Cisco CCNP SWITCH Private VLANs & EtherChannel

Cisco CCNP SWITCH Private VLANS

Service providers often have devices from multiple clients, in addition to their own servers, on a single Demilitarized Zone (DMZ) segment or VLAN. As security issues proliferate, it becomes necessary to provide traffic isolation between devices, even though they may exist on the same Layer 3 segment and VLAN. Catalyst 6500/4500/3750 switches implement PVLANs to keep some switch ports shared and some switch ports isolated, although all ports exist on the same VLAN. The 2950/2960 and 3550/3560 support “protected ports,” which are functionality similar to PVLANs on a per-switch basis.

Cisco CCNP SWITCH PVLAN Port Types

Isolated: An isolated port has complete Layer 2 separation from other ports within the same PVLAN, except for the promiscuous port. PVLANs block all traffic to isolated ports, except the traffic from promiscuous ports. Traffic received from an isolated port is forwarded to only promiscuous ports.

Promiscuous: A promiscuous port can communicate with all ports within the PVLAN, including the community and isolated ports. The default gateway for the segment would likely be hosted on a promiscuous port, given that all devices in the PVLAN will need to communicate with that port.

Community: Community ports communicate among themselves and with their promiscuous ports. These interfaces are isolated at Layer 2 from all other interfaces in other communities, or in isolated ports within their PVLAN.

PVLAN ports are associated with a set of supporting VLANs that are used to create the PVLAN structure. A PVLAN uses VLANs in three ways:

As a primary VLAN: Carries traffic from promiscuous ports to isolated, community, and other promiscuous ports in the same primary VLAN.

As an isolated VLAN: Carries traffic from isolated ports to a promiscuous port.

As a community VLAN: Carries traffic between community ports and to promiscuous ports. You can configure multiple community VLANs in a PVLAN.

Isolated and community VLANs are called secondary VLANs. You can extend PVLANs across multiple devices by trunking the primary, isolated, and community VLANs to other devices that support PVLANs.

Cisco CCNP SWITCH Configuring PVLANs

Basic steps to congfigure PVLANs.

– Set VTP mode to transparent.

– Create the secondary VLANs.

– Isolated and community VLANs are secondary VLANs.

– Create the primary VLAN.

– Associate the secondary VLAN with the primary VLAN. Only one isolated VLAN can be mapped to a primary VLAN, but more than one community VLAN can be mapped to a primary VLAN.

– Configure an interface as an isolated or community port.

– Associate the isolated port or community port with the primary-secondary VLAN pair.

– Configure an interface as a promiscuous port.

-Map the promiscuous port to the primary-secondary VLAN pair.

– Use these commands to configure a VLAN as a PVLAN:

Switch(config)#vlan vlan_ID
Switch(config-vlan)#