Configuring PVLANs across 3 switches

Question

We are about to implement PVLANs into our environment however I had a couple of questions for anyone who has production experience with them.

The network will be set up as follows:

Hosts     Hosts
 |          |
SW1 (N)    SW2 (S)
    \     /
      SW3 (Core SW)
       |
    Firewall
       |
    Internet

My question is which VLAN would the IP address go on? The primary? If so, all the other switches have the same primary VLAN but separate IP addresses, would that not create a conflict?

Thanks for the help guys!

Here is an idea of my current config:

PVLAN config for 11 N 3560x

conf t
vtp mode transparent
feature private-vlan
vlan 2
private-vlan primary
exit
vlan 3
private-vlan isolated
exit
vlan 2
private-vlan associated add 3
exit
int gi0/1 - gi0/23
switchport mode private-vlan host
switchport private-vlan host-association 2 3
spanning-tree portfast
int gi0/24
description to core switch
switchport mode private-vlan promiscuous
switchport private-vlan mapping 2 add 3
spanning-tree portfast
end

show vlan primary

show int gi0/1 - gi0/23 switch | beg private

PVLAN config for 11 S 3560x

conf t
vtp mode transparent
feature private-vlan
vlan 2
private-vlan primary
exit
vlan 5
private-vlan isolated
exit
vlan 2
private-vlan associated add 5
exit
int gi0/1 - gi0/23
switchport mode private-vlan host
switchport private-vlan host-association 2 5
spanning-tree portfast
int gi0/24
description to core switch
switchport mode private-valn promiscuous
switchport private-vlan mapping 2 add 5
spanning-tree portfast
end

show vlan primary

PVLAN config for core switch

conf t
vtp mode transparent
feature private-vlan
vlan 2
private-vlan primary
exit
vlan 7
private-vlan isolated
exit
vlan 2
private-vlan associated add 7
exit
int gi0/1 - gi0/23
switchport mode private-vlan host
switchport private-vlan host-association 2 7
spanning-tree portfast
int gi0/24
description to fortinet
switchport mode private-valn promiscuous
switchport private-vlan mapping 2 add 7
spanning-tree portfast
end

show vlan primary

show vlan private-vlan type

Configuring trunk ports one device not aware of pvlan

int gi0/24
switchport mode private-vlan trunk secondary
switchport private-vlan trunk native vlan 3
switchport private-vlan trunk allowed 3, 7
switchport private-vlan association trunk 2 3   #primary, secondary

show int gi0/24 switchport

Configuring trunk ports both devices aware of pvlan

int gi0/24
switchport mode private-vlan trunk promiscuous
switchport private-vlan trunk native vlan 3
switchport private-vlan trunk allowed vlan 3, 7 #core switch vlan
switchport private-vlan mapping trunk 2 add 3, 7

Answer 1

You would put the IP address on the primary VLAN SVI.

Interface vlan2
 private-VLAN mapping 3,5,7
 ip address x.x.x.x x.x.x.x

I would suggest running VTPv3 which supports pvlans. That way all switches will have the same VLAN configuration (VLAN.dat file) added on them. Also, vtpv3 supports extended range vlans. Further having different pvlan per switch is not needed, especially since they are isolated. Think, 1 primary VLAN, 1 isolated VLAN and 1 VLAN per pvlan community.

I have not analyzed your config but a quick skim over this looks correct. I'd just have the same pvlan numbers across all switches.

Answer 2

1) Yes the Primary vlan is the entity that homes the shared subnet for community and isolated vlans. Why would each switch have their own Primary vlan address? (Is your switch management vlan the same vlan as the Primary vlan?)

Thus I imagine your core switch is performing MLS(Multi-Layer Switching) and homes the Primary Vlan SVI?

2) You don't need to define three different isolated vlans. The purpose of the isolated vlan is to only allow communication between an isolated port and promiscuous port. By definition the isolated host will not be able to communicate with any other type of port other than the promiscuous port. Just trunk one isolated vlan through the pvlan domain and utilize it.

Another note is that a Primary Vlan can be associated with at most one isolated vlan and many community vlans. Likewise a Promiscuous port can only served one primary vlan, one isolated vlan and many community vlans.

3) Why do you need to trunk the vlans through to your fortinet firewall? If it isn't absolutely necessary I'd turn this into a routed link between the core switch and the fortinet. If your core switch is L3 capable.

4) Just use a Promiscuous-PVlan trunk for the link to devices that don't support PVLAN or protected ports. This will ensure secondary vlan tagged frames are rewritten with the primary vlan tag when crossing the trunk. Although if you make 3) happen then this may not be necessary anymore AIUI.

HTH. Feel free to ask for clarification.