PVLAN & VLAN same uplink interface

[Hubsi-Smith]

Hello,
I have configured my Cisco c1000 with some VLAN and one PVLAN. That works so far as expected but I am unsure if it is possible to use the same uplink interface?

# works for VLAN (uplink)
int gi1/0/1
switchport mode trunk
switchport trunk native vlan 100
switchport trunk allowed vlan 100-108
end

# works for PVLAN (uplink)
int gi1/0/1
switchport private-vlan mapping 302 402
switchport mode private-vlan promiscuous
end

How can both, VLAN and PVLAN on one interface???

[balaji.bandi]

Cat 9K is possible - never tested on cat 1K switches (check the version you using on the configuration guide)

below example for Cat 9K

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9600/software/release/17-4/configuration_guide/vlan/b_174_vlan_9600_cg/configuring_private_vlans.html#id_100563

[paul driver]

Hello 
The promiscuous port ( in this case a trunk) should be applicable when implementing PVLANS, its a port that all hosts within either the secondary/isolated pvlans can gain access to, and they do this by being associated to a primary vlan, and if that primary vlan is then allowed to traverse a trunk then that should be okay as then the PVLAN hosts will be able to reach hosts residing across that trunk in another switch, which is also implementing PLVAN or not.



 

[Peter Paluch]

My friends,

Please allow me to join.

Let's first clarify the terminology:

• A promiscuous PVLAN host port configured with switchport mode private-vlan promiscuous is an access port, not a trunk. It does not send or receive tagged traffic. The point of an PVLAN promisc host port is to connect to a device that should be accessible by any member of the associated secondary VLANs, community or isolated, but which is still treated as a host.
• A promiscuous PVLAN trunk port configured with switchport mode private-vlan trunk promiscuous is a trunk port that performs rewrites on PVLAN tags - it rewrites every secondary PVLAN ID to its associated primary PVLAN ID. This special trunk type allows extending the PVLAN to a VLAN-aware device that doesn't support PVLANs but at least can be made accessible to all hosts in all associated secondary VLANs.

So clearly, we cannot have gi1/0/1 act both as a PVLAN host and a trunk port - it can't be an access port and a trunk at the same time.

How we should configure it depends on the capability of the upstream device connected to it:

• If the upstream device is another switch supporting PVLANs, the port should be a normal trunk configured with switchport mode trunk - yes, a classic trunk port, nothing fancy.
• If the upstream device supports VLANs but not PVLANs, it makes sense to use the promisc PVLAN trunk port with switchport mode private-vlan trunk promiscuous and configure the upstream device with the primary PVLAN ID.

Additional details and config examples can be found here: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9600/software/release/17-4/configuration_guide/vlan/b_174_vlan_9600_cg/configuring_private_vlans.html

Best regards,
Peter