Hello Fernando,
I would say it all depends of your current architecture (where is the promiscuous port, routing device and so on…).
Maybe you are trying to extend a pvlan domain to an ESX vdswitch or a Nexus 1000v.;
If it is not possible to upgrade to 5.1(3)N2(1) and activate the ‘PVLAN on FEX trunk’ feature, please find some ideas :
- Define the vlans to be secured as pvlans only on the END switches (* On the VMware vdSwitch, N1k, .. * On the outgoing switch where the promiscuous port is locally configured) but not on the N5k where they will be defined as regular vlans.
Hence those vlans could be allowed on the FEX trunks, they will just be used for the transport of the flows.
The drawback is that we may not connect ‘private-vlan hosts’ on the N5k/N2k (at least in the same pvlan domain).
- Define and connect the trunk directly on the 5548 => Depending on the number of trunks you will need to define, some GLC-T are to be used for the connection.
- Still depending on your environment => With the Nexus 1000v it is possible to define the uplink as a ‘promiscuous trunk’ directly connected to the routing device.
- If possible within you environment and devices capabilities define the vlans to secure as regular vlans and implement ACLs to define the communication matrix.
- I have never tested it and do not think it is a good idea => To dedicate interfaces for each pvlan between the N2K and the downstream resource.
If there is other alternatives there are welcomed.
Hope that helps.
Best regards.
Karim
