PVLAN over Trunk Ports

[vsurresh]

(Edited) Let’s assume I have two access switches and one distribution switch. The clients only connect to the access switches. The distribution switch connects to the firewall or router where the default gateway is located (router on a stick). I also have some other normal VLANs (100, 105, 110)

Suppose I have a primary VLAN 10 and an isolated VLAN 11 configured on both access switches.

My understanding is that I don’t need to create the PVLAN configs on the distribution switch, right? All I need to do is configure the following on the trunk between SW-01/SW02 and the distribution switch.

switchport trunk allowed vlan add 10, 100, 105, 110
switchport private-vlan mapping trunk 10 11
switchport mode private-vlan trunk promiscuous

Does this need to be configured on both sides of the trunk? (both access switch side and distribution switch side) This is where I'm confused.

On the other side, I can configure the same commands on the trunk between switch 2 and the firewall, right? (only on the switch 2 side, of course). Thanks in advance.

[paul driver]

Hello

---

@vsurresh wrote:

If the clients don’t connect directly to the distribution switch, my understanding is that I don’t need to create the PVLAN configs on switch 2, right? All I need to do is configure the following on the trunk between SW-01 and SW02.

---

Correct .. if you do not have Pvlan hosts on the dist switch then you do not need to create it on that sw

[vsurresh]

Thank you. Sorry, I modified the question slightly and added a diagram

[paul driver · Accepted solution]

Hello
Assuming all your host reside in a single flat address range and reside on both Sw01-02 which are access switches then you ONLY need Pvlan enabled on those switches, the trunk interconnects will be just L2 trunks.

[vsurresh]

Thank you