Configuring Private VLANs for Host Isolation

1. The Case for Isolation Within a VLAN

Ordinarily, all devices within the same VLAN exist in a single broadcast domain and can communicate freely at Layer 2. While this is the intended behavior, it can be a security risk in certain situations.

Consider a multi-tenant office building where a single switch serves multiple small, independent companies on the same floor. To conserve IP addresses, you might place all companies into a single VLAN and subnet. However, you certainly don't want Company A to be able to see the broadcast traffic from Company B, or worse, directly access their file servers. This is where Private VLANs become essential.

2. The Components of a Private VLAN Architecture

Private VLANs achieve this intra-VLAN isolation by partitioning a primary VLAN into one or more secondary subdomains. This architecture introduces new VLAN roles and port types.

Let's summarize those key terms:

VLAN Types:

• Primary VLAN: The main VLAN that carries traffic downstream from the router (via a promiscuous port) to all host ports. All ports in a private VLAN are members of the primary VLAN.
• Secondary VLANs: These are "VLANs within a VLAN" and are associated with the primary VLAN. They define the isolation boundaries. There are two types:
  • Isolated VLAN: Any host port assigned to this VLAN is completely isolated at Layer 2 from all other host ports in the PVLAN, including other isolated ports. They can only communicate with promiscuous ports.
  • Community VLAN: Host ports assigned to the same community VLAN can communicate with each other and with promiscuous ports. They cannot communicate with ports in other communities or with isolated ports.

Port Types:

• Promiscuous Port: This port can communicate with all other ports in the private VLAN (isolated, community, and other promiscuous ports). It is typically used to connect to a router or firewall that provides the default gateway for the entire PVLAN domain.
• Host Port: This is a standard access port that connects to an end device. It can be one of two types:
  • Isolated Port: A host port associated with an isolated VLAN.
  • Community Port: A host port associated with a community VLAN.

3. Configuration and Verification

Now, let's walk through the configuration process using the topology from the diagram above. The configuration follows a logical sequence: set the switch prerequisite, create and define the VLANs, associate them, and then configure the interfaces.

To complement the video demonstration, let's refer to the official Cisco documentation. It provides a structured, command-by-command guide that serves as an excellent reference for building and verifying your configurations.

Configuration Summary

Let's consolidate the process into key steps:

1. Set VTP Prerequisite: PVLAN configurations are not propagated by VTP v1/v2. You must set the switch to transparent mode. VTPv3 supports PVLANs, but for the exam and general practice, transparent mode is the standard approach.

   Switch(config)# vtp mode transparent
   

2. Create and Define VLANs: Create your primary and secondary VLANs and assign their roles.

   Switch(config)# vlan 100
   Switch(config-vlan)# private-vlan primary
   Switch(config-vlan)# exit
   Switch(config)# vlan 501
   Switch(config-vlan)# private-vlan community
   Switch(config-vlan)# exit
   Switch(config)# vlan 502
   Switch(config-vlan)# private-vlan isolated
   Switch(config-vlan)# exit
   

3. Associate VLANs: Go back into the primary VLAN and associate the secondary VLANs with it.

   Switch(config)# vlan 100
   Switch(config-vlan)# private-vlan association 501,502
   Switch(config-vlan)# end
   

4. Configure Ports:

   • Promiscuous Port (Router/Server):

     Switch(config)# interface Fa0/24
     Switch(config-if)# switchport mode private-vlan promiscuous
     Switch(config-if)# switchport private-vlan mapping 100 501,502
     

   • Community Host Port:

     Switch(config)# interface Fa0/1
     Switch(config-if)# switchport mode private-vlan host
     Switch(config-if)# switchport private-vlan host-association 100 501
     

   • Isolated Host Port:

     Switch(config)# interface Fa0/3
     Switch(config-if)# switchport mode private-vlan host
     Switch(config-if)# switchport private-vlan host-association 100 502
     

Verification Commands

• show vlan private-vlan: This is your primary command. It gives a summary of the primary/secondary relationships and which ports are assigned to them.
• show interfaces <interface-id> switchport: This shows the detailed private VLAN status for a specific port, including its mode (e.g., private-vlan host) and associations.

Switch(config)# interface GigabitEthernet1/0/1
Switch(config-if)# switchport mode private-vlan promiscuous
Switch(config-if)# switchport private-vlan mapping 200 201

Switch(config)# interface GigabitEthernet1/0/5
Switch(config-if)# switchport mode private-vlan host
Switch(config-if)# switchport private-vlan host-association 200 201

4. Private VLANs and Layer 3 Routing

A common point of confusion is how IP routing works with PVLANs. Since all hosts are in the same primary VLAN, they typically share the same IP subnet. This means they all need the same default gateway.

The Switched Virtual Interface (SVI) for the PVLAN domain is only configured on the primary VLAN. You cannot create an active SVI on a secondary VLAN. The switch automatically handles the mapping so that all hosts, regardless of their secondary VLAN, can use the primary VLAN's SVI as their gateway.

We will cover SVIs in much greater detail in our next lesson, but for now, the key takeaway is: one IP subnet, one SVI (on the primary VLAN), one default gateway for the entire private VLAN domain.

Conclusion

In this lesson, we moved beyond standard VLANs to implement a powerful security feature for Layer 2 isolation. By partitioning a broadcast domain into primary and secondary VLANs, you can enforce strict communication policies even for hosts on the same IP subnet.

Key Takeaways:

• Private VLANs (PVLANs) provide Layer 2 isolation between hosts within the same primary VLAN and IP subnet.
• The main components are a Primary VLAN and one or more Secondary VLANs (which can be Isolated or Community).
• Ports are configured as Promiscuous (for routers/gateways), Isolated Host, or Community Host.
• Communication rules are strict:
  • Isolated ports only talk to promiscuous ports.
  • Community ports talk to each other and to promiscuous ports.
  • Promiscuous ports talk to everyone.
• Configuration requires setting VTP mode, creating and associating VLANs, and then configuring the port modes and mappings.
• Verification relies on show vlan private-vlan and show interfaces switchport.

Preview of the Next Lesson:

Now that we've seen how PVLANs operate at Layer 2 and briefly touched on their interaction with Layer 3, our next lesson will be a deep dive into Layer 3 switching on Catalyst switches. We will focus on how to troubleshoot inter-VLAN routing using Switched Virtual Interfaces (SVIs), a foundational skill for managing any multi-VLAN enterprise network.