Recently I came across the concept of a Private VLAN (https://en.wikipedia.org/wiki/Private_VLAN). However, I can't seem to see the difference between a PVLAN and a VLAN which is configured on one port only.

Imagine that I have a switch with 4 ports:

  1. The trunk port
  2. VLAN 1
  3. VLAN 2
  4. VLAN 3

In the above set-up, each VLAN can be regarded as a PVLAN. Is that correct?

2 Answers 2


Yes and no.

Yes in the sense that the effect of two ports in an isolated PVLAN or two ports in two different community PVLANs can not communicate, as if they were in two different actual VLANs (considered Primary VLANs when discussing PVLAN).

No in the sense that with Private VLANs, all four of the hosts I mentioned previously are able to speak to the same port, configured as a Promiscuous port.

With "regular" VLANs (Primary VLANs), they may all be able to speak out the same trunk port, but each of their traffic will still be isolated from the other due to the VLAN Tag. That is why if you had four traditional VLANs, you would typically have four different IP subnets and a router handling the Routing between the VLANs.

With PVLANs, all four hosts could be able to speak out the exact same Promiscuous port, that could be facing a Router that does not have to maintain four different IP networks. A step further, all four hosts could also be using IP addresses from the same IP network.

Note: There are different games you can play with VRFs and multi-context devices that allow four different VLANs to use the same IP Subnet, but given the nature of the question I believe those technologies are outside the scope of what the OP is asking about.


In short, no, those VLANs would be considered primary VLANs, not private VLANs or PVLANs.

PVLANs are a segmentation technique that can isolate hosts within the same 'primary' VLAN into 'secondary' or private VLANs. These PVLAN hosts belong to the same IP subnet. In order for the hosts to communicate, they will have to traverse a router. PVLANs have to be configured as such and are different from "regularly" configured VLANs.

See if these links at Packetlife and INE can help explain more. PVLANs can get quite complicated.

  • Thanks for the answer, it clarifies things already. However, I could also have 2 normal vlans within the same subnet, so I don't see why I would need pvlans to do that?
    – Michael
    Dec 21, 2016 at 18:00
  • 1
    You couldn't have two "normal " vlans on the same subnet. You would either end up with a bifurcated subnet, or you would effectively have one vlan with no isolation between them.
    – Ron Trunk
    Jan 19, 2017 at 22:35
  • 1
    Sure you can. At least with linux based routers you can use /32 routes to control which interface outgoing traffic from the router goes to and proxy arp to sweep up incoming traffic. Not saying I would recommend such a configuration just saying it is possible. Jan 20, 2017 at 1:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.