CCNA Basics: Introduction to Private VLANs

Today I am going to talk about the basic information followed by the basic configuration of the private VLANs. A Private VLAN gives us the  opportunity to divide a VLAN into Sub VLANs. In the case of PVLAN, a normal VLAN is mapped on Secondary VLANs. 

This helps us to restrict devices being connected in the same normal VLAN (subnet) to communicate with each other.Private VLANs can be configured to different characteristics such as “Community”, “Isolated” and “promiscuous”. 

Fig-1.1- Sample topology showing Private VLANs

Community : The community state will enable communication between client ports if they are in the same community VLAN. 

Isolated : The isolated port will only be able to send data to the promiscuous port, regardless of clients belonging in the same VLAN. 

Promiscuous Port: The promiscuous port will be able to receive data from all ports, this port should be connected to a gateway of some sort in order to let all the different ports out of the network 

Below is the diagram showing the concept of the Private VLANs which includes Community and Isolated VLANs and also covers the concept of the Promiscuous port in the network.

Let's talk about the basic configuration in the network showing the Private VLANs which include the Community and the isolated Private VLANs.

NDNA(config)# vtp mode transparent
NDNA(config)# vlan 102
NDNA(config-vlan)# private-vlan isolated
NDNA(config)# vlan 101
NDNA(config-vlan)#private-vlan community
NDNA(config-vlan)# vlan 100
NDNA(config-vlan)# private-vlan primary
NDNA(config-vlan)# private-vlan association 101 102

Our Configuration looks like as below. Please make a note that IP address used here are only for the testing purposes and has no relevance with any of the enterprise networks.

vlan 100
private-vlan primary
private-vlan association 101 102
vlan 101
private-vlan community
vlan 102
private-vlan isolated

Let's Configure the association of the ports 

NDNA(config)# interface ge0/1
NDNA(config-if)# Switchport mode private-vlan promiscuous
NDNA(config-if)# Switchport private-vlan mapping 100 101 102

NDNA(config)# interface range ge0/2-ge0/3
NDNA(config-if)# Switchport mode private-vlan host
NDNA(config-if)# Switchport private-vlan host-association 100 101
NDNA(config)# interface range ge0/4-ge0/5
NDNA(config-if)# Switchport mode private-vlan host
NDNA(config-if)# Switchport private-vlan host-association 100 102

Let's check all the interface status 

NDNA# show interface status
Port      Name               Status       Vlan       Duplex  Speed Type
Gi0/1                        connected    100        a-full  a-100 10/100BaseTX
Gi0/2                        connected    100,101 a-full  a-100 10/1000BaseTX
Gi0/3                        connected    100,101 a-full  a-100 10/100BaseTX
Gi0/4                        connected    100,102 a-full  a-100 10/100BaseTX
Gi0/5                        connected    100,102 a-full  a-100 10/100BaseTX

No comments