The SAP encapsulation definition on Ethernet ingress ports defines which VLAN tags are used to determine the service that the packet belongs:
Null encapsulation defined on ingress
Any VLAN tags are ignored and the packet goes to a default service for the SAP.
Dot1q encapsulation defined on ingress
Only first VLAN tag is considered.
QinQ encapsulation defined on ingress
Both VLAN tags are considered.
Note that the SAP can be defined with a wild-card for the inner label (for example, ‟100.*”). In this situation all packets with an outer label of 100 will be treated as belonging to the SAP. If, on the same physical link, there is also a SAP defined with a QinQ encapsulation of 100.1, then traffic with 100.1 will go to that SAP and all other traffic with 100 as the first label will go to the SAP with the *100.* definition.
In situations 2 and 3, traffic encapsulated with tags for which there is no definition are discarded.