OUCS can offer transparent LAN services which preserve and extend a Unit's virtual LAN (VLAN) groupings and associated access privileges across the university backbone network. This is achieved with 802.1Q Tunnelling (also called 802.1Q-in-Q).
OUCS can allocate each unit a second VLAN, with no routed interface – a 'switched' VLAN. This is presented at your main site and any annexe sites you nominate. Many Units have this in place already. Usually you send your main VLAN as un-tagged traffic down this switched VLAN, enabling you to have a common subnet across your main site and annexes. The traffic has an 802.1Q tag added while it's inside the university backbone network to keep it separate from other Units' traffic. However the limitation is that only one VLAN can ever be sent between your sites.
If you would like to discuss this feature or request that we enable it for you, please contact firstname.lastname@example.org
2. Technical Details
When Q-in-Q tunnelling is enabled, the software adds an extra 802.1Q tag to your traffic at the ingress port of the switch (usually FroDo) at the edge of our network – regardless of whether or not it is already tagged. When the traffic leaves the egress port and enters another point in your network, the extra tag is removed.
802.1Q-in-Q tunnelling allows all of your configured VLANs to be aggregated and backhauled over this single Backbone VLAN, which is a scalable solution. Without Q-in-Q, OUCS would have to assign a unique VLAN ID number to each of your individual VLANs which are required at more than one site this would rapidly consume the 4094-ID VLAN space supported by IEEE 802.1Q technology. In this way, encapsulating multiple 802.1Q VLANs into a single Backbone 802.1Q VLAN (hence the name, “Q in Q”) makes it possible for you to have up to 4094 VLANs present across your sites.
4. Layer 2 control plane traffic
To transport not only your data traffic but also Layer 2 control traffic (such as STP, Cisco Discovery Protocol (CDP), and VLAN Trunking Protocol (VTP)), we also configure Layer 2 Protocol Tunnelling, which is a separate feature. This means that to you, the backbone appears like a 'bump in the wire' and it is as if the two Unit switches were directly connected. For example the main site switch will be able to see all the annexe switches as 'CDP/LLDP neighbors' on the annexe port.
This leads to an additional benefit. A standard 'switched' VLAN merges the Spanning Tree Protocol (STP) of your VLAN and the Backbone VLAN. This can often lead to a Spanning Tree with a diameter of greater than seven. The default timers are set with the assumption that the limit of seven hops from the Root Bridge to any leaf will not be broken so this can lead to anomalous behaviour which can be difficult to troubleshoot. Enabling this feature creates many distinct STP instances, one for the switched VLAN crossing the backbone and one for each of your VLANs. OUCS has complete control over the STP in the university backbone network, and you have control over the STP for each of your VLANs.
There are several issues which we will hope to address in the next iteration of the backbone by providing an alternative solution.
In order to mitigate the risk of anomalous behaviour we require the following:
 This assumes you are using Cisco switches. Other vendors provide one instance of STP for the native (untagged) VLAN and one for all tagged VLANs. Since the tree is usually identical for all VLANs in these examples, this is not an issue.
 If and only if you are connecting to a 801.1Q tunnel.