Private VLAN (PVLAN) on Cisco Catalyst Switch

Lessons Discussion
21

Hello Rene,

Just a question please, this lab is the same as PVLAN in Switching CCNP, but the course should be for CCIE, so i am a little confused , what did you add to this course as an CCIE ? or it is only a review for the PVLAN . can you please clarified ?

22

Hi Sinan,

Thatā€™s right, itā€™s the same lesson. Thereā€™s nothing more on CCIE-level that you need to know about private VLANs so I added it here as a review.

Rene

23

Why private VLANā€™s are used?

24

Within a VLAN itā€™s hard to implement security, the private VLANs allows you to isolate traffic within a VLAN even more.

25

Hi Rene,
Thanks for the explanation is very clear. My question is:
Who is going to use private vlans? If you can configure access-lists to block or allow traffic
I havenā€™t ever had to configure private-vlans but I had configure access-lists.
Please advise

26

Alfredo,
Private VLANs are often implemented in shared environments where multiple, independent entities need the same IP space, but should be isolated from each other (ISP co-location, for example). Access-lists wonā€™t really work if you are trying to keep two machines isolated from each other within the same IP subnet, and MAC based ACLs can get messy.

--Andrew

27

Great tutorial, clear and concise.

28

In your example to configure the promiscuous portā€¦. You wrote:

SwitchA(config)#interface fa0/24
SwitchA(config-if)#switchport mode private-vlan promiscuous
SwitchA(config-if)#switchport private-vlan mapping 500 501

Can you have more than one promiscuous port? If yes - What if you wanted to include additional servers (additional ports). Let say you had 5 servers (fa0/20, fa0/21, fa0/22, fa0/23, fa0/24). Would you have to config each interface separately or could you just do something like this?

SwitchA(config)#int fa0/20 - 24
SwitchA(config-if)#switchport mode private-vlan promiscuous
SwitchA(config-if)#switchport private-vlan mapping 500 501
29

Hi Jason,

Multiple promiscuous ports is no problem. You can configure an entire range of interfaces like that but make sure you use the interface range command:

Switch(config)#interface range fa0/20 - 24
Switch(config-if-range)#switchport mode private-vlan promiscuous 
Switch(config-if-range)#switchport private-vlan mapping 500 501

Rene

30

You have primary VLAN 500, community VLAN 501, Isolation VLAN 502ā€¦ If all this (primary VLAN 500) had a layer 3 switch connection (promiscuous port)ā€¦ would they be able to communicate through the Layer 3 switch?

31

Hi Jason,

Thatā€™s right. All that you need is an IP address that you can reach on the promiscuous port.

Rene

32

Hello,

I have a question can a secondary vlan communicate with another regular vlan? in other words a vlan that isnt configured as a primary?

Thanks

33

Could you provide a description of the trunking configuration for that second diagram (SwitchA and SwitchB)?

34

@Fabian,

The secondary VLANs will only be able to communicate with the promiscious port, not with other VLANs. They are ā€œtrappedā€ in their primary VLAN.

@Jason,

Iā€™ll add an example for this in a couple of days. Iā€™ll post it here.

35

Hi Rene,

Letā€™s say we have a request to add a private vlan on an access switch. Access switch connects to core, core is connected to a firewall. In some cases, the SVI between the core and firewall are already configured as a normal vlan. If we add a primary vlan config under this interface (SVI) will it change it to a primary and a regular vlan? Is this possible? Or will it become a ā€œprimaryā€ vlan for the secondary private vlan and loose its prior connfig? Whats the best method to implement a private vlan to an already existing access switch, that is connected in the same fashion I mentioned earlier without breaking anything? Assuming the SVI connected to the fireall is default gateway for hosts to the internet? I hope I correctly explained myself.

Thanks

36

Hi Fabian,

When you configure a VLAN as the primary VLAN then it will be primary. It canā€™t be the primary and ā€œregularā€ VLAN at the same time. When you want to migrate to a private VLANā€¦do it when nobody is around, itā€™s easy to break stuff :slight_smile:

Do you want to use private VLANs to prevent server-to-server traffic? If so, I would configure a new VLAN as the primary VLAN with some new secondary VLANs. Assign some unused switchports to it, see if it works. Configure the interface that connects to the firewall as the promiscuous port. When it works, you can assign the switchports from the servers in the ā€œregularā€ VLAN to your new secondary VLAN.

Rene

37

Great thanks Rene, ended up using a VACL instead as it wouldnā€™t break anything and wouldnā€™t require a change control. Iā€™m sure this will come up eventually though :slight_smile:

Thanks

38

Hi Fabian,

Thatā€™s good to hear.

Protected ports, VACLs and PACLs are great alternatives since they donā€™t require as much changes as private VLANs.

Rene

39

19 posts were merged into an existing topic: Private VLAN (PVLAN) on Cisco Catalyst Switch

40

do we have to run (switchport access vlan ##) on community or isolated ports?