Information About Configuring PVLAN over OTV
The private VLAN (PVLAN) partitions the Layer 2 Ethernet broadcast domain of a VLAN into subdomains, allowing you to isolate the ports on the switch from each other. A subdomain consists of a primary VLAN and one or more secondary VLANs (see the following figure). All VLANs in a PVLAN domain share the same primary VLAN. For more information about PVLANs, see Configuring Private VLANs Using NX-OS chapter in Cisco Nexus 7000 Series NX-OS Layer 2 Switching Configuration Guide.
Beginning from Release 8.2(1), Cisco Nexus 7000 Series Switches support Private VLAN (PVLAN) extended over the OTV overlay. The transmission occurs in a Layer2 frame attached to a Layer 3 header. Over the OTV overlay, this feature allows two VLANs to communicate based on the PVLAN association.
PVLAN provides L2 port isolation by breaking a VLAN up into sub-domains. Primary VLAN or uplink can communicate with all the Secondary VLANs in its domain. Secondary VLANs communicates to an uplink Primary (P) VLAN and then the communication between secondary VLANs themselves can be isolate or community configurations as follows:
-
Isolated (I)-they only communicate with the uplink and do not communicate with other hosts on the same 2nd VLAN.
-
Community (C)-ports on this VLAN can talk among themselves and the uplink.
After the OTV is configured, and PVLAN primary and secondary VLANs are configured, OTV will receive a message from the VLAN manager that describe these PVLAN configurations.
In a multi-homing configuration, OTV will split the VLANs as odd and even between the two edge devices. In the route look-up table, the VLAN of the MAC from the secondary VLAN is the primary VLAN ID.
In OTV ARP cache the MAC is associated with the original VLAN ID, and therefore OTV is aware of the VLAN type. Based on the VLAN type, OTV decides whether an ARP request should be responded.
For example:
-
If an ARP request is coming from an isolated VLAN, OTV will only response if the MAC is found in its primary VLAN.
-
If an ARP request is coming from a community VLAN, OTV will only response if the MAC is found on that community VLAN ID and its primary VLAN.
-
If an ARP request is coming from a primary VLAN ID, OTV will response if the MAC is found on the primary VLAN ID all its secondary VLANs.