Private VLANs Same As VLANs!

Question

The common VLANs provides a layer 2 speration flooding and broadcasting is limited to each virtual lans. Im wondering what is the purpose of the private VLANs also the secondary VLANs (isolated and community) since the known vlans already provides the isolation and some HSRP or VRRP vlans can be used in uplinks same as community i mean what is the additional features that it can give!? Thanks in advance.

Answer 1

Private VLAN is a feature that prevent hosts within a single VLAN to communicate with each others.

VLAN separate different networks.

A site may consists of thousands computers, belonging to dozens of business unit or department, segregated by different VLANs. One VLAN for the accounting department, one for human ressources, one for IT, etc...

Each VLAN corresponds to an IP network, and access control lists (ACL) control what the hosts on those VLAN can access. I.E. the users in the accounting department can access some servers while the other user can't, etc...

Now two clients computer in a given department have no need to communicate together, and this is a security liability. If a virus infect a computer it can exploit a vulnerability in a network protocol to infect other computers. Private VLAN prevent this.

You can't possibly isolate each single host in this own VLAN. It doesn't scale to more than a few computers. This would be an administrative nightmare, and is anyway limited to 4095 hosts.

So VLANs give a nice way to group hosts that have the same functional role and security requirements while private VLAN give an easy way to block unwanted communication between hosts in a VLAN.

Answer 2

Basically and by default different VLANs won't communicate with each other . And same VLANs host will communicate to each other . Traditional to restrict traffic among same VLANs host àccess-list can be configured restricting access among same Vlan hosts . Private Vlan is open standard protocol used alternative for access-list to restrict and allow tràffic between same VLANs

Basically different VLans won't communicate with each other to make them talk to each other Inter -Vlan routing need to be enable . After enable inter-Vlan routing different VLANs will talk to each other to restrict traffic or control traffic among different Vlans host private Vlan concept is used .