Huawei QinQ to VSI: Check the Tag Stack Before You Configure

Two failures account for most broken QinQ handoffs into a VSI, and neither one shows up as a down interface. Either the ingress port eats the customer tag before classification can see it, or the attachment circuit is bound to a VSI that the far end never joined. From the customer side the two look identical: the circuit reports up and no frame crosses. Work through the four checks below in order, and stop at the first one where the frame you observe differs from the frame you wrote down.

Write the tag stack down before you touch the device

Pick one representative service and describe it as frames, not as configuration. For a service that keeps customer VLANs 100 and 200 inside provider VLAN 900, the contract is short: ingress frames carry one customer tag, the provider adds one service tag, and the customer's own tag survives untouched underneath.

customer to provider:  [ C-tag 100 | payload ]
provider inside:       [ S-tag 900 ][ C-tag 100 | payload ]
provider to customer:  [ C-tag 100 | payload ]

Write the return direction as well, because a contract that only describes ingress will pass a one-way test and fail in production. The far end has to hand the customer the frame the customer expects, which means its own pop operation must be the exact inverse of your push. Anything that is not symmetric in that description is a design decision you have not made yet.

Check the ingress match first

Classification happens before any tag operation, and it can only match what arrives. Confirm whether the port is configured as access, trunk or hybrid, which frame types it accepts, and what the port VLAN identifier does to an untagged frame. On an access port the customer tag is stripped on arrival, so a later rule that matches C-tag 100 has nothing left to match and the service joins the wrong broadcast domain without any error.

A capture on the provider side settles this in seconds: a correctly classified QinQ frame shows two tags, and a single-tagged frame there means the inner tag was consumed.

Check what the tag action actually does

Stacking and translation are different operations and platforms expose them as different objects. Stacking pushes an outer tag and leaves the inner one alone, which is what the contract above needs. Translation rewrites one tag into another, which is a valid design but produces a different frame on the wire. Some families also need QinQ enabled explicitly on the port before a stacking rule takes effect, and the outer TPID may be configurable between the 802.1Q and 802.1ad values.

The return path deserves equal attention. If the egress rule pops the outer tag on one subinterface but a different subinterface carries the reply with no matching rule, the customer sees working transmit and dead receive.

Check the service binding, not the interface number

A VSI is identified by its own service and virtual-circuit identifiers, and the peer must use matching values before a pseudowire forms. The attachment circuit then binds that VSI to a specific port and VLAN, which is a separate statement from the rule that classified the frame. A subinterface number that looks right proves nothing about either binding.

Check the pseudowire state and the attachment-circuit state separately, and check the signalling session that carries the pseudowire. Two of those three can be healthy while the third is not, and the one that is down tells you which side to fix.

Isolation is a separate promise. Keeping customer tags intact inside one VSI does not segment customers from each other, because MAC learning spans the whole instance; if the contract says isolation, it needs separate instances or an explicit per-VLAN policy.

Check the size budget and then prove the contract

The outer tag adds four bytes, and the pseudowire encapsulation adds a label stack and possibly a control word on top of that. Put all of it into the MTU and MRU budget on both provider edge devices, and do not switch off a control word purely to silence a size warning, since the far end may require it. Keep a management path that does not depend on the service you are changing.

Then test three cases at the customer attachment: the first admitted C-VLAN in both directions, the second admitted C-VLAN, and a VLAN that the contract says must be refused. Observe frames rather than reading interface states, and repeat after any change to the tag rule.

An up VSI only says the pseudowire formed. It says nothing about whether the frame that crosses it is the frame the customer paid for.