Private Vlan Port Configuration; Limitations With Other Features - Cisco Nexus 7000 Series Configuration Manual

Configuring Private VLANs Using NX-OS
You must keep the same VACLs for the primary VLAN and all secondary VLANs in the private VLAN.
Note
• You can enable DHCP snooping on private VLANs. When you enable DHCP snooping on the primary
• Before you configure a VLAN as a secondary VLAN, you must shut down the VLAN network interface
• To prevent interhost communication in isolated private VLANs with a promiscuous port, configure a

Private VLAN Port Configuration

Follow these guidelines when configuring private VLAN ports:
• The Layer 2 access ports that are assigned to the VLANs that you configure as primary, isolated, or
• If you delete a VLAN used in the private VLAN configuration, the private VLAN ports that are associated

Limitations with Other Features

Consider these configuration limitations with other features when configuring private VLANs:
In some cases, the configuration is accepted with no error messages, but the commands have no effect.
Note
• IGMP runs only on the primary VLAN and uses the configuration of the primary VLAN for all secondary
• Any IGMP join request in the secondary VLAN is treated as if it is received in the primary VLAN.
• Private VLANs support these Switched Port Analyzer (SPAN) features:
• Private VLAN host or promiscuous ports cannot be a SPAN destination port.
• A destination SPAN port cannot be an isolated port. (However, a source SPAN port can be an isolated
• You can configure SPAN to span both primary and secondary VLANs or to span either one if the user
VLAN, the DHCP configuration is propagated to the secondary VLANs. If you configure DHCP on a
secondary VLAN, the configuration does not take effect if the primary VLAN is already configured.
for the secondary VLAN.
role-based ACL (RBACL) that disallows hosts in that subnet from communicating with each other.
community VLANs are inactive while the VLAN is part of the private VLAN configuration. Layer 2
trunk interfaces, which may carry private VLANs, are active and remain part of the STP database.
with the VLAN become inactive.
VLANs.
◦ You can configure a private VLAN port as a SPAN source port.
◦ You can use VLAN-based SPAN (VSPAN) on primary, isolated, and community VLANs or use
SPAN on only one VLAN to separately monitor egress or ingress traffic.
port.)
is interested only in ingress or egress traffic.
Cisco Nexus 7000 Series NX-OS Layer 2 Switching Configuration Guide, Release 5.x
Private VLAN Port Configuration
63