Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Community Member

Configure Private VLAN on 3750 & 2960

Hi All,

( R ) ------ [ 3750 ] ------- [ 2960 A ]

                        |------------ [ 2960 B ]

I had these VLAN on the 3750 & 2960:
- Vlan 8 (mgnt Vlan), Vlan 17, Vlan 34, Vlan 35

Basically I had already configure switchport protected on all the port on the 2960 except the uplink to 3750.

2960 Configure
On uplink to 3750
 switchport mode trunk

On end device port 
 switchport trunk native vlan 35
 switchport trunk allowed vlan 34,35
 switchport mode trunk
 switchport protected
 spanning-tree portfast


How do I go about configure private VLAN on the 3750? 

3750 Configure
On downlink to 2960
 switchport mode trunk

Interface vlan8
 ip address

Interface vlan17
​ ip address

Interface vlan34
​ ip address

Interface vlan35
​ ip address


What I want to achieve is to send all the VLAN 8, 17, 34, 35 from 2960 to 3750 and 3750 to 2960. But at the same time prevent 2960 A client from talking to 2960 B client on VLAN 35? 

Cisco Employee

Hi,       switchport



      switchport protected is not actually private vlan, it prevents one port talking to another on the same switch only, once it reaches the other switch it will not be a valid config. The correct config for private VLAN can be seen on the link below.


Community Member

Hi Renan, Is it possible to

Hi Renan,


Is it possible to configure private VLAN on the trunk port connecting from 3750 to the both 2960? But at the same time, VLAN 35 is able to communicate to 3750?

Cisco Employee

Hi Daniel,     Private VLAN

Hi Daniel,

     Private VLAN is a feature for access ports, trunk ports carry traffic from regular and all kinds of private VLANs.


     The way private VLANs works is this way.


Promiscuous port => those ports can talk to any private VLAN type, usually this is the port connected to the GW or let's say to an wireshark gathering all kind of data.

Isolated port => Can only talk to a promiscuous port, not with other private VLANs.

community port => Can only talk to the promiscuous port and other ports on the same community.


What exactly are you trying to do? Do you have a specific port on one of those switches that you do not want talking to the other ports? 


Community Member

Hi Renan,What I want was to

Hi Renan,

What I want was to prevent 2960 A client ( to talk to 2960 B client ( But at the same time VLAN 35 was able to pass from the 2960 A/B to 3750. 

Cisco Employee

I believe that if both

I believe that if both devices you want no to speak with each other are on 2960 the "switchport protected" should work.


But you can configure with private vlan.

let's say client A is in port f0/1 and client B in port f0/2

Parent (main) VLAN is 100 and child is 999


You would configure the VLANs in ALL switches.

vlan 999

private-vlan isolated

vlan 100

private-vlan primary

private-vlan association 999


Now you would need to configure the ports.

int range f0/1 - 2

switchport mode private-vlan host
switchport private-vlan host-association 100 999

If the interfaces will talk to other VLANs, you need to configure the SVI to understand it will serve the private VLANs.

interface vlan 100

private-vlan mapping 999


That's it, but notice that now interface f0/1 will not talk to f0/2 and to any other interface inside vlan 100, if you want a port to communicate to f0/1 or f0/2 this new port would need to be configured as a promiscuous one (In case it needs to talk to both of them) or create a community private-vlan and configure the ports desired on it. (F0/1 and F0/2 can't be on the same community VLAN or they'll be able to talk to each other).

If the intention is to prevent one specific port from talking to all the others, you can put only this interface in the private VLAN instead of both.


wrote too much, if this answers your question let me know, or we can create a practical scenario for it.



Community Member

Hi Renan,Thanks for your

Hi Renan,

Thanks for your prompt respond. For this case, Client A and Client B is located on 2 different switch. eg Client A is located at 2960 A and Client B is located on 2960 B. Between for 2960, it unable to create private VLAN. Only switchport protected is allow, that why I can only configure private VLAN on 3750 trunk port which is connected to the 2 x 2960 switches. 

Cisco Employee

Got it, just checked this

Got it, just checked this link below, looks like 2960s do not support private vlan.

I believe you would need to use something else to do it, maybe VLAN filter...

In 3560 

ip access-list extended FILTER_CLIENTS_TRAFFIC_ACL
permit ip host host
permit ip host host

vlan access-map FILTER_CLIENTS_TRAFFIC_AM 10
action drop

vlan access-map FILTER_CLIENTS_TRAFFIC_AM 20
action forward

vlan filter FILTER_CLIENTS_TRAFFIC_AM vlan-list  100

Assuming  vlan 100 is the vlan in question.

Community Member

Hi Renan,Thanks for the

Hi Renan,

Thanks for the information. I will give it a try.

CreatePlease to create content