A private VLAN allows conservation of IP and VLANs via L2 separation within a VLAN. It allows web hosts and ISPs to segregate or group devices whilst conserving IP addressing. PVLANs restrict communication between ports and allow communication with promiscuous port. Think VLAN inside a VLAN!
- Primary PVLAN can be composed of many secondary PVLANs. The secondary PVLANs belong to the same subnet as the Primary PVLAN. The primary VLAN has the task of also carrying data from the promiscuous port to the isolated, community, and other promiscuous ports in the same primary PVLAN.
- A child PVLAN to the primary PVLAN, a secondary PVLAN is mapped to a single primary PLVAN. Secondary PVLAN are what hosts attach to.
Types of Secondary PVLANs
- Community PVLANS
- Ports can communicate with other community members and the promiscuous port of the primary PVLAN
- Isolated Private VLAN
- Ports can only communicate with the promiscuous ports only.
NOTE: Promiscuous ports only service and work with one primary PVLAN. A promiscuous port can service one isolated PVLAN or many community PVLANs
PVLAN Port types
- Isolated ports are completely separated at L2 from any other ports except those listed as promiscuous. These ports block all traffic to other isolated ports. Traffic is forward to promiscuous ports only
- Servers, Hosts (Think web-hosting!)
- These ports communicated with all ports within a PVLAN including community and isolated ports. Promiscuous ports are apart of one primary PVLAN and each promiscuous port can map themselves to multiple secondary PVLANS.
- Routers, Shared Servers, SVIs, Routed Switch ports
- These ports communicate amongst themselves and their promiscuous ports. L2 communities are isolated from other communities and isolated ports within their PVLAN.
- Servers, Server Farms
Configuration of Private VLANs
The objective of this exercise is meet the requirements of a webhosting company. They have employed you to configure the following PVLAN setup for their tenants.
First of all we define the PVLAN Type. This allows us to assign which VLAN will be a primary, community or isolated PVLAN
vlan 50private-vlan primaryvlan 51private-vlan communityvlan 52private-vlan isolatedvlan 50private-vlan association 51,52
int gi0/10switchport mode private-vlan hostswitchport private-vlan host-association 50 51int gi0/11switchport mode private-vlan hostswitchport private-vlan host-association 50 51int gi0/12switchport mode private-vlan hostswitchport private-vlan host-association 50 52int gi0/13switchport mode private-vlan hostswitchport private-vlan host-association 50 52int gi0/15switchport mode private-vlan promiscuousswitchport private-vlan mapping 50 add 51,52
show vlan private-vlan typeVlan Type---- -----------------50 primary51 community52 isolatedshow vlan private-vlanPrimary Secondary Type Ports------- --------- ----------------- ------------------------------------------50 51 community Gi0/10, Gi0/11, Gi0/1550 52 isolated Gi0/12, Gi0/13, Gi0/15
Easy enough. I was always daunted by this topic but now after labbing it I have found it to be quite nice and easy. Also remember that this is a 3560 series and higher technology. Sorry 3550!