Private VLANs

Private VLANs are used to isolate ports or groups of ports within the same primary VLAN/subnet. Shared resources like routers or servers are configured on promiscuous ports which can be reached by any member of a community or isolated private VLAN.

Topology subnet 192.168.100.0/24

This is the configuration for SW1 where VLAN 100 is the primary VLAN, 101 is an isolated VLAN which can only communicate with promiscuous ports and 102 is a community VLAN that where hosts in the same secondary VLAN can communicate with each other and promiscuous ports.

vlan 100
  private-vlan primary
  private-vlan association 101-102
!
vlan 101
  private-vlan isolated
!
vlan 102
  private-vlan community

Interface E0/0 configuration. This is attached to the router.

interface Ethernet0/0
description ROUTER
switchport private-vlan mapping 100 101-102
switchport mode private-vlan promiscuous

Interfaces E1/0 and E1/1 belong to community VLAN 102

interface Ethernet1/0
switchport private-vlan host-association 100 102
switchport mode private-vlan host
!
interface Ethernet1/1
switchport private-vlan host-association 100 102
switchport mode private-vlan host

Interface E1/2 belongs to isolated VLAN 101

interface Ethernet1/2
description ISOLATED
switchport private-vlan host-association 100 101
switchport mode private-vlan host

With this configuration, VPC3 and VPC4 can ping each other along with the router. They cannot ping VPC5.

VPC5 can ping the router only.

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.