实现交换专用动机服务提供商除内容.pdf

MotivationforPrivateVLANs

▪Serviceprovidersoftenhavedevicesfrommultiples,inadditionto

theirownservers,inasingleDemilitarizedZone(DMZ)segmentor

VLAN.Assecurityissuesabound,itesmoreimportanttoprovidetraffic

isolationbetweendevices,eventhoughtheymightexistonthesame

Layer3segmentandVLAN.

▪MostCiscoIOS-basedswitchesimplementprivateVLANstokeepsome

switchportssharedandsomeswitchportsisolated,eventhoughall

portsremaininthesameVLAN.

pVLANPortTypes

▪Isolated

▪Promiscuous

▪Community

pVLANStructureSupportingVLANs

▪PrimaryPrivateVLAN

▪SecondaryPrivateVLAN

▪CommunityPrivateVLAN

▪IsolatedPrivateVLAN

ConfiguringpVLANs-Steps

▪Step1.SetVTPmodetotransparent.

▪Step2.CreatethesecondarypVLANs.

▪Step3.CreatetheprimarypVLAN.

▪Step4.AssociatethesecondarypVLANwiththeprimarypVLAN.

OnlyoneisolatedpVLANcanbemappedtoaprimarypVLAN,butmore

thanonecommunitypVLANcanbemappedtoaprimarypVLAN.

▪Step5.Configureaninterfaceasanisolatedorcommunityport.

▪Step6.Associatetheisolatedportorcommunityportwiththe

primary-secondarypVLANpair.

▪Step7.Configureaninterfaceasapromiscuousport.

▪Step8.Mapthepromiscuousporttotheprimary-secondary

pVLANpair.

ConfiguringpVLANs-Commands

Switch(config)#vlanpvlan-id

Switch(config-vlan)#private-vlan{community|isolated|primary}

Switch(config-vlan)#exit

Switch(config)#vlanprimary-vlan-id

Switch(config-vlan)#private-vlanassociation{secondary-vlan-list|add

secondary-vlan-list|removesecondary-vlan-list}

Switch(config-vlan)#interfacevlanprimary-vlan-id

Switch(config-if)#private-vlanmap{secondary-vlan-list|add

secondary-vlan-list|removesecondary-vlan-list}

Switch(config-if)#interfacetypeslot/port

Switch(config-if)#switchport

Switch(config-if)#switchportmodeprivate-vlan{host|p