Configuration restrictions and guidelines
When you configure VLAN termination, follow these restrictions and guidelines:
On a portal-enabled interface, log off all portal users before you change the VLAN termination type, for example, from Dot1q termination to QinQ termination. Any portal users who remain online after the change cannot be logged off or reauthenticated. For more information about portal authentication, see Security Configuration Guide.
A main interface cannot terminate VLAN-tagged packets. To terminate VLAN-tagged packets, you can create subinterfaces for the main interface.
Subinterfaces (Layer 3 Ethernet subinterfaces and Layer 3 aggregate subinterfaces for example) can terminate the following packets:
Packets with matching Layer 1 VLAN IDs.
Packets with matching Layer 1 and Layer 2 VLAN IDs.
After you modify the VLAN termination configuration for a Layer 3 Ethernet subinterface or Layer 3 aggregate subinterface, the subinterface automatically restarts. All dynamic ARP table entries for the subinterface are deleted.
When a main interface bound to a VLAN interface receives a VLAN-tagged packet, the main interface processes the packet according to the VLAN interface configuration.
After you configure VLAN termination, the system finds an interface for a received packet in the following order:
Subinterface configured with QinQ termination.
Subinterface configured with loose QinQ termination.
Subinterface configured with Dot1q termination, or subinterface that supports Dot1q termination by default.
Subinterface configured with loose Dot1q termination.
Subinterface configured with untagged termination.
Subinterface configured with default termination.
Main interface.