Secondary And Primary Vlan Configuration - Cisco Nexus 9000 Series Configuration Manual

Configuring Private VLANs Using NX-OS
• To change the private port mode to non-PVLAN port mode, you must enter the default interface

Secondary and Primary VLAN Configuration

Follow these guidelines when configuring secondary or primary VLANs in private VLANs:
• You cannot configure the default VLAN (VLAN1) or any of the internally allocated VLANs as primary
• You must use VLAN configuration (config-vlan) mode to configure private VLANs.
• A primary VLAN can have only one isolated VLAN associated with it, however it can have multiple
• Although private VLANs provide host isolation at Layer 2, hosts can communicate with each other at
• A PVLAN group can have at most one isolated VLAN. Multiple isolated VLAN configurations per
• When a secondary VLAN is associated with the primary VLAN, the STP parameters of the primary
• For normal trunk ports, note the following:
• For nontrunking ports, note the following:
We recommend that you enable BPDU Guard on all ports that you configure as a host port; do not enable
Note
this feature on promiscuous ports.
• For private VLAN promiscuous trunk ports, note the following:
does not make the association under the PVLAN become operational. You need to apply the association
again under the PVLAN.
command and then configure non-PVLAN port mode under the interface.
or secondary VLANs.
community VLANs associated with it. An isolated or community VLAN can be associated with only
one primary VLAN.
Layer 3.
primary VLAN configurations are not supported.
VLAN, such as bridge priorities, are propagated to the secondary VLAN. However, STP parameters do
not necessarily propagate to other devices. You should manually check the STP configuration to ensure
that the spanning tree topologies for the primary, isolated, and community VLANs match exactly so
that the VLANs can properly share the same forwarding database.
◦ There is a separate instance of STP for each VLAN in the private VLAN.
◦ STP parameters for the primary and all secondary VLANs must match.
◦ The primary and all associated secondary VLANs should be in the same MST instance.
◦ STP is aware only of the primary VLAN for any private VLAN host port; STP runs only on the
primary VLAN for all private VLAN ports.
• You can configure a maximum of 16 private VLAN primary and secondary VLAN pairs on each
promiscuous trunk port.
Cisco Nexus 9000 Series NX-OS Layer 2 Switching Configuration Guide, Release 7.x
Secondary and Primary VLAN Configuration
53