Configuring A Vlan As A Pvlan - Cisco 4500M Software Manual

Chapter 36 Configuring Private VLANs
•
•
•
•
•
•
•
•
•
•
•
•

Configuring a VLAN as a PVLAN

To configure a VLAN as a PVLAN, perform this task:
Command
Step 1
Switch# configure terminal
Step 2
Switch(config)# vlan vlan_ID
Switch(config-vlan)# private-vlan {community |
isolated | primary}
Step 3
Switch(config-vlan)# end
Step 4
Switch# show vlan private-vlan [type]
This example shows how to configure VLAN 202 as a primary VLAN and verify the configuration:
Switch# configure terminal
Switch(config)# vlan 202
Switch(config-vlan)# private-vlan primary
Switch(config-vlan)# end
Switch# show vlan private-vlan
OL-6696-01
You can apply different quality of service (QoS) configurations to primary, isolated, and community
VLANs. (See Chapter 29, "Configuring
interface of a primary VLAN automatically apply to the associated isolated and community VLANs.
On a PVLAN trunk port a secondary VLAN ACL is applied on ingress traffic and a primary VLAN
ACL is applied on egress traffic.
On a promiscuous port the primary VLAN ACL is applied on ingress traffic.
PVLAN trunk ports support only IEEE 802.1q encapsulation.
You cannot change the VTP mode to client or server for PVLANs.
An isolated or community VLAN can have only one primary VLAN associated with it.
VTP does not support PVLANs. You must configure PVLANs on each device where you want
PVLAN ports.
Community VLANs cannot be propagated or carried over private VLAN trunks.
ARP entries learned on Layer 3 PVLAN interfaces are termed "sticky" ARP entries (we recommend
that you display and verify PVLAN interface ARP entries).
For security reasons, PVLAN port sticky ARP entries do not age out. Connecting a device with a
different MAC address but with the same IP address generates an error message and the ARP entry
is not created.
Because PVLAN port sticky ARP entries do not age out, you must manually remove the entries if
you change the MAC address. To overwrite a sticky ARP entry, first delete the entry with the no arp
command, then overwrite the entry with the arp command.
In a DHCP environment, if you shut down your PC, it is not possible to give your IP address to
someone else. To solve this problem, the Catalyst 4500 series switch supports the no ip sticky-arp
command. This command promotes IP address overwriting and reuse in a DHCP environment.
QoS.") Cisco IOS ACLs applied to the Layer 3 VLAN
Purpose
Enters configuration mode.
Configures a VLAN as a PVLAN.
• This command does not take effect until you exit
VLAN configuration submode.
You can use the no keyword to clear PVLAN status.
•
Exits VLAN configuration mode.
Verifies the configuration.
Software Configuration Guide—Release 12.2(25)EW
How to Configure PVLANs
36-5