I've an issue leading with Private Vlans. I've fiber modem and they can't reach the DHCP/TFTP to be provision. I suspect from the configuration of Private VLANs. Can you review them ? My doubts are mainly on access switch and trunk configuration on gigabit port.
In brief, the modem when they power up they tried to get an IP through DHCP, send an untagged frame arrive at Access switch 4506 and should be handle on vlan 11 due they are the untagged private-vlan. After broadcast discovery DHCP should go to aggregator switch through vlan 10. On aggregator switch 4500x, there is an SVI vlan 10 with ip helper-address of provisioning server who send in unicast the packet to him.
Config on access switch 4506 :
vlan 10 name vlan_10 private-vlan primary ! vlan 20 name vlan_20 private-vlan primary ! vlan 30 name vlan_30 private-vlan primary ! ! Isolated VLAN: Connects all CPE hosts to Switch ! vlan 11 name Pvlan_11 private-vlan isolated ! vlan 21 name Pvlan_21 private-vlan isolated ! vlan 31 name Pvlan_31 private-vlan isolated ! ! Associating ! vlan 10 private-vlan assoc 11 ! vlan 20 private-vlan assoc 21 ! vlan 30 private-vlan assoc 31 ! ! Isolated port (Can only communicate with Primary port) ! interface giX/Y switchport mode private-vlan trunk promiscuous switchport private-vlan trunk native vlan 11 switchport private-vlan trunk allowed vlan 11,21,31 switchport private-vlan mapping trunk 10 11 switchport private-vlan mapping trunk 20 21 switchport private-vlan mapping trunk 30 31