Hi
Mainly part of the answer that has been missed is that although users are in the same IP subnet (in terms of PVLAN) they can not reach each other through the local network!
If they need to reach each other they should go out and come in to the LAN!
PVLAN is mainly used in ISPs so that they can prevent their customers from accessing each other through the LAN while saving the address space!
If they would use normal VLANs it would need a huge amount of IP addresses to accommodate this goal.
Using PVLANs if you retrieve your IP address while connecting to an ISP you would surprisingly consider that your net mask is like /32 that is strange.
It is a trick you are in a subnet! You can not reach anywhere else on the subnet unless your gateway.
If you want to access other routers residing on your subnet you should access the through internet.
There is another way to accomplish the task of isolation two systems from accessing each other which is called Protected Port! But it is limited to the hosts on the same swich while PVLAN can do it on different switches.
Wish it would be helpfull!
Sent from Cisco Technical Support iPhone App
