Configure VLAN Tag Stripping

Follow this procedure to strip VLAN tags to support your traffic-analysis tools expected encapsulation type.

About this task

The VLAN tag is not inside the packet and must be stripped at the ingress device before the encapsulated packet is sent into the network. You can configure VLAN tag stripping so it is performed at ingress or egress.

Procedure

Enter the Config mode.
```
device(config)# 
```
Configure an ACL of type IPv4, IPv6, or MAC and any actions.
```
device(config)# ip access-list acl3-ipv4
device(config-ip-acl)# seq 12 permit ip any any count
```
The specified ACL and configured actions will be bound to a listener policy.

Create the listener policy, including any action sub-commands for the policy.

Note

A listener policy supports only one IPv4 ACL, IPv6 ACL, or MAC ACL.

device(config)# listener-policy lp-10 5
device(config-listener-policy)# match ip access-list acl3-ipv4
device(config-listener-policy)# strip vlan-tag
device(config-listener-policy)# description "ipv4 listener policy, strip vlan tag"

Configure an egress policy and bind the listener policy, specifying any additional egress actions.

Note
An egress can be associated with only one listener policy.
```
device(config-egress)# egress e3
device(config-egress)# set listener-policy lp-3
device(config-egress)# description DirectTool
device(config-egress)# precedence 1 interface ethernet 1/14
```

Configure an egress group and associate it with the egress policy.

device(config)# egress-group eg_5 
device(config-egress-group)# description e-group_5
device(config-egress-group)# set egress e3

Configure the route map and set any other parameters, such as forwarding actions, match ip access list, and the egress-group.

Note
A route-map policy supports only one match-ACL per layer.
```
device(config)# route-map R2 10 
device(config-route-map)# match ip access-list acl3-ipv4
device(config-route-map)# set egress-group eg_5
device(config-route-map)# forward-action permit
```
Configure an ingress group and associate a route map.

Note
An ingress group can be associated with only one route map.
```
device(config)# ingress-group TAP_TRAFFIC
device(config-ingress-group)# set route-map R2
```
Configure the interface port and channel for ingress traffic.
Note
In the following example, traffic is coming in on slot/port number 2/3.
```
interface ethernet 2/3
description From_TAP
ingress-group TAP_TRAFFIC
no shutdown
```
Configure the interface port and channel for egress traffic.
Note
In the following example, traffic is leaving on slot/port number 2/14.
```
interface ethernet 2/14
description To_Tool
no shutdown
```