Private Vlans Exposed

Private Vlan’s
By default a vlan have layer2 reach ability among all the hosts associated with the specified vlan. Private Vlan breaks the Vlan into different segments.
Private Vlan’s supported on 3560 but not on 3550 switches.
** Private vlan need the switches to be in transparent mode.
Private Vlan consists of different Vlan’s.
1.) Primary Vlan
2.) Isolated Vlan
3.) Community Vlan
Secondary Vlan’s Ports associated with Isolated Vlan cannot communicate with any other ports except the ports of primary Vlan.
Ports associated with community Vlan can communicate with ports associated to same community Vlan and ports associated with primary Vlan.
** Please note that these restrictions exclude the trunk ports.
A primary Vlan can have one private Vlan, one isolated Vlan and many community Vlan’s.
Private Vlan can be extended to several switches. If you want to block the communication between two ports belong to same Vlan, you can configure switch ports in isolated Vlan. We can also perform the same task by configuring ports as protected ports but protected ports only work inside of the switch so if you need to span the ports across different switches for protection, you need to use the private Vlan’s.
Configure the default gateway server ports and backup devices port in promiscuous port as all the devices in a LAN need to be communicated to these devices.
When configuring private Vlan’s in a switch, always use the default SDM template. Command needed to configure default SDM template.
# sdm prefer default (Global configuration command)
Types of ports
1.) Promiscuous port
2.) Isolated port
3.) Community port
Primary Vlan port used to be in promiscuous port and can communicate to all other ports.
Secondary Vlan’s in a private Vlan can’t have a SVI layer 3 interface, SVI layer 3 only exists for Primary VLAN.
Private Vlan’s need to be configured with vlan global configuration mode only as well as extended Vlan range(1005 to higher) also will be configured with vlan mode only) and also switch should be in transparent mode with VTP disabled.
We can’t use Vlan 1 and 1002-1005 as primary or secondary Vlan’s.
Private Vlan’s ARP entries are sticky and do not age out, so if change the Ip address of a system, it will give error message and you have delete ARP entry manually. You can use below mentioned commands.
You can remove a private-VLAN ARP entry by using the no arp ip-address global configuration command.
– You can add a private-VLAN ARP entry by using the arp ip-address hardware-address type global
** To filter private Vlan layer3 traffic, we can use a Vlan-map as well as we can apply layer-3 ACL’s on primary Vlan SVI and it will be applied on primary as well as secondary Vlan.
** If you configure a private Vlan port as a part of ether channel, Ether channel will be inactive.
** You can’t configure a SPAN destination port as a private Vlan port as the port will become inactive.

Private Vlan Configuration
# Config t
# VTP mode transparent
# Vlan 3
Private-Vlan primary
# Vlan 4
Private-Vlan isolated
# Vlan 5
Private-vlan Community
# Vlan 3
Private-vlan association add Secondary_Vlan_list (12, 13, 15)
# show vlan private-vlan
Switch (config) # show vlan private vlan
Primary Secondary Type Ports
------- --------- ----------------- ------------------------------------------
20 501 isolated
20 502 community
20 503 community
20 504 non-operational

Configuring a port as private-Vlan host port
# configure terminal
# interface fastethernet0/22
# switchport mode private-vlan host
# switchport private-vlan host-association 20 25
# end
# show interfaces fastethernet0/22 switchport

Configure a switch-port as private Vlan promiscuous port
# configure terminal
# interface fastethernet0/2
# switchport mode private-vlan promiscuous
# switchport private-vlan mapping 20 add 501-503

Mapping Secondary VLANs to a Primary VLAN Layer 3 VLAN Interface

If the private VLAN will be used for inter-VLAN routing, you configure an SVI for the primary VLAN and map secondary VLANs to the SVI.
# Interface vlan 10
# private-vlan mapping 501-502
# Show interfaces private-vlan mapping

Please let me know, if anything need to be corrected in the document.
Mahi