Understanding PVLAN

[David Lin]

Good day,

I am confusing with private vlan now,

1. PVLAN can only work under vtp transparent mode, how can I set up the trunk with other switches then? (I was curious the transparant mode on 2960 works another 2960 in clinet mode)

2. How does PVLAN work with L2 Switch? or can't?

3. It says PVLAN could save the vlan id. but we still need to create vlan and associate it to prime VLAN. How does it save the VLAN ID?

For example, I have one 3560 and two 2960, currently I set 3560 as vtp server and configure g1/47 and g/48 as trunk mode for each 2960(g0/1). VLAN 10, 20, 30 have been configured on 3560 and assigned to the ports on 3560 and 2960.

Is there any configuration for reference? Can anyone help me to sort out these? Thank you.

[Jon Marshall]

1) As long as the trunked vlans exist on both switches it doesn't matter whether the switch is in VTP transparent mode or not, the trunk should still work.

As for PVLAN - could you describe what you are trying to achieve. 2960's only support PVLAN Edge ie. protected ports and not full PVLAN. See attached link for PVLAN support on Catalyst switches.

http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a0080094830.shtml#topic1

Jon

[David Lin]

Thanks for your reply.

But I just did a test, after I changed the vtp mode to transparent, the existing VLANs are working fine, but new VLANs I created on the L3 Switch 3560 can't be updated to underlying switch any more.

[Jon Marshall]

Do you mean vlans created on L3 3560 do not get updated on VTP transparent 2960 switches ?

If that is what you mean this behaviour is normal. VTP transparent switches will not update their vlan database from VTP servers. With a switch in VTP transparent mode you have to manually add each vlan you want on that switch.

Jon

[David Lin]

So in another word, I can't implement PVLAN on a switch which is supposed to be deleted/added VLAN frequently, right?

How come PVLAN works under transparent mode and creat such kind limitation....

[Jon Marshall · Accepted solution]

Because VTP does not support PVLANS so you must create the PVLAN on each switch.

You can implement it on a switch but you are right in what you say, if the switch is getting constantly updated it requires a fair bit more work if the switch is in VTP transparent mode.

Jon

[David Lin]

Got it. Thanks your swift response.

[jcoke · Accepted solution]

Petr Lapukhov wrote a really good blog post on the subject:

http://blog.internetworkexpert.com/2008/01/31/understanding-private-vlans/

[David Lin]

Good post. thanks!