I'm trying to grasp the private VLAN configuration on Juniper EX switches.

As I understand it right now:

  • Access ports in the primary VLAN (VLAN with no-local-switching configured) are implicitly isolated ports
  • Trunk ports in the primary VLAN with pvlan-trunk set are PVLAN trunk interfaces
  • All other trunk ports in the primary VLAN are promiscuous ports

Is there any way to configure a trunk port to be a isolated port in a PVLAN?

Background: A host has a NIC with multiple VLANs configured. On the switch this is a trunk port accordingly. I want the switchport to be an isolated port in the private VLAN.

  • What OS is the host? I could assume ESXi/vSphere? Have you also review this: juniper.net/techpubs/en_US/junos10.4/topics/concept/… ?
    – nzspambot
    Commented Aug 4, 2014 at 0:33
  • I have reviewed private VLANs, I'm actually using them. ;) The host is a normal host, no virtualisation or anything. But that wouldn't make a difference anyway. The host (OS) has no influence over PVLANs. Commented Aug 4, 2014 at 11:40

1 Answer 1


Unfortunately not. This is a frustrating limitation of the way Juniper have implemented Isolated ports and Promiscuos ports in PVLANs - it essentially boils down to if the interfaces is in access mode, it's an Isolated port, but if it's tagged, it's a Promiscuous port.

This https://mellowd.co.uk/ccie/?p=5387 is worth a read if you haven't seen it already - goes into a bit more detail than the Juniper Support documentation examples.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.