Information About Private Vlans; Private Vlan Overview; Primary And Secondary Vlans In Private Vlans - Cisco Nexus 7000 Series Configuration Manual

Information About Private VLANs

Information About Private VLANs

A Layer 2 port can function as either a trunk port, an access port, or a private VLAN port.
Note
You must enable the private VLAN feature before you can configure this feature.
Note
In certain instances where similar systems do not need to interact directly, private VLANs provide additional
protection at the Layer 2 level. Private VLANs are an association of primary and secondary VLANs.
A primary VLAN defines the broadcast domain with which the secondary VLANs are associated. The secondary
VLANs may either be isolated VLANs or community VLANs. Hosts on isolated VLANs communicate only
with associated promiscuous ports in primary VLANs, and hosts on community VLANs communicate only
among themselves and with associated promiscuous ports but not with isolated ports or ports in other community
VLANs.
In configurations that use integrated switching and routing functions, you can assign a single Layer 3 VLAN
network interface to each private VLAN to provide routing. The VLAN network interface is created for the
primary VLAN. In such configurations, all secondary VLANs communicate at Layer 3 only through a mapping
with the VLAN network interface on the primary VLAN. Any VLAN network interfaces previously created
on the secondary VLANs are put out-of-service.

Private VLAN Overview

You must enable private VLANs before the device can apply the private VLAN functionality.
You cannot disable private VLANs if the device has any operational ports in a private VLAN mode.
Note You must have already created the VLAN before you can convert the specified VLAN to a private VLAN,
either primary or secondary.

Primary and Secondary VLANs in Private VLANs

The private VLAN feature addresses two problems that users encounter when using VLANs:
• Each VDC supports up to 4096 VLANs. If a user assigns one VLAN per customer, the number of
• To enable IP routing, each VLAN is assigned with a subnet address space or a block of addresses, which
Using private VLANs solves the scalability problem and provides IP address management benefits and Layer 2
security for customers.
The private VLAN feature allows you to partition the Layer 2 broadcast domain of a VLAN into subdomains.
A subdomain is represented by a pair of private VLANs: a primary VLAN and a secondary VLAN. A private
Cisco Nexus 7000 Series NX-OS Layer 2 Switching Configuration Guide, Release 5.x
54
customers that the service provider can support is limited.
can result in wasting the unused IP addresses and creating IP address management problems.
Configuring Private VLANs Using NX-OS