Private VLANs (PVLAN)
Hosts associated with a secondary VLAN can communicate with ports on the primary VLAN , but not with another secondary VLAN.<\/p>\n\n\n\n
A secondary VLAN is configured as one of the following types define the port with one of the following modes: ps: …<\/p>\n\n\n\n 1\u5b9a\u7fa9primary\u53casecondary VLANs …<\/p>\n\n\n\n \u7576gw\u5728\u4e0a\u5c64switch\u6642,\u5206\u914dprivate-vlan\u5728port Private VLANs (PVLAN)Hosts ass …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"","fifu_image_alt":"","_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[31],"tags":[],"class_list":["post-878","post","type-post","status-publish","format-standard","hentry","category-cisco-security"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":950,"url":"https:\/\/systw.net\/note\/archives\/950","url_meta":{"origin":878,"position":0},"title":"Cisco Vlan Trunk","author":"raymond","date":"2008 \u5e74 10 \u6708 7 \u65e5","format":false,"excerpt":"ps:\u4ee5\u4e0b\u8a2d\u5b9a\u4ee52950switch\u70ba\u4e3b \u8a2d\u5b9atrunk \u5c01\u88dd\u65b9\u6cd5(config)#int <\u2026","rel":"","context":"\u5728\u300cCisco layer2\u300d\u4e2d","block_context":{"text":"Cisco layer2","link":"https:\/\/systw.net\/note\/archives\/category\/network\/cisco-layer2"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":874,"url":"https:\/\/systw.net\/note\/archives\/874","url_meta":{"origin":878,"position":1},"title":"Cisco Vlan ACL","author":"raymond","date":"2011 \u5e74 9 \u6708 7 \u65e5","format":false,"excerpt":"VLAN access lists (VACL)VACL are filters that dire\u2026","rel":"","context":"\u5728\u300cCisco security\u300d\u4e2d","block_context":{"text":"Cisco security","link":"https:\/\/systw.net\/note\/archives\/category\/network\/cisco-security"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":954,"url":"https:\/\/systw.net\/note\/archives\/954","url_meta":{"origin":878,"position":2},"title":"Cisco QoS for VoIP","author":"raymond","date":"2011 \u5e74 9 \u6708 7 \u65e5","format":false,"excerpt":"Cisco IP Phone modelsMost contain a 3port switchTh\u2026","rel":"","context":"\u5728\u300cCisco layer2\u300d\u4e2d","block_context":{"text":"Cisco layer2","link":"https:\/\/systw.net\/note\/archives\/category\/network\/cisco-layer2"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":880,"url":"https:\/\/systw.net\/note\/archives\/880","url_meta":{"origin":878,"position":3},"title":"Vlan Hopping Attack","author":"raymond","date":"2011 \u5e74 9 \u6708 7 \u65e5","format":false,"excerpt":"secure vlan trunking1. VLAN Hopping with Switch Sp\u2026","rel":"","context":"\u5728\u300cCisco security\u300d\u4e2d","block_context":{"text":"Cisco security","link":"https:\/\/systw.net\/note\/archives\/category\/network\/cisco-security"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":948,"url":"https:\/\/systw.net\/note\/archives\/948","url_meta":{"origin":878,"position":4},"title":"Cisco Vlan","author":"raymond","date":"2008 \u5e74 10 \u6708 7 \u65e5","format":false,"excerpt":"\u57fa\u672c\u6982\u5ff5 \u4ea4\u63db\u5668\u4e0b\u7684\u6240\u6709port\u9810\u8a2d\u70bavlan1\u7684\u6210\u54e1switch\u8a2d\u5b9a\u5f8c,\u5c31\u6703\u7522\u751f\u4e00\u4efdconfig.\u2026","rel":"","context":"\u5728\u300cCisco layer2\u300d\u4e2d","block_context":{"text":"Cisco layer2","link":"https:\/\/systw.net\/note\/archives\/category\/network\/cisco-layer2"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":815,"url":"https:\/\/systw.net\/note\/archives\/815","url_meta":{"origin":878,"position":5},"title":"802.1s MSTP","author":"raymond","date":"2011 \u5e74 9 \u6708 5 \u65e5","format":false,"excerpt":"MSTP(Multiple Spanning Tree Protocol)2002 \u5e74 IEEE 8\u2026","rel":"","context":"\u5728\u300cOSI Layer2\u300d\u4e2d","block_context":{"text":"OSI Layer2","link":"https:\/\/systw.net\/note\/archives\/category\/network\/osi-layer2"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"_links":{"self":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/878","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/comments?post=878"}],"version-history":[{"count":0,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/878\/revisions"}],"wp:attachment":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/media?parent=878"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/categories?post=878"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/tags?post=878"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Isolated vlan:<\/strong>
same isolated VLAN cannot reach each other
Community vlan:<\/strong>
same communicate VLAN can reach each other
ps
L2 device\u53ef\u7528protect port\u9054\u5230\u540cIsolated\u7684\u529f\u80fd<\/p>\n\n\n\n
1
All secondary VLANs must be associated with one primary VLAN to set up the uni-directional relationship
2
VTP does not pass any information about the private VLAN configuration.
Therefore, private VLANs are only locally significant to a switch
ps:to configure VTP to transparent mode before a private VLAN be created
3
Each of the private VLANs must be configured locally on each switch that interconnects them<\/p>\n\n\n\n
Promiscuous port:<\/strong>
the rules of private VLANs are ignored
\u4f7f\u7528\u6642\u6a5f:connects to a router, firewall, or other common gateway device
\u529f\u80fd:can communicate with anything else connected to the primary or any secondary VLAN
host port:<\/strong>
\u4f7f\u7528\u6642\u6a5f:connects to a regular host that resides on an isolated or community VLAN
\u529f\u80fd:The port communicates only with:
\u30001. a promiscuous port
\u30002. ports on the same community VLAN<\/p>\n\n\n\n
Private VLAN\u6ce8\u610f\u4e8b\u9805<\/strong>
disable VTP
not support Port Security
not support SPAN port<\/p>\n\n\n\n
1-1
defining any secondary VLANs
Switch(config)# vlan vlan-id
Switch(config-vlan)# private-vlan < isolated | community><\/strong>
1-2
define the primary VLAN
(config)# vlan vlan-id
(config-vlan)# private-vlan primary<\/strong>
private-vlan primary carries traffic from promiscuous ports to isolated, community, and other promiscuous ports in the same VLAN.
(config-vlan)# private-vlan association [add|remove] < secondary-vlan-list><\/strong>
< secondary-vlan-list >: to associate the primary VLAN with all its component secondary VLANs using the association keyword
ps:
These VLAN configuration commands set up only the mechanisms for unidirectional connectivity from the secondary VLANs to the primary VLAN<\/p>\n\n\n\n
2-1
associate host mode port <\/strong>with primary and secondary VLANs
(config-if)#switchport mode private-vlan host
(config-if)#switchport private-vlan host-association < primary-vlan-id> < secondary-vlan-id><\/strong>
ps:
only the private VLANs themselves have been configured until now. The switch port must know how to interact with the various VLANs
2-2
map promiscuous mode ports<\/strong> to primary and secondary VLAN
(config-if)# switchport mode private-vlan promiscuous
(config-if)# switchport private-vlan mapping < primary-vlan-id > < [ add| remove] secondary-vlan-list><\/strong>
ps:
that can communicate with any other private VLAN device, are mapped, whereas other secondary VLAN ports are associated.
One (promiscuous mode port) exhibits bidirectional behavior, whereas the other (secondary VLAN ports) exhibits unidirectional or logical behavior
ex:
1-1
sw(config)# vlan 10
sw(config-vlan)# private-vlan community
sw(config)# vlan 20
sw(config-vlan)# private-vlan community
sw(config)# vlan 30
sw(config-vlan)# private-vlan isolated
1-2
sw(config)# vlan 100
sw(config-vlan)# private-vlan primary
sw(config-vlan)# private-vlan association 10,20,30
sw(config-vlan)# exit
2-1
sw(config)# interface range fastethernet 1\/1 – 1\/2
sw(config-if)# switchport private-vlan host
sw(config-if)# switchport private-vlan host-association 100 10
sw(config)# interface range fastethernet 1\/4 – 1\/5
sw(config-if)# switchport private-vlan host
sw(config-if)# switchport private-vlan host-association 100 20
sw(config)# interface fastethernet 1\/3
sw(config-if)# switchport private-vlan host
sw(config-if)# switchport private-vlan host-association 100 30
2-2
sw(config)# interface fastethernet 2\/1
sw(config-if)# switchport mode private-vlan promiscuous
sw(config-if)# switchport private-vlan mapping 100 10,20,30<\/p>\n\n\n\n
\u7576gw\u70ba\u672c\u6a5fswitch\u6642,\u5206\u914dprivate-vlan\u5728SVI
3
SVI configured with Layer 3 addresses<\/strong>
add a private VLAN mapping to the primary SVI
(config)#interface vlan < primary-vlan-id>
(config-if)# private-vlan mapping < [add|remove] secondary-vlan-list><\/strong>
ex:
1,2
\u5ef6\u7e8c\u4e0a\u500bexample
3
gw(config)# interface vlan 100
gw(config-if)# ip address 192.168.199.1 255.255.255.0
gw(config-if)# private-vlan mapping 10,20,30<\/p>\n","protected":false},"excerpt":{"rendered":"