18-5
Catalyst 3750-X and 3560-X Switch Software Configuration Guide
OL-21521-01
Chapter 18 Configuring Private VLANs Configuring Private VLANs

Private VLANs and SVIs

In a Layer 3 switch, a switch virtual interface (SVI) represents the Layer 3 interface of a VLAN. Layer 3
devices communicate with a private VLAN only through the primary VLAN and not through secondary
VLANs. Configure Layer 3 VLAN interfaces (SVIs) only for primary VLANs. You cannot configure
Layer 3 VLAN interfaces for secondary VLANs. SVIs for secondary VLANs are inactive while the
VLAN is configured as a secondary VLAN.
• If you try to configure a VLAN with an active SVI as a secondary VLAN, the configuration is not
allowed until you disable the SVI.
• If you try to create an SVI on a VLAN that is configured as a secondary VLAN and the secondary
VLAN is already mapped at Layer 3, the SVI is not created, and an error is returned. If the SVI is
not mapped at Layer 3, the SVI is created, but it is automatically shut down.
When the primary VLAN is associated with and mapped to the secondary VLAN, any configuration on
the primary VLAN is propagated to the secondary VLAN SVIs. For example, if you assign an IP subnet
to the primary VLAN SVI, this subnet is the IP subnet address of the entire private VLAN.

Private VLANs and Switch Stacks

Private VLANs can operate within the switch stack, and private-VLAN ports can reside on different
stack members. However, some changes to the switch stack can impact private-VLAN operation:
• If a stack contains only one private-VLAN promiscuous port and the stack member that contains that
port is removed from the stack, host ports in that private VLAN lose connectivity outside the private
VLAN.
• If a stack master stack that contains the only private-VLAN promiscuous port in the stack fails or
leaves the stack and a new stack master is elected, host ports in a private VLAN that had its
promiscuous port on the old stack master lose connectivity outside of the private VLAN.
• If two stacks merge, private VLANs on the winning stack are not affected, but private-VLAN
configuration on the losing switch is lost when that switch reboots.
For more information about switch stacks, see Chapter 5, “Managing Switch Stacks.”
Configuring Private VLANs
These sections contain this configuration information:
• Tasks for Configuring Private VLANs, page 18-6
• Default Private-VLAN Configuration, page 18-6
• Private-VLAN Configuration Guidelines, page 18-6
• Configuring and Associating VLANs in a Private VLAN, page 18-9
• Configuring a Layer 2 Interface as a Private-VLAN Host Port, page 18-11
• Configuring a Layer 2 Interface as a Private-VLAN Promiscuous Port, page 18-12
• Mapping Secondary VLANs to a Primary VLAN Layer 3 VLAN Interface, page 18-13