is private Vlan concept is introduced by cisco for alternative for access-list to segregate traffic among different Vlan and within same Vlan .


It might.

A private VLAN (or port isolation) restricts communication between switch ports. Normally, that is used to enable their communication to a server or uplink port while denying all other ports. Since a private VLAN is port-based it is essentially a layer-2 concept. Your trust is based on physical switch ports.

An access list can be used to filter traffic based on IP addresses (layer 3) or transport-layer port numbers (layer 4). An ACL is much more flexible than a private VLAN - you could for instance restrict traffic to DNS queries to one IP destination and HTTP to a range of destinations that are remote to the filtering switch. However, your trust is based on IP addresses. Since those might be spoofed, ACLs may require additional policies (DHCP snooping, MAC-IP binding, 802.1X, ...) to ensure the required security.

Whatever you use depends on your requirements and where you can base your trust.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.