1

We are about to implement PVLANs into our environment however I had a couple of questions for anyone who has production experience with them.

The network will be set up as follows:

Hosts     Hosts
 |          |
SW1 (N)    SW2 (S)
    \     /
      SW3 (Core SW)
       |
    Firewall
       |
    Internet

My question is which VLAN would the IP address go on? The primary? If so, all the other switches have the same primary VLAN but separate IP addresses, would that not create a conflict?

Thanks for the help guys!

Here is an idea of my current config:

PVLAN config for 11 N 3560x

conf t
vtp mode transparent
feature private-vlan
vlan 2
private-vlan primary
exit
vlan 3
private-vlan isolated
exit
vlan 2
private-vlan associated add 3
exit
int gi0/1 - gi0/23
switchport mode private-vlan host
switchport private-vlan host-association 2 3
spanning-tree portfast
int gi0/24
description to core switch
switchport mode private-vlan promiscuous
switchport private-vlan mapping 2 add 3
spanning-tree portfast
end

show vlan primary

show int gi0/1 - gi0/23 switch | beg private

PVLAN config for 11 S 3560x

conf t
vtp mode transparent
feature private-vlan
vlan 2
private-vlan primary
exit
vlan 5
private-vlan isolated
exit
vlan 2
private-vlan associated add 5
exit
int gi0/1 - gi0/23
switchport mode private-vlan host
switchport private-vlan host-association 2 5
spanning-tree portfast
int gi0/24
description to core switch
switchport mode private-valn promiscuous
switchport private-vlan mapping 2 add 5
spanning-tree portfast
end

show vlan primary

PVLAN config for core switch

conf t
vtp mode transparent
feature private-vlan
vlan 2
private-vlan primary
exit
vlan 7
private-vlan isolated
exit
vlan 2
private-vlan associated add 7
exit
int gi0/1 - gi0/23
switchport mode private-vlan host
switchport private-vlan host-association 2 7
spanning-tree portfast
int gi0/24
description to fortinet
switchport mode private-valn promiscuous
switchport private-vlan mapping 2 add 7
spanning-tree portfast
end

show vlan primary

show vlan private-vlan type

Configuring trunk ports one device not aware of pvlan

int gi0/24
switchport mode private-vlan trunk secondary
switchport private-vlan trunk native vlan 3
switchport private-vlan trunk allowed 3, 7
switchport private-vlan association trunk 2 3   #primary, secondary

show int gi0/24 switchport

Configuring trunk ports both devices aware of pvlan

int gi0/24
switchport mode private-vlan trunk promiscuous
switchport private-vlan trunk native vlan 3
switchport private-vlan trunk allowed vlan 3, 7 #core switch vlan
switchport private-vlan mapping trunk 2 add 3, 7
2

You would put the IP address on the primary VLAN SVI.

Interface vlan2
 private-VLAN mapping 3,5,7
 ip address x.x.x.x x.x.x.x

I would suggest running VTPv3 which supports pvlans. That way all switches will have the same VLAN configuration (VLAN.dat file) added on them. Also, vtpv3 supports extended range vlans. Further having different pvlan per switch is not needed, especially since they are isolated. Think, 1 primary VLAN, 1 isolated VLAN and 1 VLAN per pvlan community.

I have not analyzed your config but a quick skim over this looks correct. I'd just have the same pvlan numbers across all switches.

  • Yup agree with this. We were typing up answers at the same time(see mine below). Agree that there are rules around isolated vlans and you shouldn't need more than one(further explanation below). – APA Jul 8 '15 at 23:12
  • I was under the impression that VTP needed to be running in transparent mode, effectively taking it our of the equation? – Kvothe Jul 9 '15 at 14:38
  • VTP mode must be in transparent if you're running version 1 or 2. However if you run version 3 which on 2960s is supported, then you can have the PVLANs distributed across all switches and the extended range VLANs if you're using them. – Joseph Drane Jul 10 '15 at 1:02
  • Thanks for the response Joseph!While I like the idea of a central management switch, vtp v3 would only be enabled on the above 3 switches. What would be the effect to the other switches in the network not running the same version of vtp? – Kvothe Jul 27 '15 at 19:55
  • Also, keeping with the idea of 1 primary vlan, and 1 isolated vlan, that would mean the same config across all 3 switches. So that would mean there would only exist vlans 2 and 3, primary and isolated respectively configured on all 3 switches. Please correct me if I am wrong. – Kvothe Jul 27 '15 at 20:00
0

1) Yes the Primary vlan is the entity that homes the shared subnet for community and isolated vlans. Why would each switch have their own Primary vlan address? (Is your switch management vlan the same vlan as the Primary vlan?)

Thus I imagine your core switch is performing MLS(Multi-Layer Switching) and homes the Primary Vlan SVI?

2) You don't need to define three different isolated vlans. The purpose of the isolated vlan is to only allow communication between an isolated port and promiscuous port. By definition the isolated host will not be able to communicate with any other type of port other than the promiscuous port. Just trunk one isolated vlan through the pvlan domain and utilize it.

Another note is that a Primary Vlan can be associated with at most one isolated vlan and many community vlans. Likewise a Promiscuous port can only served one primary vlan, one isolated vlan and many community vlans.

3) Why do you need to trunk the vlans through to your fortinet firewall? If it isn't absolutely necessary I'd turn this into a routed link between the core switch and the fortinet. If your core switch is L3 capable.

4) Just use a Promiscuous-PVlan trunk for the link to devices that don't support PVLAN or protected ports. This will ensure secondary vlan tagged frames are rewritten with the primary vlan tag when crossing the trunk. Although if you make 3) happen then this may not be necessary anymore AIUI.

HTH. Feel free to ask for clarification.

  • APA, Thanks for the quick response! 1) Why would each switch have their own Primary vlan address? (Is your switch management vlan the same vlan as the Primary vlan?). Each switch has their own IP address for MGMT purposes so my question was were to put that IP. Should I keep it on the default vlan1? 2) So you're saying in my topology there should be one primary vlan (2) and one isolated vlan for all three switches? So it would be the exact same commands regarding vlan configs for all three switches? – Kvothe Jul 9 '15 at 14:57
  • I assume this to be true because of your statement regarding primary vlans only being able to associate with one isolated vlan. 3) I want to trunk the vlans because we currently have old allied switched in the environment as well which do not work with the cisco switches unless all uplink ports are in trunk mode. 4) Regarding PVLAN trunk ports I have come across quite a bit of disparate info as my current trunk config above does not work in the 3560. Any experience with pvlan trunks on these models? – Kvothe Jul 9 '15 at 14:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.