Private VLAN config

[Andy White]

Hello,

I have a 3560 switch with 1 VLAN (VLAN 10) where I need to make ports:

1-10 as isolated (can't contact each other)

11-20 as community (need to contact each other like a normal VLAN)

23 as promiscuous (server that ports 1-20 need to get to)

24 as promiscuous (WAN router where ports 1-20 need to get to and the remote servers)

Is this roughly right based on some reading:

1. Set VTP to transparent
2. Create the secondary VLANs first

vlan 101

  private-vlan community

vlan 102

  private-vlan isolated

   3.  Create the primary VLAN

vlan 100

  private-vlan primary

  private-vlan association 101-102

Now the ports:

int range FastEthernet0/1 -10

description isolated ports

switchport private-vlan host-association 100 102

switchport mode private-vlan host

int range FastEthernet0/11 -20

description community ports

switchport private-vlan host-association 100 101

switchport mode private-vlan host

int FastEthernet0/23

description primary host port for server

switchport private-vlan mapping 100 101-102

switchport mode private-vlan promiscuous

int FastEthernet0/24

description primary host port for WAN router

switchport private-vlan mapping 100 101-102

switchport mode private-vlan promiscuous

Does that look about right?

I have also just attach a config of what I think it may look like.

Thanks

[Andy White]

Yeah the attachment is just a text file that gets zipped.  Here is a snippet, they way I see it is I have a single VLAN 10 subnet and the Primary PVLAN is 100 with the secondary PVLANs as community 101 and isolated as 102.

VLANs

vlan 10

PVLANs

vlan 100

  private-vlan primary

  private-vlan association 101-102

vlan 101

  private-vlan community

vlan 102

  private-vlan isolated

Hosts

interface FastEthernet0/10

description isolated ports

switchport access vlan 10

switchport private-vlan host-association 100 102

switchport mode private-vlan host

spanning-tree portfast

spanning-tree bpduguard enable

interface FastEthernet0/11

description community ports

switchport access vlan 10

switchport private-vlan host-association 100 101

switchport mode private-vlan host

spanning-tree portfast

spanning-tree bpduguard enable

Server

interface FastEthernet0/23

description primary host port for server

switchport access vlan 10

switchport private-vlan mapping 100 101-102

switchport mode private-vlan promiscuous

spanning-tree portfast

spanning-tree bpduguard enable

WAN Router

interface FastEthernet0/24

description primary host port for WAN router

switchport access vlan 10

switchport private-vlan mapping 100 101-102

switchport mode private-vlan promiscuous

SVI

interface Vlan10

ip address 10.100.80.2 255.255.255.0

Routing

router eigrp 100

network 10.100.80.0 0.0.0.255

Does this seem ok?

Kind regards

[paul driver]

Hello andy

Vtp mode transparent

PVLANs

vlan 100
private-vlan primary
private-vlan association 101-102

vlan 101
private-vlan community

vlan 102
private-vlan isolated



Secondary ports,..

switchport private-vlan host-association 100 101 / 102@
switchport mode private-vlan hosts
spanning-tree portfast
spanning-tree bpduguard enable


promiscuous ports

switchport private-vlan mapping 100 101-102
switchport mode private-vlan promiscuous
spanning-tree portfast
spanning-tree bpduguard enable

Res
Paul



Sent from Cisco Technical Support iPad App

[Andy White]

But what happens to VLAN 10?  This is the part I don't understand, I'd like to keep VLAN 10.

Thanks

[paul driver]

Hello andy

For the promiscuous ports

Switchport private-vlan mapping 100 add 101,102
Switch port mode private- vlan promiscuous



Res
Paul

Sent from Cisco Technical Support iPad App

[Andy White]

I think it is almost working!

One thing that no longer works though is DHCP on the switch, I had to statically assign IPs, any ideas why this would be?

What happens to VLAN 10 as other mention removing this?  This is the part I don't understand, I'd like to keep VLAN 10.

[paul driver]

Hello,

Vlan 10 is a normal vlan any access ports in this are not in the plvan domain

Res
Paul

Sent from Cisco Technical Support iPad App

[Andy White]

Hi,

Ok I understand.  Any reason the DHCP scope doen't work on the isolated and community ports now?  I'm haven't tested it but I'm sure if I made onw of the ports a normal access port in VLAN 10 it would get an IP.

Thanks

[Andy White]

Hi,

Don't suppose you have any idea why the DHCP no longer works since ports have been put into the community and isolated ports, I thought the DHCP discover broadcast would get to the switch, but maybe I should move the DHCP scope to the router as this is a promiscuous.

[paul driver]

Andy,

Your Vlan 10 is not in the PLVAN domain so it wont communicate with any device with that domain - hence the nature of Private vlans!

The secondary ports will only communicate within its own vlan and promiscuous ports, unless you provide some l3 communication for the secondarys and add the ip range for the subnets to the primary vlan svi as stated in the previous post.

res

Paul

Please don't forget to rate any posts that have been helpful.

[Andy White]

As it is a L3 switch I can just create the SVI's locally for each secondary VLAN and a 2 more DHCP scopes, I guess I will have 3 DHCP scopes for the same subnet though?

[paul driver]

Andy

Please don't forget to rate any posts that have been helpful.

res

Paul

[Andy White]

Once I have fixed this DHCP issue and you have answered my last post I will