Chapter 42 Configuring Private Vlan - Cisco Catalyst 4500 Series Configuration Manual

About Private VLANs
•
Purpose of a PVLAN
Using PVLANs provides scalability and IP address management benefits for service providers and
Layer 2 security for customers. PVLANs partition a regular VLAN domain into subdomains. A
subdomain is represented by a pair of VLANs: a primary VLAN and a secondary VLAN. A PVLAN can
have multiple VLAN pairs, one pair for each subdomain. All VLAN pairs in a PVLAN share the same
primary VLAN. The secondary VLAN ID differentiates one subdomain from another. See
Figure 42-1
The three types of secondary VLANs are as follows:
•
•
•
Note
A promiscuous port can serve only one primary VLAN, one isolated VLAN, and multiple community
(or twoway-community) VLANs. Layer 3 gateways are typically connected to the switch through a
promiscuous port.
Software Configuration Guide—Release IOS XE 3.3.0SG and IOS 15.1(1)SG
42-2
Private-VLAN Interaction with Other Features, page 42-8
Private-VLAN Domain
Private Private Private
VLAN VLAN VLAN
domain domain domain
Subdomain Subdomain
Secondary Secondary
community VLAN community VLAN
Isolated VLANs—Ports within an isolated VLAN cannot communicate with each other at the
Layer 2 level.
Community VLANs—Ports within a community VLAN can communicate with each other but
cannot communicate with ports in other communities at the Layer 2 level.
Twoway-Community VLANs—Bidirectional VLAN. Ports within a twoway-community VLAN can
communicate with each other but not with communities or twoway-communities at the Layer 2 level.
Beginning with Cisco IOS Release 15.0(2)SG, you can use a twoway-community VLAN to
apply VACLs or QoS in both directions per-community and per-customer.
Primary
VLAN
Subdomain Subdomain
Secondary Secondary
isolated VLAN or isolated VLAN or
Twoway-Community Twoway-Community
VLAN VLAN
Chapter 42 Configuring Private VLANs
Figure
OL-25340-01
42-1.