 Sessionator

Re: vwire & VLAN tagging?

Hi BigIr0n ,

Yes that is correct, if you don't specify any vlans that means (0-4094), that everything is that is coming off of 1 vwire interface  will exit out other interface. If you want do it based off of specific vlan, you can configure that as well. There are no issues with this configuration. Hope this helps. Thank you.

Highlighted
L3 Networker

Re: vwire & VLAN tagging?

In my experience,

when i deployed the Vwire with trunks on either side of it, i had to give tags as 0-4094 and only then the tagged traffic would pass through.

leaving it blank was dropping all the "tagged"traffic.

you can try leaving it empty, but in case you run into issues, try that workaround.

Regards,

~Harry

Highlighted
L6 Presenter

Re: vwire & VLAN tagging?

Hi Biglr0n,

Please find Configuration Guide Description for "Tag Allowed" field :

Enter the tag number (0 to 4094) or range of tag numbers (tag1-tag2) for the traffic allowed on the virtual wire. A tag value of zero indicates untagged traffic (the default). Multiple tags or ranges must be separated by commas. Traffic that has an excluded tag value is dropped. Note that tag values are not changed on incoming or outgoing packets.When utilizing virtual wire subinterfaces, the Tag Allowed list will cause all traffic with the listed tags to be classified to the parent virtual wire. Virtual wire subinterfaces must utilize tags that do not exist in the parent's Tag Allowed list.

Which means you have to enter value 0-4094 to allow tagged and all tagged frames.

TAg.png

Let me know if this helps.

Regards,

Hardik Shah

Highlighted
L6 Presenter

Re: vwire & VLAN tagging?

you can also use subinterfaces with tags

https://live.paloaltonetworks.com/docs/DOC-6894

Highlighted
L4 Transporter

Re: vwire & VLAN tagging?

Hey Panos,

I have a question regarding the config in knowledgebase document you provided (Error When Specifying a Tag for VWire Subinterfaces)

Why do they not specify anything in the "Tags Allowed" field for the vwire1 and vwire2?

Why not set "Tags Allowed" to 1 and 2 respectively?

Is this necessary, or will adding the tag numbers here as well work but just be redundant since you configure it on the interface?


Also, shouldn't 0 be added to the "Tags Allowed" for the default-vwire (so set it to: "0, 3-4094") to allow untagged traffic as well?

Highlighted
L1 Bithead

Re: vwire & VLAN tagging?

There are a few threads where this question comes up, but this seems to be the one with the most & newest comments...

 

I've noticed the following situation:

- allowing tags (dot1q VLANs) 0-4094 doesn't allow any traffic through, even when trunking is explicitly configured on each device connected via the vwire

- changing the Tag Allowed field from '0-4094' to the specific VLANs you need to transit (such as 0,1,199,900, etc.) allows such traffic to flow

 

tag.png

 

Has anyone else noticed this?

 

Nick

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!