Private Vlan Configuration Guidelines - Cisco WS-C4003 - Catalyst 4000 Chassis Switch Software Configuration Manual

Chapter 10 Configuring VLANs

Private VLAN Configuration Guidelines

Follow these guidelines to configure private VLANs:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
78-12647-02
Designate one VLAN as the primary VLAN.
Designate one VLAN as an isolated VLAN. If you want to use private VLAN communities, you
need to designate a community VLAN for each community.
Bind the isolated and/or community VLAN(s) to the primary VLAN and assign the isolated or
community ports. You will achieve these results:
– Isolated/community VLAN spanning tree properties are set to those of the primary VLAN.
– VLAN membership becomes static.
Access ports become host ports.
–
BPDU guard protection is activated.
–
Set up the automatic VLAN translation that maps the isolated and community VLANs to the primary
VLAN on the promiscuous port(s). Set nontrunk ports as promiscuous ports.
You must set VTP to transparent mode.
Once you configure a private VLAN, you cannot change the VTP mode to client or server mode,
because VTP does not support private VLAN types and mapping propagation.
You can configure VLANs as primary, isolated, or community only if no access ports are currently
assigned to the VLAN. Enter the show port command to verify that the VLAN has no access ports
assigned to it.
An isolated or community VLAN can have only one primary VLAN associated with it.
Private VLANs can use VLANs 2 through 1000.
If you delete either the primary or isolated VLAN, the ports associated with the VLAN become
inactive.
When configuring private VLANs, note the hardware and software restrictions:
– You can use the sc0 interface in a private VLAN assinged to either an isolated or community
VLAN, but not as a promiscuous port to a primary VLAN.
– You cannot set private VLAN ports to trunking mode or channeling or have dynamic VLAN
memberships.
If you attempt such a configuration, a warning message displays and the command is rejected.
Isolated and community ports should run BPDU guard features to prevent spanning tree loops due
to misconfigurations.
Primary VLANs and associated isolated/community VLANs must have the same spanning tree
configuration. This configuration maintains consistent spanning tree topologies among associated
primary, isolated, and community VLANs and avoids connectivity loss. These priorities and
parameters automatically propagate from the primary VLAN to isolated and community VLANs.
You can create private VLANs that run in MISTP mode.
– If you disable MISTP, any change to the configuration of a private VLAN propagates to all
corresponding isolated and community VLANs, and you cannot change the isolated or
community VLANs.
– If you enable MISTP, you can only configure the MISTP instance with the private VLAN.
Changes are applied to the primary VLAN and propagate to isolated and community VLANs.
Software Configuration Guide—Catalyst 4000 Family, Catalyst 2948G, Catalyst 2980G, Releases 6.3 and 6.4
Configuring Private VLANs
10-9