Home » TP-Link Manuals » Hubs & Switches » TP-Link T2700G-28TQ » Manual Viewer

TP-Link T2700G-28TQ T2700G-28TQ User Guide V1 - Page 108

Private VLAN, The Elements of a Private VLAN, Promiscuous port, Host port, Primary VLAN

View all TP-Link T2700G-28TQ manuals

Add to My Manuals
Save this manual to your list of manuals

Page 108 highlights

7.9 Private VLAN Private VLANs, designed to save VLAN resources of uplink devices and decrease broadcast, are sets of VLAN pairs that share a common primary identifier. To guarantee user information security, the ease with which to manage and account traffic for service providers, in campus network, service providers usually require that each individual user is Layer-2 separated. VLAN feature can solve this problem. However, as stipulated by IEEE 802.1Q protocol, a device can only support up to 4094 VLANs. If a service provider assigns one VLAN per user, the VLANs will be far from enough; as a result, the number of users this service provider can support is limited. Private VLAN adopts Layer 2 VLAN structure. A Private VLAN consists of a Primary VLAN and a Secondary VLAN, providing a mechanism for achieving layer-2-separation between ports. For uplink devices, all the packets received from the downstream are without VLAN tags. Uplink devices need to identify Primary VLANs but not Secondary VLANs. Therefore, they can save VLAN resources without considering the VLAN configuration in the lower layer. Meanwhile, the service provider can assign each user an individual Secondary VLAN, so that users are separated at the Layer 2 level. Private VLAN technology is mainly used in campus or enterprise networks to achieve user Layer-2-separation and to save VLAN resources of uplink devices.  The Elements of a Private VLAN Promiscuous port: A promiscuous port connects to and communicates with the uplink device. The PVID of the promiscuous port is the same with the Primary VLAN ID. One promiscuous port can only join to one Primary VLAN. Host port: A host port connects to and communicates with terminal device. The PVID of the host port is the same as the Secondary VLAN ID. One host port can only belong to one Private VLAN. Primary VLAN: A Private VLAN has one Primary VLAN and one Secondary VLAN. Primary VLAN is the user VLAN uplink device can identify but it is not the actual VLAN the end user is in. Every port in a private VLAN is a member of the primary VLAN. The primary VLAN carries unidirectional traffic downstream from the promiscuous ports to the host ports and to other promiscuous ports. Secondary VLAN: .Secondary VLAN is the actual VLAN the end user is in. Secondary VLANs are associated with a primary VLAN, and are used to carry traffic from hosts to uplink devices. There are two types of secondary VLANS:  Isolated VLAN－The VLAN that an isolated port is associated with is called isolated VLAN. Each isolated VLAN must bind to a primary VLAN.  Community VLAN－The VLAN that a community port is associated with is called community VLAN. Each community VLAN must bind to a primary VLAN.  Features of Private VLAN 1. A Private VLAN contains one Primary VLAN and one Secondary VLAN. 2. A VLAN cannot be set as the Primary VLAN and Secondary VLAN simultaneously. 3. A Secondary VLAN can only join one private VLAN. 96

Section	Page
Package Contents	13
Chapter 1 About This Guide	14
1.1 Intended Readers	14
1.2 Conventions	14
1.3 Overview of This Guide	14
Chapter 2 Introduction	19
2.1 Overview of the Switch	19
2.2 Main Features	19
2.3 Appearance Description	21
2.3.1 Front Panel	21
2.3.2 Rear Panel	23
Chapter 3 Login to the Switch	24
3.1 Login	24
3.2 Configuration	25
Chapter 4 System	26
4.1 System Info	26
4.1.1 System Summary	26
4.1.2 Device Description	28
4.1.3 System Time	28
4.1.4 License Info	30
4.1.5 Daylight Saving Time	31
4.2 User Management	32
4.2.1 User Table	32
4.2.2 User Config	32
4.3 System Tools	34
4.3.1 Boot Config	34
4.3.2 Config Restore	35
4.3.3 Config Backup	36
4.3.4 Firmware Upgrade	36
4.3.5 License Load	37
4.3.6 System Reboot	37
4.3.7 System Reset	38
4.4 Access Security	38
4.4.1 Access Control	38
4.4.2 SSL Config	40
4.4.3 SSH Config	41
Chapter 5 Stack	48
5.1 Stack Management	54
5.1.1 Stack Info	54
5.1.2 Stack Config	55
5.1.3 Switch Renumber	56
5.2 Application Example for Stack	57
Chapter 6 Switching	59
6.1 Port	59
6.1.1 Port Config	59
6.1.2 Port Mirror	60
6.1.3 Port Security	62
6.1.4 Port Isolation	64
6.1.5 Loopback Detection	65
6.2 LAG	67
6.2.1 LAG Table	68
6.2.2 Static LAG	69
6.2.3 LACP Config	70
6.3 Traffic Monitor	72
6.3.1 Traffic Summary	72
6.3.2 Traffic Statistics	73
6.4 MAC Address	75
6.4.1 Address Table	76
6.4.2 Static Address	78
6.4.3 Dynamic Address	79
6.4.4 Filtering Address	81
Chapter 7 VLAN	83
7.1 802.1Q VLAN	84
7.1.1 VLAN Config	85
7.1.2 Port Config	87
7.2 Application Example for 802.1Q VLAN	89
7.3 MAC VLAN	90
7.3.1 MAC VLAN	91
7.3.2 Port Enable	92
7.4 Application Example for MAC VLAN	92
7.5 Protocol VLAN	94
7.5.1 Protocol Group Table	95
7.5.2 Protocol Group	96
7.5.3 Protocol Template	96
7.6 Application Example for Protocol VLAN	98
7.7 VLAN VPN	100
7.7.1 VPN Config	101
7.7.2 Port Enable	101
7.7.3 VLAN Mapping	102
7.8 GVRP	104
7.9 Private VLAN	108
7.9.1 PVLAN Config	109
7.9.2 Port Config	110
7.10 Application Example for Private VLAN	111
Chapter 8 Spanning Tree	114
8.1 STP Config	119
8.1.1 STP Config	119
8.1.2 STP Summary	121
8.2 Port Config	122
8.3 MSTP Instance	123
8.3.1 Region Config	123
8.3.2 Instance Config	124
8.3.3 Instance Port Config	125
8.4 STP Security	127
8.4.1 Port Protect	127
8.4.2 TC Protect	130
8.5 Application Example for STP Function	130
Chapter 9 Multicast	135
9.1 IGMP Snooping	137
9.1.1 Snooping Config	138
9.1.2 Port Config	140
9.1.3 VLAN Config	141
9.1.4 Multicast VLAN	142
9.1.5 Querier Config	144
9.2 Application Example for Multicast VLAN	146
9.3 Multicast IP	147
9.3.1 Multicast IP Table	147
9.3.2 Static Multicast IP	148
9.4 Multicast Filter	150
9.4.1 Profile Config	150
9.4.2 Profile Binding	152
9.5 Packet Statistics	153
Chapter 10 Routing	155
10.1 Interface	155
10.2 Routing Table	158
10.3 Static Routing	158
10.3.1 Static Routing	158
10.3.2 Application Example for Static Routing	159
10.4 DHCP Server	160
10.4.1 DHCP Server	166
10.4.2 Pool Setting	168
10.4.3 Manual Binding	169
10.4.4 Binding Table	169
10.4.5 Packet Statistics	170
10.4.6 Application Example for DHCP Server and Relay	172
10.5 DHCP Relay	173
10.5.1 Global Config	175
10.5.2 DHCP Server	176
10.6 Proxy ARP (License Required)	177
10.6.1 Proxy ARP	178
10.6.2 Application Example for Proxy ARP	179
10.7 ARP	180
10.8 RIP	180
10.8.1 Basic Config	183
10.8.2 Interface Config	185
10.8.3 RIP Database	186
10.8.4 Application Example for RIP	187
10.9 OSPF (License Required)	188
10.9.1 Process	205
10.9.2 Basic	206
10.9.3 Network	208
10.9.4 Interface	209
10.9.5 Area	213
10.9.6 Area Aggregation	214
10.9.7 Virtual Link	216
10.9.8 Route Redistribution	217
10.9.9 ASBR Aggregation	218
10.9.10 Neighbor Table	219
10.9.11 Link State Database	221
10.9.12 Application Example for OSPF	221
10.10 VRRP (License Required)	223
10.10.1 Basic Config	227
10.10.2 Advanced Config	229
10.10.3 Virtual IP Config	230
10.10.4 Track Config	231
10.10.5 Virtual Router Statistics	232
10.10.6 Application Example for VRRP	234
Chapter 11 Multicast Routing (License Required)	236
11.1 Global Config	237
11.1.1 Global Config	237
11.1.2 Mroute Table	238
11.2 IGMP	239
11.2.1 Interface Config	243
11.2.2 Interface State	244
11.2.3 Static Multicast Config	245
11.2.4 Multicast Group Table	247
11.2.5 Profile Binding	248
11.2.6 Packet Statistics	250
11.2.7 Application Example for IGMP	251
11.3 PIM DM	252
11.3.1 PIM DM Interface	257
11.3.2 PIM DM Neighbor	257
11.3.3 Application Example for PIM DM	259
11.4 PIM SM	260
11.4.1 PIM SM Interface	266
11.4.2 PIM SM Neighbor	266
11.4.3 BSR	267
11.4.4 RP	269
11.4.5 RP Mapping	270
11.4.6 RP Info	271
11.4.7 Application Example for PIM SM	272
11.5 Static Mroute	273
11.5.1 Static Mroute Config	274
11.5.2 Static Mroute Table	275
11.5.3 Application Example for Static Mroute	275
Chapter 12 QoS	278
12.1 DiffServ	281
12.1.1 Port Priority	281
12.1.2 Schedule Mode	282
12.1.3 802.1P Priority	283
12.1.4 DSCP Priority	284
12.2 Bandwidth Control	286
12.2.1 Rate Limit	286
12.2.2 Storm Control	287
12.3 Voice VLAN	288
12.3.1 Global Config	290
12.3.2 Port Config	291
12.3.3 OUI Config	292
Chapter 13 ACL	294
13.1 Time-Range	294
13.1.1 Time-Range Summary	294
13.1.2 Time-Range Create	295
13.1.3 Holiday Config	296
13.2 ACL Config	296
13.2.1 ACL Summary	297
13.2.2 ACL Create	297
13.2.3 MAC ACL	298
13.2.4 Standard-IP ACL	298
13.2.5 Extend-IP ACL	299
13.3 Policy Config	301
13.3.1 Policy Summary	301
13.3.2 Policy Create	301
13.3.3 Action Create	302
13.4 Policy Binding	303
13.4.1 Binding Table	303
13.4.2 Port Binding	304
13.4.3 VLAN Binding	305
13.5 Application Example for ACL	306
Chapter 14 Network Security	308
14.1 IP-MAC Binding	308
14.1.1 Binding Table	308
14.1.2 Manual Binding	309
14.1.3 ARP Scanning	311
14.2 DHCP Snooping	313
14.2.1 Global Config	316
14.2.2 Port Config	317
14.3 ARP Inspection	318
14.3.1 ARP Detect	321
14.3.2 ARP Defend	323
14.3.3 ARP Statistics	324
14.4 IP Source Guard	325
14.5 DoS Defend	326
14.5.1 DoS Defend	327
14.6 802.1X	328
14.6.1 Global Config	331
14.6.2 Port Config	333
14.6.3 Radius Server	334
Chapter 15 SNMP	336
15.1 SNMP Config	338
15.1.1 Global Config	338
15.1.2 SNMP View	339
15.1.3 SNMP Group	340
15.1.4 SNMP User	341
15.1.5 SNMP Community	343
15.2 Notification	345
15.3 RMON	347
15.3.1 Statistics	347
15.3.2 History	348
15.3.3 Event	349
15.3.4 Alarm	350
Chapter 16 LLDP	353
16.1 Basic Config	356
16.1.1 Global Config	356
16.1.2 Port Config	357
16.2 Device Info	358
16.2.1 Local Info	359
16.2.2 Neighbor Info	360
16.3 Device Statistics	361
16.4 LLDP-MED	362
16.4.1 Global Config	363
16.4.2 Port Config	364
16.4.3 Local Info	366
16.4.4 Neighbor Info	367
Chapter 17 Cluster	369
17.1 NDP	370
17.1.1 Neighbor Info	370
17.1.2 NDP Summary	371
17.1.3 NDP Config	372
17.2 NTDP	373
17.2.1 Device Table	373
17.2.2 NTDP Summary	375
17.2.3 NTDP Config	376
17.3 Cluster	377
17.3.1 Cluster Summary	377
17.3.2 Cluster Config	380
17.3.3 Member Config	383
17.3.4 Cluster Topology	384
17.4 Application Example for Cluster Function	386
Chapter 18 Maintenance	388
18.1 System Monitor	388
18.1.1 CPU Monitor	389
18.1.2 Memory Monitor	390
18.2 Log	390
18.2.1 Log Table	391
18.2.2 Local Log	392
18.2.3 Remote Log	393
18.2.4 Backup Log	394
18.3 Device Diagnostics	394
18.3.1 Cable Test	394
18.3.2 Loopback	396
18.4 Network Diagnostics	396
18.4.1 Ping	396
18.4.2 Tracert	397
Chapter 19 System Maintenance via FTP	399
Appendix A: Specifications	405
Appendix B: Configuring the PCs	407
Appendix C: 802.1X Client Software	409

Match case Limit results 1 per page

7.9 Private VLAN

Private VLANs, designed to save VLAN resources of uplink devices and decrease broadcast, are

sets of VLAN pairs that share a common primary identifier. To guarantee user information security,

the ease with which to manage and account traffic for service providers, in campus network,

service providers usually require that each individual user is Layer-2 separated. VLAN feature can

solve this problem. However, as stipulated by IEEE 802.1Q protocol, a device can only support up

to 4094 VLANs. If a service provider assigns one VLAN per user, the VLANs will be far from

enough; as a result, the number of users this service provider can support is limited.

Private VLAN adopts Layer 2 VLAN structure. A Private VLAN consists of a Primary VLAN and a

Secondary VLAN, providing a mechanism for achieving layer-2-separation between ports. For

uplink devices, all the packets received from the downstream are without VLAN tags. Uplink

devices need to identify Primary VLANs but not Secondary VLANs. Therefore, they can save

VLAN resources without considering the VLAN configuration in the lower layer. Meanwhile, the

service provider can assign each user an individual Secondary VLAN, so that users are separated

at the Layer 2 level.

Private VLAN technology is mainly used in campus or enterprise networks to achieve user

Layer-2-separation and to save VLAN resources of uplink devices.



The Elements of a Private VLAN

Promiscuous port:

A promiscuous port connects to and communicates with the uplink device.

The PVID of the promiscuous port is the same with the Primary VLAN ID. One promiscuous port

can only join to one Primary VLAN.

Host port:

A host port connects to and communicates with terminal device. The PVID of the host

port is the same as the Secondary VLAN ID. One host port can only belong to one Private VLAN.

Primary VLAN:

A Private VLAN has one Primary VLAN and one Secondary VLAN. Primary VLAN

is the user VLAN uplink device can identify but it is not the actual VLAN the end user is in. Every

port in a private VLAN is a member of the primary VLAN. The primary VLAN carries unidirectional

traffic downstream from the promiscuous ports to the host ports and to other promiscuous ports.

Secondary VLAN:

.Secondary VLAN is the actual VLAN the end user is in. Secondary VLANs are

associated with a primary VLAN, and are used to carry traffic from hosts to uplink devices. There

are two types of secondary VLANS:



Isolated VLAN

－

The VLAN that an isolated port is associated with is called isolated VLAN.

Each isolated VLAN must bind to a primary VLAN.



Community VLAN

－

The VLAN that a community port is associated with is called community

VLAN. Each community VLAN must bind to a primary VLAN.



Features of Private VLAN

1. A Private VLAN contains one Primary VLAN and one Secondary VLAN.

2. A VLAN cannot be set as the Primary VLAN and Secondary VLAN simultaneously.

3. A Secondary VLAN can only join one private VLAN.