Connecting two Catalyst IOS switches using private-vlan isolated ports

[chad patterson]

Hello all,

 I am trying to connect two switches together using two ports. Rather than using STP or something, I am trying to prevent looping by implementing private vlans; to isolate the ports from one another.

On Switch #1, I have created two private-vlan isolated ports. 

On Switch #2, I connect two access-ports to the Switch #1 isolated ports.

So in theory (my theory), any device connected to Switch #2 should be able to ping any other device connected to Switch #2.  However any device on Switch #1 should not be able to ping any device on Switch #2.

But that is NOT what is happening. Nothing on Switch #2 can communicate with Switch #1, and vice versa. But when I set the ports on switch#1 to be promiscuous rather than isolated, everybody can communicate. But that's not what I'm going for; I am trying to allow only vlan 101 outbound traffic from switch#2 to pass through switch#1. 

Can somebody please explain why this not working as I expect it to, and if it is indeed possible to make this work as expected?

[balaji.bandi]

How is the configuration done between Switches.

look at sample configuration and setup as below :

https://www.cisco.com/c/en/us/support/docs/lan-switching/private-vlans-pvlans-promiscuous-isolated-community/40781-194.html

[chad patterson]

@balaji.bandi: Thanks for posting a link to the page where I obviously got the diagram from. 

The configuration between the switches is what the included configuration is in the diagram. The top switch is Switch#1 and the bottom diagram is Swtich#2. I am trying to put the private-vlan isolated ports on Switch#1, and connect the host to switch to Switch#2.

So to sum it all up, I am basically trying to connect two switches together using private-vlan isolated ports. 

My question is, why isn't that working? Is it possible to make it work, and if so, how?

[chad patterson · Accepted solution]

I found the answer to the problem.  

I was running this simulation in VIRL, and when I changed the Switch#2 to an unmanaged switch, then it worked as expected. So it seems that as long as the switch recognizes PVLAN tagging, then this is not possible.