Filter
Top Products
16-8
Catalyst 3750 Switch Software Configuration Guide
OL-8550-09
Chapter 16 Configuring Private VLANs
Configuring Private VLANs
• We recommend that you prune the private VLANs from the trunks on devices that carry no traffic
in the private VLANs.
• You can apply different quality of service (QoS) configurations to primary, isolated, and community
VLANs.
• Sticky ARP
–
Sticky ARP entries are those learned on SVIs and Layer 3 interfaces. They entries do not age
out.
–
The ip sticky-arp global configuration command is supported only on SVIs belonging to
private VLANs.
–
The ip sticky-arp interface configuration command is only supported on
Layer 3 interfaces
SVIs belonging to normal VLANs
SVIs belonging to private VLANs
For more information about using the ip sticky-arp global configuration and the ip sticky-arp
interface configuration commands, see the command reference for this release.
• You can configure VLAN maps on primary and secondary VLANs (see the “Configuring VLAN
Maps” section on page 34-30). However, we recommend that you configure the same VLAN maps
on private-VLAN primary and secondary VLANs.
• When a frame is Layer-2 forwarded within a private VLAN, the same VLAN map is applied at the
ingress side and at the egress side. When a frame is routed from inside a private VLAN to an external
port, the private-VLAN map is applied at the ingress side.
–
For frames going upstream from a host port to a promiscuous port, the VLAN map configured
on the secondary VLAN is applied.
–
For frames going downstream from a promiscuous port to a host port, the VLAN map
configured on the primary VLAN is applied.
To filter out specific IP traffic for a private VLAN, you should apply the VLAN map to both the
primary and secondary VLANs.
• You can apply router ACLs only on the primary-VLAN SVIs. The ACL is applied to both primary
and secondary VLAN Layer 3 traffic.
• Although private VLANs provide host isolation at Layer 2, hosts can communicate with each other
at Layer 3.
• Private VLANs support these Switched Port Analyzer (SPAN) features:
–
You can configure a private-VLAN port as a SPAN source port.
–
You can use VLAN-based SPAN (VSPAN) on primary, isolated, and community VLANs or use
SPAN on only one VLAN to separately monitor egress or ingress traffic.