Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

PVLANs and Trunking:

Hi folks,

Can a dot1q trunking port operate as well as promiscous port under Private VLAN configuration.

Let me explain the scenario,

1. I've two trusted networks (trust-1[100.x.y.z/24], [trust-2/200.x.y.z]). They should only communicate through firewall. So they can be designated as community PVLAN in the 65xx switch.

2. The trusted-1 gateway should be subinterface-1(100.x.y.1) of the PIX firewall. The trusted-2 gateway should be subinterface-2(200.x.y.1) of the PIX firewall. In short, the trunk port of the switch is conneted to one FE interface of the firewall.

In otherwords,

1. A promiscous mode operation over truking is allowed?

2. Does it provide additional LAN security to prevent VLAN hopping?.

Regds,

Dinesh

1 REPLY
Silver

Re: PVLANs and Trunking:

According to below link. PVLAN cannot configure as trunk, you have to configure another trunk port and include the PVLAN there.

http://www.cisco.com/en/US/products/hw/switches/ps4324/products_tech_note09186a0080094830.shtml

Pleas check if below doc. ans. the VLAN hopping question.

http://www.cisco.com/en/US/products/hw/switches/ps700/products_tech_note09186a008013565f.shtml

Just found info. on VLAN hopping from below. Please check is it helpful.

*Quote start

You can easily prevent VLAN hopping by configuring trunk ports so that their native VLANs do not match the VID of any other VLANs that you have configured. Remember that by default, the native VLAN for a trunk will be VID one, the default for any VLAN. You can choose to set the native VLAN for trunks to be 1001, or any value that your switch supports and is not used for any other VLAN.

*Quote end

http://www.spirit.com/Network/net0103.html

Hope this helps.

113
Views
0
Helpful
1
Replies
CreatePlease to create content