Switching · VLANs and Trunking

Private VLANs

Restrict local host-to-host communication while retaining a shared upstream gateway.

Independent lab examples; selected output and frame summaries are illustrative. Port naming and command support vary by switch and software release.

Network and objective

Requires PVLAN-capable hardware/software; use a compatible VTP mode and supported trunk/SVI mappings.

SW1 hosts isolated clients on Gi1/0/1 and /2; Gi1/0/24 is a promiscuous gateway connection. Primary VLAN 100 associates isolated secondary VLAN 101.

Physical links are solid; device roles and relevant links are labeled.

How it works

An isolated host can communicate with a promiscuous gateway but not another isolated host through the PVLAN. A community secondary permits communication within that community and to the promiscuous port. Different secondary groups are not simply ordinary access VLANs with unrestricted reachability.

The association, host port association and promiscuous mapping are separate configurations. A shared IP subnet does not override Layer 2 isolation. Routing, proxy behavior and a gateway’s policy can create an indirect path, so test the complete security requirement rather than assuming PVLAN isolation is end-to-end authorization.

Configure or inspect

vtp mode transparent
vlan 101
 private-vlan isolated
vlan 100
 private-vlan primary
 private-vlan association 101
interface range GigabitEthernet1/0/1 - 2
 switchport mode private-vlan host
 switchport private-vlan host-association 100 101
interface GigabitEthernet1/0/24
 switchport mode private-vlan promiscuous
 switchport private-vlan mapping 100 101

Verify the result

Illustrative output · selected lines

SW1#show vlan private-vlan
Primary Secondary Type      Ports
100     101       isolated  Gi1/0/1, Gi1/0/2, Gi1/0/24
Constructed reachability:
  H1 → gateway: succeeds
  H1 → H2 directly: blocked by isolation

An entry is not enough: validate permitted upstream traffic and prohibited direct peer traffic. Extend primary/secondary VLANs and compatible mappings deliberately when spanning switches.

Failure and recovery

A host assigned to an ordinary access VLAN instead of private-vlan host mode can bypass the intended local isolation model. Correct the role and association, then retest the entire matrix.

interface GigabitEthernet1/0/2
 switchport mode private-vlan host
 switchport private-vlan host-association 100 101

Key Takeaways

Primary and secondary VLANs have distinct roles.
Isolated hosts reach promiscuous ports, not isolated peers.
Community hosts can communicate within their community.
Host associations and gateway mappings must match.
Gateway routing and policy still affect end-to-end isolation.