Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Community Member

Private VLANs

Hi, Just a quickie.

Installing and configuring two C65K switches as the main backbone to a new data centre design, that's going live shortly. Restricted from using MSFC for routing due to corporate policy that says all routing must be done by packet filtering firewalls at each layer of the classic three-tier data centre design model. Have tried to argue -but no way forward. No big deal, I can see the thinking.

So, remembering that the C65K's will be L2 switching devices in the main only, I want to introduce pvlans to the equation.

I understand the logic behind them etc and the config specifics...except one thing....

Ideally, isolated pvlans will suffice in this design as each i-pvlan will have a promiscuous connection to a firewall interface. However, when I read the text about configuring these types of pvlans, it continually states that isolated (or community,or 2-way community) pvlans must be mapped to primary vlans.

Now, if I am not using primary pvlans as trunking mechanisms per module, why do I need them?

Also, whilst I am in full swing..:) Does anyone have any horror stories about pvlan architectures and STP domains? I want to balance my STP domain on a per vlan basis to aggregate the switching throughput.

Thanks all,


Community Member

Re: Private VLANs

Primary VLANS are how the traffic is carried to the isolated and community vlans. FYI - you also need an MSFC to create the PVLANS see

Also see

CreatePlease to create content