Q-in-Q / no S-Tag strip required?

RouterOS General
1

Hi,

I am reading this article (section “VLAN Tunneling (Q-in-Q)”):
https://wiki.mikrotik.com/wiki/Manual:CRS1xx/2xx_series_switches_examples#VLAN_Tunneling_.28Q-in-Q.29

As far as I understand, it is described how the customer frames (C-Tag) get an S-Tag:
1. /interface ethernet switch ingress-vlan-translation

Further how they are send out the Service-Trunk:
2. /interface ethernet switch egress-vlan-tag

But do I not have to configure, that the outer S-Tag gets stripped of prior exiting eth1 or eth2??
And when not, why?

Screenshot 2022-01-02 144217.jpg

2

To my understanding, the stripping on egress is done on all ports of a given VLAN except those mentioned on the tagged-ports list of the corresponding row under /interface ethernet switch egress-vlan-tag.

3

OK, that makes sense, but leads to another question.

Lets assume SW-3 send out an ARP-request (DST-MAC: FF:FF:FF:FF:FF:FF). This gets S-tagged with VID400 at CRS-3 and will arrive at CRS-1.
How does CRS-1 “know” how to forward this frame to SW-1?

The only refernece SVID400 ↔ CVID200/eth1 is under /interface ethernet switch ingress-vlan-translation.
But it seems wrong, the switch does a lookup againts this rules when the frame ingresses via the S-Trunk (eth9)??

Edit: Or will the ARP-request arrive at both, SW-1 and SW-2, because from the perspective of the CRS-1, C-Tags are treated as non-present “untagged” and so both will get the L2-broadcast?

4

The dst-mac is ff:ff:ff:ff:ff:ff, so the frame is forwarded to all member ports of the VLAN it is tagged with on the trunk. The example configuration doesn’t show any membership of ports in the VLANs (S-VLANs to be precise), which means that this ARP-request would egress also via ether2, to which SW-2 is connected. If I remember well, the switch has no way to check for C-VLAN on egress if bridge-type=service-vid-used-as-lookup-vid.