8

I've an issue leading with Private Vlans. I've fiber modem and they can't reach the DHCP/TFTP to be provision. I suspect from the configuration of Private VLANs. Can you review them ? My doubts are mainly on access switch and trunk configuration on gigabit port.

In brief, the modem when they power up they tried to get an IP through DHCP, send an untagged frame arrive at Access switch 4506 and should be handle on vlan 11 due they are the untagged private-vlan. After broadcast discovery DHCP should go to aggregator switch through vlan 10. On aggregator switch 4500x, there is an SVI vlan 10 with ip helper-address of provisioning server who send in unicast the packet to him.

pvlan topology

Config on access switch 4506 : 

vlan 10
name vlan_10
 private-vlan primary
!
vlan 20
name vlan_20
 private-vlan primary
!
vlan 30
name vlan_30
 private-vlan primary
!
! Isolated VLAN: Connects all CPE hosts to Switch 
!
vlan 11
name Pvlan_11
 private-vlan isolated
!
vlan 21
name Pvlan_21
 private-vlan isolated
!
vlan 31
name Pvlan_31
 private-vlan isolated
!
!  Associating
!
vlan 10
 private-vlan assoc 11
!
vlan 20
 private-vlan assoc 21
!
vlan 30
 private-vlan assoc 31
!
! Isolated port (Can only communicate with Primary port)
!
interface giX/Y
switchport mode private-vlan trunk promiscuous
switchport private-vlan trunk native vlan 11
switchport private-vlan trunk allowed vlan 11,21,31
switchport private-vlan mapping trunk 10 11
switchport private-vlan mapping trunk 20 21
switchport private-vlan mapping trunk 30 31
Improve this question
3
  • Hi mate, How is the modem connected to the 4506? You trunk all three private vlans to it?
    – laf
    Aug 11, 2013 at 12:32
  • Hi, the intention is to have 3 vlan for different services. The modem when they power up they look to be provisioned (IP add + config. file). They send at first untagged packet, when they receive the IP and config. file (with configuration of there VLANs). After, the CPE sent frame in accord with they VLAN. In this example, 11 is mgmt vlan, for that we have the native vlan configured, the 20 Internet, and 30 VoIP.
    – cgasp
    Aug 12, 2013 at 5:32
  • Can you please provide the private VLAN interface configuration of both switches in your question? Given your associated VLANs are isolated they will only be able to communicate with a promiscuous interface.
    – one.time
    Sep 7, 2013 at 5:41

1 Answer 1

Reset to default
2

After a few tests, I found the solution and it's working. My first configuration was incomplete.

schema

Configuration Generator

Here a working configuration : 

vlan 10
name vlan_10
 private-vlan primary
!
vlan 20
name vlan_20
 private-vlan primary
!
vlan 30
name vlan_30
 private-vlan primary
!
! Isolated VLAN: Connects all CPE hosts to Switch 
!
vlan 11
name Pvlan_11
 private-vlan isolated
!
vlan 21
name Pvlan_21
 private-vlan isolated
!
vlan 31
name Pvlan_31
 private-vlan isolated
!
!  Associating
!
vlan 10
 private-vlan assoc 11
!
vlan 20
 private-vlan assoc 21
!
vlan 30
 private-vlan assoc 31
!
! Isolated/Access port
!
interface GigabitEthernet1/1
switchport private-vlan trunk native vlan 11
switchport private-vlan trunk allowed vlan 11,21,31
switchport private-vlan association trunk 10 11
switchport private-vlan association trunk 20 21
switchport private-vlan association trunk 30 31
switchport mode private-vlan trunk secondary
!
! Promiscuous port (interconnect switchs) 
!
interface TenGigabitEthernet1/1
switchport private-vlan trunk native vlan 10
switchport private-vlan mapping trunk 10 11
switchport private-vlan mapping trunk 20 21
switchport private-vlan mapping trunk 30 31
switchport mode private-vlan trunk promiscuous
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.