Cisco Catalyst 4500 Series Command Reference Manual page 624

private-vlan
The secondary_vlan_list parameter cannot contain spaces; it can contain multiple comma-separated
items. Each item can be a single private VLAN ID or a range of private VLAN IDs separated by hyphens.
The secondary_vlan_list parameter can contain multiple community VLAN IDs.
The secondary_vlan_list parameter can contain only one isolated VLAN ID. A private VLAN is defined
as a set of private ports characterized by a common set of VLAN number pairs: each pair is made up of
at least two special unidirectional VLANs and is used by isolated ports or by a community of ports to
communicate with the switches.
An isolated VLAN is a VLAN that is used by the isolated ports to communicate with the promiscuous
ports. The isolated VLAN traffic is blocked on all other private ports in the same VLAN and can be
received only by the standard trunking ports and the promiscuous ports that are assigned to the
corresponding primary VLAN.
A community VLAN is the VLAN that carries the traffic among the community ports and from the
community ports to the promiscuous ports on the corresponding primary VLAN. A community VLAN
is not allowed on a private VLAN trunk.
A promiscuous port is a private port that is assigned to a primary VLAN.
A primary VLAN is a VLAN that is used to convey the traffic from the switches to the customer end
stations on the private ports.
You can specify only one isolated vlan-id value, while multiple community VLANs are allowed. You
can only associate isolated and community VLANs to one VLAN. The associated VLAN list may not
contain primary VLANs. Similarly, a VLAN that is already associated to a primary VLAN cannot be
configured as a primary VLAN.
The private-vlan commands do not take effect until you exit the config-VLAN submode.
If you delete either the primary or secondary VLAN, the ports that are associated with the VLAN become
inactive.
Refer to the Catalyst 4500 Series Switch Cisco IOS Software Configuration Guide for additional
configuration guidelines.
Examples This example shows how to configure VLAN 202 as a primary VLAN and verify the configuration:
Switch# configure terminal
Switch(config)# vlan 202
Switch(config-vlan)# private-vlan primary
Switch(config-vlan)# end
Switch# show vlan private-vlan
Primary Secondary Type
------- --------- ----------------- ------------------------------------------
202
This example shows how to configure VLAN 303 as a community VLAN and verify the configuration:
Switch# configure terminal
Switch(config)# vlan 303
Switch(config-vlan)# private-vlan community
Switch(config-vlan)# end
Switch# show vlan private-vlan
Primary Secondary Type
------- --------- ----------------- ------------------------------------------
202
This example shows how to configure VLAN 440 as an isolated VLAN and verify the configuration:
Catalyst 4500 Series Switch Cisco IOS Command Reference—Release IOS XE 3.4.0SG and IOS 15.1(2)SG)
2-566
primary
primary
303 community
Chapter 2 Cisco IOS Commands for the Catalyst 4500 Series Switches
Interfaces
Interfaces
OL-27596 -01