Users Guide

Private VLAN Configuration Example
The following example shows a private VLAN topology.
Figure 106. Sample Private VLAN Topology
The following configuration is based on the example diagram for the Z9500:
● Te 1/1 and Te 1/23 are configured as promiscuous ports, assigned to the primary VLAN, VLAN 4000.
● Te 1/25 is configured as a PVLAN trunk port, also assigned to the primary VLAN 4000.
● Te 1/24 and Te 1/47 are configured as host ports and assigned to the isolated VLAN, VLAN 4003.
● Te 4/1 and Te 23 are configured as host ports and assigned to the community VLAN, VLAN 4001.
● Te 4/24 and Te 4/47 are configured as host ports and assigned to community VLAN 4002.
The result is that:
● The ports in community VLAN 4001 can communicate directly with each other and with promiscuous ports.
● The ports in community VLAN 4002 can communicate directly with each other and with promiscuous ports.
● The ports in isolated VLAN 4003 can only communicate with the promiscuous ports in the primary VLAN 4000.
● All the ports in the secondary VLANs (both community and isolated VLANs) can only communicate with ports in the other
secondary VLANs of that PVLAN over Layer 3, and only when the ip local-proxy-arp command is invoked in the
primary VLAN.
NOTE:
Even after you disable ip-local-proxy-arp (no ip-local-proxy-arp) in a secondary VLAN, Layer 3
communication may happen between some secondary VLAN hosts, until the ARP timeout happens on those secondary
VLAN hosts.
In parallel, on S4810:
● Te 1/3 is a promiscuous port and Te 1/25 is a PVLAN trunk port, assigned to the primary VLAN 4000.
● Te 1/4-6 are host ports. Te 1/4 and Te 1/5 are assigned to the community VLAN 4001, while Te 1/6 is assigned to the
isolated VLAN 4003.
The result is that:
668
Private VLANs (PVLAN)