Administrator Guide

762 VLANs

The same traffic isolation can be achieved by assigning each port with a

different VLAN, allocating an IP subnet for each VLAN, and enabling layer-3

routing between them. In a private VLAN domain, on the other hand, all

members can share the common address space of a single subnet, which is

associated with a primary VLAN. So, the advantage of the private VLANs

feature is that it reduces the number of consumed VLANs, improves IP

addressing space utilization, and helps to avoid layer-3 routing.

Figure 21-3 shows an example Private VLAN scenario, in which five hosts (H-

A through H-E) are connected to a stack of switches (SW1, SW2). The

switch stack is connected to router R1. Port references shown are with

reference to the stack.

Figure 21-3. Private VLAN Domain

Promiscuous Ports

An endpoint connected to a promiscuous port is allowed to communicate

with any endpoint within the private VLAN. Multiple promiscuous ports can

be defined for a single private VLAN domain.

TE1/1/1

SW1

Gi1/0/10 Gi1/0/11

Gi1/0/12

H-A H-B H-C H-D H-E

Gi2/0/10

Gi2/0/11

SW2