Private VLAN (PVLAN) on Cisco Catalyst Switch

(Andrew P) #53

Changing VTP to transparent mode is really only required if VTP version 1 or 2 is being used. The reason is because those VTP modes don’t support the higher VLAN ranges used for PVLANs.

Starting with VTP version 3, however, Private VLANs are not only supported by the configuration is also propagated by VTP. If you are curious, there is a Network Lesson on VTP Version 3

0 Likes

(sims) #54

Hi,
In a multilayer switch how the configuration look like ?

Thanks

0 Likes

(Lazaros Agapides) #55

Hello sims

The configuration of private VLANs in a multi-layer switch would be exactly the same.

Laz

0 Likes

(Shantel - Networklessons.com) split this topic #56

19 posts were merged into an existing topic: Private VLAN (PVLAN) on Cisco Catalyst Switch

0 Likes

(AZM U) #57

Hello Rene,
Would you please let me know if I can configure multiple trunk ports in a switch as promiscuous ports for a single primary vlan? Also can a single trunk port be configured as a promiscuous port for multiple primary vlans? If so, please explain.

Thank you so much.

Azm

0 Likes

(Lazaros Agapides) #58

Hello Azm

Yes, it is possible to configure multiple trunk ports as promiscuous ports for a single primary VLAN. You would configure this if you want to span a primary VLAN over three switches for example.

Secondly, it is possible as well to configure a single trunk port as a promiscuous port for multiple primary VLANs. This again, would be the case if you have multiple primary VLANs that you want to span over more than one switch. Specifically, Cisco states:

Multiple private VLAN pairs can be specified using the switchport private-vlan mapping trunk command so that a promiscuous trunk port can carry multiple primary VLANs.

Also, Cisco states:

The maximum number of unique private VLAN pairs supported by the switchport private-vlan mapping trunk command is 500. For example, one thousand secondary VLANs could map to one primary VLAN, or one thousand secondary VLANs could map one to one to one thousand primary VLANs.

However, keep the following guidelines in mind:

  1. According to Cisco, if you are using private VLANs and you want to span them over several switches, "You should use standard trunk ports if both switches undergoing trunking support PVLANs."
  2. You would use promiscuous trunk ports only in the case where you are connecting to a switch that does not have PVLAN capability. You can find more on this in Cisco’s official documentation.

I hope this has been helpful!

Laz

1 Like

(AZM U) #59

Hello Laz,
Very nice explanation as usual. Thank you so much.

Azm

1 Like

(Edi W) #60

@ReneMolenaar

Could you please let me know the port config between SW1 and SW2?

Thanks,
Edi

0 Likes

(Lazaros Agapides) #61

Hello Edi

The configuration on the interfaces connecting SW1 and SW2 are configured as trunks that include VLANs 500 501 and 502. Although we are not told in Rene’s diagram which interface this connection is on, let’s assume that it’s Fa0/5. The configuration for these interfaces can be seen below:

**Switch 1**

interface fastethernet 0/5
 switchport mode trunk
 switchport trunk allowed vlans 500,501,502

**Switch 2**

interface fastethernet 0/5
 switchport mode trunk
 switchport trunk allowed vlans 500,501,502

I hope this has been helpful!

Laz

0 Likes

(Manuel G) #62

Hello Rene,

My question is, is there any way you can use static route if you still want to have connectivity between community vlan and isolated vlan ? if so, can you please provide an illustration example ?

0 Likes

(Lazaros Agapides) #63

Hello Manuel!

Sorry for the late reply. Your question is a good one! First of all, let’s clarify that the functionality of PVLANs is at layer two, that is, it functions using switch ports as criteria to allow and disallow communication. Layer three IP addressing and routing does not come into play. All hosts within the primary VLAN, the secondary Community VLAN and the secondary Isolated VLAN are in the SAME subnet. That means that, if no private VLANs were configured, they would all be on the same VLAN and they would communicate with each other WITHOUT routing.

Adding the private VLAN functionality essentially segregates the VLAN into parts using only layer two functionality. That is, specific ports can speak with each other and others cannot. Routing does not come into play at all.

Having said all that, the answer to your question is no, static routing cannot be used to allow connectivity between a community and isolated VLAN. Actually, there is no way to create an exception to allow an isolated VLAN to communicate with a community VLAN. If you want a host on an isolated VLAN to communicate with the community VLAN, then just change the VLAN of its port to the community VLAN.

I hope this has been helpful!

Laz

0 Likes

(kuda m) #64

hi Rene/Laz

I have question - I am trying to figure out how SVI’s and vlans work , is it possible to have 2 instances of the same Vlan number on cisco swtches ?
for instance can I create int vlan 10 2.2.2.2 /24 and int vlan 10 3.3.3.3 /24 on the same box.

Regards

0 Likes

(Lazaros Agapides) #65

Hello Kuda

Before I answer your question, if you were to attempt to configure what you describe above, you would have to implement the following commands:

SW1#configure terminal
SW1(config)#interface VLAN 10
SW1(config-if)#ip address 2.2.2.2 255.255.255.0
SW1(config-if)#exit
SW1(config)#interface VLAN 10
SW1(config-if)#ip address 3.3.3.3 255.255.255.0
SW1(config-if)#exit
SW1(config)#

If you were to enter those commands, you would essentially define the IP address of VLAN 10 as 2.2.2.2 and then you would redefine it as 3.3.3.3.

So, the answer to your question is no. Each SVI must have a unique VLAN number, as must every VLAN configured in a switch.

You can however have an SVI on VLAN 10 on switch 1 and have a second SVI on VLAN 10 of a neighbouring switch, and configure each of those with a separate IP address.

For example, if SW1 and SW2 are connected via an access port on VLAN 10, you can configure interface VLAN 10 on SW1 with an IP address of 2.2.2.2/24 and interface VLAN 10 on SW2 with an IP address of 2.2.2.3/24. Notice that these are both in the same subnet of 2.2.2.0/24. If they were not, then in most cases this would be considered a misconfiguration as they would not be able to communicate with each other. Also, because SVIs are usually used as default gateways for the hosts on the VLAN, the hosts on the subnet would not be able to communicate correctly with their default gateway.

I hope this has been helpful!

Laz

0 Likes

(kuda m) #66

hi Laz
understood , thank you very much for clarifying :slight_smile:

Regards

Kuda

0 Likes

(simon w) #67

Hi Rene I know this is a Private VLAN on a Catalyst switch, but have you configured Private VLAN on a Cisco Small Business SG300 switch. I am looking to configure most of the ports as isolated ports and then a trunk to other switches with isolated ports and also a uplink to a another switch towards the core router I am having problems configuring the trunk links and need help

0 Likes

(Rene Molenaar) #68

Hi @unitynetworks,

I never configured it on an SG300 but it seems to be supported. Not sure if you can span it between two switches. Does it work with a single switch?

0 Likes

(simon w) #69

Hi Rene

I have been able to get a private VLAN working across 2 SG300 switches. The only issue i have is is setting up a promiscuous trunk port on the SG300 as there does not seem to be a option to set this up on the SG switch.

0 Likes

(Lazaros Agapides) #70

Hello Simon.

The SG300 switches can have their ports configured as EITHER promiscuous access ports OR trunk ports. (See Step 4 on pages 236 and 237 of the Cisco 300 Series Managed Switches Administration Guide.

The Promiscuous trunk port is only supported on the Catalyst 4500 and 6500 series and their successors. However, that being said, it is probably not necessary for you to do this. As Cisco says,

“PVLAN promiscuous trunks are used in situations where a PVLAN promiscuous host port is normally used, but where it is necessary to carry multiple VLANs, either normal VLANs or multiple PVLAN domains. You can connect to an upstream router that does not support PVLANs, such as a Cisco 7200 router.”

Secondly, Cisco also suggests that:

You should use standard trunk ports if both switches that use trunking support PVLANs.

So if you’re using two SG300s, you don’t need to configure a promiscuous trunk port since both devices support PVLANs. Just use a standard trunk connection between them and configure the access ports on other switch to be community, promiscuous or isolated as you would do if you had only one switch.

I hope this has been helpful!

Laz

0 Likes

(Michael R) #71

Hi, i have a question regarding the syncing of private VLANS across VTP v3. It’s stated that you must configure the switch to use transparent mode while using private VLANS, but on the VTP v3 page it states that you can sync up private VLANS. I’m just wondering how this is possible when using transparent mode on the switches?

Thanks

0 Likes

(Lazaros Agapides) #72

Hello Michael

Until VTPv2, the common practice was to create private VLANs only on transparent switches because VTP didn’t support the transmission of private VLAN information between VTP switches. This was best practice so that other switches wouldn’t be flooded with unnecessary private VLAN traffic. Thus, older documentation states that private VTPs should be implemented manually on a transparent switch only.

With the advent of VTPv3, private VLANs are now transmitted via VTP, so you no longer have to adhere to this best practice. So, you can create private VLANs on VTP servers without hesitation if you are using VTPv3 and all your switches support this version.

I hope this has been helpful!

Laz

0 Likes