Introduction To Private Vlan Group - UTStarcom iSpirit 3026 Manual

4.1 Introduction to private VLAN group

The iSpirit 3026 switch can support 12 groups private VLANs, each of them represents a single
broadcast domain, i.e., there is only one subnet for a private VLAN group (we just use "group" in
later literature for simplicity.). A group has multiple contiguous VLANs and can provide port
isolation. Different groups represent different broadcast domain and thus are different subnets.
Communication between groups should go through Layer 3 transmission
This section describes private VLAN:
Port types of private VLAN
VLAN range of private VLAN
Private VLAN with normal VLAN
Subnet of private VLAN
1. Port types of private VLAN
There are three types of ports in private VLAN: promiscuous ports, shared ports and separated
ports. Promiscuous ports are uplink ports for a group, while shared ports and separated ports
are those that are isolated.
Promiscuous ports are uplink ports for a group, there should be at least one (can be more)
promiscuous port in a group. Promiscuous ports can have Layer 2 communication with all other
ports in the group, including promiscuous ports, shared ports and separated ports. In real
networks, they usually connect with shared data servers and up links to INTERNET.
Shared ports belong to isolated ports in a group. They have the concept of "grouping", i.e., one
or more shared ports can become a shared port group. In the iSpirit 3026 switch there can be a
maximum of 6 shared port groups in a VLAN group. Shared ports can communicate with
promiscuous ports and other ports in the same shared port group, but not with separated ports
and ports in other shared port groups. If there is only one port in a shared port group, this port is
actually a separated port.
Separated ports also belong to isolated ports in a VLAN group, they don't have the idea of
"grouping", and they are isolated from each other. Separated ports can only communicate with
promiscuous ports, but no with shared ports and other separated ports.
Isolated ports should exist for private VLAN, and there should be at least one separated port or
one shared port group in a VLAN group; If there is no separated port, there should be one or
more shared port group, and vice visa. But if there is only one separated port or one shared port
group in a VLAN group, there is actually no isolation. So in real networks, a VLAN group should
have at least two isolated ports.