11-18
Catalyst 6000 Family Software Configuration Guide—Releases 6.3 and 6.4
78-13315-02
Chapter 11 Configuring VLANs
Configuring Private VLANs
•
IGMP snooping and multicast shortcuts are not supported in private VLANs.
•
You cannot enable EtherChannel on isolated, community, or promiscuous ports.
•
You can apply different VACLs and quality of service (QoS) ACLs to primary, isolated, and
community VLANs.
Note
For information on configuring ACLs, see the
“Configuring ACLs on Private VLANs”
section on page 16-26
.
•
Output ACLs need to be configured on both the two-way community VLANs and the primary
VLAN in order to be applied to all outgoing traffic from the MSFC.
•
If you map a Cisco IOS ACL to a primary VLAN, the Cisco IOS ACL automatically maps to the
associated isolated and community VLANs.
•
You cannot map Cisco IOS ACLs to an isolated or community VLAN.
•
You cannot use policy-based routing (PBR) on a private VLAN interface. You get an error message
if you try to apply a policy to a private VLAN interface using the
ip policy route-map
route_map_name
command.
•
You cannot set a VLAN to a private VLAN if the VLAN has dynamic access control entries (ACEs)
configured on it.
•
You can stop Layer 3 switching on an isolated or community VLAN by destroying the binding of
that VLAN with its primary VLAN. Deleting the corresponding mapping is not sufficient.
Creating a Primary Private VLAN
To create a primary private VLAN, perform this task in privileged mode:
Task
Command
Step 1
Create the primary private VLAN.
set vlan
vlan
pvlan-type primary
Step 2
Set the isolated, community, or two-way
community VLAN(s).
set vlan
vlan
pvlan-type
{
isolated
|
community
|
twoway-community
}
Step 3
Bind the isolated, community, or two-way
community VLAN(s) to the primary VLAN.
set pvlan
primary_vlan
{
isolated_vlan |
community_vlan
|
twoway_community_vlan
}
Step 4
Associate the isolated, community, or two-way
community port(s) to the primary private VLAN.
set pvlan
primary_vlan
{
isolated_vlan |
community_vlan
|
twoway_community_vlan
}
[
mod
/
ports
|
sc0
]
Step 5
Map the isolated, community, or two-way
community VLAN to the primary private VLAN
on the promiscuous port.
set pvlan mapping
primary_vlan
{
isolated_vlan
| community_vlan
|
twoway_community_vlan
}
mod
/
ports
Step 6
Verify the primary private VLAN configuration.
show pvlan
[
vlan
]
show pvlan mapping
