vwire & VLAN tagging?

[BigIr0n]

Hi all,

Is there any issue with configuring a vwire for both tagged and untagged traffic. For example use VLAN tag 0 AND whatever my real tags would be, like 1, 100, 200, etc. I'm assuming it will be fine since there is an option for 0-4094.

Any issues or limitations I should be aware of? Thanks for your support!

[ssharma]

Hi BigIr0n ,

Yes that is correct, if you don't specify any vlans that means (0-4094), that everything is that is coming off of 1 vwire interface  will exit out other interface. If you want do it based off of specific vlan, you can configure that as well. There are no issues with this configuration. Hope this helps. Thank you.

[Harshit]

In my experience,

when i deployed the Vwire with trunks on either side of it, i had to give tags as 0-4094 and only then the tagged traffic would pass through.

leaving it blank was dropping all the "tagged"traffic.

you can try leaving it empty, but in case you run into issues, try that workaround.

Regards,

~Harry

[hshah]

Hi Biglr0n,

Please find Configuration Guide Description for "Tag Allowed" field :

Enter the tag number (0 to 4094) or range of tag numbers (tag1-tag2) for the traffic allowed on the virtual wire. A tag value of zero indicates untagged traffic (the default). Multiple tags or ranges must be separated by commas. Traffic that has an excluded tag value is dropped. Note that tag values are not changed on incoming or outgoing packets.When utilizing virtual wire subinterfaces, the Tag Allowed list will cause all traffic with the listed tags to be classified to the parent virtual wire. Virtual wire subinterfaces must utilize tags that do not exist in the parent's Tag Allowed list.

Which means you have to enter value 0-4094 to allow tagged and all tagged frames.

Let me know if this helps.

Regards,

Hardik Shah

[panos]

you can also use subinterfaces with tags

https://live.paloaltonetworks.com/docs/DOC-6894

[mr.linus]

Hey Panos,

I have a question regarding the config in knowledgebase document you provided (Error When Specifying a Tag for VWire Subinterfaces)

Why do they not specify anything in the "Tags Allowed" field for the vwire1 and vwire2?

Why not set "Tags Allowed" to 1 and 2 respectively?

Is this necessary, or will adding the tag numbers here as well work but just be redundant since you configure it on the interface?

Also, shouldn't 0 be added to the "Tags Allowed" for the default-vwire (so set it to: "0, 3-4094") to allow untagged traffic as well?

[LooperN]

There are a few threads where this question comes up, but this seems to be the one with the most & newest comments...

I've noticed the following situation:

- allowing tags (dot1q VLANs) 0-4094 doesn't allow any traffic through, even when trunking is explicitly configured on each device connected via the vwire

- changing the Tag Allowed field from '0-4094' to the specific VLANs you need to transit (such as 0,1,199,900, etc.) allows such traffic to flow

Has anyone else noticed this?

Nick