Cisco Systems 3560X Manual De Usuario
18-5
Catalyst 3750-X and 3560-X Switch Software Configuration Guide
OL-21521-01
Chapter 18 Configuring Private VLANs
Configuring Private VLANs
Private VLANs and SVIs
In a Layer 3 switch, a switch virtual interface (SVI) represents the Layer 3 interface of a VLAN. Layer 3
devices communicate with a private VLAN only through the primary VLAN and not through secondary
VLANs. Configure Layer 3 VLAN interfaces (SVIs) only for primary VLANs. You cannot configure
Layer 3 VLAN interfaces for secondary VLANs. SVIs for secondary VLANs are inactive while the
VLAN is configured as a secondary VLAN.
devices communicate with a private VLAN only through the primary VLAN and not through secondary
VLANs. Configure Layer 3 VLAN interfaces (SVIs) only for primary VLANs. You cannot configure
Layer 3 VLAN interfaces for secondary VLANs. SVIs for secondary VLANs are inactive while the
VLAN is configured as a secondary VLAN.
•
If you try to configure a VLAN with an active SVI as a secondary VLAN, the configuration is not
allowed until you disable the SVI.
allowed until you disable the SVI.
•
If you try to create an SVI on a VLAN that is configured as a secondary VLAN and the secondary
VLAN is already mapped at Layer 3, the SVI is not created, and an error is returned. If the SVI is
not mapped at Layer 3, the SVI is created, but it is automatically shut down.
VLAN is already mapped at Layer 3, the SVI is not created, and an error is returned. If the SVI is
not mapped at Layer 3, the SVI is created, but it is automatically shut down.
When the primary VLAN is associated with and mapped to the secondary VLAN, any configuration on
the primary VLAN is propagated to the secondary VLAN SVIs. For example, if you assign an IP subnet
to the primary VLAN SVI, this subnet is the IP subnet address of the entire private VLAN.
the primary VLAN is propagated to the secondary VLAN SVIs. For example, if you assign an IP subnet
to the primary VLAN SVI, this subnet is the IP subnet address of the entire private VLAN.
Private VLANs and Switch Stacks
Private VLANs can operate within the switch stack, and private-VLAN ports can reside on different
stack members. However, some changes to the switch stack can impact private-VLAN operation:
stack members. However, some changes to the switch stack can impact private-VLAN operation:
•
If a stack contains only one private-VLAN promiscuous port and the stack member that contains that
port is removed from the stack, host ports in that private VLAN lose connectivity outside the private
VLAN.
port is removed from the stack, host ports in that private VLAN lose connectivity outside the private
VLAN.
•
If a stack master stack that contains the only private-VLAN promiscuous port in the stack fails or
leaves the stack and a new stack master is elected, host ports in a private VLAN that had its
promiscuous port on the old stack master lose connectivity outside of the private VLAN.
leaves the stack and a new stack master is elected, host ports in a private VLAN that had its
promiscuous port on the old stack master lose connectivity outside of the private VLAN.
•
If two stacks merge, private VLANs on the winning stack are not affected, but private-VLAN
configuration on the losing switch is lost when that switch reboots.
configuration on the losing switch is lost when that switch reboots.
For more information about switch stacks, see
Configuring Private VLANs
These sections contain this configuration information:
•
•
•
•
•
•
•