Zte ZXR10 5900E Product Description page 19

Protocol VLAN is set "enable" on the physical interface, and it can be disabled as
customer requires. It only classifies VLAN according to data packet label. It isolates
packets with different labels.
3.1.2.3 Subnet VLAN
Subnet VLAN is implemented in L2 VLAN, realizing data frame forwarding flexible.
Subnet VLAN determines the corresponding VLAN data will be forwarding according to
the source IP address of the data frame. This VLAN based upon the source IP address
enables users in different network segments cross multiple VLAN forwarding. But their
VLAN membership will still remain.
Subnet VLAN isolates data with different source IP addresses. So users can only get
data from the same network segment. The priority for UNTAG frame to forward subnet
VLAN is higher than protocol VLAN and PVID, TAG frame is forwarded in TAG mode,
and its priority is higher than subnet VLAN.
3.1.2.4 PVLAN
To enhance network security and isolate messages between users, each user will be
distributed with one VLAN traditionally. This method has the following obvious
drawbacks:

Currently 4094 VLANs are supported at most in IEEE 802.1Q standard. So the
limitation of the user number stops network extension.

Each VLAN is corresponding to one IP sub-net, so many subnets will cause the
waste of IP address.

The planning and management of so many VLAN and IP subnets make network
management more complicated.
PVLAN（Private VLAN） aims at solving these problems.
PVLAN divided VLAN port into two categories: Isolate Port connecting with user's port
and Promiscuous Port uplinking router. The isolate port which can't connect with each
other can only communicate with promiscuous port. Therefore, ports under the same
ZTE Confidential Proprietary
ZXR10 5900E Product Description
17