I have a SG350 switch between a ESXi host and a PaloAlto firewall.
I'm trying to use private-vlan but I cant get any traffic to work between them.
Topology:
ESXi - SG350 - Firewall(gateway)
The configuration in short looks like this:
ESXi;
private vlan in DVS - 302 Primary vlan, 702 Isolated
DP-VM - Isolated 302,702
DVS-uplink - Trunk 0-4094
SG350;
Interface vlan 302
private-vlan primary
private-vlan association add 702
Interface vlan 702
private-vlan isolated
GE1-3(connection to ESXi 3 different host NICs)
Switchport mode trunk
Switchport trunk allowed vlan all
TGE1(connection to firewall)
Switchport mode private-vlan promiscuous
switchport private-vlan mapping 302 add 702
The port in the firewall has subinterfaces with subnets + tags.
Since ESXi and SG350 are both private-vlan aware it should work with regular trunks between those but PaloAlto are not, thats why I have to use a promiscuous port.
Is this a correct understanding? Why doesnt it work?
I dont have any VTP commands in the SG350 switch cli, it seems to use GVRP instead. Should that be enabled or not?
Is there something else in a SG350 that has to be disabled/enabled in order for private-vlan to work?
Br,
Alex
