I'm struggeling with a VLAN mapping issue on a Nexus 3524 Switch.
Downlink router<---Dot1Q 1901--->NX3524<---Dot1Q 493--->Uplink router
I already figured out that basic 1:1 VLAN ID mapping is not supported on the 3k Series nexus boxes, so i try to fix this job using the Private-Vlans feature. Unfortunately i can't change anything in this setup because the uplink Provider is has mapped his Service to this Tag and the donwnlink router is only reachable via VLAN tag 1901 through a metro provider network. i can only put my hands on the downlink router and the Nexus.
VLAN 493 should be my primary private VLAN and 1901 my secondary.
vlan 493 private-vlan primary private-vlan association 1901 vlan 1901 private-vlan community
in my understanding primary and secondary vlans are transported on normal trunk ports, so i configured vlans 493 and 1901 as allowed VLANs on a normal trunk port (eth1/1) that carries a lot of other tags facing the Metro network so there should be no needs to configure explicit
interface Ethernet1/1 switchport mode trunk switchport trunk native vlan 1900 switchport trunk allowed vlan add 493,1901 no shutdown
i can't change a lot in the configuration here because there are several productive VLANs already configured on this port.
The Port facing the upstream router (Eth1/6) is configured as a promiscious private-vlan trunk port
interface Ethernet1/6 switchport mode private-vlan trunk promiscuous switchport private-vlan trunk allowed vlan 493 switchport private-vlan mapping trunk 493 1901 no shutdown
Mac address-learning looks fine.
# sh mac address-table | i 493 * 493 00c1.xxxx.xxxx dynamic 0 F F Eth1/1 * 493 dab1.xxxx.xxxx dynamic 0 F F Eth1/6
but there is no ping possible between the two nodes due to incomplete ARP on the upstream router.
I'm also missing port Eth1/1 in following output.
# sh vlan private-vlan Primary Secondary Type Ports ------- --------- --------------- ---------------------- 493 1901 community Eth1/6
I'm not sure if this is just a missing statement somewhere or if there is a mayor error in my thinking.
Using Q-in-Q tunneling unfortunately is not an alternative because the downstream router can not terminate Layer3 interfaces in a double-tagged VLAN :(