Private VLANs partitions a regular VLAN domain into subdomains. Such a subdomain is created when a primary VLAN is paired with a secondary VLAN. Only a switch in VTP Transparent mode supports Private VLANs
To set a VLAN as Primary VLAN, use:
After the secondary VLANs are configured, they are associated with the primary VLAN, using the following confing form withing the primary vlan:
Sw(config)#private-vlan association [add|remove] SECONDARY-VLAN-LIST
To verify, use:
Sw# show vlan private-vlan [type]
Secondary VLANs can be condfigured as Isolated or as Community VLANs. Private VLANs work over different switches, as long as the Private VLANs and the primary VLANs are carried over the trunk links.
Ports within the isolated VLAN cannot communicate with each other at Layer.
Sw(config-vlan)# private-vlan isolated
Ports within the Community VLAN can communicate with ports in the same Community VLAN but not with ports in other Community VLANs or with ports in the Isolated VLAN.
Sw(config-vlan)# private-vlan community
Private VLAN Ports
To configure a port as part of a private VLAN, use:
A promiscuous ports belongs to the primary VLAN and can communicate with all interfaces in the primary VLAN, including ports in the isolated and community secondary VLANs. To set up a promiscuous port, use: