Broadcast Traffic In Private Vlans; Private Vlan Port Isolation; Guidelines And Limitations For Private Vlans; Configuring A Private Vlan - Cisco Nexus 5000 Series Configuration Manual

Broadcast Traffic in Private VLANs

Broadcast Traffic in Private VLANs
Broadcast traffic from ports in a private VLAN flows in the following ways:
• The broadcast traffic flows from a promiscuous port to all ports in the primary VLAN (which includes
• The broadcast traffic from an isolated port is distributed only to those promiscuous ports in the primary
• The broadcast traffic from community ports is distributed to all ports within the port's community and

Private VLAN Port Isolation

You can use private VLANs to control access to end stations as follows:
• Configure selected interfaces connected to end stations as isolated ports to prevent any communication.
• Configure interfaces connected to default gateways and selected end stations (for example, backup

Guidelines and Limitations for Private VLANs

When configuring private VLANs, follow these guidelines:
• You must have already created the VLAN before you can assign the specified VLAN as a private VLAN.
• You must enable private VLANs before the switch can apply the private VLAN functionality.
• You cannot disable private VLANs if the switch has any operational ports in a private VLAN mode.
• Enter the private-vlan synchronize command from within the Multiple Spanning Tree (MST) region
• Beginning with Cisco NX-OS Release 5.0(2)N2(1), the number of mappings on a private-vlan trunk

Configuring a Private VLAN

Enabling Private VLANs

You must enable private VLANs on the switch to use the private VLAN functionality.
Cisco Nexus 5000 Series NX-OS Layer 2 Switching Configuration Guide, Release 5.0(3)N1(1)
60
all the ports in the community and isolated VLANs). This broadcast traffic is distributed to all ports
within the primary VLAN, including those ports that are not configured with private VLAN parameters.
VLAN that are associated to that isolated port.
to all promiscuous ports that are associated to the community port. The broadcast packets are not
distributed to any other communities within the primary VLAN, or to any isolated ports.
For example, if the end stations are servers, this configuration prevents communication between the
servers.
servers) as promiscuous ports to allow all end stations access to a default gateway.
definition to map the secondary VLANs to the same MST instance as the primary VLAN.
port is limited to 16.
Configuring Private VLANs