Private Vlan - Dell PowerConnect B-RX Configuration Manual

11
Private VLANs
Syntax: [no] pvlan type community | isolated | primary
Syntax: [no] pvlan mapping <vlan-id> ethernet <portnum>
The untagged command adds the ports to the VLAN.
The pvlan type command specifies that this port-based VLAN is a private VLAN. Specify primary as
the type.
The pvlan mapping command identifies the other private VLANs for which this VLAN is the primary.
The command also specifies the primary VLAN ports to which you are mapping the other private
VLANs.
•
•
Enabling broadcast, multicast or unknown unicast traffic to the private
VLAN
To enhance private VLAN security, the primary private VLAN does not forward broadcast or
unknown unicast packets to its community and isolated VLANs. For example, if port 3/2 in
Figure 30
packet to the other private VLAN ports (3/5, 3/6, 3/9, and 3/10).
This forwarding restriction does not apply to traffic from the private VLAN. The primary port does
forward broadcast and unknown unicast packets that are received from the isolated and
community VLANs. For example, if the host on port 3/9 sends an unknown unicast packet, port 3/2
forwards the packet to the firewall.
If you want to remove the forwarding restriction, you can enable the primary port to forward
broadcast or unknown unicast traffic, if desired, using the following CLI method. You can enable or
disable forwarding of broadcast or unknown unicast packets separately.
Using the CLI
To configure the ports in the primary VLAN to forward broadcast, multicast or unknown unicast
traffic received from sources outside the private VLAN, enter the following commands at the global
CONFIG level of the CLI.
BigIron RX(config)# pvlan-preference broadcast flood
BigIron RX(config)# pvlan-preference unknown-unicast flood
These commands enable forwarding of broadcast, multicast and unknown-unicast packets to ports
within the private VLAN. To again disable forwarding, enter a command such as the following.
BigIron RX(config)# no pvlan-preference broadcast flood
This command disables forwarding of broadcast packets within the private VLAN.
Syntax: [no] pvlan-preference broadcast | unknown-unicast flood
310
The <vlan-id> parameter specifies another private VLAN. The other private VLAN you want to
specify must already be configured.
The ethernet <portnum> parameter specifies the primary VLAN port to which you are mapping
all the ports in the other private VLAN (the one specified by <vlan-id>).
on page 306 receives a broadcast packet from the firewall, the port does not forward the
BigIron RX Series Configuration Guide
53-1001810-01