Broadcast Traffic In Private Vlans; Private Vlan Port Isolation; Guidelines And Limitations For Private Vlans - Cisco Nexus 3000 Series Configuration Manual

Configuring Private VLANs
• The primary VLAN must exist and be configured as a primary VLAN.
• The secondary VLAN must exist and be configured as either an isolated or community VLAN.
Note Use the show vlan private-vlan command to verify that the association is operational. The switch does
not display an error message when the association is nonoperational.
If you delete either the primary or secondary VLAN, the ports that are associated with the VLAN become
inactive. Use the no private-vlan command to return the VLAN to the normal mode. All primary and secondary
associations on that VLAN are suspended, but the interfaces remain in PVLAN mode. When you convert the
VLAN back to PVLAN mode, the original associations are reinstated.
If you enter the no vlan command for the primary VLAN, all PVLAN associations with that VLAN are
deleted. However, if you enter the no vlan command for a secondary VLAN, the PVLAN associations with
that VLAN are suspended and are restored when you recreate the specified VLAN and configure it as the
previous secondary VLAN.
In order to change the association between a secondary and primary VLAN, you must first remove the current
association and then add the desired association.

Broadcast Traffic in Private VLANs

Broadcast traffic from ports in a private VLAN flows in the following ways:
• The broadcast traffic flows from a promiscuous port to all ports in the primary VLAN (which includes
• The broadcast traffic from an isolated port is distributed only to those promiscuous ports in the primary
• The broadcast traffic from community ports is distributed to all ports within the port's community and

Private VLAN Port Isolation

You can use PVLANs to control access to end stations as follows:
• Configure selected interfaces connected to end stations as isolated ports to prevent any communication.
• Configure interfaces connected to default gateways and selected end stations (for example, backup

Guidelines and Limitations for Private VLANs

When configuring PVLANs, follow these guidelines:
OL-29545-03
all the ports in the community and isolated VLANs). This broadcast traffic is distributed to all ports
within the primary VLAN, including those ports that are not configured with private VLAN parameters.
VLAN that are associated to that isolated port.
to all promiscuous ports that are associated to the community port. The broadcast packets are not
distributed to any other communities within the primary VLAN or to any isolated ports.
For example, if the end stations are servers, this configuration prevents communication between the
servers.
servers) as promiscuous ports to allow all end stations access to a default gateway.
Cisco Nexus 3000 Series NX-OS Layer 2 Switching Configuration Guide, Release 6.x
Broadcast Traffic in Private VLANs
23