DELL 9.7(0.0) User Manual
41
Private VLANs (PVLAN)
Private VLANs (PVLANs) extend Dell Networking OS security suite by providing Layer 2 isolation between
ports within the same virtual local area network (VLAN).
A PVLAN partitions a traditional VLAN into subdomains identified by a primary and secondary VLAN pair.
Private VLANs block all traffic to isolated ports except traffic from promiscuous ports. Traffic received
from an isolated port is forwarded only to promiscuous ports or trunk ports.
ports within the same virtual local area network (VLAN).
A PVLAN partitions a traditional VLAN into subdomains identified by a primary and secondary VLAN pair.
Private VLANs block all traffic to isolated ports except traffic from promiscuous ports. Traffic received
from an isolated port is forwarded only to promiscuous ports or trunk ports.
Example uses of PVLANs:
• A hotel can use an isolated VLAN in a PVLAN to provide Internet access for its guests, while stopping
direct access between the guest ports.
• A service provider can provide Layer 2 security for customers and use the IP addresses more
efficiently, by using a separate community VLAN per customer and at the same time using the same IP
subnet address space for all community and isolated VLANs mapped to the same primary VLAN.
– In more detail, community VLANs are especially useful in the service provider environment
because multiple customers are likely to maintain servers that must be strictly separated in
customer-specific groups. A set of servers owned by a customer could comprise a community
VLAN, so that those servers could communicate with each other, and would be isolated from
other customers. Another customer might have another set of servers in another community
VLAN. Another customer might want an isolated VLAN, which has one or more ports that are also
isolated from each other.
For complete syntax information about the commands described in this chapter, refer to the Private
VLANs chapter in the Dell Networking OS Command Line Reference Guide.
VLANs chapter in the Dell Networking OS Command Line Reference Guide.
Private VLAN Concepts
Review the following PVLAN concepts before you create PVLANs on your system.
The VLAN types in a PVLAN include:
• Community VLAN — a type of secondary VLAN in a primary VLAN:
– Ports in a community VLAN can communicate with each other.
– Ports in a community VLAN can communicate with all promiscuous ports in the primary VLAN.
– A community VLAN can only contain ports configured as host.
– Ports in a community VLAN can communicate with all promiscuous ports in the primary VLAN.
– A community VLAN can only contain ports configured as host.
• Isolated VLAN — a type of secondary VLAN in a primary VLAN:
– Ports in an isolated VLAN cannot talk directly to each other.
– Ports in an isolated VLAN can only communicate with promiscuous ports in the primary VLAN.
– An isolated VLAN can only contain ports configured as host.
– Ports in an isolated VLAN can only communicate with promiscuous ports in the primary VLAN.
– An isolated VLAN can only contain ports configured as host.
• Primary VLAN — the base VLAN of a PVLAN:
– A switch can have one or more primary VLANs, and it can have none.
698
Private VLANs (PVLAN)