Cisco Systems 3750E Manual De Usuario
16-7
Catalyst 3750-E and 3560-E Switch Software Configuration Guide
OL-9775-02
Chapter 16 Configuring Private VLANs
Configuring Private VLANs
Step 5
If inter-VLAN routing will be used, configure the primary SVI, and map secondary VLANs to the
primary. See the
primary. See the
Step 6
Verify private-VLAN configuration.
Default Private-VLAN Configuration
No private VLANs are configured.
Private-VLAN Configuration Guidelines
Guidelines for configuring private VLANs fall into these categories:
•
•
•
Secondary and Primary VLAN Configuration
Follow these guidelines when configuring private VLANs:
•
Set VTP to transparent mode. After you configure a private VLAN, you should not change the VTP
mode to client or server. For information about VTP, see
mode to client or server. For information about VTP, see
•
You must use VLAN configuration (config-vlan) mode to configure private VLANs. You cannot
configure private VLANs in VLAN database configuration mode. For more information about
VLAN configuration, see
configure private VLANs in VLAN database configuration mode. For more information about
VLAN configuration, see
•
After you have configured private VLANs, use the copy running-config startup config privileged
EXEC command to save the VTP transparent mode configuration and private-VLAN configuration
in the switch startup configuration file. Otherwise, if the switch resets, it defaults to VTP server
mode, which does not support private VLANs.
EXEC command to save the VTP transparent mode configuration and private-VLAN configuration
in the switch startup configuration file. Otherwise, if the switch resets, it defaults to VTP server
mode, which does not support private VLANs.
•
VTP does not propagate private-VLAN configuration. You must configure private VLANs on each
device where you want private-VLAN ports.
device where you want private-VLAN ports.
•
You cannot configure VLAN 1 or VLANs 1002 to 1005 as primary or secondary VLANs. Extended
VLANs (VLAN IDs 1006 to 4094) can belong to private VLANs
VLANs (VLAN IDs 1006 to 4094) can belong to private VLANs
•
A primary VLAN can have one isolated VLAN and multiple community VLANs associated with it.
An isolated or community VLAN can have only one primary VLAN associated with it.
An isolated or community VLAN can have only one primary VLAN associated with it.
•
Although a private VLAN contains more than one VLAN, only one Spanning Tree Protocol (STP)
instance runs for the entire private VLAN. When a secondary VLAN is associated with the primary
VLAN, the STP parameters of the primary VLAN are propagated to the secondary VLAN.
instance runs for the entire private VLAN. When a secondary VLAN is associated with the primary
VLAN, the STP parameters of the primary VLAN are propagated to the secondary VLAN.
•
You can enable DHCP snooping on private VLANs. When you enable DHCP snooping on the
primary VLAN, it is propagated to the secondary VLANs. If you configure DHCP on a secondary
VLAN, the configuration does not take effect if the primary VLAN is already configured.
primary VLAN, it is propagated to the secondary VLANs. If you configure DHCP on a secondary
VLAN, the configuration does not take effect if the primary VLAN is already configured.
•
When you enable IP source guard on private-VLAN ports, you must enable DHCP snooping on the
primary VLAN.
primary VLAN.