Restrictions for Private VLANs
Thefollowing arerestrictions for configuring private VLANs:
•PrivateVLANs are only supported on switches running the IP Lite image.

Limitations with Other Features

Whenconfiguring privateVLANs, rememberthese limitations with other features:
Insome cases, the configuration is accepted with no error messages, but the commands have no effect.Note
•Donot configure fallback bridging on switches with private VLANs.
•WhenIGMP snooping is enabled on the switch (the default), the switch or switch stack supports no
morethan 20 private VLAN domains.
•Donot configure a remoteSPAN (RSPAN) VLAN as a private VLAN primary or secondary VLAN.
•Donot configure privateVLAN ports on interfaces configured for these other features:
◦Dynamic-accessport VLAN membership
◦DynamicTrunking Protocol (DTP)
◦PortAggregation Protocol (PAgP)
◦LinkAggregation Control Protocol (LACP)
◦MulticastVLAN Registration (MVR)
◦VoiceVLAN
◦WebCache Communication Protocol (WCCP)
•Youcan configure IEEE 802.1x port-based authentication on a private VLAN port, but do not configure
802.1xwith port security, voice VLAN, or per-user ACL on private VLAN ports.
•Aprivate VLAN host or promiscuous port cannot be a SPAN destination port. If you configure a SPAN
destinationport as a private VLAN port, the port becomes inactive.
•Ifyou configure a staticMAC address on a promiscuous port in the primary VLAN, you must add the
samestatic address to all associated secondary VLANs. If you configure a static MAC address on a host
portin a secondary VLAN, you must add the same static MAC address to the associated primary VLAN.
Whenyou delete a static MAC address from a private VLAN port, you must remove all instances of the
configuredMAC address from the private VLAN.
Catalyst 2960-XR Switch VLAN Configuration Guide, Cisco IOS Release 15.0(2)EX1
86 OL-29440-01
Configuring Private VLANs
Restrictions for Private VLANs