The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
The following sections provide information about configuring Private VLANs:
Private VLANs are supported in:
Tansparent mode for VTP 1, 2 and 3.
Server mode with VTP 3.
 Note |
In some cases, the configuration is accepted with no error messages, but the commands have no effect. |
Do not configure fallback bridging on the device with private VLANs.
Do not configure a remote SPAN (RSPAN) VLAN as a primary or a secondary VLAN of a private-VLAN.
Do not configure private VLAN ports on interfaces configured for these other features:
Dynamic-access port VLAN membership
Dynamic Trunking Protocol (DTP)
IP Source Guard
IPv6 First Hop Security (FHS)
IPv6 Security Group (SG)
Multicast VLAN Registration (MVR)
Voice VLAN
Web Cache Communication Protocol (WCCP)
Port Aggregation Protocol (PAgP) and Link Aggregation Control Protocol (LACP) are supported only for Private VLAN promiscuous trunk ports and Private VLAN isolated trunk ports.
You can configure IEEE 802.1x port-based authentication on a private-VLAN port, but do not configure 802.1x with port security, voice VLAN, or per-user ACL on private-VLAN ports.
A private-VLAN host or promiscuous port cannot be a SPAN destination port. If you configure a SPAN destination port as a private-VLAN port, the port becomes inactive.
If you configure a static MAC address on a promiscuous port in the primary VLAN, you need not add the same static address to all associated secondary VLANs. Similarly, if you configure a static MAC address on a host port in a secondary VLAN, you need not add the same static MAC address to the associated primary VLAN. Also, when you delete a static MAC address from a private-VLAN port, you do not have to remove all instances of the configured MAC address from the private VLAN.
Note |
Dynamic MAC addresses learned in the secondary VLAN of a private VLAN are replicated to the primary VLANs. All MAC entries are learnt on secondary VLANs, even if the traffic ingresses from primary VLAN. If a MAC address is dynamically learnt in the primary VLAN, it is not replicated in the associated secondary VLANs. |
Configure Layer 3 VLAN interfaces (switch value interfaces) only for primary VLANs.
Private VLAN configured with MACsec or Virtual Private LAN Services (VPLS) or Cisco Software-Defined Access solution on the same VLAN does not work.
The following sections provide information about Private VLANs:
The private VLAN feature addresses two problems that service providers face when using VLANs:
When running the Network Essentials or Network Advantage license, the device supports up to 4094 active VLANs. If a service provider assigns one VLAN per customer, this limits the numbers of customers the service provider can support.
To enable IP routing, each VLAN is assigned a subnet address space or a block of addresses, which can result in wasting the unused IP addresses, and cause IP address management problems.
There are two types of secondary VLANs:
Isolated VLANs—Ports within an isolated VLAN cannot communicate with each other at the Layer 2 level.
Community VLANs—Ports within a community VLAN can communicate with each other but cannot communicate with ports in other communities at the Layer 2 level.
Private VLANs provide Layer 2 isolation between ports within the same private VLAN. Private VLAN ports are access ports that are one of these types:
Promiscuous—A promiscuous port belongs to the primary VLAN and can communicate with all interfaces, including the community and isolated host ports that belong to the secondary VLANs associated with the primary VLAN.
Isolated—An isolated port is a host port that belongs to an isolated secondary VLAN. It has complete Layer 2 separation from other ports within the same private VLAN, except for the promiscuous ports. Private VLANs block all traffic to isolated ports except traffic from promiscuous ports. Traffic received from an isolated port is forwarded only to promiscuous ports.
Community—A community port is a host port that belongs to a community secondary VLAN. Community ports communicate with other ports in the same community VLAN and with promiscuous ports. These interfaces are isolated at Layer 2 from all other interfaces in other communities and from isolated ports within their private VLAN.
Note |
Trunk ports carry traffic from regular VLANs and also from primary, isolated, and community VLANs. |
Primary and secondary VLANs have these characteristics:
Primary VLAN—A private VLAN has only one primary VLAN. Every port in a private VLAN is a member of the primary VLAN. The primary VLAN carries unidirectional traffic downstream from the promiscuous ports to the (isolated and community) host ports and to other promiscuous ports.
Isolated VLAN —A private VLAN has only one isolated VLAN. An isolated VLAN is a secondary VLAN that carries unidirectional traffic upstream from the hosts toward the promiscuous ports and the gateway.
Community VLAN—A community VLAN is a secondary VLAN that carries upstream traffic from the community ports to the promiscuous port gateways and to other host ports in the same community. You can configure multiple community VLANs in a private VLAN.
A promiscuous port can serve only one primary VLAN, one isolated VLAN, and multiple community VLANs. Layer 3 gateways are typically connected to the device through a promiscuous port. With a promiscuous port, you can connect a wide range of devices as access points to a private VLAN. For example, you can use a promiscuous port to monitor or back up all the private VLAN servers from an administration workstation.
In a switched environment, you can assign an individual private VLAN and associated IP subnet to each individual or common group of end stations. The end stations need to communicate only with a default gateway to communicate outside the private VLAN.
You can use private VLANs to control access to end stations in these ways:
Configure selected interfaces connected to end stations as isolated ports to prevent any communication at Layer 2. For example, if the end stations are servers, this configuration prevents Layer 2 communication between the servers.
Configure interfaces connected to default gateways and selected end stations (for example, backup servers) as promiscuous ports to allow all end stations access to a default gateway.
You can extend private VLANs across multiple devices by trunking the primary, isolated, and community VLANs to other devices that support private VLANs. To maintain the security of your private VLAN configuration and to avoid other use of the VLANs configured as private VLANs, configure private VLANs on all intermediate devices, including devices that have no private VLAN ports.
Assigning a separate VLAN to each customer creates an inefficient IP addressing scheme:
Assigning a block of addresses to a customer VLAN can result in unused IP addresses.
If the number of devices in the VLAN increases, the number of assigned address might not be large enough to accommodate them.
These problems are reduced by using private VLANs, where all members in the private VLAN share a common address space, which is allocated to the primary VLAN. Hosts are connected to secondary VLANs and the DHCP server assigns them IP addresses from the block of addresses allocated to the primary VLAN. Subsequent IP addresses can be assigned to customer devices in different secondary VLANs, but in the same primary VLAN. When new devices are added, the DHCP server assigns them the next available address from a large pool of subnet addresses.
The following sections provide information about Private-VLAN interaction with other features:
In regular VLANs, devices in the same VLAN can communicate with each other at the Layer 2 level, but devices connected to interfaces in different VLANs must communicate at the Layer 3 level. In private VLANs, the promiscuous ports are members of the primary VLAN, while the host ports belong to secondary VLANs. Because the secondary VLAN is associated with the primary VLAN, members of the these VLANs can communicate with each other at the Layer 2 level.
In a regular VLAN, broadcasts are forwarded to all ports in that VLAN. Private VLAN broadcast forwarding depends on the port sending the broadcast:
An isolated port sends a broadcast only to the promiscuous ports or trunk ports.
A community port sends a broadcast to all promiscuous ports, trunk ports, and ports in the same community VLAN.
A promiscuous port sends a broadcast to all ports in the private VLAN (other promiscuous ports, trunk ports, isolated ports, and community ports).
Multicast traffic is routed or bridged across private VLAN boundaries and within a single community VLAN. Multicast traffic is not forwarded between ports in the same isolated VLAN or between ports in different secondary VLANs.
Private VLAN multicast forwarding supports the following:
Sender can be outside the VLAN and the Receivers can be inside the VLAN domain.
Sender can be inside the VLAN and the Receivers can be outside the VLAN domain.
Sender and Receiver can both be in the same community VLAN.
A switch virtual interface (SVI) represents the Layer 3 interface of a VLAN. Layer 3 devices communicate with a private VLAN only through the primary VLAN and not through secondary VLANs. Configure Layer 3 VLAN interfaces (SVIs) only for primary VLANs. You cannot configure Layer 3 VLAN interfaces for secondary VLANs. SVIs for secondary VLANs are inactive while the VLAN is configured as a secondary VLAN.
If you try to configure a VLAN with an active SVI as a secondary VLAN, the configuration is not allowed until you disable the SVI.
If you try to create an SVI on a VLAN that is configured as a secondary VLAN and the secondary VLAN is already mapped at Layer 3, the SVI is not created, and an error is returned. If the SVI is not mapped at Layer 3, the SVI is created, but it is automatically shut down.
When the primary VLAN is associated with and mapped to the secondary VLAN, any configuration on the primary VLAN is propagated to the secondary VLAN SVIs. For example, if you assign an IP subnet to the primary VLAN SVI, this subnet is the IP subnet address of the entire private VLAN.
The MAC addresses learnt in the secondary VLAN are replicated to the primary VLAN and not vice-versa. This saves the hardware l2 cam space. The primary VLAN is always used for forwarding lookups in both directions.
Dynamic MAC addresses learned in Primary VLAN of a private VLAN are then, if required, replicated in the secondary VLANs. For example, if a MAC-address is dynamically received on the secondary VLAN, it will be learnt as part of primary VLAN. In case of isolated VLANs, a blocked entry for the same mac will be added to secondary VLAN in the mac address table. So, MAC learnt on host ports in secondary domain are installed as blocked type entries. All mac entries are learnt on secondary VLANs, even if the traffic ingresses from primary VLAN.
However, if a MAC-address is dynamically learnt in the primary VLAN it will not get replicated in the associated secondary VLANS.
Users are not required to replicate the Static MAC Address CLI for private VLAN hosts as compare to legacy model.
Example:
In the legacy model, if the user configures a static MAC address, they need to add the same static MAC address in the associated VLAN too. For example, if MAC address A is user configured on port 1/0/1 in VLAN 101, where VLAN 101 is a secondary VLAN and VLAN 100 is a primary VLAN, then the user has to configure
mac-address static A vlan 101 interface G1/0/1
mac-address static A vlan 100 interface G1/0/1In this device, the user does not need to replicate the mac address to the associated VLAN. For the above example, user has to configure only
mac-address static A vlan 101 interface G1/0/1 Private VLANs are bidirectional in case of this device, as compared to “Unidirectional” in other platforms.
After layer-2 forward lookup, proper egress VLAN mapping happens and all the egress VLAN based feature processing happens in the egress VLAN context.
When a frame in Layer-2 is forwarded within a private VLAN, the VLAN map is applied at the ingress side and at the egress side. When a frame is routed from inside a private VLAN to an external port, the private-VLAN map is applied at the ingress side. Similarly, when the frame is routed from an external port to a Private VLAN, the private-VLAN is applied at the egress side. This is applicable to both bridged and routed traffic.
Bridging:
For upstream traffic from secondary VLAN to primary VLAN, the MAP of the secondary VLAN is applied on the ingress side and the MAP of the primary VLAN is applied on the egress side.
For downstream traffic from primary VLAN to secondary VLAN, the MAP of the primary VLAN is applied in the ingress direction and the MAP of the secondary VLAN is applied in the egress direction.
Routing
If we have two private VLAN domains - PV1 (sec1, prim1) and PV2 (sec2, prim2). For frames routed from PV1 to PV2:
The MAP of sec1 and L3 ACL of prim1 is applied in the ingress port.
The MAP of sec2 and L3 ACL of prim2 is applied in the egress port.
For packets going upstream or downstream from isolated host port to promiscuous port, the isolated VLAN’s VACL is applied in the ingress direction and primary VLAN’s VACL is applied in the egress direction. This allows user to configure different VACL for different secondary VLAN in a same primary VLAN domain.
Note |
2-way community VLAN is now not required as the private VLANs on this device are always bi-directional. |
PVLAN will work seamlessly with High Availability (HA) feature. The Private VLAN existing on the active switch before changeover should be the same after changeover (new active switch should have similar PVLAN configuration both on IOS side and FED side as that of the old active switch).
The following sections provide information about Private-VLAN configuration guidelines:
No private VLANs are configured.
Follow these guidelines when configuring private VLANs:
Private VLANs are supported in transparent mode for VTP 1, 2 and 3. If the device is running VTP version 1 or 2, you must set VTP to transparent mode. After you configure a private VLAN, you should not change the VTP mode to client or server. VTP version 3 supports private VLANs in all modes.
With VTP version 1 or 2, after you have configured private VLANs, use the copy running-config startup config privileged EXEC command to save the VTP transparent mode configuration and private-VLAN configuration in the device startup configuration file. Otherwise, if the device resets, it defaults to VTP server mode, which does not support private VLANs. VTP version 3 does support private VLANs.
VTP version 1 and 2 do not propagate private-VLAN configuration. You must configure private VLANs on each device where you want private-VLAN ports unless the devices are running VTP version 3, as VTP3 propagate private vlans.
You cannot configure VLAN 1 or VLANs 1002 to 1005 as primary or secondary VLANs. Extended VLANs (VLAN IDs 1006 to 4094) can belong to private VLANs.
A primary VLAN can have one isolated VLAN and multiple community VLANs associated with it. An isolated or community VLAN can have only one primary VLAN associated with it.
Although a private VLAN contains more than one VLAN, only one Spanning Tree Protocol (STP) instance runs for the entire private VLAN. When a secondary VLAN is associated with the primary VLAN, the STP parameters of the primary VLAN are propagated to the secondary VLAN.
When copying a PVLAN configuration from a tftp server and applying it on a running-config, the PVLAN association will not be formed. You will need to check and ensure that the primary VLAN is associated to all the secondary VLANs.
You can also use configure replace flash:config_file force instead of copy flash:config_file running-config .
You can enable DHCP snooping on private VLANs. When you enable DHCP snooping on the primary VLAN, it is propagated to the secondary VLANs. If you configure DHCP on a secondary VLAN, the configuration does not take effect if the primary VLAN is already configured.
When you enable IP source guard on private-VLAN ports, you must enable DHCP snooping on the primary VLAN.
We recommend that you prune the private VLANs from the trunks on devices that carry no traffic in the private VLANs.
You can apply different quality of service (QoS) configurations to primary, isolated, and community VLANs.
Note the following considerations for sticky ARP:
Sticky ARP entries are those learned on SVIs and Layer 3 interfaces. These entries do not age out.
The ip sticky-arp global configuration command is supported only on SVIs belonging to private VLANs.
The ip sticky-arp interface configuration command is only supported on:
Layer 3 interfaces
SVIs belonging to normal VLANs
SVIs belonging to private VLANs
For more information about using the ip sticky-arp global configuration and the ip sticky-arp interface configuration commands, see the command reference for this release.
You can configure VLAN maps on primary and secondary VLANs. However, we recommend that you configure the same VLAN maps on private-VLAN primary and secondary VLANs.
PVLANs are bidirectional. They can be applied at both the ingress and egress sides.
When a frame inLayer-2 is forwarded within a private VLAN, the VLAN map is applied at the ingress side and at the egress side. When a frame is routed from inside a private VLAN to an external port, the private-VLAN map is applied at the ingress side. Similarly, when the frame is routed from an external port to a Private VLAN, the private-VLAN is applied at the egress side.
Bridging
For upstream traffic from secondary VLAN to primary VLAN, the MAP of the secondary VLAN is applied on the ingress side and the MAP of the primary VLAN is applied on the egress side.
For downstream traffic from primary VLAN to secondary VLAN, the MAP of the primary VLAN is applied in the ingress direction and the MAP of the secondary VLAN is applied in the egress direction.
Routing
If we have two private VLAN domains - PV1 (sec1, prim1) and PV2 (sec2, prim2). For frames routed from PV1 to PV2:
The MAP of sec1 and L3 ACL of prim1 is applied in the ingress port .
The MAP of sec1 and L3 ACL of prim2 is applied in the egress port.
For packets going upstream or downstream from isolated host port to promiscuous port, the isolated VLAN’s VACL is applied in the ingress direction and primary VLAN’S VACL is applied in the egress direction. This allows user to configure different VACL for different secondary VLAN in a same primary VLAN domain.
To filter out specific IP traffic for a private VLAN, you should apply the VLAN map to both the primary and secondary VLANs.
You can apply router ACLs only on the primary-VLAN SVIs. The ACL is applied to both primary and secondary VLAN Layer 3 traffic.
Although private VLANs provide host isolation at Layer 2, hosts can communicate with each other at Layer 3.
Private VLANs support these Switched Port Analyzer (SPAN) features:
You can configure a private-VLAN port as a SPAN source port.
You can use VLAN-based SPAN (VSPAN) on primary, isolated, and community VLANs or use SPAN on only one VLAN to separately monitor egress or ingress traffic.
Follow these guidelines when configuring private VLAN ports:
Use only the private VLAN configuration commands to assign ports to primary, isolated, or community VLANs. Layer 2 access ports assigned to the VLANs that you configure as primary, isolated, or community VLANs are inactive while the VLAN is part of the private VLAN configuration. Layer 2 trunk interfaces remain in the STP forwarding state.
Do not configure ports that belong to a PAgP or LACP EtherChannel as private VLAN ports. While a port is part of the private VLAN configuration, any EtherChannel configuration for it is inactive.
Enable Port Fast and BPDU guard on isolated and community host ports to prevent STP loops due to misconfigurations and to speed up STP convergence. When enabled, STP applies the BPDU guard feature to all Port Fast-configured Layer 2 LAN ports. Do not enable Port Fast and BPDU guard on promiscuous ports.
If you delete a VLAN used in the private VLAN configuration, the private VLAN ports associated with the VLAN become inactive.
Private VLAN ports can be on different network devices if the devices are trunk-connected and the primary and secondary VLANs have not been removed from the trunk.
The following sections provide information about configuring Private VLANs:
To configure a private VLAN, perform these steps:
Note |
Private vlans are supported in transparent mode for VTP 1, 2 and 3. Private VLANS are also supported on server mode with VTP 3. |
|
Step 1 |
Set VTP mode to transparent
|
||
|
Step 2 |
Create the primary and secondary VLANs and associate them.
|
||
|
Step 3 |
Configure interfaces to be isolated or community host ports, and assign VLAN membership to the host port. |
||
|
Step 4 |
Configure interfaces as promiscuous ports, and map the promiscuous ports to the primary-secondary VLAN pair. |
||
|
Step 5 |
If inter-VLAN routing will be used, configure the primary SVI, and map secondary VLANs to the primary. |
||
|
Step 6 |
Verify private-VLAN configuration. |
The private-vlan commands do not take effect until you exit VLAN configuration mode.
To configure and associate VLANs in a Private VLAN, perform these steps:
| Command or Action | Purpose | |||
|---|---|---|---|---|
|
Step 1 |
enable Example: |
Enables privileged EXEC mode. Enter your password if prompted. |
||
|
Step 2 |
configure terminal Example: |
Enters global configuration mode. |
||
|
Step 3 |
vtp mode transparent Example: |
Sets VTP mode to transparent (disable VTP).
|
||
|
Step 4 |
vlan vlan-id Example: |
Enters VLAN configuration mode and designates or creates a VLAN that will be the primary VLAN. The VLAN ID range is 2 to 1001 and 1006 to 4094. |
||
|
Step 5 |
private-vlan primary Example: |
Designates the VLAN as the primary VLAN. |
||
|
Step 6 |
exit Example: |
Returns to global configuration mode. |
||
|
Step 7 |
vlan vlan-id Example: |
(Optional) Enters VLAN configuration mode and designates or creates a VLAN that will be an isolated VLAN. The VLAN ID range is 2 to 1001 and 1006 to 4094. |
||
|
Step 8 |
private-vlan isolated Example: |
Designates the VLAN as an isolated VLAN. |
||
|
Step 9 |
exit Example: |
Returns to global configuration mode. |
||
|
Step 10 |
vlan vlan-id Example: |
(Optional) Enters VLAN configuration mode and designates or creates a VLAN that will be a community VLAN. The VLAN ID range is 2 to 1001 and 1006 to 4094. |
||
|
Step 11 |
private-vlan community Example: |
Designates the VLAN as a community VLAN. |
||
|
Step 12 |
exit Example: |
Returns to global configuration mode. |
||
|
Step 13 |
vlan vlan-id Example: |
(Optional) Enters VLAN configuration mode and designates or creates a VLAN that will be a community VLAN. The VLAN ID range is 2 to 1001 and 1006 to 4094. |
||
|
Step 14 |
private-vlan community Example: |
Designates the VLAN as a community VLAN. |
||
|
Step 15 |
exit Example: |
Returns to global configuration mode. |
||
|
Step 16 |
vlan vlan-id Example: |
Enters VLAN configuration mode for the primary VLAN designated in Step 4. |
||
|
Step 17 |
private-vlan association [add | remove] secondary_vlan_list Example: |
Associates the secondary VLANs with the primary VLAN. It can be a single private-VLAN ID or a hyphenated range of private-VLAN IDs.
|
||
|
Step 18 |
end Example: |
Returns to privileged EXEC mode. |
||
|
Step 19 |
show vlan private-vlan [type] or show interfaces status Example: |
Verifies the configuration. |
||
|
Step 20 |
copy running-config startup config Example: |
Saves your entries in the device startup configuration file. |
Follow these steps to configure a Layer 2 interface as a private-VLAN host port and to associate it with primary and secondary VLANs:
Note |
Isolated and community VLANs are both secondary VLANs. |
| Command or Action | Purpose | |||
|---|---|---|---|---|
|
Step 1 |
enable Example: |
Enables privileged EXEC mode. Enter your password if prompted. |
||
|
Step 2 |
configure terminal Example: |
Enters global configuration mode. |
||
|
Step 3 |
interface interface-id Example: |
Enters interface configuration mode for the Layer 2 interface to be configured. |
||
|
Step 4 |
switchport mode private-vlan host Example: |
Configures the Layer 2 port as a private-VLAN host port. |
||
|
Step 5 |
switchport private-vlan host-association primary_vlan_id secondary_vlan_id Example: |
Associates the Layer 2 port with a private VLAN.
|
||
|
Step 6 |
end Example: |
Returns to privileged EXEC mode. |
||
|
Step 7 |
show interfaces [interface-id] switchport Example: |
Verifies the configuration. |
||
|
Step 8 |
copy running-config startup-config Example: |
(Optional) Saves your entries in the configuration file. |
Follow these steps to configure a Layer 2 interface as a private VLAN promiscuous port and map it to primary and secondary VLANs:
Note |
Isolated and community VLANs are both secondary VLANs. |
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
enable Example: |
Enables privileged EXEC mode. Enter your password if prompted. |
|
Step 2 |
configure terminal Example: |
Enters global configuration mode. |
|
Step 3 |
interface interface-id Example: |
Enters interface configuration mode for the Layer 2 interface to be configured. |
|
Step 4 |
switchport mode private-vlan promiscuous Example: |
Configures the Layer 2 port as a private VLAN promiscuous port. |
|
Step 5 |
switchport private-vlan mapping primary_vlan_id {add | remove} secondary_vlan_list Example: |
Maps the private VLAN promiscuous port to a primary VLAN and to selected secondary VLANs.
|
|
Step 6 |
end Example: |
Returns to privileged EXEC mode. |
|
Step 7 |
show interfaces [interface-id] switchport Example: |
Verifies the configuration. |
|
Step 8 |
copy running-config startup config Example: |
Saves your entries in the device startup configuration file. |
To configure a Layer 2 interface as an isolated PVLAN trunk port, perform this task:
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure terminal Example: |
Enters global configuration mode. |
|
Step 2 |
interface interface-id Example: |
Enters interface configuration mode for the Layer 2 interface to be configured. |
|
Step 3 |
switchport mode private-vlan { host | promiscuous | trunk promiscuous | trunk [secondary]} Example: |
Configures the Layer 2 interface as an isolated private VLAN trunk port. |
|
Step 4 |
switchport private-vlan association trunk primary_vlan_id secondary_vlan_id Example: |
Maps the private VLAN trunk port to a primary VLAN and to the selected secondary VLAN. |
|
Step 5 |
switchport private-vlan trunk allowed vlan { word | add |all | except |none | remove } vlan_list Example: |
Configures a list of allowed VLANs on a PVLAN trunk port. The list must include primary VLANs. In addition, normal VLANs can be configured as well. You can use the no keyword to remove all allowed VLANs on a PVLAN trunk port. |
|
Step 6 |
switchport private-vlan trunk native vlan vlan_id Example: |
Configures a VLAN to which untagged packets (as in IEEE 802.1Q tagging) are assigned on a PVLAN trunk port. You can use the no keyword to remove native VLAN configuration on an isolated PVLAN trunk port. The native VLAN is then set to default VLAN1. |
|
Step 7 |
end Example: |
Returns to privileged EXEC mode. |
|
Step 8 |
show interfaces [interface-id] switchport Example: |
Verifies the configuration. |
|
Step 9 |
copy running-config startup config Example: |
Saves your entries in the device startup configuration file. |
To configure a Layer 2 interface as a promiscuous private VLAN trunk port, perform this task:
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure terminal Example: |
Enters global configuration mode. |
|
Step 2 |
interface interface-id Example: |
Enters interface configuration mode for the Layer 2 interface to be configured. |
|
Step 3 |
switchport mode private-vlan { host | promiscuous | trunk promiscuous | trunk [secondary]} Example: |
Configures the Layer 2 port as a promiscuous private VLAN trunk port. |
|
Step 4 |
switchport private-vlan mapping trunk primary_vlan_id [add | remove] secondary_vlan_list Example: |
Maps the promiscuous private VLAN trunk port to a primary VLAN and to selected secondary VLANs.
|
|
Step 5 |
switchport private-vlan trunk allowed vlan { word | add |all | except |none | remove } vlan_list Example: |
Configures a list of allowed VLANs on a PVLAN trunk port. The list must include primary VLANs. In addition, normal VLANs can be configured as well. You can use the no keyword to remove all allowed VLANs on a PVLAN promiscuous trunk port. |
|
Step 6 |
switchport private-vlan trunk native vlan vlan_id Example: |
Configures a VLAN to which untagged packets (as in IEEE 802.1Q tagging) are assigned on a PVLAN trunk port. You can use the no keyword to remove native VLAN configuration on a PVLAN promiscuous trunk port. The native VLAN is then set to default VLAN1. |
|
Step 7 |
end Example: |
Returns to privileged EXEC mode. |
|
Step 8 |
show interfaces [interface-id] switchport Example: |
Verifies the configuration. |
|
Step 9 |
copy running-config startup config Example: |
Saves your entries in the device startup configuration file. |
To configure a Layer 2 interface as an isolated private VLAN trunk port on a portchannel, perform this task:
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure terminal Example: |
Enters global configuration mode. |
|
Step 2 |
interface interface range Example: |
Enters interface configuration mode for the Layer 2 interface range to be configured. |
|
Step 3 |
switchport mode private-vlan { host | promiscuous | trunk promiscuous | trunk [secondary]} Example: |
Configures the Layer 2 interface range as a private VLAN isolated trunk port. |
|
Step 4 |
switchport private-vlan association trunk primary_vlan_id secondary_vlan_id Example: |
Maps the private VLAN trunk port to a primary VLAN and to the selected secondary VLAN. |
|
Step 5 |
switchport private-vlan trunk allowed vlan { word | add |all | except |none | remove } vlan_list Example: |
Configures a list of allowed VLANs on a PVLAN trunk port. The list must include primary VLANs. In addition, normal VLANs can be configured as well. You can use the no keyword to remove all allowed VLANs on an isolated private VLAN trunk port. |
|
Step 6 |
channel-group channel group number mode { active | auto | desirable | on | passive } Example: |
Configures the port in a channel group and sets the mode. The channel-number range is from 1 to 128. The port channel associated with this channel group is automatically created if the port channel does not already exist. |
|
Step 7 |
end Example: |
Returns to privileged EXEC mode. |
|
Step 8 |
show etherchannel summary Example: |
Verifies the configuration. |
|
Step 9 |
copy running-config startup config Example: |
Saves your entries in the device startup configuration file. |
To configure a Layer 2 interface as a promiscuous private VLAN trunk port on a portchannel, perform this task:
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure terminal Example: |
Enters global configuration mode. |
|
Step 2 |
interface interface range Example: |
Enters interface configuration mode for the Layer 2 interface range to be configured. |
|
Step 3 |
switchport mode private-vlan { host | promiscuous | trunk promiscuous | trunk [secondary]} Example: |
Configures the Layer 2 ports as private VLAN promiscuous trunk port. |
|
Step 4 |
switchport private-vlan mapping trunk primary_vlan_id [add | remove] secondary_vlan_list Example: |
Maps the private VLAN promiscuous trunk port to a primary VLAN and to selected secondary VLANs.
|
|
Step 5 |
switchport private-vlan trunk allowed vlan { word | add |all | except |none | remove } vlan_list Example: |
Configures a list of allowed VLANs on a PVLAN trunk port. The list must include primary VLANs. In addition, normal VLANs can be configured as well. You can use the no keyword to remove all allowed VLANs on a promiscuous private VLAN trunk port. |
|
Step 6 |
channel-group channel group number mode { active | auto | desirable | on | passive } Example: |
Configures the port in a channel group and sets the mode. The channel-number range is from 1 to 128. The port channel associated with this channel group is automatically created if the port channel does not already exist. |
|
Step 7 |
end Example: |
Returns to privileged EXEC mode. |
|
Step 8 |
show etherchannel summary Example: |
Verifies the configuration. |
|
Step 9 |
copy running-config startup config Example: |
Saves your entries in the device startup configuration file. |
If the private VLAN will be used for inter-VLAN routing, you configure an SVI for the primary VLAN and map secondary VLANs to the SVI.
Note |
Isolated and community VLANs are both secondary VLANs. |
Follow these steps to map secondary VLANs to the SVI of a primary VLAN to allow Layer 3 switching of private VLAN traffic:
| Command or Action | Purpose | |||
|---|---|---|---|---|
|
Step 1 |
enable Example: |
Enables privileged EXEC mode. Enter your password if prompted. |
||
|
Step 2 |
configure terminal Example: |
Enters global configuration mode. |
||
|
Step 3 |
interface vlan primary_vlan_id Example: |
Enters interface configuration mode for the primary VLAN, and configures the VLAN as an SVI. The VLAN ID range is 2 to 1001 and 1006 to 4094. |
||
|
Step 4 |
private-vlan mapping [add | remove] secondary_vlan_list Example: |
Maps the secondary VLANs to the Layer 3 VLAN interface of a primary VLAN to allow Layer 3 switching of private VLAN ingress traffic.
|
||
|
Step 5 |
end Example: |
Returns to privileged EXEC mode. |
||
|
Step 6 |
show interfaces private-vlan mapping Example: |
Verifies the configuration. |
||
|
Step 7 |
copy running-config startup config Example: |
Saves your entries in the device startup configuration file. |
The following table displays the commands used to monitor private VLANs.
|
Command |
Purpose |
|---|---|
|
show interfaces status |
Displays the status of interfaces, including the VLANs to which they belongs. |
|
show vlan private-vlan [type] |
|
|
show interface switchport |
Displays private VLAN configuration on interfaces. |
|
show interface private-vlan mapping |
Displays information about the private VLAN mapping for VLAN SVIs. |
The following sections provide information about configuring Private VLANs:
This example shows how to configure VLAN 20 as a primary VLAN, VLAN 501 as an isolated VLAN, and VLANs 502 and 503 as community VLANs, to associate them in a private VLAN, and to verify the configuration:
Device# configure terminal
Device(config)# vlan 20
Device(config-vlan)# private-vlan primary
Device(config-vlan)# exit
Device(config)# vlan 501
Device(config-vlan)# private-vlan isolated
Device(config-vlan)# exit
Device(config)# vlan 502
Device(config-vlan)# private-vlan community
Device(config-vlan)# exit
Device(config)# vlan 503
Device(config-vlan)# private-vlan community
Device(config-vlan)# exit
Device(config)# vlan 20
Device(config-vlan)# private-vlan association 501-503
Device(config-vlan)# end
Device# show vlan private-vlan
Primary Secondary Type
--------- -------------- -----------------
20 501 isolated
20 502 community
20 503 community
This example shows how to configure an interface as a private VLAN host port, associate it with a private VLAN pair, and verify the configuration:
Device# configure terminal
Device(config)# interface gigabitethernet 1/3
Device(config-if)# switchport mode private-vlan host
Device(config-if)# switchport private-vlan host-association 20 501
Device(config-if)# end
Device# show interfaces gigabitethernet 1/3 switchport
Name: Gi1/0/22
Switchport: Enabled
Administrative Mode: private-vlan host
Operational Mode: private-vlan host
Administrative Trunking Encapsulation: negotiate
Operational Trunking Encapsulation: native
Negotiation of Trunking: Off
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: none
Administrative private-vlan host-association: 20 501
Administrative private-vlan mapping: none
Administrative private-vlan trunk native VLAN: none
Administrative private-vlan trunk Native VLAN tagging: enabled
Administrative private-vlan trunk encapsulation: dot1q
Administrative private-vlan trunk normal VLANs: none
Administrative private-vlan trunk private VLANs: none
Operational private-vlan:
20 501
<output truncated>
This example shows how to configure an interface as a private VLAN promiscuous port and map it to a private VLAN. The interface is a member of primary VLAN 20 and secondary VLANs 501 to 503 are mapped to it.
Device# configure terminal
Device(config)# interface gigabitethernet 1/3
Device(config-if)# switchport mode private-vlan promiscuous
Device(config-if)# switchport private-vlan mapping 20 add 501-503
Device(config-if)# end
Use the show vlan private-vlan or the show interface status privileged EXEC command to display primary and secondary VLANs and private-VLAN ports on the device.
This example shows how to map the interfaces fo VLANs 501 and 502 to primary VLAN 10, which permits routing of secondary VLAN ingress traffic from private VLANs 501 and 502:
Device# configure terminal
Device(config)# interface vlan 20
Device(config-if)# private-vlan mapping 501-503
Device(config-if)# end
Device# show interfaces private-vlan mapping
Interface Secondary VLAN Type
--------- -------------- -----------------
vlan20 501 isolated
vlan20 502 community
vlan20 503 community
This example shows how to configure an interface as an isolated private VLAN trunk port and to verify the configuration:
Device# configure terminal
Device(config)# interface GigabitEthernet 1/3
Device(config-if)# switchport private-vlan trunk allowed vlan 20
Device(config-if)# switchport private-vlan association trunk 20 503
Device(config-if)# switchport mode private-vlan trunk
Device(config-if)# end
Device# show interface GigabitEthernet 1/3 switchport
Name: GigabitEthernet 1/3
Switchport: Enabled
Administrative Mode: private-vlan trunk secondary
Operational Mode: private-vlan trunk secondary
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: none
Administrative private-vlan host-association: none
Administrative private-vlan mapping: none
Administrative private-vlan trunk native VLAN: none
Administrative private-vlan trunk Native VLAN tagging: enabled
Administrative private-vlan trunk encapsulation: dot1q
Administrative private-vlan trunk normal VLANs: 20
Administrative private-vlan trunk associations:
20 (VLAN0020) 503 (VLAN0503)
Administrative private-vlan trunk mappings: none
Operational private-vlan:
20 (VLAN0020) 503 (VLAN0503)
Operational Normal VLANs: none
Trunking VLANs Enabled: ALL
Pruning VLANs Enabled: 2-1001
Capture Mode Disabled
Capture VLANs Allowed: ALL
Protected: false
Unknown unicast blocked: disabled
Unknown multicast blocked: disabled
Vepa Enabled: false
Appliance trust: none
This example shows how to configure an interface as a promiscuous private VLAN trunk port and to verify the configuration:
Device# configure terminal
Device(config)# interface GigabitEthernet 1/3
Device(config-if)# switchport private-vlan trunk native vlan 20
Device(config-if)# switchport private-vlan trunk allowed vlan 20
Device(config-if)# switchport private-vlan mapping trunk 20 501-503
Device(config-if)# switchport mode private-vlan trunk promiscuous
Device(config-if)# end
Device# show interface GigabitEthernet 1/3 switchport
Name: Gi6/0/4
Switchport: Enabled
Administrative Mode: private-vlan trunk promiscuous
Operational Mode: private-vlan trunk promiscuous
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: none
Administrative private-vlan host-association: none
Administrative private-vlan mapping: none
Administrative private-vlan trunk native VLAN: 20
Administrative private-vlan trunk Native VLAN tagging: enabled
Administrative private-vlan trunk encapsulation: dot1q
Administrative private-vlan trunk normal VLANs: 20
Administrative private-vlan trunk associations: none
Administrative private-vlan trunk mappings:
20 (VLAN0020) 501 (VLAN0501)
502 (VLAN0502)
503 (VLAN0503)
Operational private-vlan:
20 (VLAN0020) 501 (VLAN0501) 502 (VLAN0502) 503 (VLAN0503)
Trunking VLANs Enabled: ALL
Pruning VLANs Enabled: 2-1001
Capture Mode Disabled
Capture VLANs Allowed: ALL
Protected: false
Unknown unicast blocked: disabled
Unknown multicast blocked: disabled
Vepa Enabled: false
Appliance trust: none
This example shows how to configure an interface as an isolated private VLAN trunk port on a port channel and to verify the configuration:
Device# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Device(config)# interface range g5/0/17, g5/0/22, g6/0/12
Device(config-if-range)# switchport mode private-vlan trunk
Device(config-if-range)# switchport private-vlan trunk allowed vlan 20
Device(config-if-range)# switchport private-vlan association trunk 20 503
Device(config-if-range)# channel-group 1 mode active
Device(config-if-range)# end
Device# show etherchannel summary
Dec 10 13:51:28.423 PST: %SYS-5-CONFIG_I: Configured from console by consolesumm
Flags: D - down P - bundled in port-channel
I - stand-alone s – suspended
H - Hot-standby (LACP only)
R - Layer3 S - Layer2
U - in use f - failed to allocate aggregator
M - not in use, minimum links not met
u - unsuitable for bundling
w - waiting to be aggregated
d - default port
A - formed by Auto LAG
Number of channel-groups in use: 1
Number of aggregators: 1
Group Port-channel Protocol Ports
------+-------------+-----------+-----------------------------------------------
1 Po1(SU) LACP Gi5/0/17(P) Gi5/0/22(P) Gi6/0/12(P)
Device# show vlan private-vlan
Primary Secondary Type Ports
------- --------- ----------------- ------------------------------------------
20 501 community
20 502 community
20 503 isolated Po1
This example shows how to configure an interface as a promiscuous private VLAN trunk port on a port channel and to verify the configuration:
Device# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Device(config)# interface range g5/0/17, g5/0/22, g6/0/12
Device(config-if-range)# switchport mode private-vlan trunk promiscuous
Device(config-if-range)# switchport private-vlan trunk allowed vlan 20
Device(config-if-range)# switchport private-vlan mapping trunk 20 501-503
Device(config-if-range)# channel-group 1 mode active
Device(config-if-range)# end
Device# show etherchannel summary
Dec 10 13:51:28.423 PST: %SYS-5-CONFIG_I: Configured from console by consolesumm
Flags: D - down P - bundled in port-channel
I - stand-alone s – suspended
H - Hot-standby (LACP only)
R - Layer3 S - Layer2
U - in use f - failed to allocate aggregator
M - not in use, minimum links not met
u - unsuitable for bundling
w - waiting to be aggregated
d - default port
A - formed by Auto LAG
Number of channel-groups in use: 1
Number of aggregators: 1
Group Port-channel Protocol Ports
------+-------------+-----------+-----------------------------------------------
1 Po1(SU) LACP Gi5/0/17(P) Gi5/0/22(P) Gi6/0/12(P)
Device# show vlan private-vlan
Primary Secondary Type Ports
------- --------- ----------------- ------------------------------------------
20 501 community Po1
20 502 community Po1
20 503 isolated Po1
This example shows output from the show vlan private-vlan command:
Device# show vlan private-vlan
Primary Secondary Type Ports
------- --------- ----------------- ------------------------------------------
20 501 isolated Gi1/0/22, Gi1/0/2
20 502 community Gi1/0/2
20 503 community Gi1/0/2
Feedback