Configuring Private Vlans - HP 9304m Installation And Getting Started Manual

Installation and Getting Started Guide
HP9300F(config-vlan-103)# exit
HP9300F(config)# vlan 104 by port
HP9300F(config-vlan-104)# tagged ethernet 2/1
HP9300F(config-vlan-104)# untagged ethernet 1/4
HP9300F(config-vlan-104)# exit
HP9300F(config)# vlan 105 by port
HP9300F(config-vlan-105)# tagged ethernet 2/1
HP9300F(config-vlan-105)# untagged ethernet 1/5
HP9300F(config-vlan-105)# exit
HP9300F(config)# write memory

Configuring Private VLANs

A private VLAN is a VLAN that has the properties of standard Layer 2 port-based VLANs but also provides
additional control over the packets that go in and out of the VLAN. Figure 7.18 shows an example of an
application using a private VLAN.
Figure 7.18 Private VLAN used to secure communication between a workstation and servers
Firewall
This example uses a private VLAN to secure traffic between hosts and the rest of the network through a firewall.
Five ports in this example are members of a private VLAN. The first port (port 3/2) is attached to a firewall. The
next four ports (ports 3/5, 3/6, 3/9, and 3/10) are attached to hosts that rely on the firewall to secure traffic between
the hosts and the rest of the network. In this example, two of the hosts (on ports 3/5 and 3/6) are in a community
private VLAN, and thus can communicate with one another as well as through the firewall. The other two hosts
(on ports 3/9 and 3/10), are in an isolated VLAN and thus can communicate only through the firewall. The two
hosts are secured from communicating with one another at Layer 2, even though they are in the same VLAN.
7 - 48
A private VLAN secures traffic
between a primary port and host
ports.
Traffic between the hosts and
the rest of the network must
travel through the primary port.
VLAN 7 VLAN 901, 903
primary community
3/2
Private VLAN
Port-based VLAN
Forwarding among
private VLAN ports
VLAN 902
isolated
3/5 3/6 3/9 3/10