Home » Dell Manuals » Servers » Dell Force10 S4810P » Manual Viewer

Dell Force10 S4810P S4810 Configuration Guide, FTOS 8.3.10.1 - Page 795

Private VLANs (PVLAN), Private VLAN Concepts

View all Dell Force10 S4810P manuals

Add to My Manuals
Save this manual to your list of manuals

Page 795 highlights

37 Private VLANs (PVLAN) c s z The Private VLANs (PVLAN) feature is supported on platforms For syntax details on the commands discussed in this chapter, see the Private VLANs Commands chapter in the FTOS Command Line Reference. This chapter contains the following major sections: • Private VLAN Concepts on page 795 • Private VLAN Commands on page 797 • Private VLAN Configuration Task List on page 798 • Private VLAN Configuration Example on page 801 • Inspecting the Private VLAN Configuration on page 802 Private VLANs extend the FTOS security suite by providing Layer 2 isolation between ports within the same VLAN. A private VLAN partitions a traditional VLAN into subdomains identified by a primary and secondary VLAN pair. Private VLANs block all traffic to isolated ports except traffic from promiscuous ports. Traffic received from an isolated port is forwarded only to promiscuous ports or trunk ports. Example uses of PVLANs: • A hotel can use an isolated VLAN in a private VLAN to provide Internet access for its guests, while stopping direct access between the guest ports. • A service provider can provide Layer 2 security for customers and use the IP addresses more efficiently, by using a separate community VLAN per customer, while at the same time using the same IP subnet address space for all community and isolated VLANs mapped to the same primary VLAN. In more detail, community VLANs are especially useful in the service provider environment, because, multiple customers are likely to maintain servers that must be strictly separated in customer-specific groups. A set of servers owned by a customer could comprise a community VLAN, so that those servers could communicate with each other, and would be isolated from other customers. Another customer might have another set of servers in another community VLAN. Another customer might want an isolated VLAN, which is has one or more ports that are also isolated from each other. Private VLAN Concepts The VLAN types in a private VLAN (PVLAN) include: Community VLAN - A community VLAN is a type of secondary VLAN in a primary VLAN: Private VLANs (PVLAN) | 795

Section	Page
About this Guide	29
Objectives	29
Audience	29
Conventions	29
Information Symbols	30
Related Documents	30
Configuration Fundamentals	31
Accessing the Command Line	31
CLI Modes	32
Navigating CLI Modes	33
The do Command	36
Undoing Commands	36
Obtaining Help	37
Entering and Editing Commands	37
Command History	38
Filtering show Command Outputs	39
Multiple Users in Configuration mode	40
Getting Started	41
Console access	41
Serial console	41
Accessing the RJ-45 console port with a DB-9 adapter	42
Default Configuration	42
Configure a Host Name	43
Access the System Remotely	43
Access the C-Series, E-Series, S-Series, and the Z-Series Remotely	43
Configure the Management Port IP Address	43
Configure a Management Route	44
Configure a Username and Password	44
Access the S-Series Remotely	45
Configure the Enable Password	46
Configuration File Management	46
Copy Files to and from the System	47
Important Points to Remember	47
Save the Running-configuration	48
Configure the Overload bit for Startup Scenario	49
View Files	50
View Configuration Files	51
File System Management	51
View command history	52
Upgrading FTOS	52
Management	53
Configure Privilege Levels	53
Create a Custom Privilege Level	53
Removing a command from EXEC mode	54
Move a command from EXEC privilege mode to EXEC mode	54
Allow Access to CONFIGURATION mode commands	54
Allow Access to INTERFACE, LINE, ROUTE-MAP, and ROUTER mode	54
Apply a Privilege Level to a Username	56
Apply a Privilege Level to a Terminal Line	56
Configure Logging	57
Log Messages in the Internal Buffer	57
Configuration Task List for System Log Management	57
Disable System Logging	58
Send System Messages to a Syslog Server	58
Configure a Unix System as a Syslog Server	58
Change System Logging Settings	59
Display the Logging Buffer and the Logging Configuration	59
Configure a UNIX logging facility level	60
Synchronize log messages	62
Enable timestamp on syslog messages	62
File Transfer Services	63
Configuration Task List for File Transfer Services	63
Enable FTP server	63
Configure FTP server parameters	63
Configure FTP client parameters	64
Terminal Lines	65
Deny and Permit Access to a Terminal Line	65
Configure Login Authentication for Terminal Lines	65
Time out of EXEC Privilege Mode	67
Telnet to Another Network Device	67
Lock CONFIGURATION mode	68
Viewing the Configuration Lock Status	69
Recovering from a Forgotten Password on the S4810	69
Recovering from a Forgotten Enable Password on the S4810	70
Recovering from a Failed Start on the S4810	70
802.1ag	73
Ethernet CFM	73
Maintenance Domains	74
Maintenance Points	74
Maintenance End Points	75
Implementation Information	76
Configure CFM	76
Related Configuration Tasks	76
Enable Ethernet CFM	77
Create a Maintenance Domain	77
Create a Maintenance Association	78
Create Maintenance Points	78
Create a Maintenance End Point	78
Create a Maintenance Intermediate Point	79
MP Databases	79
MP Database Persistence	80
Continuity Check Messages	80
Enable CCM	81
Enable Cross-checking	82
Loopback Message and Response	82
Linktrace Message and Response	82
Link Trace Cache	83
Enable CFM SNMP Traps.	84
Display Ethernet CFM Statistics	85
802.1X	87
Protocol Overview	87
The Port-authentication Process	88
EAP over RADIUS	89
RADIUS Attributes for 802.1 Support	90
Configuring 802.1X	90
Related Configuration Tasks	90
Important Points to Remember	91
Enabling 802.1X	91
Configuring Request Identity Re-transmissions	92
Configuring a Quiet Period after a Failed Authentication	93
Forcibly Authorizing or Unauthorizing a Port	94
Re-authenticating a Port	95
Periodic Re-authentication	95
Configuring Timeouts	96
Dynamic VLAN Assignment with Port Authentication	98
Guest and Authentication-fail VLANs	99
Configuring a Guest VLAN	99
Configuring an Authentication-fail VLAN	100
Access Control Lists (ACLs)	103
Overview	103
IP Access Control Lists (ACLs)	104
CAM Profiling, CAM Allocation, and CAM Optimization	104
CAM Profiling	105
User Configurable CAM Allocation	105
CAM optimization	106
Test CAM Usage	106
Implementing ACLs on FTOS	107
ACLs and VLANs	107
ACL Optimization	107
Determine the order in which ACLs are used to classify traffic	107
IP Fragment Handling	108
IP fragments ACL examples	109
Layer 4 ACL rules examples	109
Configure a standard IP ACL	110
Configure an extended IP ACL	113
Configure filters with sequence number	113
Configure filters without sequence number	115
Established Flag	116
Configuring Layer 2 and Layer 3 ACLs on an Interface	116
Assign an IP ACL to an Interface	117
Counting ACL Hits	118
Configuring Ingress ACLs	119
Configuring Egress ACLs	119
Egress Layer 3 ACL Lookup for Control-plane IP Traffic	120
Configuring ACLs to Loopback	121
Applying an ACL on Loopback Interfaces	121
IP Prefix Lists	122
Implementation Information	123
Configuration Task List for Prefix Lists	123
Configure a prefix list	123
Use a prefix list for route redistribution	126
ACL Resequencing	127
Resequencing an ACL or Prefix List	128
Route Maps	130
Implementation Information	130
Important Points to Remember	130
Configuration Task List for Route Maps	130
Create a route map	131
Configure route map filters	132
Configure a route map for route redistribution	135
Configure a route map for route tagging	136
Continue clause	136
Bidirectional Forwarding Detection (BFD)	139
Protocol Overview	139
How BFD Works	140
BFD packet format	140
BFD sessions	142
BFD three-way handshake	143
Session state changes	144
Important Points to Remember	145
Configuring Bidirectional Forwarding Detection	145
Configuring BFD for Physical Ports	145
Related configuration tasks	146
Enabling BFD globally	146
Establishing a session on physical ports	146
Viewing physical port session parameters	148
Disabling and re-enabling BFD	149
Configuring BFD for Static Routes	149
Related configuration tasks	150
Establishing sessions for static routes	150
Changing static route session parameters	151
Disabling BFD for static routes	151
Configuring BFD for OSPF	151
Related configuration tasks	152
Establishing sessions with OSPF neighbors	152
Changing OSPF session parameters	153
Disabling BFD for OSPF	154
Configuring BFD for IS-IS	154
Related configuration tasks	154
Establishing sessions with IS-IS neighbors	154
Changing IS-IS session parameters	156
Disabling BFD for IS-IS	156
Configuring BFD for BGP	157
Prerequisites	157
Establishing sessions with BGP neighbors	157
Disabling BFD for BGP	159
Using BFD in a BGP Peer Group	160
Displaying BFD for BGP Information	160
Configuring BFD for VRRP	165
Related configuration tasks	165
Establishing sessions with all VRRP neighbors	165
Establishing VRRP sessions on VRRP neighbors	166
Changing VRRP session parameters	167
Disabling BFD for VRRP	168
Configuring BFD for VLANs	168
Related configuration tasks	169
Establishing sessions with VLAN neighbors	169
Disabling BFD for VLANs	169
Configuring BFD for Port-Channels	169
Related configuration tasks	170
Establishing sessions on port-channels	170
Disabling BFD for port-channels	170
Configuring Protocol Liveness	171
Troubleshooting BFD	171
Border Gateway Protocol	173
Protocol Overview	174
Autonomous Systems (AS)	174
Sessions and Peers	176
Establishing a session	177
Peer Groups	177
Route Reflectors	178
Confederations	179
Communities	179
BGP Attributes	179
Best Path Selection Criteria	179
Best Path selection details	181
Weight	182
Local Preference	182
Multi-Exit Discriminators (MEDs)	183
Origin	184
AS Path	185
Next Hop	186
Multiprotocol BGP	186
Implementing BGP with FTOS	186
Additional Path (Add-Path) support	186
Advertise IGP cost as MED for redistributed routes	187
Ignore Router-ID for some best-path calculations	187
4-Byte AS Numbers	188
AS4 Number Representation	188
Dynamic AS Number Notation application	189
AS Number Migration	191
BGP4 Management Information Base (MIB)	193
Important Points to Remember	193
Configuration Information	194
BGP Configuration	195
Defaults	195
Configuration Task List for BGP	196
Enable BGP	196
Configure AS4 Number Representations	201
Configure Peer Groups	203
BGP fast fall-over	207
Configure passive peering	209
Maintain existing AS numbers during an AS migration	210
Allow an AS number to appear in its own AS path	211
Enable graceful restart	212
Filter on an AS-Path attribute	214
Redistribute routes	217
Enable additional paths	218
Configure IP community lists	218
Manipulate the COMMUNITY attribute	221
Change MED attribute	224
Change LOCAL_PREFERENCE attribute	224
Change NEXT_HOP attribute	225
Change WEIGHT attribute	225
Enable multipath	226
Filter BGP routes	226
Configure BGP route reflectors	229
Aggregate routes	230
Configure BGP confederations	231
Enable route flap dampening	231
Change BGP timers	235
BGP neighbor soft-reconfiguration	235
Route map continue	237
MBGP Configuration	238
BGP Regular Expression Optimization	239
Debugging BGP	239
Storing Last and Bad PDUs	240
Capturing PDUs	241
PDU Counters	242
Sample Configurations	242
Bare Metal Provisioning 3.0 (BMP 3.0)	253
Overview	253
Prerequisites	254
Important Information	254
BMP Process Overview	254
Preparing BMP	255
DHCP Server	255
DHCP Configuration	255
DHCP Retry Mechanism	256
DHCP server IP Blacklist	256
MAC-Based IP assignment	256
File Server	257
Domain Name Server	257
Reload Modes	257
BMP Mode	258
BMP Mode Prerequisites	258
MAC-Based IP Address Assignment	258
Normal Mode	259
DHCP Configuration	259
FTOS Image Retrieval	259
Scripts	259
Pre-configuration Scripts	259
Post-configuration Scripts	260
Auto-execution Scripts	260
Process for pre-configuration scripts:	260
Configuration Tasks	261
System boot and set-up behavior in BMP Mode	262
BMP mode: Boot and Set-up Behavior	263
Reload without a DHCP Server Offer	264
Reload with a DHCP Server Offer without an FTOS Image	264
Reload with a DHCP Server Offer without a Configuration File	264
Reload with a DHCP Server Offer without a DNS Server	266
Reload with a Pre-configuration Script (BMP mode only)	266
Using the Post-Configuration Script (BMP mode only)	267
Reload using the Auto-execution Script (Normal mode only)	267
Script Examples	268
Auto-execution Script - Normal mode	268
Pre-configuration Script - BMP Mode	271
Content Addressable Memory (CAM)	273
Content Addressable Memory	273
CAM Profiles	274
Microcode	275
CAM Profiling for ACLs	276
Boot Behavior	277
Example: EF Line Card with EG Chassis Profile (Card Problem)	278
Example: EH Line Card with EG Chassis Profile (Card Problem)	278
When to Use CAM Profiling	278
Important Points to Remember	279
Differences Between EtherScale and TeraScale	279
Select CAM Profiles	279
CAM Allocation	280
Test CAM Usage	281
View CAM Profiles	281
View CAM-ACL settings	282
View CAM Usage	284
Configure IPv4Flow Sub-partitions	284
Configure Ingress Layer 2 ACL Sub-partitions	287
Return to the Default CAM Configuration	289
CAM Optimization	289
Applications for CAM Profiling	289
LAG Hashing	289
LAG Hashing based on Bidirectional Flow	290
CAM profile for the VLAN ACL group feature	290
Troubleshoot CAM Profiling	290
CAM Profile Mismatches	290
QoS CAM Region Limitation	291
Control Plane Policing (CoPP)	293
Overview	293
Configure Control Plane Policing	294
Configure CoPP for protocols	295
Sample Config for CoPP protocol configuration	296
Configure CoPP for CPU queues	297
Sample Config for CoPP CPU queue configuration	297
Show commands	298
Data Center Bridging (DCB)	301
Ethernet Enhancements in Data Center Bridging	301
Priority-Based Flow Control	302
Enhanced Transmission Selection	304
Data Center Bridging Exchange Protocol (DCBx)	305
Data Center Bridging in a Traffic Flow	305
Enabling Data Center Bridging	306
QoS dot1p Traffic Classification and Queue Assignment	307
Configuring Priority-Based Flow Control	308
Configuring Lossless Queues	311
Configuring the PFC Buffer in a Switch Stack	312
DCB and Switch Stacking Caveats for the S4820T	313
Configuring Enhanced Transmission Selection	313
ETS Prerequisites and Restrictions	313
Creating a QoS ETS Output Policy	314
Creating an ETS Priority Group	317
Applying an ETS Output Policy for a Priority Group to an Interface	318
ETS Operation with DCBx	319
Configuring Bandwidth Allocation for DCBx CIN	320
Applying DCB Policies in a Switch Stack	321
Configuring DCBx Operation	322
DCBx Operation	322
DCBx Port Roles	322
DCB Configuration Exchange	324
Configuration Source Election	324
Propagation of DCB Information	325
Auto-Detection and Manual Configuration of the DCBx Version	325
DCBx Example	326
DCBx Prerequisites and Restrictions	328
DCBx Configuration Procedure	328
Configuring DCBx on an Interface	328
Configuring DCBx Globally on the Switch	330
DCBx Error Messages	332
An error in DCBx operation is displayed using the syslog messages:	332
Debugging DCBx on an Interface	332
Verifying DCB Configuration	333
PFC and ETS Configuration Examples	346
Using PFC and ETS to Manage Data Center Traffic	346
Using PFC and ETS to Manage Converged Ethernet Traffic in a Switch Stack	350
Hierarchical Scheduling in ETS Output Policies	351
S-Series Debugging and Diagnostics	353
Offline diagnostics	353
Important Points to Remember	354
Running Offline Diagnostics	354
Trace logs	357
Auto Save on Crash or Rollover	358
Last restart reason	358
Hardware watchdog timer	358
show hardware commands	359
Environmental monitoring	360
Recognize an over-temperature condition	360
Troubleshoot an over-temperature condition	361
Recognize an under-voltage condition	361
Troubleshoot an under-voltage condition	362
Buffer tuning	362
Deciding to tune buffers	364
Buffer tuning commands	365
Using a pre-defined buffer profile	367
Sample buffer profile configuration	367
Troubleshooting packet loss	368
Displaying Drop Counters	368
Dataplane Statistics	370
Displaying Stack Port Statistics	372
Displaying Stack Member Counters	372
Application core dumps	373
Mini core dumps	373
TCP dumps	374
Dynamic Host Configuration Protocol (DHCP)	377
Protocol Overview	377
DHCP Packet Format and Options	378
Assigning an IP Address using DHCP	379
Implementation Information	380
Configuration Tasks	380
Configure the System to be a DHCP Server	380
Configuration Tasks	381
Related Configuration Tasks	381
Configure the Server for Automatic Address Allocation	381
Create an IP Address Pool	382
Exclude Addresses from the Address Pool	382
Specify an Address Lease Time	383
Specify a Default Gateway	383
Enable DHCP Server	383
Configure a Method of Hostname Resolution	384
Address Resolution using DNS	384
Address Resolution using NetBIOS WINS	384
Create Manual Binding Entries	384
Debug DHCP server	385
DHCP Clear Commands	385
Configure the System to be a Relay Agent	385
Configure the System for User Port Stacking	387
Configure Secure DHCP	387
Option 82	387
DHCP Snooping	388
Enable DCHP Snooping	389
Add a static entry in the binding table	389
Clear the binding table	389
Display the contents of the binding table	389
Drop DHCP packets on snooped VLANs only	390
Dynamic ARP Inspection	391
Bypass the ARP Inspection	393
Source Address Validation	393
IP Source Address Validation	393
DHCP MAC Source Address Validation	394
IP+MAC Source Address Validation	394
Equal Cost Multi-Path (ECMP)	397
ECMP for Flow-based Affinity	397
Configurable Hash Algorithm	397
Deterministic ECMP Next Hop	398
Configurable Hash Algorithm Seed	398
Link Bundle Monitoring	399
Managing ECMP Group Paths	400
Enabling FIPS Cryptography	401
Preparing the System	401
Enabling FIPS Mode	401
Generating Host-Keys	402
Monitoring FIPS Mode Status	403
Disabling the FIPS Mode	403
FIP Snooping	405
Fibre Channel over Ethernet	405
Ensuring Robustness in a Converged Ethernet Network	405
FIP Snooping on Ethernet Bridges	407
FIP Snooping in a Switch Stack	409
Configuring FIP Snooping	409
Enabling the FIP Snooping Feature	410
Enabling FIP Snooping on VLANs	410
Configuring the FC-MAP Value	410
Configuring a Port for a Bridge-to-Bridge Link	411
Configuring a Port for a Bridge-to-FCF Link	411
Impact on Other Software Features	411
FIP Snooping Prerequisites	411
FIP Snooping Restrictions	412
Configuration Procedure	412
Displaying FIP Snooping Information	413
FIP Snooping Configuration Example	418
Force10 Resilient Ring Protocol (FRRP)	421
Protocol Overview	421
Ring Status	422
Ring Checking	422
Ring Failure	422
Ring Restoration	422
Multiple FRRP Rings	423
Member VLAN Spanning Two Rings Connected by One Switch	423
Important FRRP Points	423
Important FRRP Concepts	424
Implementing FRRP	425
FRRP Configuration	425

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1,000
1,001
1,002
1,003
1,004
1,005
1,006
1,007
1,008
1,009
1,010
1,011
1,012
1,013
1,014
1,015
1,016
1,017
1,018
1,019
1,020
1,021
1,022
1,023
1,024
1,025
1,026
1,027
1,028
1,029
1,030
1,031
1,032
1,033
1,034
1,035
1,036
1,037
1,038
1,039
1,040
1,041
1,042
1,043
1,044
1,045
1,046
1,047
1,048
1,049
1,050
1,051
1,052
1,053
1,054
1,055
1,056
1,057
1,058
1,059
1,060
1,061
1,062
1,063
1,064
1,065
1,066
1,067
1,068
1,069
1,070
1,071
1,072
1,073
1,074
1,075
1,076
1,077
1,078
1,079
1,080
1,081
1,082
1,083
1,084
1,085
1,086
1,087
1,088
1,089
1,090
1,091
1,092
1,093
1,094
1,095
1,096
1,097
1,098
1,099
1,100
1,101
1,102
1,103
1,104
1,105
1,106
1,107
1,108
1,109
1,110
1,111
1,112
1,113
1,114
1,115
1,116
1,117
1,118
1,119
1,120
1,121
1,122
1,123
1,124
1,125
1,126
1,127
1,128
1,129
1,130
1,131
1,132
1,133
1,134
1,135
1,136
1,137
1,138
1,139
1,140
1,141
1,142
1,143
1,144

Match case Limit results 1 per page

Private VLANs (PVLAN)

795

Private VLANs (PVLAN)

The

Private VLANs (PVLAN)

feature is supported on platforms

s z

For syntax details on the commands discussed in this chapter, see the Private VLANs Commands chapter

in the

FTOS Command Line Reference

This chapter contains the following major sections:

•

Private VLAN Concepts on page 795

•

Private VLAN Commands on page 797

•

Private VLAN Configuration Task List on page 798

•

Private VLAN Configuration Example on page 801

•

Inspecting the Private VLAN Configuration on page 802

Private VLANs extend the FTOS security suite by providing Layer 2 isolation between ports within the

same VLAN. A private VLAN partitions a traditional VLAN into subdomains identified by a

primary

and

secondary VLAN

pair. Private VLANs block all traffic to isolated ports except traffic from promiscuous

ports. Traffic received from an isolated port is forwarded only to promiscuous ports or trunk ports.

Example uses of PVLANs:

•

A hotel can use an isolated VLAN in a private VLAN to provide Internet access for its guests, while

stopping direct access between the guest ports.

•

A service provider can provide Layer 2 security for customers and use the IP addresses more

efficiently, by using a separate community VLAN per customer, while at the same time using the same

IP subnet address space for all community and isolated VLANs mapped to the same primary VLAN.

In more detail, community VLANs are especially useful in the service provider environment, because,

multiple customers are likely to maintain servers that must be strictly separated in customer-specific

groups. A set of servers owned by a customer could comprise a community VLAN, so that those

servers could communicate with each other, and would be isolated from other customers. Another

customer might have another set of servers in another community VLAN. Another customer might

want an isolated VLAN, which is has one or more ports that are also isolated from each other.

Private VLAN Concepts

The VLAN types in a private VLAN (PVLAN) include:

Community VLAN

— A

community VLAN

is a type of secondary VLAN in a primary VLAN: