Private Vlan Configuration Guidelines And Restrictions - Cisco 7604 Configuration Manual

Private VLAN Configuration Guidelines and Restrictions

Private VLANs and Unicast, Broadcast, and Multicast Traffic
In regular VLANs, devices in the same VLAN can communicate with each other at the Layer 2 level, but
devices connected to interfaces in different VLANs must communicate at the Layer 3 level. In private
VLANs, the promiscuous ports are members of the primary VLAN, while the host ports belong to
secondary VLANs. Because the secondary VLAN is associated to the primary VLAN, members of the
these VLANs can communicate with each other at the Layer 2 level.
In a regular VLAN, broadcasts are forwarded to all ports in that VLAN. Private VLAN broadcast
forwarding depends on the port sending the broadcast:
•
•
•
Multicast traffic is routed or bridged across private VLAN boundaries and within a single community
VLAN. Multicast traffic is not forwarded between ports in the same isolated VLAN or between ports in
different secondary VLANs.
Private VLANs and SVIs
A router virtual interface (SVI) is the Layer 3 interface of a Layer 2 VLAN. Layer 3 devices
communicate with a private VLAN only through the primary VLAN and not through secondary VLANs.
Configure Layer 3 VLAN SVIs only for primary VLANs. Do not configure Layer 3 VLAN interfaces
for secondary VLANs. SVIs for secondary VLANs are inactive while the VLAN is configured as a
secondary VLAN.
•
•
When the primary VLAN is associated with and mapped to the secondary VLAN, any configuration on
the primary VLAN is propagated to the secondary VLAN SVIs. For example, if you assign an IP subnet
to the primary VLAN SVI, this subnet is the IP subnet address of the entire private VLAN.
Private VLAN Configuration Guidelines and Restrictions
The guidelines for configuring private VLANs are described in the following sections:
•
•
•
Cisco 7600 Series Router Cisco IOS Software Configuration Guide, Release 12.2SX
15-6
An isolated port sends a broadcast only to the promiscuous ports or trunk ports.
A community port sends a broadcast to all promiscuous ports, trunk ports, and ports in the same
community VLAN.
A promiscuous port sends a broadcast to all ports in the private VLAN (other promiscuous ports,
trunk ports, isolated ports, and community ports).
If you try to configure a VLAN with an active SVI as a secondary VLAN, the configuration is not
allowed until you disable the SVI.
If you try to create an SVI on a VLAN that is configured as a secondary VLAN, and the secondary
VLAN is already mapped at Layer 3, the SVI is not created, and an error is returned. If the SVI is
not mapped at Layer 3, the SVI is created, but it is automatically shut down.
Secondary and Primary VLAN Configuration, page 15-7
Private VLAN Port Configuration, page 15-9
Limitations with Other Features, page 15-9
Chapter 15 Configuring Private VLANs
OL-4266-08