VLANs - 802.1Q tunneling (QinQ)

802.1Q tunneling (aka QinQ) is a technique often used by Metro Ethernet providers as a Layer 2 VPN for customers. 802.1Q (or dot1q) tunneling is pretty simple…the provider will put an 802.1Q tag on all the frames that it receives from a customer with a unique VLAN tag. By using a different VLAN tag for each customer we can separate the traffic from different customers and also transparently transfer it throughout the service provider network.

Essentially, this results in the nesting of a set of customer trunks (inside tags) within a single provider trunk (outside tag).

This technique allows customers to pass multiple internal VLANs over a single VLAN on the ISP's network. This creates a (customer) VLAN tag within the (ISP) VLAN tag. A 802.1q tag within an 802.1q tag... thus the name QinQ.

The following diagram depicts this tag within a tag:

Links:

https://networklessons.com/switching/802-1q-tunneling-q-q-configuration-example