i have a sw nexus

i have a router BGN with vlan 50 is going to sw then mode access to Client 1 and Client 2

BNG ==== SW1 == PORT1 =Client 1 (Mode access vlan 50)

                PORT2 =Client 2 (Mode access vlan 50


the have connected to BNG by pppoe and everything is ok

but the problem is

when Client 1 try to connect to BNG , is send a PADI packet , it's a broadcast , so this packet is going to Client 2 and to BNG Router

i need some filter apply in Port 1 ( outbound) so is just filter Any PADI packet to go to client

so the Port 1 and 2 they just only can send PADI message and not do not receive it it from another Client .

  • What's the switch model? If you can't/don't want to put each client in a different VLAN you need to configure the VLAN as private. How that works depends on the switch features.
    – Zac67
    Apr 16 '20 at 17:55
  • Hello , is nexus 3000 model Apr 16 '20 at 17:56
  • Any another idea except pvlan ? ,,, Apr 16 '20 at 17:57
  • Without PVLAN your clients can generally talk to one another outside of PPPoE - don't think you'd want that.
    – Zac67
    Apr 16 '20 at 18:35
  • what about Mac access-list with ethertype Apr 16 '20 at 19:59

What you're looking for is generally called "port isolation". On NX-OS, that's done with private vlans. Yes, at first glance, PVLAN configuration can be confusing, but Cisco has many documented examples. Here is one such document. (old, and ignore that it's for a 7000 and v5_x)

vlan 3
  private-vlan isolated

vlan 2
  private-vlan primary
  private-vlan association 3

interface ethernet 1/1
  switchport mode private-vlan promiscuous

! CLIENT1    
interface ethernet 1/2
  switchport mode private-vlan host
  switchport private-vlan host-association 2 3

interface ethernet 1/3
  switchport mode private-vlan host
  switchport private-vlan host-association 2 3

! Layer-3 interface (optional?)
interface vlan 2
  private-vlan mapping 3

You only need a primary and isolated vlan. The primary vlan carries traffic downstream to the isolated client ports. The isolated vlan carries traffic upstream from the isolated ports. That should prevent traffic between clients. However, broadcast traffic from the router (e1/1) would still be sent to all clients.

MAC filtering could also work, but would require knowing the MACs of all devices at all times. Any change in device would require updating the filters.

  • thank for helping ,but i can use same interface to trunk a normal vlan and Pvlan? Apr 17 '20 at 9:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.