34-5
Software Configuration Guide—Release 12.2(25)SG
OL-76590-03
Chapter34 Configuring Private VLANs
How to Configure PVLANs
•You can apply different quality of service (QoS) configurations to primary, isolated, and community
VLANs. (See Chapter27, “Configuring Quality of Service.”) Cisco IOS ACLs applied to the
Layer3 VLAN interface of a primary VLAN automatically apply to the associated isolated and
community VLANs.
•On a PVLAN trunk port a secondary VLAN ACL is applied on ingress traffic and a primary VLAN
ACL is applied on egress traffic.
•On a promiscuous port the primary VLAN ACL is applied on ingress traffic.
•PVLAN trunk ports support only IEEE 802.1q encapsulation.
•You cannot change the VTP mode to client or server for PVLANs.
•An isolated or community VLAN can have only one primary VLAN associated with it.
•VTP does not support PVLANs. You must configure PVLANs on each device where you want
PVLAN ports.
•Community VLANs cannot be propagated or carried over private VLAN trunks.
•ARP entries learned on Layer 3 PVLAN interfaces are termed “sticky” ARP entries (we recommend
that you display and verify PVLAN interface ARP entries).
•For security reasons, PVLAN port sticky ARP entries do not age out. Connecting a device with a
different MAC address but with the same IP address generates an error message and the ARP entry
is not created.
•Because PVLAN port sticky ARP entries do not age out, you must manually remove the entries if
you change the MAC address. To overwrite a sticky ARP entry, first delete the entry with the no arp
command, then overwrite the entry with the arp command.
•In a DHCP environment, if you shut down your PC, it is not possible to give your IP address to
someone else. To solve this problem, the Catalyst 4500 series switch supports the no ip sticky-arp
command. This command promotes IP address overwriting and r euse in a DHCP environment.
Configuring a VLAN as a PVLAN
To configure a VLAN as a PVLAN, perform this task:
This example shows how to configure VLAN 202 as a primary VLAN and verify the configuration:
Switch# configure terminal
Switch(config)# vlan 202
Switch(config-vlan)# private-vlan primary
Switch(config-vlan)# end
Switch# show vlan private-vlan
Command Purpose
Step1 Switch# configure terminal Enters configuration mode.
Step2 Switch(config)# vlan
vlan_ID
Switch(config-vlan)# private-vlan {community |
isolated | primary}
Configures a VLAN as a PVLAN.
•This command does not take effect until you exit
VLAN configuration submode.
•You can use the no keyword to clear PVLAN status.
Step3 Switch(config-vlan)# end Exits VLAN configuration mode.
Step4 Switch# show vlan private-vlan [type]Verifies the configuration.