Protected Port

Switch Port Isolation without Private VLANs:

Private VLAN Edge

* We have SW2, fas0/16 (Server)  Fas 0/17 (Hacker)

! Configure Isolation, use protect sentence 
SW2(config)#in range fastEthernet 0/16-17
SW2(config-if-range)#switchport protected
* Note: They now can not communicate each other 

Private VLAN

VLANs involved:
- Primary
- Secondary

Secondary VLAN Types:
- Isolated
- Community

Port Types:
- Promiscuous
- Isolated
- Community  

! Private VLANs require Transparent Mode VTP
SW2(config)#vtp mode transparent

! Create the Community secondary VLANs
SW2(config)#vlan 500
SW2(config-vlan)#private-vlan community
SW2(config-vlan)#exit
SW2(config)#vlan 400
SW2(config-vlan)#private-vlan community
SW2(config-vlan)#exit
SW2(config)#vlan 400
SW2(config-vlan)#private-vlan community
SW2(config-vlan)#exit

! Create the Isolated secondary VLAN
SW2(config)#vlan 200
SW2(config-vlan)#private-vlan isolated
SW2(config-vlan)#exit

! Create the Primary VLAN 
SW2(config)#vlan 100
SW2(config-vlan)#private-vlan primary

! Associate all the secondary VLANs to this Primary VLAN
SW2(config-vlan)#private-vlan association 200,300,400,500
SW2(config-vlan)#exit

! Specify the Promiscuous port 
SW2(config)#interface fas 0/11
SW2(config-if)#switchport mode private-vlan promiscuous 

! Specify the Primary VLAN #, followed by the Secondaries
SW2(config-if)#switchport private-vlan mapping 100 200,300,400,500
SW2(config-if)#exit

! Place a couple interfaces in the Isolated VLAN
SW2(config)#interface range fas 0/12-13
SW2(config-if)#switchport mode private-vlan host

! List the Primary VLAN then Secondary (Isolated) VLAN
SW2(config-if)#switchport private-vlan host-association 100 200

! Add a port to Community VLAN 300
SW2(config)#interface fas 0/14
SW2(config-if)#switchport mode private-vlan host
SW2(config-if)#switchport private-vlan host-association 100 300

! Add a port to Community VLAN 400
SW2(config)#interface fas 0/15
SW2(config-if)#switchport mode private-vlan host
SW2(config-if)#switchport private-vlan host-association 100 400

! To Verify use: 
SW2#show vlan private vlan
SW2#show int fas 0/11 switchport

Cisco CCNP Switch Chapter 17

Setting Up Private VLANs

#Change VTP mode to Transparent
SW1#conf terminal
SW1(config)#vtp mode  transparent

#Create Primary VLAN
SW1(config)#vlan 200
SW1(config-vlan)#private-vlan ?
  association  Configure association between private VLANs
  community    Configure the VLAN as a community private VLAN
  isolated     Configure the VLAN as an isolated private VLAN
  primary      Configure the VLAN as a primary private VLAN
SW1(config-vlan)#private-vlan primary
SW1(config-vlan)#exit

#Create Community VLAN
SW1(config)#vlan 205
SW1(config-vlan)#private-vlan community
SW1(config-vlan)#exit

#Create Isolated VLAN
SW1(config)#vlan 210
SW1(config-vlan)#private-vlan isolated
SW1(config-vlan)#exit

#Associate sub vlans to primary vlan
SW1(config)#vlan 200
SW1(config-vlan)#private-vlan association 205,210
SW1(config-vlan)#end

#Check created Vlans
SW1#show vlan private-vlan type
Vlan Type
---- -----------------
200  primary
205  community
210  isolated

#Port Configuration and associate Ports to Vlan

#Community Port Configuration
SW1#conf terminal
SW1(config)#interface Fa4/24
SW1(config-if)#switchport mode private-vlan ?
  host         Set the mode to private-vlan host
  promiscuous  Set the mode to private-vlan promiscuous
  
SW1(config-if)#switchport mode private-vlan host

SW1(config-if)#switchport private-vlan ?
  association       Set the private VLAN association
  host-association  Set the private VLAN host association
  mapping           Set the private VLAN promiscuous mapping

SW1(config-if)#switchport private-vlan host-association ?
  <1006-4094>  Primary extended range VLAN ID of the private VLAN host port
               association
  <2-1001>     Primary normal range VLAN ID of the private VLAN port
               association

SW1(config-if)#switchport private-vlan host-association 200 ?
  <1006-4094>  Secondary extended range VLAN ID of the private VLAN host port
               association
  <2-1001>     Secondary normal range VLAN ID of the private VLAN host port
               association

SW1(config-if)#switchport private-vlan host-association 200 205
SW1(config-if)#interface Fa4/25
SW1(config-if)#switchport mode private-vlan host
SW1(config-if)#switchport private-vlan host-association 200 205

#Isolated Port Configuration
SW1(config)#interface Fa4/26
SW1(config-if)#switchport mode private-vlan host
SW1(config-if)#switchport private-vlan host-association 200 210

#Promiscuous Port Configuration
SW1(config-if)#interface Fa4/27
SW1(config-if)#switchport mode private-vlan promiscuous
SW1(config-if)#switchport private-vlan ?
  association       Set the private VLAN association
  host-association  Set the private VLAN host association
  mapping           Set the private VLAN promiscuous mapping

SW1(config-if)#switchport private-vlan mapping ?
  <1006-4094>  Primary extended range VLAN ID of the private VLAN promiscuous
               port mapping
  <2-1001>     Primary normal range VLAN ID of the private VLAN promiscuous
               port mapping
SW1(config-if)#switchport private-vlan mapping 200 ?
  WORD    Secondary VLAN IDs of the private VLAN promiscuous port mapping
  add     Add a VLAN to private VLAN list
  remove  Remove a VLAN from private VLAN list

SW1(config-if)#switchport private-vlan mapping 200 205,210

#Check Configuration
SW1#show vlan private-vlan
Primary Secondary Type              Ports
------- --------- ----------------- ------------------------------------------
200     205       community         Fa4/24, Fa4/25, Fa4/27
200     210       isolated          Fa4/26, Fa4/27

SW1#show running-config
!
vtp mode transparent
!
vlan 200
  private-vlan primary
  private-vlan association 205,210
!
vlan 205
  private-vlan community
!
vlan 210
  private-vlan isolated
!
interface FastEthernet4/24
 switchport private-vlan host-association 200 205
 switchport mode private-vlan host
!
interface FastEthernet4/25
 switchport private-vlan host-association 200 205
 switchport mode private-vlan host
!
interface FastEthernet4/26
 switchport private-vlan host-association 200 210
 switchport mode private-vlan host
!
interface FastEthernet4/27
 switchport private-vlan mapping 200 205,210
 switchport mode private-vlan promiscuous
!