Hands-On Lab: Configuring Private VLANs (PVLANs)

Lab Objective

Configure a primary VLAN with one isolated secondary VLAN and one community secondary VLAN, assign hosts to each, configure a promiscuous port for the shared gateway, and verify the distinct communication rules each VLAN type enforces.

Lab Purpose

The protected port feature covered in an earlier lab provides simple binary isolation on a single switch. Private VLANs extend this into a genuine multi-tier isolation model spanning potentially multiple switches, distinguishing between hosts that can never talk to each other (isolated) and hosts that can talk within their own small group (community) — all while sharing a single IP subnet and default gateway.

Lab Topology

Switch1
  Primary VLAN 100 (192.168.100.0/24)
  Isolated VLAN 101
  Community VLAN 102

  Gi1/0/1 ---- HostA (isolated VLAN 101)
  Gi1/0/2 ---- HostB (isolated VLAN 101)
  Gi1/0/3 ---- HostC (community VLAN 102)
  Gi1/0/4 ---- HostD (community VLAN 102)
  Gi1/0/24 ---- Router (promiscuous port, primary VLAN)

Task 1: Create the Primary and Secondary VLANs

Create VLAN 100 as primary, VLAN 101 as isolated, and VLAN 102 as community.

Task 2: Associate the Secondary VLANs with the Primary

Link both secondary VLANs to the primary VLAN.

Task 3: Configure Host Ports

Configure Gi1/0/1 and Gi1/0/2 as host ports in the isolated VLAN, and Gi1/0/3 and Gi1/0/4 as host ports in the community VLAN.

Task 4: Configure the Promiscuous Port

Configure Gi1/0/24 as a promiscuous port mapping to both secondary VLANs.

Task 5: Verify Isolated VLAN Behavior

Confirm HostA and HostB, both in the isolated VLAN, cannot communicate with each other.

Task 6: Verify Community VLAN Behavior

Confirm HostC and HostD, both in the community VLAN, can communicate with each other.

Task 7: Verify All Hosts Reach the Promiscuous Port

Confirm every host can reach the router through the promiscuous port.

Solution and Verification

Switch1(config)# vlan 100
Switch1(config-vlan)# private-vlan primary
Switch1(config-vlan)# exit
Switch1(config)# vlan 101
Switch1(config-vlan)# private-vlan isolated
Switch1(config-vlan)# exit
Switch1(config)# vlan 102
Switch1(config-vlan)# private-vlan community

Switch1(config)# vlan 100
Switch1(config-vlan)# private-vlan association 101,102

Switch1(config)# interface gigabitethernet1/0/1
Switch1(config-if)# switchport mode private-vlan host
Switch1(config-if)# switchport private-vlan host-association 100 101
Switch1(config-if)# exit
Switch1(config)# interface gigabitethernet1/0/2
Switch1(config-if)# switchport mode private-vlan host
Switch1(config-if)# switchport private-vlan host-association 100 101

Switch1(config)# interface gigabitethernet1/0/3
Switch1(config-if)# switchport mode private-vlan host
Switch1(config-if)# switchport private-vlan host-association 100 102
Switch1(config-if)# exit
Switch1(config)# interface gigabitethernet1/0/4
Switch1(config-if)# switchport mode private-vlan host
Switch1(config-if)# switchport private-vlan host-association 100 102

Switch1(config)# interface gigabitethernet1/0/24
Switch1(config-if)# switchport mode private-vlan promiscuous
Switch1(config-if)# switchport private-vlan mapping 100 101,102

-- The promiscuous port maps to BOTH secondary
-- VLANs, since the shared gateway needs to
-- reach hosts in every secondary VLAN
-- associated with the primary

HostA> ping 192.168.100.12

Request timed out.
Success rate is 0 percent (0/5)
-- HostA (isolated) cannot reach HostB
-- (also isolated), even though both share
-- VLAN 101 -- isolated VLAN hosts can
-- NEVER talk to each other, only to
-- promiscuous ports

HostC> ping 192.168.100.14

Reply from 192.168.100.14: bytes=32 time=1ms
-- HostC and HostD, both in the community
-- VLAN 102, CAN communicate with each
-- other -- this is the defining difference
-- between community and isolated secondary
-- VLANs

HostA> ping 192.168.100.1
Reply from 192.168.100.1: bytes=32 time=1ms

HostC> ping 192.168.100.1
Reply from 192.168.100.1: bytes=32 time=1ms
-- Every host, regardless of secondary VLAN
-- type, reaches the router through the
-- promiscuous port normally

Key Takeaway

The isolated versus community distinction is the core PVLAN concept: isolated VLAN hosts can only ever talk to promiscuous ports, never to each other under any circumstances, while community VLAN hosts form their own mini broadcast domain able to talk within their group while still being isolated from hosts in other secondary VLANs — both secondary types share the same primary VLAN's IP subnet and default gateway, reached exclusively through the promiscuous port.