I need to implement PVLAN on HP Aruba switches, unfortunately HP-2530 switch do not support Private-VLAN.Is there an alternative to achieve similar results?
You could use an ACL for this, e.g.
pvlan for the 192.168.1.0/24 subnet in VLAN 99, allowing contact to the DHCP server on 192.168.1.10 and the router on 192.168.1.1
ip access-list extended pvlan 1000 permit ip 192.168.1.0/24 192.168.1.1/32 1010 permit ip 192.168.1.1/32 192.168.1.0/24 1020 permit ip 192.168.1.0/24 192.168.1.10/32 1030 permit ip 192.168.1.10/32 192.168.1.0/24 1100 deny ip 192.168.1.0/24 192.168.1.0/24 9999 permit ip any any exit vlan 99 ip access-group pvlan vlan-in
This inhibits all IP traffic between nodes within this subnet except to/from the router and the DHCP server while allowing everything else.
The router isn't really required but it's nice for a simple connectivity test. Note that ACLs are evaluated from the top and the first match counts. There's an implicit
deny ip any any at the very end, so you'd need to put a
permit ip any any in front of it to counter that.
Also note that an ACL only kills IP traffic that uses the filtered subnet. Other protocols or subnets are not inflicted.
Source-port filters drop all traffic from the indicated source-destination port combination.
With the switch uplink on port 1 and clients on 2-48, you would use
filter source-port named-filter pvlan drop 2-48 filter source-port 2-48 named-filter pvlan
Access-list configuration is traditionally way and alternative way to restrict or control tràffic among VLANs . Private Vlan concept is brought to overcome challenge in configuring access -list .
If network setup is large-scale network , it is difficult manage and configure access-list it will become challenge to network administrator .To overcome this challenge cisco has introduced private -Vlan concept to restrict traffic among different Same and different Vlans.
If device is not compatible with private Vlan .Then access-list can be configured.