Private VLAN adopts Layer 2 VLAN structure. A Private VLAN consists of a Primary VLAN and a
Secondary VLAN, providing a mechanism for achieving layer-2-separation between ports. For
uplink devices, all the packets received from the downstream are without VLAN tags. Uplink
devices need to identify Primary VLANs but not Secondary VLANs. Therefore, they can save
VLAN resources without considering the VLAN configuration in the lower layer. Meanwhile, the
service provider can assign each user an individual Secondary VLAN, so that users are
separated at the Layer 2 level.
Private VLAN technology is mainly used in campus or enterprise networks to achieve user
Layer-2-separation and to save VLAN resources of uplink devices.
The Elements of a Private VLAN
Promiscuous port:
A promiscuous port connects to and communicates with the uplink device.
The PVID of the promiscuous port is the same with the Primary VLAN ID. One promiscuous port
can only join to one Primary VLAN.
Host port:
A host port connects to and communicates with terminal device. The PVID of the
host port is the same as the Secondary VLAN ID. One host port can only belong to one Private
VLAN.
Primary VLAN:
A Private VLAN has one Primary VLAN and one Secondary VLAN. Primary VLAN
is the user VLAN uplink device can identify, but it is not the actual VLAN the end user is in. Every
port in a private VLAN is a member of the primary VLAN. The primary VLAN carries
unidirectional traffic downstream from the promiscuous ports to the host ports and to other
promiscuous ports.
Secondary VLAN:
Secondary VLAN is the actual VLAN the end user is in. Secondary VLANs
are associated with a primary VLAN, and are used to carry traffic from hosts to uplink devices.
There are two types of secondary VLANS:
Isolated VLAN
－
Members in an isolated VLAN are isolated with each other. Each isolated
VLAN must bind to a primary VLAN.
Community VLAN
－
Members in a community VLAN can communicate with each other
directly. Each community VLAN must bind to a primary VLAN.
Features of Private VLAN
1.
A Private VLAN contains one Primary VLAN and one Secondary VLAN.
2.
A VLAN cannot be set as the Primary VLAN and Secondary VLAN simultaneously.
3.
A Secondary VLAN can only join one private VLAN.
4.
A Primary VLAN can be associated with multi-Secondary VLANs to create
multi-Private VLANs.
100
