2

I need to implement PVLAN on HP Aruba switches, unfortunately HP-2530 switch do not support Private-VLAN.Is there an alternative to achieve similar results?

Improve this question
2
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Feb 21, 2018 at 17:38
  • Unfortunately I do not have a solution yet.
    – Shruthi
    Feb 22, 2018 at 11:01

3 Answers 3

Reset to default
1

Some people suggest that (link here) you can use source-port filters.

Improve this answer
4
  • Can vlan multinetting be useful?
    – Shruthi
    Nov 13, 2017 at 11:26
  • @Innov It could be. You should give me a try first.
    – Hung Tran
    Nov 13, 2017 at 11:34
  • @Innov Please let me know if you were able to get it worked out.
    – Hung Tran
    Dec 13, 2017 at 13:47
  • unfortunately I couldnt get it done.
    – Shruthi
    Dec 14, 2017 at 9:33
1

You could use an ACL for this, e.g. pvlan for the 192.168.1.0/24 subnet in VLAN 99, allowing contact to the DHCP server on 192.168.1.10 and the router on 192.168.1.1

ip access-list extended pvlan
1000 permit ip 192.168.1.0/24 192.168.1.1/32
1010 permit ip 192.168.1.1/32 192.168.1.0/24
1020 permit ip 192.168.1.0/24 192.168.1.10/32
1030 permit ip 192.168.1.10/32 192.168.1.0/24
1100 deny ip 192.168.1.0/24 192.168.1.0/24
9999 permit ip any any
exit
vlan 99 ip access-group pvlan vlan-in

This inhibits all IP traffic between nodes within this subnet except to/from the router and the DHCP server while allowing everything else.

The router isn't really required but it's nice for a simple connectivity test. Note that ACLs are evaluated from the top and the first match counts. There's an implicit deny ip any any at the very end, so you'd need to put a permit ip any any in front of it to counter that.

Also note that an ACL only kills IP traffic that uses the filtered subnet. Other protocols or subnets are not inflicted.

Source-port filters drop all traffic from the indicated source-destination port combination.

With the switch uplink on port 1 and clients on 2-48, you would use

filter source-port named-filter pvlan drop 2-48
filter source-port 2-48 named-filter pvlan
Improve this answer
0

Access-list configuration is traditionally way and alternative way to restrict or control tràffic among VLANs . Private Vlan concept is brought to overcome challenge in configuring access -list .

If network setup is large-scale network , it is difficult manage and configure access-list it will become challenge to network administrator .To overcome this challenge cisco has introduced private -Vlan concept to restrict traffic among different Same and different Vlans.

If device is not compatible with private Vlan .Then access-list can be configured.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.