How to configure private VLANs on the
Cisco 3560 switch.
The private-VLAN feature addresses two
problems that service providers face when using VLANs:
•Scalability:
The switch supports up to 1005 active VLANs. If a service provider assigns one
VLAN per customer, this limits the numbers of customers that the service
provider can support.
•To enable IP
routing, each VLAN is assigned a subnet address space or a block of addresses,
which can waste the unused IP addresses and cause IP address management
problems.
Using private VLANs addresses the
scalability problem and provides IP address management benefits for service
providers and Layer 2 security for customers.
Private VLANs partition a regular VLAN
domain into subdomains and can have multiple VLAN pairs—one for each subdomain.
A subdomain is represented by a primary VLAN and a secondary VLAN.
There are two types of secondary VLANs:
•Isolated
VLANs—Ports within an isolated VLAN cannot communicate with each other at the
Layer 2 level.
•Community
VLANs—Ports within a community VLAN can communicate with each other but cannot
communicate with ports in other communities at the Layer 2 level.
Private VLANs provide Layer 2 isolation
between ports within the same private VLAN. Private-VLAN ports are access ports
that are one of these types:
•Promiscuous—A
promiscuous port belongs to the primary VLAN and can communicate with all
interfaces, including the community and isolated host ports that belong to the
secondary VLANs associated with the primary VLAN.
•Isolated—An
isolated port is a host port that belongs to an isolated secondary VLAN. It has
complete Layer 2 separation from other ports within the same private VLAN,
except for the promiscuous ports. Private VLANs block all traffic to isolated
ports except traffic from promiscuous ports. Traffic received from an isolated
port is forwarded only to promiscuous ports.
•Community—A
community port is a host port that belongs to a community secondary VLAN.
Community ports communicate with other ports in the same community VLAN and
with promiscuous ports. These interfaces are isolated at Layer 2 from all other
interfaces in other communities and from isolated ports within their private
VLAN.
Trunk ports carry traffic from regular
VLANs and also from primary, isolated, and community VLANs.
Primary and secondary VLANs have these
characteristics:
•Primary
VLAN—A private VLAN has only one primary VLAN. Every port in a private VLAN is
a member of the primary VLAN. The primary VLAN carries unidirectional traffic
downstream from the promiscuous ports to the (isolated and community) host
ports and to other promiscuous ports.
•Isolated VLAN
—A private VLAN has only one isolated VLAN. An isolated VLAN is a secondary
VLAN that carries unidirectional traffic upstream from the hosts toward the
promiscuous ports and the gateway.
•Community
VLAN—A community VLAN is a secondary VLAN that carries upstream traffic from
the community ports to the promiscuous port gateways and to other host ports in
the same community. You can configure multiple community VLANs in a private
VLAN.
A promiscuous port can serve only one
primary VLAN, one isolated VLAN, and multiple community VLANs. Layer 3 gateways
are typically connected to the switch through a promiscuous port. With a
promiscuous port, you can connect a wide range of devices as access points to a
private VLAN. For example, you can use a promiscuous port to monitor or back up
all the private-VLAN servers from an administration workstation.
In a switched environment, you can assign
an individual private VLAN and associated IP subnet to each individual or
common group of end stations. The end stations need to communicate only with a
default gateway to communicate outside the private VLAN.
You can use private VLANs to control access
to end stations in these ways:
•Configure
selected interfaces connected to end stations as isolated ports to prevent any
communication at Layer 2. For example, if the end stations are servers, this
configuration prevents Layer 2 communication between the servers.
•Configure
interfaces connected to default gateways and selected end stations (for
example, backup servers) as promiscuous ports to allow all end stations access
to a default gateway.
You can extend private VLANs across
multiple devices by trunking the primary, isolated, and community VLANs to
other devices that support private VLANs. To maintain the security of your
private-VLAN configuration and to avoid other use of the VLANs configured as
private VLANs, configure Cisco 3560X private VLANs on all intermediate devices, including
devices that have no private-VLAN ports.
