Private Vlans

[ziad sousa]

Can 2 isolated vlans in same subnet communicate on layer 3 ? If they are both associated to same SVI 

[devils_advocate]

How can you have a single SVI for two Vlans?

[ziad sousa]

By associating the secondary vlans to the SVI of the primary vlan

[Francesco Molino]

Hi

When you use Private VLAN, all isolated ports are not able to communicate with other isolated port.

You can use community port to allow only few hosts to communicate together.

	I-Port	P-Port	C1-Port
I-Port	Deny	Permit	Deny
P-Port	Permit	Permit	Permit
C1-Port	Deny	Permit	Permit
C2-Port	Deny	Permit	Deny

source: https://en.wikipedia.org/wiki/Private_VLAN

Thanks

PS: Please don't forget to rate and mark as correct answer if this answered your question

[ziad sousa]

Yes i understand but can we use routing or the promiscuous port to pass information between secondary vlans?

[Francesco Molino]

Honestly, never done in production that but you can maybe use some proxy arp...

But again if these 2 hosts need to talk together then why not using community port?

[ziad sousa]

True you are right , it was a bizarre scenario i encountred that we have a TACACS server on isolated vlan and another server which need credentials and they both have to be on the same subnet that's why i was asking if its possible

[Francesco Molino · Accepted solution]

Ok. you can do several things to achieve that (proxy arp, nat,..) but best way to accomplish is using community port. 

PS: Please don't forget to rate and mark as correct answer if this answered your question 

[ziad sousa]

Yes i think community vlan and pacl will be the best solution thank you guys really appreciate it

[Francesco Molino]

You're welcome. Yes community will limit the acl lines you need to do to filter what's denied.

Thanks

[Georg Pauwen · Accepted solution]

Ziad,

if you want to isolate the TACACS server while still being in the same VLAN, why not use port ACLs ? Community ports in a private VLAN, as suggested, are definitely an idea, but by themselves they would not let you shield the TACACS server. Port ACLs would let you define exactly which traffic you allow in or out.

[ziad sousa]

Seems like a soln .. thank you very much for your help really appreciate it

[Georg Pauwen]

Ziad,

not sure if I correctly understand your question. For layer 3 connectivity, you need to map the primary Vlan SVI to the private Vlans. As in the example below, where Vlan 100 is your primary Vlan, and 101 and 102 are your private Vlans:

interface Vlan 100

description Primary Vlan

private-vlan mapping add 101, 102

HTH