Private VLAN Tutorial V2

Today we’ll go over Private VLANs (PVLANs) in Cisco IOS. PVLANs segregate VLANs even further than normal, they are basically VLANs inside of VLANs. The ports share a subnet, but can be prevented from communicating. They use different port types:

Promiscuous ports – These will be the “open ports” of the PVLANs, they can communicate with all other ports.
 
Community ports – These ports can communicate with other community ports and promiscuous ports.
 
Isolated ports – These can ONLY communicate with promiscuous ports.
There are different uses for PVLANs. They are used by service providers to allow customer security while sharing a single subnet. Another use could be for DMZ hosts in an enterprise environment. If one host is compromised its ability to inflict damage to the other hosts will be severely limited. That’s the scenario we’ll be using today. This is our topology:



Here we see VLAN 50 as the primary (parent VLAN), then VLAN 51 is for community ports, and VLAN 52 is for isolate ports. In this example we have a Webserver (Gi0/5) and DB Server (Gi0/6) allowed to communicate with each other. Then we have two mailservers (Gi0/6, and Gi0/7) which are not allowed to communicate. We also have a router (Gi0/1) which will be our promiscuous port. Here’s the config:

vlan 50 private-vlan primary ! vlan 51 private-vlan community ! vlan 52 private-vlan isolated ! vlan 50 private-vlan association 51,52

Here we define our VLANs. VLAN 50 is the primary (basically parent) VLAN, then we have VLAN 51, which is for the community ports and VLAN 52, which is for the isolated ports. Now the interface config:

interface Gi0/5 switchport mode private-vlan host switchport private-vlan host-association 50 51 ! interface Gi0/6 switchport mode private-vlan host switchport private-vlan host-association 50 51 ! interface Gi0/7 switchport mode private-vlan host switchport private-vlan host-association 50 52 ! interface Gi0/8 switchport mode private-vlan host switchport private-vlan host-association 50 52 ! interface Gi0/1 switchport mode private-vlan promiscuous switchport private-vlan mapping 50 add 51,52

We have associated the appropriate interfaces with the appropriate VLANs. We also made the router’s port promiscuous.
Now let’s look at some show commands:

CORE#sh vlan private-vlan   Primary Secondary Type Ports ------- --------- ----------------- --------------------- 50 51 community Gi0/5, Gi0/6, Gi0/1 50 52 isolated Gi0/7, Gi0/8, Gi0/1   CORE#sh vlan private-vlan type   Vlan Type ---- ----------------- 50 primary 51 community 52 isolated

You can see both VLANs and that each port is where it should be also that the router’s port is in both the community and isolated VLANs.

We’re done. We have full communication between the Web and DB servers, while the two Mailservers can only communicate with the router. I hope someone finds this useful.