Blog Home | INE Home | Members | Contact Us | Subscribe Free Resources View Archives All Access Pass Private VLANs 31 Understanding Posted by Petr Lapukhov, 4xCCIE/CCDE in Advanced Security,CCIE R&S,CCIE Security,Switching CCIE Bloggers Search Jan 31 Comments Search Submit You may want to see the updated version of this post at: http://blog.internetworkexpert.com/2008/07/14/private-vlans-revisited/ Categories — Select Category Private VLAN concepts are quite simple, but Cisco’s implemenation and configuration steps are a bit confusing – with all the “mappings” and “associations” stuff Here comes a short overview of how private VLANs work To begin with, let’s look at the concept of VLAN as a broadcast domain What Private VLANs (PVANs) do, is split the domain into multiple isolated broadcast subdomains It’s a simple nesting concept – VLANs inside a VLAN As we know, Ethernet VLANs are not allowed to communicate directly, they need L3 device to forward packets between broadcast domains The same concept applies to PVLANS – since the subdomains are isolated at level 2, they need to communicate using an upper level (L3 and packet forwarding) entity – such as router However, there is difference here Regular VLANs usually correspond to a single IP subnet When we split VLAN using PVLANs, hosts in different PVLANs still belong to the same IP subnet, but they need to use router (another L3 device) to talk to each other (for example, by means of local Proxy ARP) In turn, router may either permit or forbid communications between sub-VLANs using access-lists Why would anyone need Private VLANs? Commonly, this kind of configurations arise in “shared” environments, say ISP co-location, where it’s beneficial to put multiple customers into the same IP subnet, yet provide a good level of isolation between them For our sample configuration, we will take VLAN 100 and divide it into two PVLANs – sub-VLANs 101 and 102 Take the regular VLAN and call it primary (VLAN 100 in our example), then divide ports, assigned to this VLAN, by their types: Promiscuous (P): Usually connects to a router – a type of a port which is allowed to send and receive frames from any other port on the VLAN Isolated (I): This type of port is only allowed to communicate with P-ports – they are “stub” This type of ports usually connects to hosts Community (C): Community ports are allowed to talk to their buddies, sharing the same group (of course they can talk to P-ports) In order to implement sub-VLAN behavior, we need to define how packets are forwarded between different port types First comes the Primary VLAN – simply the original VLAN (VLAN 100 in our example) This type of VLAN is used to forward frames downstream from P-ports to all other port types (I and C ports) In essense, Primary VLAN entails all port in domain, but is only used to transport frames from router to hosts (P to I and C) Next comes Secondary VLANs, which correspond to Isolated and Community port groups They are used to transport frames in the opposite direction – from I and C ports to P-port Isolated VLAN: forwards frames from I ports to P ports Since Isolated ports not exchange frames with each other, we can use just ONE isolated VLAN to connect all I-Port to the P-port Community VLANs: Transport frames between community ports (C-ports) within to the same group (community) and forward frames uptstream to the P-ports of the primary VLAN This is how it works: Primary VLANs is used to deliver frames downstream from router to all hosts; Isolated VLAN transports frames from stub hosts upstream to the router; Community VLANs allow frames exchange withing a single group and also forward frames in upstream direction towards P-port All the basic MAC address learning and unknown unicast flooding princinples remain the same CCIE Bloggers Brian Dennis CCIE #2210 Routing & Sw itching ISP Dial Security Service Provider Voice Let’s move to the configuration part (Primary VLAN 100, Isolated VLAN 101 and Community VLAN 102) Step 1: Brian McGahan CCIE #8593 Routing & Sw itching Security Service Provider Create Primary and Secondary VLANs and group them into PVLAN domain: Petr Lapukhov CCIE #16379 ! Routing & Sw itching Security Service Provider Voice ! Creating VLANs: Primary, subject to subdivision ! vlan 100 Mark Snow CCIE #14073 private-vlan primary Voice Security ! ! Isolated VLAN: Connects all stub hosts to router Popular Posts ! vlan 101 CCNA R&S Exam Course and private-vlan isolated CCNA R&S Video Flashcards - ! Free Streaming Video Access! ! Community VLAN: allows a subVLAN within a Primary VLAN SO Many Voice Updates! ! New AAP Streaming Video vlan 102 Layout and Transcriptions private-vlan community ! ! Associating ! vlan 100 private-vlan assoc 101,102 What this step is needed for, is to group PVLANs into a domain and establish a formal association (for syntax checking and VLAN type verifications) Step 2: Configure host ports and bind them to the respective isolated PVLANs Note that a host port belongs to different VLANs at the same time: downstream primary and upstream secondary ! ! Isolated port (uses isoalated VLAN to talk to P-port) ! interface FastEthernet x/y switchport mode private-vlan host switchport private-vlan host-association 100 101 ! ! Community ports: use community VLAN ! interface range FastEthernet x/y - z switchport mode private-vlan host switchport private-vlan host-association 100 102 Step 3: Create a promiscuous port, and configure downstream mapping Here we add secondary VLANs for which traffic is received by this P-port Primary VLAN is used to send traffic downstream to all C/I ports as per their associations ! ! Router port ! interface FastEthernet x/y switchport mode private-vlan promisc switchport private-vlan mapping 100 add 101,102 if you need to configure an SVI on the switch, you should add an interface correspoding to Primary VLAN only Obviously that’s because of all secondary VLANs being simply “subordiantes” of primary In our case the config would look like this: interface Vlan 100 ip address 172.16.0.1 255.255.255.0 Lastly, there is another feature, worths to be mentioned, called protected port or Private VLAN edge The feature is pretty basic and avaiable even on low-end Cisco switches, allows to isolate ports in the same VLAN Specifically, all ports in a VLAN, marked as protected are prohibited from sending frames to each other (but still allowed to send frames to other (non-protected) ports within the same VLAN) Usually, ports configurated as protected, are also configured not to receive unknown unicast (frame with destination MAC address not in switch’s MAC table) and multicast frames flooding for added security Example: interface range FastEthernet 0/1 - switchport mode access switchport protected switchport block unicast switchport block multicast Tags: 3550, 3560, arp, association, ccie, community, isolated, mapping, private-vlan, promiscuous Download this page as a PDF About Petr Lapukhov, 4xCCIE/CCDE: Petr Lapukhov's career in IT begain in 1988 w ith a focus on computer programming, and progressed into netw orking w ith his first exposure to Novell NetWare in 1991 Initially involved w ith Kazan State University's campus netw ork support and UNIX system administration, he w ent through the path of becoming a netw orking consultant, taking part in many netw ork deployment projects Petr currently has over 12 years of experience w orking in the Cisco netw orking field, and is the only person in the w orld to have obtained four CCIEs in under tw o years, passing each on his first attempt Petr is an exceptional case in that he has been w orking w ith all of the technologies covered in his four CCIE tracks (R&S, Security, SP, and Voice) on a daily basis for many years When not actively teaching classes, developing self-paced products, studying for the CCDE Practical & the CCIE Storage Lab Exam, and completing his PhD in Applied Mathematics Find all posts by Petr Lapukhov, 4xCCIE/CCDE | Visit Website You can leave a response, or trackback from your own site 31 Responses to “Understanding Private VLANs” January 31, 2008 at 2:23 pm Internetwork Expert Blog: Private VLANs Demystified « CCIE Pursuit [ ] VLAN, PVLAN The Internetwork Expert blog continues to post excellent information and tutorials. The most recent post concerns private VLANs. This was a topic that confused the hell out of me at first. I read the configuration guide and [ ] Reply January 31, 2008 at 4:54 pm Ali Hasan The best explanation I have ever read about PVLANs that’s why i stick to Internetworkexpert Reply February 1, 2008 at 10:37 am michael This is a very good article Thanks for clearing up the confusion One thing the article forgot to mention and I have to state the obvious is that PVLANs require VTP mode to be Transparent Reply February 6, 2008 at 1:21 pm Siva This document is excellent……… Reply February 16, 2008 at 1:00 pm Joep Excellent explanation! You should be credited by CiscoPress, InternetworkExpert and all the others who leave bits and bytes out in their PVLAN explanation causing (complete) confusion I’ve added you to my IE favorites Reply February 16, 2008 at 1:02 pm Joep And now i realize this is the InternetworkExpert forum (thanks Google) so i should have left InternetworkExpert out of my comment above Reply Marc h 6, 2008 at 6:30 am prashant Very simple & straight to the point description Reply April 10, 2008 at 7:35 pm Separating Hosts in the Same VLAN Using Protected Ports « Network Enthusiast [ ] intro to private VLANs (with a little introduction to protected ports, as well), check out “Understanding Private VLANs” on the InternetworkExpert blog Posted by Nick Chandler Filed in [ ] Reply May 9, 2008 at 7:27 am Rukshy Thanku so much for such a straight & clear explanation Reply May 13, 2008 at 11:56 pm Marcus Yes, this article is very god, but i don’t understand one thing: on our port, witch is connect to router we configure : interface FastEthernet x/y switchport mode private-vlan promisc switchport private-vlan mapping 100 add 101,102 what i should configure on my router sub’s ? something like interface Fa 0/1.1 encaps dot 1q 101 ip add x.x.x.x interface fa 0/1.2 encaps dot 1q 102 ip add x.x.x.x Reply June 1, 2008 at 11:33 pm vishvanath good Reply July 23, 2008 at 3:42 am Muhammed thanks so much for clear explanation Reply July 29, 2008 at 10:20 am Progress Update - 29 July « South African Networker [ ] Came Across a really nice post regarding Private VLANs (PVLAN) today, if you’re interested take a look at Understanding Private VLANs [ ] Reply Oc tober 14, 2008 at 11:51 am RTFM Education » Blog Archive » A bunch of useful PVLAN Links [ ] http://blog.internetworkexpert.com/2008/01/31/understanding-private-vlans/ http://blog.internetworkexpert.com/2008/07/14/privatevlans-revisited/ http://www.mdh.se/netcenter/CT3870/vt-2007/forelas/Private_vlans.pdf [ ] Reply November 3, 2008 at 5:19 am Jim This is a good document, and gives a good quick start to those who cannot peice the intenet of the structure together from the cisco site I have a concern with “All the basic MAC address learning and unknown unicast flooding principles are the same” This needs to be clarified, even if in a secondard document If the certification exams test the very edge of our knowledge it would be good to know specifically how the switch does not pass the traffic to Isolated VLANS (as an example) or restated why if these priciples are exactly the same the switch does not simply the lookup and forward the frame Good work!! Thx, Jim Reply January 8, 2009 at 1:05 pm Nigero Thanks for the good information Very clear Reply January 25, 2009 at 4:49 am Sandipani It’s wonderful.A beautiful understanding about the subject Reply February 2, 2009 at 9:36 pm prasanna Still not clear why would someone want private vlan if you want to stop some of the devices communicate with each simply put them in different vlan Reply Marc h 6, 2009 at 7:08 pm Jerricho good and clear explanation Reply March 31, 2009 at 9:06 am Sriram Hi, I have private-Vlan host ports which are all in the same private VLAN.( Basically used for backup) I would like to create LACP channel with all these ports is this possible on Cisco Catalyst 6500 Switches? Thanks & Regards Sriram Reply May 29, 2009 at 3:19 pm NetStorming » Private VLANs [ ] en Wikipedia Me rsultó interesante también otra breve explicación en Cisco Press y un artÃculo en Internetwork Expert’s Categories: General Tags: cisco, switching, vlans Comentarios (0) Referencias (0) Dejar [ ] Reply September 14, 2009 at 4:32 am Ariel thank you very much for this article finally i understand how private vlan works! Reply November 18, 2009 at 7:33 pm Mathew Kumaly This is a good article ………… When i wah thinking about world end i get some information about vlan I was so exited to know that………… Reply June 22, 2010 at 1:39 am Andy Len Great, clear explanation on PVLANs, enough information to send to client with limited networking understanding Well done Petr! Reply August 6, 2010 at 1:07 am Nayak jayesh V IT’s really help me to understand this concept instead of books Reply August 11, 2010 at 1:46 am Sai Lwin Thu Thanks , it’s clear explanation Reply January 13, 2011 at 10:58 pm Jason Wang Excellent article Petr I will be attending your class in Chicago in a couple weeks Reply March 12, 2011 at 4:09 pm Sagar Karale Awesome Explanation!!! This is the 3rd time I am referring to this blog and every time I got the solution Very nice Reply April 22, 2011 at 9:10 am Roger We don’t need the mapping inside the SVI? Something like: interface Vlan 100 ip address 172.16.0.1 255.255.255.0 private-vlan mapping 101,102 Reply August 18, 2011 at 2:46 am sandeep than k u very much those who dont know anything they can know many things about pvlan.completly satisfied Reply September 23, 2011 at 6:25 am My CCIE Journey Has Officially Begun - Page [ ] MCSA:S 2k3,MCSE:S 2k3,MCITP:SA/EA CCNA:Security, CCNP Today 01:25 PM #173 Understanding Private VLANs | CCIE Blog Great explanation and configuration example for private vlans "Configure host ports and [ ] Reply Leave a Reply Name (required) Mail (will not be published) (required) Submit Comment CCNP Voice Trivia Contest :: CCD Dynamic Routing of DNs (Nice Prizes) http://t.co/McEw Nrmn twitter.com/inetraining Get a FREE Streaming CCNA R&S Exam Course or Dow nload for $99! http://t.co/tQmWMAsY Congratulations to our IEOC Community Winners for October 2011! Alexander Halim, Cristian Matei, JJ@E and NNN! http://t.co/zq0VifOk © 2011 INE, Inc., All Rights Reserved pdfcrowd.com