Table of Contents
Chapter 16
Configuring Private VLANs
Private-VLAN Port Configuration
Follow these guidelines when configuring private-VLAN ports:
•
•
•
•
•
Limitations with Other Features
When configuring private VLANs, remember these limitations with other features:
In some cases, the configuration is accepted with no error messages, but the commands have no effect.
Note
•
•
•
•
•
•
OL-13270-06
Use only the private-VLAN configuration commands to assign ports to primary, isolated, or
community VLANs. Layer 2 access ports assigned to the VLANs that you configure as primary,
isolated, or community VLANs are inactive while the VLAN is part of the private-VLAN
configuration. Layer 2 trunk interfaces remain in the STP forwarding state.
Do not configure ports that belong to a PAgP or LACP EtherChannel as private-VLAN ports. While
a port is part of the private-VLAN configuration, any EtherChannel configuration for it is inactive.
Enable Port Fast and BPDU guard on isolated and community host ports to prevent STP loops due
to misconfigurations and to speed up STP convergence (see
Spanning-Tree
Features"). When enabled, STP applies the BPDU guard feature to all Port
Fast-configured Layer 2 LAN ports. Do not enable Port Fast and BPDU guard on promiscuous ports.
If you delete a VLAN used in the private-VLAN configuration, the private-VLAN ports associated
with the VLAN become inactive.
Private-VLAN ports can be on different network devices if the devices are trunk-connected and the
primary and secondary VLANs have not been removed from the trunk.
Do not configure fallback bridging on switches with private VLANs.
When IGMP snooping is enabled on the switch (the default), the switch or switch stack supports no
more than 20 private-VLAN domains.
Do not configure a remote SPAN (RSPAN) VLAN as a private-VLAN primary or secondary VLAN.
For more information about SPAN, see
Do not configure private-VLAN ports on interfaces configured for these other features:
dynamic-access port VLAN membership
–
Dynamic Trunking Protocol (DTP)
–
Port Aggregation Protocol (PAgP)
–
–
Link Aggregation Control Protocol (LACP)
–
Multicast VLAN Registration (MVR)
–
voice VLAN
–
Web Cache Communication Protocol (WCCP)
You can configure IEEE 802.1x port-based authentication on a private-VLAN port, but do not
configure 802.1x with port security, voice VLAN, or per-user ACL on private-VLAN ports.
A private-VLAN host or promiscuous port cannot be a SPAN destination port. If you configure a
SPAN destination port as a private-VLAN port, the port becomes inactive.
Cisco Catalyst Blade Switch 3130 and 3032 for Dell Software Configuration Guide
Chapter 20, "Configuring Optional
Chapter 30, "Configuring SPAN and RSPAN."
Configuring Private VLANs
16-9
Hide quick links:
Chapters
Table of Contents
Troubleshooting
