I have a question on when to use private VLAN trunking. I have read when trunking to a device that is not PVLAN aware, you should use PVLAN trunking. If you are trunking between devices that are PVLAN aware the you should use regular trunking.
What it doesn't tell me is why. Why do we need to use private VLAN trunking?? If the PVLANs are tagged using dot1Q then what is the purpose of using PVLAN trunking - it is not clear what is gained.
Thanks in advance...
Your information is correct - if the interconnected devices both understand Private VLANs then you should use a regular trunk. If one of them does not understand PVLANs then there are other special types of trunks to enable the communication under circumstances.
The first special trunk type is the promiscuous PVLAN trunk. Whenever a frame from a secondary VLAN is going to sent out such trunk, its 802.1Q tag will be rewritten with the appropriate primary VLAN ID. That is usable if you are, for example, doing a router-on-stick between several primary private VLANs. As the router does not understand that multiple secondary PVLANs actually map to a single particular primary PVLAN, the promisc trunk port will translate all secondary PVLAN IDs into the corresponding primary PVLAN ID.
The second special type of a trunk is the isolated PVLAN trunk. An isolated PVLAN trunk translates primary PVLAN ID tag into the isolated secondary PVLAN ID that is associated with the primary PVLAN. This is used if you want to extend the secondary isolated PVLAN onto a switch that does not support PVLANs. Thus, if a frame is coming from a promisc host port somewhere in the primary PVLAN and is about to be sent out the isolated PVLAN trunk port, its 802.1Q tag currently carrying the primary PVLAN ID will be rewritten to the isolated secondary PVLAN ID. If a frame comes in with the isolated secondary PVLAN ID, the tag won't be changed.
So, in essence, the speciality of these trunks is in the tag rewriting they perform:
- A promisc trunk port rewrites the secondary PVLAN ID into the primary PVLAN ID upon sending a frame. When a frame is received, no tag manipulation is performed.
- An isolated trunk port rewrites the primary PVLAN ID into the isolated secondary PVLAN ID upon sending a frame. When a frame is received, no tag manipulation is performed.
Note, however, that these special trunk ports are available only on Catalyst 4500 and higher. You may want to read this chapter from the 4500 Configuration Guide for more information: