Configuration of private vla ns

1. http://blog.router-switch.com/
Configuration of Private VLANs
With Private VLANs, you can provide segmentation of your existing VLAN, providing
isolation and security for end devices. Devices put on an isolated port can only talk
with promiscuous ports: usually the port going towards the gateway router.
Community ports can talk with the promiscuous port and all other ports in their own
community.
The illustration below is what I have set up to test it.
The switch is a Cisco 3560 series, capable of PVLANs, currently configured with VLAN
1 on all ports. This means that the IP Phone and the computer are in the same VLAN.
Not a good practice, but since the router (provided by the ISP) does not support
multiple VLANs and trunking, that’s what I have to work with. So to provide some
form of security to the IP Phone, I’m going to put it in its own isolated PVLAN. The
port to the router will be the promiscuous port. This way, the IP Phone will only be
able to communicate with the gateway, segmenting it from the rest of the network.
The IP Phone has IP 192.168.0.106 and is connected to FastEthernet 0/2. The router
is on FastEthernet 0/1. Before we start implementing the PVLAN, it can be pinged
from the computer connected on FastEthernet 0/3.
Warning! Always configure PVLANs through the console port, or through a switch
port that will not be affected by the PVLANs, otherwise you’ll lose connectivity
http://www.router-switch.com/

2. http://blog.router-switch.com/
during configuration.
First thing to do is putting VTP in transparent mode, as VTP version 1 and 2 don’t
support PVLANs:
Switch(config)#vtp mode transparent
Next, we implement the PVLANs on the switch. I’ve choosen VLAN 4 as the
promiscuous VLAN. VLAN 41 will be set on the port going to the IP Phone, the
isolated port. Finally, all other ports will be put into PVLAN 42, a community VLAN, so
all other devices can communicate with each other. The naming is just to make it
easy in case of troubleshooting.
Switch(config)#vlan 4
Switch(config-vlan)#name PRIMARY
Switch(config-vlan)#exit
Switch(config)#vlan 41
Switch(config-vlan)#name ISOLATED
Switch(config-vlan)#exit
Switch(config)#vlan 42
Switch(config-vlan)#name COMMUNITY
Switch(config-vlan)#exit
Returning to VLAN 4 and binding all PVLANs together:
Switch(config)#vlan 4
Switch(config-vlan)#private-vlan primary
Switch(config-vlan)#private-vlan association 41,42
Switch(config-vlan)#exit
Switch(config)#vlan 41
Switch(config-vlan)#private-vlan isolated
Switch(config-vlan)#exit
Switch(config)#vlan 42
Switch(config-vlan)#private-vlan community
Switch(config-vlan)#exit
The creation of the VLANs has to be done first; otherwise the ‘association’ command
will not work. Once this is done, we start binding ports to PVLANs.
First the port towards the router:
Switch(config)#interface f0/1
Switch(config-int)#switchport mode private-vlan promiscuous
Switch(config-int)#switchport private-vlan mapping 4 41,42
Then the isolated port:
Switch(config)#interface f0/2
Switch(config-int)#switchport mode private-vlan host
Switch(config-int)#switchport private-vlan host-association 4 41
http://www.router-switch.com/

3. http://blog.router-switch.com/
And last, the community ports:
Switch(config)#interface range f0/3 – 24
Switch(config-int)#switchport mode private-vlan host
Switch(config-int)#switchport private-vlan host-association 4 42
That’s it. I can’t ping the IP Phone anymore, but I still have internet connectivity.
Calling from the IP Phone works as usual.
Reference fromhttp://reggle.wordpress.com
More Related Reading:
Types of VLANs
How Private VLANs Work?
http://www.router-switch.com/