Cisco Catalyst 3650 series Command Reference Manual page 1073

switchport mode private-vlan
For more information about private-VLAN interaction with other features, see the software configuration
guide for this release.
We strongly recommend that you enable spanning tree Port Fast and bridge-protocol-data-unit (BPDU) guard
on isolated and community host ports to prevent STP loops due to misconfigurations and to speed up STP
convergence.
If you configure a port as a private-VLAN host port and you do not configure a valid private-VLAN association
by using the switchport private-vlan host-association command, the interface becomes inactive.
If you configure a port as a private-VLAN promiscuous port and you do not configure a valid private VLAN
mapping by using theswitchport private-vlan mapping command, the interface becomes inactive.
Examples
This example shows how to configure an interface as a private-VLAN host port and associate it to primary
VLAN 20. The interface is a member of secondary isolated VLAN 501 and primary VLAN 20.
Device(config)# interface gigabitethernet2/0/1
Device(config-if)# switchport mode private-vlan host
Device (config-if)# switchport private-vlan host-association 20 501
Device (config-if)# end
This example shows how to configure an interface as a private-VLAN promiscuous port and map it to a private
VLAN. The interface is a member of primary VLAN 20 and secondary VLANs 501 to 503 are mapped to it.
Device(config)# interface gigabitethernet2/0/1
Device(config-if)# switchport mode private-vlan promiscuous
Device (config-if)# switchport private-vlan mapping 20 501-503
Device (config-if)# end
Command Reference, Cisco IOS XE Everest 16.5.1a (Catalyst 3650 Switches)
1047