How to configure VLAN VPN on L2 Managed switches using the new GUI

T2600G-28MPS( V3 ) , T2600G-52TS( V3 ) , T2600G-28TS( V3 ) , T2600G-28SQ( V1 )
Recent updates may have expanded access to feature(s) discussed in this FAQ. Visit your product's support page, select the correct hardware version for your device, and check either the Datasheet or the firmware section for the latest improvements added to your product. Please note that product availability varies by region, and certain models may not be available in your region.
VLAN VPN (Virtual Private Network), also known as QinQ, is a simple and flexible layer 2 tunneling technology. VLAN VPN enables the packets sent from the private network to be forwarded through the ISP network with double VLAN tags.
With VLAN VPN enabled, when forwarding packets from the private VLAN to the ISP VLAN, the switch adds an outer VLAN tag (VLAN tag of the ISP VLAN) to the packets. Thus, packets can be transmitted through the ISP network with double VLAN tags. In the ISP network, packets are forwarded according to the outer VLAN tag, while the inner VLAN tag is treated as part of the payload. When the packets get to the peer private network, the switch removes the outer VLAN tag of the packets and then forwards the packets to the corresponding VLAN according to the inner VLAN tag.
Here is a configuration example for VLAN VPN.
A company has two stations, and the computers belong to VLAN 100 and VLAN 200 respectively. The ISP VLAN is VLAN 1050 and VLAN 1060, and the TPID adopted by the ISP network is 0x9100.
The two stations need to communicate with each other through the ISP network. And it is required that the traffic from VLAN 100 should be transmitted in VLAN 1050, while the traffic from VLAN 200 should be transmitted in VLAN 1060.
Configurations on Switch 1:
- Go to L2 FEATURES > VLAN > 802.1Q VLAN > VLAN Config to create VLAN 100 and VLAN 200 for the private network. Add the Tagged port 1/0/2 to VLAN 100 and VLAN 200.
- Create VLAN 1050 and VLAN 1060 for the ISP network. Add the Tagged port 1/0/1 and Untagged port 1/0/2 to VLAN 1050 and VLAN 1060.
- Go to L2 FEATURES > VLAN > VLAN VPN > VPN Config, enable VLAN VPN globally, set port 1/0/1 as the NNI port and port /1/0/2 as UNI port. Specify the TPID of port 1/0/1 as 9100.
- Go to L2 FEATURES > VLAN > VLAN VPN > VLAN Mapping, enable VLAN Mapping globally. Then configure VLAN mapping for the UNI port 1/0/2.
Configurations on Switch 3:
- Go to L2 FEATURES > VLAN > 802.1Q VLAN > VLAN Config to create VLAN 100 and VLAN 200 for the private network. Add the Untagged port 1/0/1 and Tagged port 1/0/3 to VLAN 100; add the Untagged port 1/0/2 and Tagged port 1/0/3 to VLAN 200.
- Go to L2 FEATURES > VLAN > 802.1Q VLAN > Port Config to set the PVID of port 1/0/1 as 100 and the PVID of port 1/0/2 to 200.
Configurations on Switch 2 and Switch 4:
The configurations on switch 2 are the same as that on switch 1, and the configurations on switch 4 are the same as that on switch 3.
Is this faq useful?
Your feedback helps improve this site.
What’s your concern with this article?
- Dissatisfied with product
- Too Complicated
- Confusing Title
- Does not apply to me
- Too Vague
- Other
Thank you
We appreciate your feedback.
Click here to contact TP-Link technical support
Recommend Products

TP-Link Community
Still need help? Search for answers, ask questions, and get help from TP-Link experts and other users around the world.
This website uses cookies to improve website navigation, analyze online activities and have the best possible user experience on our website. You can object to the use of cookies at any time. You can find more information in our privacy policy . Don’t show again
This website uses cookies to improve website navigation, analyze online activities and have the best possible user experience on our website. You can object to the use of cookies at any time. You can find more information in our privacy policy . Don’t show again
Basic Cookies
These cookies are necessary for the website to function and cannot be deactivated in your systems.
TP-Link
accepted_local_switcher, tp_privacy_base, tp_privacy_marketing, tp_smb-select-product_scence, tp_smb-select-product_scenceSimple, tp_smb-select-product_userChoice, tp_smb-select-product_userChoiceSimple, tp_smb-select-product_userInfo, tp_smb-select-product_userInfoSimple, tp_top-banner, tp_popup-bottom, tp_popup-center, tp_popup-right-middle, tp_popup-right-bottom, tp_productCategoryType
Livechat
__livechat, __lc2_cid, __lc2_cst, __lc_cid, __lc_cst, CASID
Youtube
id, VISITOR_INFO1_LIVE, LOGIN_INFO, SIDCC, SAPISID, APISID, SSID, SID, YSC, __Secure-1PSID, __Secure-1PAPISID, __Secure-1PSIDCC, __Secure-3PSID, __Secure-3PAPISID, __Secure-3PSIDCC, 1P_JAR, AEC, NID, OTZ
Analysis and Marketing Cookies
Analysis cookies enable us to analyze your activities on our website in order to improve and adapt the functionality of our website.
The marketing cookies can be set through our website by our advertising partners in order to create a profile of your interests and to show you relevant advertisements on other websites.
Google Analytics & Google Tag Manager
_gid, _ga_<container-id>, _ga, _gat_gtag_<container-id>
Google Ads & DoubleClick
test_cookie, _gcl_au
Meta Pixel
_fbp
Crazy Egg
cebsp_, _ce.s, _ce.clock_data, _ce.clock_event, cebs
lidc, AnalyticsSyncHistory, UserMatchHistory, bcookie, li_sugr, ln_or