Reg private VLAN

[shibi.ravindran]

We have a special requirement. One of the  server (WEB server ) in DMZ should be restricted from accesssing other servers and also other servers should be restricted from accessing this particular server, I have created Private vlan as below.

vlan 10

private-vlan primary

private-vlan association 20,30

vlan 20

private-vlan isolated

vlan 30

private-vlan community

Then configured the port which the web server connected as ioslated vlan ,

switchport mode private-vlan host
switchport private-vlan host-association 10 20

rest of the ports where the other servers are connected configured as community vlan.

switchport mode private-vlan host

switchport private-vlan host-association 10 30

Now from the Webserver i can not communicate  to any of the servers which is one of the requirement.

But from other servers which is in the community vlan can access the webserver in isolated vlan  which is not acceptable !!!

Any solution to this will be highly appreciated....

Regards

[Dhavantharim]

Dear shibi

I have two questions in your scenario

could you clarify whether the webservers should communicate with other servers or not ?

Did you configure promiscus ports to carry the isolated vlan traffic ?

[shibi.ravindran]

Hi,

Yes we have configured promiscous, we dont need webserver to communicate with other servers and that is achieved by configured as isolated port , also other servers which are connected under community port should not talk to webserver. Will this be possible ??