cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
442
Views
2
Helpful
5
Replies

Private vlan through trunk

aw75635
Beginner
Beginner

Hello,

I am trying, in my lab, to make computers running in a private vlan, reach the gateway. 

I am probably missing some config on the trunk port, I believe. 

The lab looks like this - see attached picture 

So, the PCs running behind sw01 and sw03 are not able to reach gateway, on router c1-l1-r1 / r2

Between switches, there PVLAN works as it should. 

What should be configured, on the switch or/and on the router, in order to make computers, running in PVLan reach the gateway?

Thank you!

1 Accepted Solution

Accepted Solutions

KJK99
Beginner
Beginner

@aw75635 

Only the server connected to the promiscuous port should be able to reach those gateways. The PCs connected to the isolated and community ports should not. The PCs connected to the isolated ports should be able to interface only the server on the promiscuous port. The PCs connected to the community ports should be able to interface with each other and the server on the promiscuous port. That’s how private VLANs work. That’s how private VLANs work. To allow the PCs reach the gateways, you would need to connect them to promiscuous ports, but that would defeat the purpose of having a private VLAN.  

Kris K

View solution in original post

5 Replies 5

M02@rt37
VIP
VIP

Hello @aw75635?,

Please provide Sw1 port Trunk configuration toward Routers.

Thanks.

Best regards
.ı|ı.ı|ı. If This Helps, Please Rate .ı|ı.ı|ı.

ammahend
VIP
VIP

follow this guide to verify your config 

-hope this helps-

Gopinath_Pigili
Spotlight
Spotlight

Router side....normal configuration...assing ip address and no shutdown... commands...

Swtich side ports should be configured as promiscuous


Interface range e0/0-1
switch port mode private-vlan promiscuous
switchport private-vlan mapping xx 20,21

Note: xx is the primary vlan number

Thanks

KJK99
Beginner
Beginner

@aw75635 

Only the server connected to the promiscuous port should be able to reach those gateways. The PCs connected to the isolated and community ports should not. The PCs connected to the isolated ports should be able to interface only the server on the promiscuous port. The PCs connected to the community ports should be able to interface with each other and the server on the promiscuous port. That’s how private VLANs work. That’s how private VLANs work. To allow the PCs reach the gateways, you would need to connect them to promiscuous ports, but that would defeat the purpose of having a private VLAN.  

Kris K

Thank you KJK99! I thought that the devices running in PVLAN should be able to access the gateway. 

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: