Private VLAN (PVLAN) on Cisco Catalyst Switch

[lagapidis (Lazarus Agapidis)]

Hello Fatih

@saltinisik82

All secondary VLANs must be associated with one primary VLAN to set up the unidirectional relationship

When the term “unidirectional relationship” is used, it is referring to the way in which hosts within secondary private VLANs are capable of communicating with other hosts in the same secondary VLAN (in the case of a community private VLAN), as well as with host in the primary VLAN, but not with hosts in other secondary VLANs. The unidirectional nature just refers to the way in which traffic can freely flow from the primary towards all secondary VLANs (one direction) but not from a secondary VLAN to other secondary VLAN (the other direction). I believe it is a misleading use of the term. Wherever you see “unidirectional VLANs” simply think “secondary VLANs”.

@saltinisik82

Should I assign the ports which are the member of secondary VLANs (host port) or primary VLAN (promiscuous port) to an access VLAN like in the example below or access VLANs are not relevant to PVLANs, so switchport mode access and switchport access vlan 10 commands do not have any effect?

If you apply the configuration you have posted, then the “switchport access vlan 10” command is ignored. From the moment that the switchport mode private-vlan host has been applied, only the switchport private-vlan host-association 20 10 command will be applied.

I hope this has been helpful!

Laz