Private-VLAN Lab

Community
20

Community
10

SVI (Interface Vlan 100)

192.168.2.99

Isolated
30

Promiscuous
100
10,20,30

Host
100
10

Host
100
10

Host
100
20

Host
100
30

Host
100
30

Fa 0/1

Fa 0/2

Fa 0/3

Fa 0/4

Fa 0/5

Fa 0/6

Srv-2
192.168.2.112

Srv-3
192.168.2.113

Srv-4
192.168.2.114

Router(or Firewall)

192.168.2.1

Srv-5
192.168.2.115

Switch#configure terminal
Switch(config)#vtp mode transparent

Switch(config)#vlan 10
Switch(config-vlan)#private-vlan community
Switch(config-vlan)#vlan 20
Switch(config-vlan)#private-vlan community
Switch(config-vlan)#vlan 30
Switch(config-vlan)#private-vlan isolated

Switch(config-vlan)#vlan 100
Switch(config-vlan)#private-vlan primary
Switch(config-vlan)#private-vlan association 10,20,30

#####################YOU CANNOT ASSOCIATE MORE THAN ONE ISOLATED-VLAN TO A PRIMARY-VLAN

Switch(config-vlan)#exit
Switch(config)#vlan 40
Switch(config-vlan)#private-vlan isolated

Srv-6
192.168.2.116

Switch(config)#vlan 100
Switch(config-vlan)#private-vlan association add 40
%Command rejected: invalid private vlan association between vlan100 and vlan40. Isolated VLAN 30 is
already associated with VLAN 100.
Switch(config)#no vlan 40

#####################YOU CANNOT CHANGE VTP MODE

Switch(config)#vtp mode server
VTP mode cannot be set to server because there are private vlans configured on this device.

Switch(config)#interface fastEthernet 0/1

Switch(config-if)#switchport mode private-vlan promiscuous
Switch(config-if)#switchport private-vlan mapping 100 10,20,30

Switch(config)#interface fastEthernet 0/2

Switch(config-if)#switchport mode private-vlan host
Switch(config-if)#switchport private-vlan host-association 100 10
Switch(config-if)#interface fastEthernet 0/3
Switch(config-if)#switchport mode private-vlan host
Switch(config-if)#switchport private-vlan host-association 100 10
Switch(config-if)#interface fastEthernet 0/4
Switch(config-if)#switchport mode private-vlan host
Switch(config-if)#switchport private-vlan host-association 100 20
Switch(config-if)#interface fastEthernet 0/5
Switch(config-if)#switchport mode private-vlan host
Switch(config-if)#switchport private-vlan host-association 100 30
Switch(config-if)#interface fastEthernet 0/6
Switch(config-if)#switchport mode private-vlan host
Switch(config-if)#switchport private-vlan host-association 100 30

Switch#show vlan
VLAN Name
Status
Ports
---- -------------------------------- --------- ------------------------------1
default
active
Fa0/7, Fa0/8, Fa0/9, Fa0/10
Fa0/11, Fa0/12, Fa0/13, Fa0/14
Fa0/15, Fa0/16, Fa0/17, Fa0/18
Fa0/19, Fa0/20, Fa0/21, Fa0/22
Fa0/23, Fa0/24, Gi0/1, Gi0/2
10
VLAN0010
active
20
VLAN0020
active
30
VLAN0030
active
100 VLAN0100
active
1002 fddi-default
act/unsup
1003 token-ring-default
act/unsup
1004 fddinet-default
act/unsup
1005 trnet-default
act/unsup
VLAN
---1
10
20
30

Type
----enet
enet
enet
enet

SAID
---------100001
100010
100020
100030

MTU
----1500
1500
1500
1500

Parent
------

RingNo
------

BridgeNo
--------

Stp
----

BrdgMode
--------

Trans1
-----0
0
0
0

Trans2
-----0
0
0
0

Switch#sh vlan private-vlan

Primary
------100
100
100

Secondary
--------10
20
30

Type
----------------community
community
isolated

Ports
-----------------------------------------Fa0/1, Fa0/2, Fa0/3
Fa0/1, Fa0/4
Fa0/1, Fa0/5, Fa0/6

Switch#show interfaces fastEthernet 0/3 switchport

Name: Fa0/3
Switchport: Enabled
Administrative Mode: private-vlan host
Operational Mode: private-vlan host
Administrative Trunking Encapsulation: negotiate
Operational Trunking Encapsulation: native
Negotiation of Trunking: Off
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: none
Administrative private-vlan host-association: 100 (VLAN0100) 10 (VLAN0010)
Administrative private-vlan mapping: none

Switch#show interfaces fastEthernet 0/1 switchport

Name: Fa0/1
Switchport: Enabled
Administrative Mode: private-vlan promiscuous
Operational Mode: private-vlan promiscuous
Administrative Trunking Encapsulation: negotiate
Operational Trunking Encapsulation: native
Negotiation of Trunking: Off
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: none
Administrative private-vlan host-association: none
Administrative private-vlan mapping: 100 (VLAN0100) 10 (VLAN0010) 20 (VLAN0020) 30 (VLAN0030)

################FROM (SRV-3, 192.168.2.113):

C:\>ping 192.168.2.1
Pinging 192.168.2.1 with 32 bytes of data:
Reply from 192.168.2.1: bytes=32 time=3ms TTL=64
Reply from 192.168.2.1: bytes=32 time=2ms TTL=64
Reply from 192.168.2.1: bytes=32 time=2ms TTL=64
Reply from 192.168.2.1: bytes=32 time=2ms TTL=64
Ping statistics for 192.168.2.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 2ms, Maximum = 3ms, Average = 2ms
C:\>ping 192.168.2.112
Pinging 192.168.2.112 with 32 bytes of data:
Reply from 192.168.2.112: bytes=32 time<1ms TTL=128
Reply from 192.168.2.112: bytes=32 time<1ms TTL=128
Reply from 192.168.2.112: bytes=32 time<1ms TTL=128
Reply from 192.168.2.112: bytes=32 time<1ms TTL=128
Ping statistics for 192.168.2.112:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
C:\>ping 192.168.2.114
Pinging 192.168.2.114 with 32 bytes of data:
Request
Request
Request
Request

timed
timed
timed
timed

out.
out.
out.
out.

Ping statistics for 192.168.2.114:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

C:\>ping 192.168.2.115
Pinging 192.168.2.115 with 32 bytes of data:
Request
Request
Request
Request

timed
timed
timed
timed

out.
out.
out.
out.

Ping statistics for 192.168.2.115:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

C:\>ping 192.168.2.116
Pinging 192.168.2.116 with 32 bytes of data:
Request
Request
Request
Request

timed
timed
timed
timed

out.
out.
out.
out.

Ping statistics for 192.168.2.116:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

################FROM (SRV-6, 192.168.2.116):

C:\>ping 192.168.2.1
Pinging 192.168.2.1 with 32 bytes of data:
Reply from 192.168.2.1: bytes=32 time=3ms TTL=64
Reply from 192.168.2.1: bytes=32 time=2ms TTL=64
Reply from 192.168.2.1: bytes=32 time=2ms TTL=64
Reply from 192.168.2.1: bytes=32 time=2ms TTL=64
Ping statistics for 192.168.2.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 2ms, Maximum = 3ms, Average = 2ms

C:\>ping 192.168.2.115
Pinging 192.168.2.115 with 32 bytes of data:
Request
Request
Request
Request

timed
timed
timed
timed

out.
out.
out.
out.

Ping statistics for 192.168.2.115:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Switch(config)#ip routing
Switch(config)#interface vlan 100
Switch(config-if)#ip address 192.168.2.99 255.255.255.0
Switch(config-if)#no shut
Switch#ping 192.168.2.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/203/1006 ms

Switch#ping 192.168.2.113
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.113, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)

Switch#conf t
Switch(config)#interface vlan 100
Switch(config-if)#private-vlan mapping 10

Switch#show interfaces vlan 100 private-vlan mapping

Interface Secondary VLANs
--------- -------------------------------------------------------------------vlan100
10

witch#ping 192.168.2.113
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.113, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

Switch#ping 192.168.2.112
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.112, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/9 ms

Switch#ping 192.168.2.114
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.114, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)

Switch#conf t
Switch(config)#inter vlan 100
Switch(config-if)#private-vlan mapping add 20
Switch(config-if)#^Z

Switch#sh
Interface
--------vlan100

interfaces vlan 100 private-vlan mapping

Secondary VLANs
-------------------------------------------------------------------10, 20

Switch#ping 192.168.2.114
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.114, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/9 ms

Omidreza Omidbahar