Private vlan type Isolated and blocked port

[mahesh18]

                   hi everyone,

I have config Private vlan on 3750

3750Switch#        sh vlan private-vlan

Primary Secondary Type              Ports
------- --------- ----------------- ------------------------------------------
20      30        community         Fa1/0/1, Gi1/0/1
20      40        isolated          Fa1/0/1, Fa1/0/5

when i do sh mac address i see this

   1    000d.2928.bcb0    DYNAMIC     Fa1/0/48
  20    000e.d7f8.b400    DYNAMIC pv  Fa1/0/5
  20    0019.e849.d3c1    DYNAMIC     Fa1/0/1
  20    001b.90e7.d4c2    DYNAMIC pv  Gi1/0/1
  30    0019.e849.d3c1    DYNAMIC pv  Fa1/0/1
  30    001b.90e7.d4c2    DYNAMIC     Gi1/0/1
  40    000e.d7f8.b400    BLOCKED     Fa1/0/5************************this goes to isolated vlan
  40    0019.e849.d3c1    DYNAMIC pv  Fa1/0/1

Need to know if port in isolated vlan always show as blocked?

Thanks

mahesh

[Reza Sharifi · Accepted solution]

Hi Mahesh,

The behavior is correct.

see below from the config guide:

Isolated—An isolated port is a host port that  belongs to an isolated secondary VLAN. This port has complete isolation  from other ports within the same private VLAN domain, except that it can  communicate with associated promiscuous ports. Private VLANs block all  traffic to isolated ports except traffic from promiscuous ports. Traffic  received from an isolated port is forwarded only to promiscuous ports.  You can have more than one isolated port in a specified isolated VLAN.  Each port is completely isolated from all other ports in the isolated  VLAN.

here is the link:

http://www.cisco.com/en/US/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli/PrivateVLANs.html

HTH

Reza

[mahesh18]

Hi Reza,

Many thanks for confirming it.

Regards

MAhesh