Q-in-Q tunneling with L2 swap-push/pop-swap configuration and DHCP security

You can configure Q-in-Q tunneling with L2 swap-push/pop-swap in which the customer VLAN (C-VLAN) tag is swapped with the inner-vlan-id tag, and the service-provider-defined service VLAN (S-VLAN) tag is pushed on it (for traffic flowing from customer to service provider site). 

For the traffic flowing from the service provider network to the customer network, we've removed the S-VLAN tag, and replaced the C-VLAN tag with the VLAN ID configured on the UNI logical interface. To support DHCP security along with Q-in-Q tunneling, you can configure the following 

DHCP security features: 

•  DHCP snooping (DHCPv4 and DHCPv6) 
•  Dynamic ARP inspection 
•  Neighbor discovery inspection 
•  IP source guard 
•  DHCP option 82 and DHCPv6 option 37