Users Guide

L2 communication is not permitted between hosts connected to ports in an isolated VLAN and hosts connected to ports in any
of the secondary VLANs. Also, hosts connected to ports in a community VLAN cannot communicate with hosts connected to
ports in another community or isolated VLAN.
However, these hosts can communicate with each other over L3 through the primary VLAN. To configure an L3 VLAN interface,
enable the local proxy ARP feature. For more information, see Configure Layer 3 VLAN interface. For ARP requests from hosts
in the secondary VLANs, the primary VLAN responds with an ARP reply and routes the packets between them.
NOTE: When you enable the Local Proxy ARP feature in the primary VLAN, the devices in the PVLAN domain might receive
more than one ARP response. For example, an ARP response from the actual destination device and an ARP response from
the router that performs proxy ARP.
Access control lists
You can apply IP ACLs and MAC ACLs on the primary VLAN, and MAC ACLs on the secondary VLAN ports.
Multicast support for PVLAN
OS10 supports enabling Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Protocol
snooping in a PVLAN domain. Enabling IGMP and MLD snooping allows switches to forward multicast traffic only to IGMP
and MLD receivers and hence conserve network resources. It offers the following benefits:
● Improves network bandwidth utilization by forwarding multicast traffic only to multicast receiver ports.
● Provides increased security by preventing an unknown multicast flood to all the VLAN member ports.
Important notes
● OS10 supports enabling IGMP and MLD snooping only on primary VLANs, and it automatically enables IGMP and MLD
snooping on all the associated secondary VLANs. When you disable IGMP and MLD snooping on a primary VLAN, the system
disables it from the associated secondary VLANs as well.
● IGMP and MLD snooping commands are not allowed on secondary VLANs.
● OS10 supports the Multicast Flood Restrict feature in a PVLAN domain.
● You cannot configure a secondary port as an mrouter port. Dynamic mrouter port learning is disabled on secondary ports.
● OS10 does not support L3 IGMP and PIM configuration commands in a PVLAN domain. These features are not allowed on
primary, isolated, and community VLANs.
PVLAN with VLT
You can configure Virtual Link Trunking (VLT) peer nodes in a PVLAN domain. With VLT being an L2 redundancy mechanism,
support for VLT nodes in a PVLAN:
● Provides a loop-free network with optimal bandwidth utilization.
● Enables L2 security functionalities.
Important notes
● PVLAN configurations of VLT-VLAN and VLT port channels must be identical on both VLT peer nodes. PVLAN IDs and
mappings must be identical on both VLT peer nodes as well.
● Enable local proxy ARP in the primary VLAN on both VLT peers. Even though you configure the local proxy ARP on both
the VLT peer nodes, only the VLT primary node processes the ARP requests. When the primary VLT node reboots and the
secondary VLT node transitions to become the primary VLT node, it processes the ARP requests.
● If you enable the Local Proxy ARP feature, enable VLT peer routing on both the VLT peer nodes.
● A VLT port channel can be a promiscuous port, secondary VLAN port, or ISL trunk port.
● MAC address replication in a PVLAN domain is based on the local configuration of the VLT peer node.
672
Layer 2