Private VLANs (PVLAN) | 795
37
Private VLANs (PVLAN)
The Private VLANs (PVLAN) feature is supported on platforms c s z
For syntax details on the commands discussed in this chapter, see the Private VLANs Commands chapter
in the
FTOS Command Line Reference.
This chapter contains the following major sections:
• Private VLAN Concepts on page 795
• Private VLAN Commands on page 797
• Private VLAN Configuration Task List on page 798
• Private VLAN Configuration Example on page 801
• Inspecting the Private VLAN Configuration on page 802
Private VLANs extend the FTOS security suite by providing Layer 2 isolation between ports within the
same VLAN. A private VLAN partitions a traditional VLAN into subdomains identified by a
primary and
secondary VLAN pair. Private VLANs block all traffic to isolated ports except traffic from promiscuous
ports. Traffic received from an isolated port is forwarded only to promiscuous ports or trunk ports.
Example uses of PVLANs:
• A hotel can use an isolated VLAN in a private VLAN to provide Internet access for its guests, while
stopping direct access between the guest ports.
• A service provider can provide Layer 2 security for customers and use the IP addresses more
efficiently, by using a separate community VLAN per customer, while at the same time using the same
IP subnet address space for all community and isolated VLANs mapped to the same primary VLAN.
In more detail, community VLANs are especially useful in the service provider environment, because,
multiple customers are likely to maintain servers that must be strictly separated in customer-specific
groups. A set of servers owned by a customer could comprise a community VLAN, so that those
servers could communicate with each other, and would be isolated from other customers. Another
customer might have another set of servers in another community VLAN. Another customer might
want an isolated VLAN, which is has one or more ports that are also isolated from each other.
Private VLAN Concepts
The VLAN types in a private VLAN (PVLAN) include:
Community VLAN — A
community VLAN is a type of secondary VLAN in a primary VLAN:
To Next Page
Loading...
