16-8
Catalyst 3750 SwitchSoftware Configuration Guide
OL-8550-09
Chapter16 Configuring Private VLANs
Configuring Private VLANs
We recommend that you prune the private VLANs from the trunks on devices that carry no traffic
in the private VLANs.
You can apply different quality of service (QoS) configurations to primary, isolated, and community
VLANs.
Sticky ARP
Sticky ARP entries are those learned on SVIs and Layer 3 interfaces. They entries do not age
out.
The ip sticky-arp global configuration command is supported only on SVIs belonging to
private VLANs.
The ip sticky-arp interface configuration command is only supported on
Layer 3 interfaces
SVIs belonging to normal VLANs
SVIs belonging to private VLANs
For more information about using the ip sticky-arp global configuration and the ip sticky-arp
interface configuration commands, see the command reference for this release.
You can configure VLAN maps on primary and secondary VLANs (see the “Configuring VLAN
Maps” section on page 34-30). However, we recommend that you configure the same VLAN maps
on private-VLAN primary and secondary VLANs.
When a frame is Layer-2 forwarded within a private VLAN, the same VLAN map is applied at the
ingress side and at the egress side. When a frame is routed from inside a private VLAN to an external
port, the private-VLAN map is applied at the ingress side.
For frames going upstream from a host port to a promiscuous port, the VLAN map configured
on the secondary VLAN is applied.
For frames going downstream from a promiscuous port to a host port, the VLAN map
configured on the primary VLAN is applied.
To filter out specific IP traffic for a private VLAN, you should apply the VLAN map to both the
primary and secondary VLANs.
You can apply router ACLs only on the primary-VLAN SVIs. The ACL is applied to both primary
and secondary VLAN Layer 3 traffic.
Although private VLANs provide host isolation at Layer 2, hosts can communicate with each other
at Layer 3.
Private VLANs support these Switched Port Analyzer (SPAN) features:
You can configure a private-VLAN port as a SPAN source port.
You can use VLAN-based SPAN (VSPAN) on primary, isolated, and community VLANs or use
SPAN on only one VLAN to separately monitor egress or ingress traffic.