Secondary And Primary Vlan Configuration - Cisco 7604 Configuration Manual

Chapter 15 Configuring Private VLANs

Secondary and Primary VLAN Configuration

When configuring private VLANs consider these guidelines:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
OL-4266-08
After you configure a private VLAN and set VTP to transparent mode, you are not allowed to change
the VTP mode to client or server. For information about VTP, see
You must use VLAN configuration (config-vlan) mode to configure private VLANs. You cannot
configure private VLANs in VLAN database configuration mode. For more information about
VLAN configuration, see
After you have configured private VLANs, use the copy running-config startup config privileged
EXEC command to save the VTP transparent mode configuration and private VLAN configuration
in the startup-config file. If the router resets it must default to VTP transparent mode to support
private VLANs.
VTP does not propagate a private VLAN configuration. You must configure private VLANs on each
device where you want private VLAN ports.
You cannot configure VLAN 1 or VLANs 1002 to 1005 as primary or secondary VLANs. Extended
VLANs (VLAN IDs 1006 to 4094) can belong to private VLANs. Only Ethernet VLANs can be
private VLANs.
A primary VLAN can have one isolated VLAN and multiple community VLANs associated with it.
An isolated or community VLAN can have only one primary VLAN associated with it.
When a secondary VLAN is associated with the primary VLAN, the STP parameters of the primary
VLAN, such as bridge priorities, are propagated to the secondary VLAN. However, STP parameters
do not necessarily propagate to other devices. You should manually check the STP configuration to
ensure that the primary, isolated, and community VLANs' spanning tree topologies match so that
the VLANs can properly share the same forwarding database.
If you enable MAC address reduction on the router, we recommend that you enable MAC address
reduction on all the devices in your network to ensure that the STP topologies of the private VLANs
match.
In a network where private VLANs are configured, if you enable MAC address reduction on some
devices and disable it on others (mixed environment), use the default bridge priorities to make sure
that the root bridge is common to the primary VLAN and to all its associated isolated and
community VLANs. Be consistent with the ranges employed by the MAC address reduction feature
regardless of whether it is enabled on the system. MAC address reduction allows only discrete levels
and uses all intermediate values internally as a range. You should disable a root bridge with private
VLANs and MAC address reduction, and configure the root bridge with any priority higher than the
highest priority range used by any nonroot bridge.
You cannot apply VACLs to secondary VLANs. (See
You can enable DHCP snooping on private VLANs. When you enable DHCP snooping on the
primary VLAN, it is propagated to the secondary VLANs. If you configure DHCP on a secondary
VLAN, the configuration does not take effect if the primary VLAN is already configured.
We recommend that you prune the private VLANs from the trunks on devices that carry no traffic
in the private VLANs.
You can apply different quality of service (QoS) configurations to primary, isolated, and community
VLANs. (See Chapter 41, "Configuring PFC
When you configure private VLANs, sticky Address Resolution Protocol (ARP) is enabled by
default, and ARP entries learned on Layer 3 private VLAN interfaces are sticky ARP entries. For
security reasons, private VLAN port sticky ARP entries do not age out. For information about
configuring sticky ARP, see the
Cisco 7600 Series Router Cisco IOS Software Configuration Guide, Release 12.2SX
Private VLAN Configuration Guidelines and Restrictions
"VLAN Configuration Options" section on page
QoS".)
"Configuring Sticky ARP" section on page
Chapter 13, "Configuring VTP."
14-9.
Chapter 35, "Configuring VLAN
36-34.
ACLs".)
15-7