TP-Link T1700X-16TS User Manual page 88

Private VLAN technology is mainly used in campus or enterprise networks to achieve user
Layer-2-separation and to save VLAN resources of uplink devices.
The Elements of a Private VLAN

Promiscuous port: A promiscuous port connects to and communicates with the uplink device.
The PVID of the promiscuous port is the same with the Primary VLAN ID. One promiscuous port
can only join to one Primary VLAN.
Host port: A host port connects to and communicates with terminal device. The PVID of the host
port is the same as the Secondary VLAN ID. One host port can only belong to one Private VLAN.
Primary VLAN: A Private VLAN has one Primary VLAN and one Secondary VLAN. Primary VLAN
is the user VLAN uplink device can identify, but it is not the actual VLAN the end user is in. Every
port in a private VLAN is a member of the primary VLAN. The primary VLAN carries unidirectional
traffic downstream from the promiscuous ports to the host ports and to other promiscuous ports.
Secondary VLAN: .Secondary VLAN is the actual VLAN the end user is in. Secondary VLANs are
associated with a primary VLAN, and are used to carry traffic from hosts to uplink devices. There
are two types of secondary VLANS:
Isolated VLAN－Members in an isolated VLAN are isolated with each other. Each

isolated VLAN must bind to a primary VLAN.
Community VLAN－Members in a community VLAN can communicate with each other

directly. Each community VLAN must bind to a primary VLAN.
Features of Private VLAN

1. A Private VLAN contains one Primary VLAN and one Secondary VLAN.
2. A VLAN cannot be set as the Primary VLAN and Secondary VLAN simultaneously.
3. A Secondary VLAN can only join one private VLAN.
4. A Primary VLAN can be associated with multi-Secondary VLANs to create multi-Private
VLANs.
 Private VLAN Implementation
To hide Secondary VLANs from uplink devices and save VLAN resources, Private VLAN
containing one Primary VLAN and one Secondary VLAN requires the following characteristics:
Packets from different Secondary VLANs can be forwarded to the uplink device via

promiscuous port and carry no corresponding Secondary VLAN information.
Packets from Primary VLANs can be sent to end users via host port and carry no Primary

VLAN information.
Private VLAN functions are implemented on the PVLAN Config and Port Config pages.
76