What are private VLANs and when would you use them?
Show the answer
Say this first
Private VLANs split one VLAN and one subnet into isolated pieces at layer 2. A primary VLAN holds secondary VLANs: one isolated VLAN, whose ports only talk to promiscuous ports, and any number of community VLANs, whose ports talk to each other and to promiscuous ports. The promiscuous port, usually the gateway or firewall, talks to everyone. They suit DMZs, hosting, and guest or hotel networks, where hosts share a subnet but should not reach each other.
Go deeper
Who can talk to whom
| From / to | Promiscuous | Same community | Other community | Isolated |
|---|---|---|---|---|
| Promiscuous | Yes | Yes | Yes | Yes |
| Community | Yes | Yes | No | No |
| Isolated | Yes | No | No | No |
Configuration on a Catalyst
Needs VTP transparent or off mode (or VTPv3).
vtp mode transparent
vlan 201
private-vlan isolated
vlan 202
private-vlan community
vlan 200
private-vlan primary
private-vlan association 201,202
!
interface GigabitEthernet1/0/10
switchport mode private-vlan host
switchport private-vlan host-association 200 201
!
interface GigabitEthernet1/0/48
description Firewall
switchport mode private-vlan promiscuous
switchport private-vlan mapping 200 201,202
!
interface Vlan200
ip address 10.200.0.1 255.255.255.0
private-vlan mapping 201,202The SVI mapping lets hosts in the secondary VLANs reach their gateway. Across switches, secondary VLANs ride a normal trunk as ordinary VLANs, and every switch needs the same PVLAN definitions.
Hosts going through the router
Isolated hosts cannot ARP each other. If you want them to talk only through the gateway, where an ACL can
inspect it, enable ip local-proxy-arp on the SVI.
They will ask next
What is
switchport protected?Private VLAN edge: protected ports on the same switch cannot exchange traffic with each other at layer 2. It needs no VLAN setup but only works within one switch.
How many isolated VLANs can a primary VLAN have?
One. It can have many community VLANs.
Traps
- Forgetting
private-vlan mappingon the SVI, which leaves secondary-VLAN hosts without a gateway.