5

In our environment, we run our computers inline with Cisco IP phones to our switch. The problem is that our phones are on a separate VLAN from our normal access traffic. I would like to know if it is possible to map the private VLAN to both our access and voice SVIs. On top of that, is it possible to have our access and voice "layer 2" VLAN statements associated with the same private VLAN? Even if these two queries are possible, is can I assign the physical ports to have multiple private VLAN associations? (This seems like a mouthful. I apologize)

Here is an example of what I have setup already:

vlan 101
 name WKS-VLAN
 private-vlan primary
 private-vlan association 1000,2000
!
vlan 254
 name VOIP-VLAN
!
 vlan 1000
  private-vlan isolated
!
vlan 2000
 private-vlan community

SVIs:

interface Vlan101
 description WKS-VLAN
 ip address x.x.x.x 255.255.252.0
 private-vlan mapping 1000,2000
!
interface Vlan254
 description VoIP-VLAN
 ip address x.x.x.x 255.255.255.0
!

Example Port:

interface GigabitEthernet2/46
 switchport private-vlan host-association 101 1000
 switchport mode private-vlan host

Thanks in advance for any help!

Improve this question
3
  • 2
    It is a bit unclear what you are trying to accomplish here and PVLANs may not be necessary. More details of what you are trying to do might help in getting a better answer. In any event the short answer is no a PVLAN is mapped to a VLAN, and cannot be mapped to a second VLAN. However assigning multiple VLANs to a port is possible (utilizing either the voice VLAN or a trunk/tagged port).
    – YLearn
    Jul 24, 2013 at 2:25
  • We have old devices that do not like having interference with traffic on our main VLAN (101) we were trying to find a solution to isolate the traffic without needing more IP space. Through my testing, just setting up an Isolated port for the picky device would work, but the rest of our access ports were not able to connect to the network.
    – abm89
    Jul 24, 2013 at 15:29
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Jan 5, 2021 at 18:23

1 Answer 1

Reset to default
4

Q: It is possible to map the private VLAN to both our access and voice SVIs? A: No. You are creating "In theory" a bridge between two main VLANs.

Q: Is it possible to have our access and voice "layer 2" VLAN statements associated with the same private VLAN? A: This is like haveing the same VLAN name on two different networks. The private VLAN scope is within its main VLAN. Technically it would not make the private VLAN part of two main VLANs but it might be against the allowed configuration to have the same name for two private VLANs on the same switch. I am not sure but logically it would be confusing.

Q: Can I assign the physical ports to have multiple private VLAN associations? A: I cant think of a reason for doing so except for the 'P' port which you will need to do on at least one port/SVI.

Check this link for a great explaination on private VLANs.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.