1

I'm using extreme network switches and have some networks that would benefit from isolation. The idea is to create a private vlan with isolated vlans, that span over multiple switches. The vlans have different ip ranges and gateways. This works fine for non isolated vlans, but how do I setup the isolated vlans in a way that the dhcp Server and Gateway can be reached?

The documentation mentions private vlan over multiple switches: Private VLAN over mutliple Switches

Another interesting point from the documentation is

VLANs are not part of the PVLAN, Switch 1, port 24, must be configured as a PVLAN endpoint, which establishes the PVLAN boundary

without any info on how to do this. Further it metions that the e flag would indicate a port that is configured as an endpoint exos manual but I couldn't find a way to configure it (and show vlan doesn't mention the flag for me). Even the command reference isn't helping.

Here an example for a single swith transfer being the network vlan:

create vlan guest-lan
config vlan guest-lan tag 1000
create vlan another-lan
config vlan another-lan tag 1001
create vlan community-lan
config vlan community-lan tag 1002

create private-vlan mypvlan
configure private-vlan mypvlan add network transfer
configure private-vlan mypvlan add subscriber guest-lan
configure private-vlan mypvlan add subscriber another-lan
configure private-vlan mypvlan add subscriber community-lan non-isolated
Improve this question
4
  • Do you really need private VLANs (where hosts within each VLAN are separated from each other and can only communicate with an upstream port) or is normal VLAN separation sufficient (separate only hosts from different VLANs)?
    – Zac67 ♦
    Sep 6, 2022 at 10:50
  • @Zac67 I want to separate the clients within the vlan from each other
    – someonr
    Sep 6, 2022 at 11:00
  • 1
    "how do I setup the isolated vlans in a way that the dhcp Server and Gateway can be reached?" Private VLAN can have a promiscuous interface with which all the interfaces in the private VLAN can communicate. That is the interface to the rest of your network where the gateway and DHCP server are found.
    – Ron Maupin ♦
    Sep 6, 2022 at 15:57
  • @RonMaupin I couldn't find the documentation on how the promiscuous interface can be configured. Any Details?
    – someonr
    Sep 7, 2022 at 9:25

1 Answer 1

Reset to default
2

Private VLANs or normal VLANs (tagged or port-based) work the same way with DHCP. PVLANs just have the added complexity that the DHCP server needs to be reachable from each secured access port.

You need to either locate a DHCP server in each (P)VLAN on a promiscuous port (that can talk to any other port in the same (P)VLAN), or you set up a DHCP relay in each VLAN:

configure <VLAN> ipaddress <IP/MASK>
enable ipforwarding <VLAN>
enable bootprelay <VLAN>

and either set up a global DHCP relay:

configure bootprelay add <IP>

or a VLAN-specific one

configure bootprelay <VLAN> add <IP>

https://extremeportal.force.com/ExtrArticleDetail?an=000083193&q=How%20to%20configure%20BOOTP%20Relay%20using%20EXOS

Of course, the DHCP server needs to support relaying and to be set up with the intended scopes.

Improve this answer
3
  • DHCP relaying seems like a good solution, but do you have any information on how the promiscuous port could be configured?
    – someonr
    Sep 7, 2022 at 9:26
  • It seems like you can't configure an ip address for a subscriber vlan. So this won't work. configure vlan gaeste-lan ipaddress 192.168.223.2 Error: Subscriber VLAN gaeste-lan cannot be configured with IP address. Configure IP address on network VLAN only.
    – someonr
    Sep 9, 2022 at 9:56
  • @someonr, I haven't done any of this with Extreme hardware, but the suggestion there to "Configure IP address on network VLAN only" matches how it works with at least some other vendors' hardware: that most features that affect the whole VLAN are configured on the "primary" ("network"?) VLAN from where they apply to the all the secondaries ("subscriber VLANs"?). In a way, the point is that for the case of e.g. DHCP relay (or DHCP snooping, or just plain routing out of the VLAN), the device doesn't care which sub-VLAN the packet came from.
    – ilkkachu
    Sep 10, 2022 at 8:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.