11 Private VLAN Configuration
11.1 Private VLAN Technology
If the service provider offers a VLAN to each subscriber, the service provider supports a
limited number of subscribers because one device supports 4096 VLANs at most. On the
layer 3 devices, each VLAN is assigned with a subnet address or a series of addresses,
which results in IP address waste. The Private VLAN technology is a solution to this
problem.
Private VLAN divides layer 2 broadcast domain of a VLAN into several sub-domains. Each
sub-domain consists of a private VLAN pair: Primary VLAN and Secondary VLAN.
One private VLAN domain can have multiple private VLAN pair, and each VLAN pair
represents a sub-domain. All the private VLAN pairs in one private VLAN domain share a
primary VLAN. Each sub-domain has a different secondary VLAN ID.
There is only one primary VLAN in each private VLAN domain. The secondary VLAN is used
to separate from layer 2 in the same private VLAN domain. There are two types of
secondary VLANs:
Isolated VLAN: Layer 2 communication is not implemented between the ports in the
same isolated VLAN. There is only one isolated VLAN in a private VLAN domain.
Community VLAN: The ports in the same community VLAN can perform layer 2
communication, but not with the ports in other community VLANs. There can be multiple
community VLANs in a private VLAN domains.
Promiscuous Port, a port in the primary VLAN, can communicate with any port, including the
isolated ports and community ports of the secondary VLAN in in the same private VLAN
domain.
Isolated Port, a port in the isolated VLAN, only communicate with the promiscuous port.
Community port is a port in the community VLAN. Community ports in the same community
VLAN can communication with each other, and they can also communicate with
promiscuous ports. They cannot communicate with the community ports in other community
VLANs and isolated ports in the isolated VLANs.
In a private VLAN, an SVI interface can be created for the primary VLAN only, instead of the
secondary VLAN.
A port in the private VLAN can be a SPAN source port instead of a mirrored destination port.
To Next Page
Loading...
Need help?
General