3

I have been wondering for a while about this.

On Cisco switches you can configure a VLAN and nest private community and private isolated VLANs into it. You can also configure promiscuous ports that can be accessed by any member of the child VLANs. I know members of one community VLAN can communicate to each other without a need for a gateway and they can't with a different community VLAN. Also there's isolated VLAN members of which can only communicate with promiscuous ports. My question is, how does it work if I want to still reach another host from the same isolated VLAN I am in? Does the router still get you there? (So that's the question number one)

But if so, what about VACLs then? If I understand correctly, they prohibit getting out of VLAN and getting back or do they just restrict sitting in a VLAN with incorrect prefix/mask? (Question number two)

EDIT:

Diagram

So I wanted to ask how for example I can get from host .24 to host .25 or from host .66 to host .24 (Between AUX VLANs)? I am confused about the routing happening. I know you cannot access them via layer 2. So how do these PCs get there? Do they still use the router? How does the router handle this? I mean, it's the same subnet, but that's different aux. VLAN.

Sorry if that sounds confusing at all.

Improve this question
2
  • 1
    I think I understand your question, but it would be much more clear if you could give us either configs or a diagram with concrete references to hosts in the vlans
    – Mike Pennington
    Oct 25, 2013 at 12:14
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 8, 2017 at 15:13

1 Answer 1

Reset to default
2

When an isolated port transmits data, that data is mapped into an auxiliary VLAN. Data in the auxiliary VLAN will be mapped to the primary VLAN -only- for transmission to promiscuous ports. Promiscuous ports, in turn, transmit data into the primary VLAN. All ports can receive information in the primary VLAN.

Putting an otherwise isolated port into a community VLAN means that traffic it transmits will be mapped into both the auxiliary and the community VLAN. Community ports will receive data from both the primary and the community VLAN.

A given pair of ports will have bidirectional communication under the following conditions-

  1. One or both are promiscuous, or...
  2. Both are in the same PVLAN community.

VACL's are a completely different mechanism and provide some measure of per-packet (and usually protocol based) control of traffic bridged within a given VLAN. You might, for instance, block traffic on TCP/80 between all hosts within the VLAN while allowing all other traffic to pass.

It's possible to approximate the effects of PVLAN's by using a VACL but this tends to be somewhat fragile, difficult to manage and there are often inherent hardware limitations with which to contend (...highly dependent on platform).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.